# Flog Txt Version 1 # Analyzer Version: 3.2.2 # Analyzer Build Date: Jun 3 2020 08:38:37 # Log Creation Date: 15.01.2021 02:04:41.911 Process: id = "1" image_name = "qdgotnx2vapbkvcb.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qdgotnx2vapbkvcb.exe" page_root = "0x42e80000" os_pid = "0xb9c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x454" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QDgotnX2VapbkvCb.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0xa94 [0051.266] SetErrorMode (uMode=0x8001) returned 0x0 [0051.284] GetVersion () returned 0x1db10106 [0051.285] GetModuleHandleA (lpModuleName="KERNEL32") returned 0x76d30000 [0051.285] GetProcAddress (hModule=0x76d30000, lpProcName="SetDefaultDllDirectories") returned 0x0 [0051.285] GetSystemDirectoryA (in: lpBuffer=0x18fcd0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0051.285] wsprintfA (in: param_1=0x18fce3, param_2="%s%s.dll" | out: param_1="\\UXTHEME.dll") returned 12 [0051.286] LoadLibraryExA (lpLibFileName="C:\\Windows\\system32\\UXTHEME.dll", hFile=0x0, dwFlags=0x8) returned 0x750f0000 [0051.868] lstrlenA (lpString="UXTHEME") returned 7 [0051.868] GetSystemDirectoryA (in: lpBuffer=0x18fcd0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0051.868] wsprintfA (in: param_1=0x18fce3, param_2="%s%s.dll" | out: param_1="\\USERENV.dll") returned 12 [0051.868] LoadLibraryExA (lpLibFileName="C:\\Windows\\system32\\USERENV.dll", hFile=0x0, dwFlags=0x8) returned 0x755d0000 [0052.552] lstrlenA (lpString="USERENV") returned 7 [0052.552] GetSystemDirectoryA (in: lpBuffer=0x18fcd0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0052.553] wsprintfA (in: param_1=0x18fce3, param_2="%s%s.dll" | out: param_1="\\SETUPAPI.dll") returned 13 [0052.553] LoadLibraryExA (lpLibFileName="C:\\Windows\\system32\\SETUPAPI.dll", hFile=0x0, dwFlags=0x8) returned 0x76950000 [0054.682] lstrlenA (lpString="SETUPAPI") returned 8 [0054.682] GetSystemDirectoryA (in: lpBuffer=0x18fcd0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0054.682] wsprintfA (in: param_1=0x18fce3, param_2="%s%s.dll" | out: param_1="\\APPHELP.dll") returned 12 [0054.682] LoadLibraryExA (lpLibFileName="C:\\Windows\\system32\\APPHELP.dll", hFile=0x0, dwFlags=0x8) returned 0x75570000 [0055.205] lstrlenA (lpString="APPHELP") returned 7 [0055.205] GetSystemDirectoryA (in: lpBuffer=0x18fcd0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0055.205] wsprintfA (in: param_1=0x18fce3, param_2="%s%s.dll" | out: param_1="\\PROPSYS.dll") returned 12 [0055.205] LoadLibraryExA (lpLibFileName="C:\\Windows\\system32\\PROPSYS.dll", hFile=0x0, dwFlags=0x8) returned 0x75470000 [0055.776] lstrlenA (lpString="PROPSYS") returned 7 [0055.776] GetSystemDirectoryA (in: lpBuffer=0x18fcd0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0055.776] wsprintfA (in: param_1=0x18fce3, param_2="%s%s.dll" | out: param_1="\\DWMAPI.dll") returned 11 [0055.776] LoadLibraryExA (lpLibFileName="C:\\Windows\\system32\\DWMAPI.dll", hFile=0x0, dwFlags=0x8) returned 0x750d0000 [0056.153] lstrlenA (lpString="DWMAPI") returned 6 [0056.153] GetSystemDirectoryA (in: lpBuffer=0x18fcd0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0056.153] wsprintfA (in: param_1=0x18fce3, param_2="%s%s.dll" | out: param_1="\\CRYPTBASE.dll") returned 14 [0056.153] LoadLibraryExA (lpLibFileName="C:\\Windows\\system32\\CRYPTBASE.dll", hFile=0x0, dwFlags=0x8) returned 0x75790000 [0056.154] lstrlenA (lpString="CRYPTBASE") returned 9 [0056.154] GetSystemDirectoryA (in: lpBuffer=0x18fcd0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0056.154] wsprintfA (in: param_1=0x18fce3, param_2="%s%s.dll" | out: param_1="\\OLEACC.dll") returned 11 [0056.154] LoadLibraryExA (lpLibFileName="C:\\Windows\\system32\\OLEACC.dll", hFile=0x0, dwFlags=0x8) returned 0x75430000 [0057.011] lstrlenA (lpString="OLEACC") returned 6 [0057.011] GetSystemDirectoryA (in: lpBuffer=0x18fcd0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0057.011] wsprintfA (in: param_1=0x18fce3, param_2="%s%s.dll" | out: param_1="\\CLBCATQ.dll") returned 12 [0057.011] LoadLibraryExA (lpLibFileName="C:\\Windows\\system32\\CLBCATQ.dll", hFile=0x0, dwFlags=0x8) returned 0x77670000 [0057.544] lstrlenA (lpString="CLBCATQ") returned 7 [0057.544] GetSystemDirectoryA (in: lpBuffer=0x18fcd0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0057.544] wsprintfA (in: param_1=0x18fce3, param_2="%s%s.dll" | out: param_1="\\NTMARTA.dll") returned 12 [0057.544] LoadLibraryExA (lpLibFileName="C:\\Windows\\system32\\NTMARTA.dll", hFile=0x0, dwFlags=0x8) returned 0x75400000 [0058.037] lstrlenA (lpString="NTMARTA") returned 7 [0058.038] GetModuleHandleA (lpModuleName="VERSION") returned 0x0 [0058.038] GetSystemDirectoryA (in: lpBuffer=0x18fcc0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0058.038] wsprintfA (in: param_1=0x18fcd3, param_2="%s%s.dll" | out: param_1="\\VERSION.dll") returned 12 [0058.038] LoadLibraryExA (lpLibFileName="C:\\Windows\\system32\\VERSION.dll", hFile=0x0, dwFlags=0x8) returned 0x753f0000 [0058.235] GetProcAddress (hModule=0x753f0000, lpProcName="GetFileVersionInfoA") returned 0x753f1ced [0058.235] GetModuleHandleA (lpModuleName="SHFOLDER") returned 0x0 [0058.235] GetSystemDirectoryA (in: lpBuffer=0x18fcc0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0058.236] wsprintfA (in: param_1=0x18fcd3, param_2="%s%s.dll" | out: param_1="\\SHFOLDER.dll") returned 13 [0058.236] LoadLibraryExA (lpLibFileName="C:\\Windows\\system32\\SHFOLDER.dll", hFile=0x0, dwFlags=0x8) returned 0x753e0000 [0058.238] GetProcAddress (hModule=0x753e0000, lpProcName="SHGetFolderPathA") returned 0x753e1528 [0058.238] GetModuleHandleA (lpModuleName="SHLWAPI") returned 0x772f0000 [0058.238] GetProcAddress (hModule=0x772f0000, lpProcName=0x1b5) returned 0x7730bee6 [0058.239] IsOS (dwOS=0x1e) returned 1 [0058.239] InitCommonControls () [0058.239] OleInitialize (pvReserved=0x0) returned 0x0 [0058.248] SHGetFileInfoA (in: pszPath="", dwFileAttributes=0x0, psfi=0x18fe2c, cbFileInfo=0x160, uFlags=0x0 | out: psfi=0x18fe2c) returned 0x1 [0059.342] lstrcpynA (in: lpString1=0x42ec20, lpString2="NSIS Error", iMaxLength=1024 | out: lpString1="NSIS Error") returned="NSIS Error" [0059.342] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QDgotnX2VapbkvCb.exe\" " [0059.342] lstrcpynA (in: lpString1=0x435000, lpString2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QDgotnX2VapbkvCb.exe\" ", iMaxLength=1024 | out: lpString1="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QDgotnX2VapbkvCb.exe\" ") returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QDgotnX2VapbkvCb.exe\" " [0059.346] GetTempPathA (in: nBufferLength=0x400, lpBuffer=0x436400 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0059.351] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 36 [0059.351] lstrcatA (in: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", lpString2="\\" | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\" [0059.351] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp"), lpSecurityAttributes=0x0) returned 0 [0059.352] GetLastError () returned 0xb7 [0059.352] GetTickCount () returned 0x1145c92 [0059.352] GetTempFileNameA (in: lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\", lpPrefixString="nsi", uUnique=0x0, lpTempFileName=0x436000 | out: lpTempFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsiB412.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsib412.tmp")) returned 0xb412 [0059.355] DeleteFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsiB412.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsib412.tmp")) returned 1 [0059.355] GetTickCount () returned 0x1145c92 [0059.355] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x436c00, nSize=0x400 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QDgotnX2VapbkvCb.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qdgotnx2vapbkvcb.exe")) returned 0x3a [0059.355] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QDgotnX2VapbkvCb.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qdgotnx2vapbkvcb.exe")) returned 0x20 [0059.355] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QDgotnX2VapbkvCb.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qdgotnx2vapbkvcb.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x174 [0059.356] lstrcpynA (in: lpString1=0x435c00, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QDgotnX2VapbkvCb.exe", iMaxLength=1024 | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QDgotnX2VapbkvCb.exe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QDgotnX2VapbkvCb.exe" [0059.356] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QDgotnX2VapbkvCb.exe") returned 58 [0059.356] lstrcpynA (in: lpString1=0x437000, lpString2="QDgotnX2VapbkvCb.exe", iMaxLength=1024 | out: lpString1="QDgotnX2VapbkvCb.exe") returned="QDgotnX2VapbkvCb.exe" [0059.356] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x44ad9 [0059.357] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.358] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.358] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.358] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.358] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.358] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.358] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.358] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.358] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.358] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.359] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.359] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.359] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.359] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.359] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.359] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.359] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.359] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.359] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.359] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.359] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.359] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.359] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.359] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.359] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.359] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.359] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.360] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.360] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.360] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.360] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.360] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.360] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.360] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.360] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.360] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.360] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.360] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.360] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.360] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.360] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.360] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.360] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.360] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.360] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.361] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.361] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.361] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.361] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.361] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.361] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.361] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.361] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.361] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.361] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.361] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.361] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.361] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.361] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.361] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.361] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.361] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.361] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.361] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.362] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.362] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.362] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.362] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.362] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.362] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.362] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.362] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.362] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.362] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.362] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.362] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.362] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.362] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.362] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.362] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.362] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.362] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.362] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.363] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.363] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.363] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.363] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.363] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.363] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.363] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.363] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.363] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.363] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.363] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.363] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.363] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.363] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.363] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.363] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.363] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.363] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.363] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.364] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.364] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.364] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.364] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.364] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.364] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.364] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.364] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.364] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.364] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.364] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.364] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.364] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.364] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.364] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.364] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.364] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.364] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.364] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.365] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.365] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.365] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.365] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.365] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.365] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.365] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.365] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.365] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.365] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.365] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.365] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.365] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.365] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.365] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.365] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.365] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.365] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.366] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.366] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.366] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.366] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.366] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.366] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.366] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.366] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.366] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.366] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.366] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.366] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.366] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.366] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.366] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.366] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.366] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.366] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.366] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.367] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.367] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.367] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.367] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.367] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.367] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.367] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.367] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.367] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.367] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.367] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.367] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.367] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.367] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.367] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.367] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.367] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.367] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.368] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.368] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.368] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.368] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.368] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.368] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.368] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.368] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.368] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.368] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.368] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.368] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.368] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.368] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.368] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.368] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.368] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.368] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.369] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.369] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.369] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.369] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.369] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.369] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.369] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.369] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.369] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.369] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.369] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.369] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.369] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.369] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.369] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.369] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.369] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.369] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.369] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.370] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.370] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.370] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.370] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.370] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.370] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.370] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.370] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.370] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.370] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.370] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.370] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.370] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.370] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.370] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.370] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.370] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.370] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.370] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.371] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.371] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.371] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.371] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.371] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.371] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.371] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.371] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.371] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.371] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.371] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.371] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.371] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.371] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.371] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.371] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.371] ReadFile (in: hFile=0x174, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0059.374] SetFilePointer (in: hFile=0x174, lDistanceToMove=214044, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3441c [0059.375] GetTickCount () returned 0x1145cb1 [0059.375] SetFilePointer (in: hFile=0x174, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x34c4f [0059.376] GetModuleHandleA (lpModuleName="KERNEL32") returned 0x76d30000 [0059.376] GetProcAddress (hModule=0x76d30000, lpProcName="GetUserDefaultUILanguage") returned 0x76d444ab [0059.376] GetUserDefaultUILanguage () returned 0x409 [0059.376] wsprintfA (in: param_1=0x436000, param_2="%d" | out: param_1="1033") returned 4 [0059.376] wsprintfA (in: param_1=0x436000, param_2="%d" | out: param_1="1033") returned 4 [0059.376] lstrlenA (lpString="setup") returned 5 [0059.376] lstrcpynA (in: lpString1=0x42ec20, lpString2="setup Setup", iMaxLength=1024 | out: lpString1="setup Setup") returned="setup Setup" [0059.376] SetWindowTextA (hWnd=0x0, lpString="setup Setup") returned 0 [0059.376] lstrcpynA (in: lpString1=0x42bc98, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0059.376] lstrcpynA (in: lpString1=0x42bc98, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0059.376] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x42e3c0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x0 [0059.378] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 45 [0059.378] lstrcpynA (in: lpString1=0x435400, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", iMaxLength=1024 | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0059.378] LoadImageA (hInst=0x400000, name=0x67, type=0x1, cx=0, cy=0, fuLoad=0x8040) returned 0x0 [0059.378] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", iMaxLength=1024 | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0059.378] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 45 [0059.378] lstrcpynA (in: lpString1=0x40a838, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", iMaxLength=1024 | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0059.378] CreateDirectoryA (lpPathName="C:\\Users" (normalized: "c:\\users"), lpSecurityAttributes=0x0) returned 0 [0059.378] GetLastError () returned 0xb7 [0059.378] GetFileAttributesA (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0059.378] CreateDirectoryA (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz"), lpSecurityAttributes=0x0) returned 0 [0059.378] GetLastError () returned 0xb7 [0059.379] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz")) returned 0x10 [0059.379] CreateDirectoryA (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata"), lpSecurityAttributes=0x0) returned 0 [0059.379] GetLastError () returned 0xb7 [0059.379] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata")) returned 0x2012 [0059.379] CreateDirectoryA (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming"), lpSecurityAttributes=0x0) returned 0 [0059.379] GetLastError () returned 0xb7 [0059.379] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming")) returned 0x2010 [0059.379] lstrcpynA (in: lpString1=0x435800, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", iMaxLength=1024 | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0059.379] SetCurrentDirectoryA (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming")) returned 1 [0059.379] lstrcpynA (in: lpString1=0x40a438, lpString2="0", iMaxLength=1024 | out: lpString1="0") returned="0" [0059.379] lstrlenA (lpString="0") returned 1 [0059.379] lstrcpynA (in: lpString1=0x432000, lpString2="0", iMaxLength=1024 | out: lpString1="0") returned="0" [0059.379] lstrcpynA (in: lpString1=0x42e3c0, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0059.379] lstrlenA (lpString="") returned 0 [0059.379] lstrcpynA (in: lpString1=0x40a438, lpString2="-", iMaxLength=1024 | out: lpString1="-") returned="-" [0059.380] lstrlenA (lpString="-") returned 1 [0059.380] lstrcpynA (in: lpString1=0x432400, lpString2="-", iMaxLength=1024 | out: lpString1="-") returned="-" [0059.380] lstrcpynA (in: lpString1=0x42e3c0, lpString2="0", iMaxLength=1024 | out: lpString1="0") returned="0" [0059.380] lstrlenA (lpString="0") returned 1 [0059.380] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="1") returned 1 [0059.380] lstrcpynA (in: lpString1=0x42e3c0, lpString2="1", iMaxLength=1024 | out: lpString1="1") returned="1" [0059.380] lstrlenA (lpString="1") returned 1 [0059.380] lstrcpynA (in: lpString1=0x40ac38, lpString2="1", iMaxLength=1024 | out: lpString1="1") returned="1" [0059.380] lstrcpynA (in: lpString1=0x40b038, lpString2="60000", iMaxLength=1024 | out: lpString1="60000") returned="60000" [0059.380] lstrcmpiA (lpString1="1", lpString2="60000") returned -1 [0059.380] lstrcpynA (in: lpString1=0x42e3c0, lpString2="-", iMaxLength=1024 | out: lpString1="-") returned="-" [0059.380] lstrlenA (lpString="-") returned 1 [0059.380] lstrcpynA (in: lpString1=0x40a438, lpString2="--", iMaxLength=1024 | out: lpString1="--") returned="--" [0059.380] lstrlenA (lpString="--") returned 2 [0059.380] lstrcpynA (in: lpString1=0x432400, lpString2="--", iMaxLength=1024 | out: lpString1="--") returned="--" [0059.380] lstrcpynA (in: lpString1=0x42e3c0, lpString2="1", iMaxLength=1024 | out: lpString1="1") returned="1" [0059.380] lstrlenA (lpString="1") returned 1 [0059.380] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="2") returned 1 [0059.380] lstrcpynA (in: lpString1=0x42e3c0, lpString2="2", iMaxLength=1024 | out: lpString1="2") returned="2" [0059.380] lstrlenA (lpString="2") returned 1 [0059.380] lstrcpynA (in: lpString1=0x40ac38, lpString2="2", iMaxLength=1024 | out: lpString1="2") returned="2" [0059.380] lstrcpynA (in: lpString1=0x40b038, lpString2="60000", iMaxLength=1024 | out: lpString1="60000") returned="60000" [0059.380] lstrcmpiA (lpString1="2", lpString2="60000") returned -1 [0059.380] lstrcpynA (in: lpString1=0x42e3c0, lpString2="--", iMaxLength=1024 | out: lpString1="--") returned="--" [0059.380] lstrlenA (lpString="--") returned 2 [0059.380] lstrcpynA (in: lpString1=0x40a438, lpString2="---", iMaxLength=1024 | out: lpString1="---") returned="---" [0059.380] lstrlenA (lpString="---") returned 3 [0059.380] lstrcpynA (in: lpString1=0x432400, lpString2="---", iMaxLength=1024 | out: lpString1="---") returned="---" [0059.380] lstrcpynA (in: lpString1=0x42e3c0, lpString2="2", iMaxLength=1024 | out: lpString1="2") returned="2" [0059.380] lstrlenA (lpString="2") returned 1 [0059.380] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="3") returned 1 [0059.380] lstrcpynA (in: lpString1=0x42e3c0, lpString2="3", iMaxLength=1024 | out: lpString1="3") returned="3" [0059.380] lstrlenA (lpString="3") returned 1 [0059.381] lstrcpynA (in: lpString1=0x40ac38, lpString2="3", iMaxLength=1024 | out: lpString1="3") returned="3" [0059.381] lstrcpynA (in: lpString1=0x40b038, lpString2="60000", iMaxLength=1024 | out: lpString1="60000") returned="60000" [0059.381] lstrcmpiA (lpString1="3", lpString2="60000") returned -1 [0059.381] lstrcpynA (in: lpString1=0x42e3c0, lpString2="---", iMaxLength=1024 | out: lpString1="---") returned="---" [0059.381] lstrlenA (lpString="---") returned 3 [0059.381] lstrcpynA (in: lpString1=0x40a438, lpString2="----", iMaxLength=1024 | out: lpString1="----") returned="----" [0059.381] lstrlenA (lpString="----") returned 4 [0059.381] lstrcpynA (in: lpString1=0x432400, lpString2="----", iMaxLength=1024 | out: lpString1="----") returned="----" [0059.381] lstrcpynA (in: lpString1=0x42e3c0, lpString2="3", iMaxLength=1024 | out: lpString1="3") returned="3" [0059.381] lstrlenA (lpString="3") returned 1 [0059.381] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="4") returned 1 [0059.381] lstrcpynA (in: lpString1=0x42e3c0, lpString2="4", iMaxLength=1024 | out: lpString1="4") returned="4" [0059.381] lstrlenA (lpString="4") returned 1 [0059.381] lstrcpynA (in: lpString1=0x40ac38, lpString2="4", iMaxLength=1024 | out: lpString1="4") returned="4" [0059.381] lstrcpynA (in: lpString1=0x40b038, lpString2="60000", iMaxLength=1024 | out: lpString1="60000") returned="60000" [0059.381] lstrcmpiA (lpString1="4", lpString2="60000") returned -1 [0059.381] lstrcpynA (in: lpString1=0x42e3c0, lpString2="----", iMaxLength=1024 | out: lpString1="----") returned="----" [0059.381] lstrlenA (lpString="----") returned 4 [0059.381] lstrcpynA (in: lpString1=0x40a438, lpString2="-----", iMaxLength=1024 | out: lpString1="-----") returned="-----" [0059.381] lstrlenA (lpString="-----") returned 5 [0059.381] lstrcpynA (in: lpString1=0x432400, lpString2="-----", iMaxLength=1024 | out: lpString1="-----") returned="-----" [0059.381] lstrcpynA (in: lpString1=0x42e3c0, lpString2="4", iMaxLength=1024 | out: lpString1="4") returned="4" [0059.381] lstrlenA (lpString="4") returned 1 [0059.381] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="5") returned 1 [0059.381] lstrcpynA (in: lpString1=0x42e3c0, lpString2="5", iMaxLength=1024 | out: lpString1="5") returned="5" [0059.381] lstrlenA (lpString="5") returned 1 [0059.381] lstrcpynA (in: lpString1=0x40ac38, lpString2="5", iMaxLength=1024 | out: lpString1="5") returned="5" [0059.381] lstrcpynA (in: lpString1=0x40b038, lpString2="60000", iMaxLength=1024 | out: lpString1="60000") returned="60000" [0059.381] lstrcmpiA (lpString1="5", lpString2="60000") returned -1 [0059.381] lstrcpynA (in: lpString1=0x42e3c0, lpString2="-----", iMaxLength=1024 | out: lpString1="-----") returned="-----" [0059.381] lstrlenA (lpString="-----") returned 5 [0059.382] lstrcpynA (in: lpString1=0x40a438, lpString2="------", iMaxLength=1024 | out: lpString1="------") returned="------" [0059.382] lstrlenA (lpString="------") returned 6 [0059.382] lstrcpynA (in: lpString1=0x432400, lpString2="------", iMaxLength=1024 | out: lpString1="------") returned="------" [0059.382] lstrcpynA (in: lpString1=0x42e3c0, lpString2="5", iMaxLength=1024 | out: lpString1="5") returned="5" [0059.382] lstrlenA (lpString="5") returned 1 [0059.382] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="6") returned 1 [0059.382] lstrcpynA (in: lpString1=0x42e3c0, lpString2="6", iMaxLength=1024 | out: lpString1="6") returned="6" [0059.382] lstrlenA (lpString="6") returned 1 [0059.382] lstrcpynA (in: lpString1=0x40ac38, lpString2="6", iMaxLength=1024 | out: lpString1="6") returned="6" [0059.382] lstrcpynA (in: lpString1=0x40b038, lpString2="60000", iMaxLength=1024 | out: lpString1="60000") returned="60000" [0059.382] lstrcmpiA (lpString1="6", lpString2="60000") returned -1 [0059.382] lstrcpynA (in: lpString1=0x42e3c0, lpString2="------", iMaxLength=1024 | out: lpString1="------") returned="------" [0059.382] lstrlenA (lpString="------") returned 6 [0059.382] lstrcpynA (in: lpString1=0x40a438, lpString2="-------", iMaxLength=1024 | out: lpString1="-------") returned="-------" [0059.382] lstrlenA (lpString="-------") returned 7 [0059.382] lstrcpynA (in: lpString1=0x432400, lpString2="-------", iMaxLength=1024 | out: lpString1="-------") returned="-------" [0059.382] lstrcpynA (in: lpString1=0x42e3c0, lpString2="6", iMaxLength=1024 | out: lpString1="6") returned="6" [0059.382] lstrlenA (lpString="6") returned 1 [0059.382] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="7") returned 1 [0059.382] lstrcpynA (in: lpString1=0x42e3c0, lpString2="7", iMaxLength=1024 | out: lpString1="7") returned="7" [0059.382] lstrlenA (lpString="7") returned 1 [0059.382] lstrcpynA (in: lpString1=0x40ac38, lpString2="7", iMaxLength=1024 | out: lpString1="7") returned="7" [0059.382] lstrcpynA (in: lpString1=0x40b038, lpString2="60000", iMaxLength=1024 | out: lpString1="60000") returned="60000" [0059.382] lstrcmpiA (lpString1="7", lpString2="60000") returned 1 [0059.382] lstrcpynA (in: lpString1=0x42e3c0, lpString2="-------", iMaxLength=1024 | out: lpString1="-------") returned="-------" [0059.382] lstrlenA (lpString="-------") returned 7 [0059.382] lstrcpynA (in: lpString1=0x40a438, lpString2="--------", iMaxLength=1024 | out: lpString1="--------") returned="--------" [0059.382] lstrlenA (lpString="--------") returned 8 [0059.382] lstrcpynA (in: lpString1=0x432400, lpString2="--------", iMaxLength=1024 | out: lpString1="--------") returned="--------" [0059.382] lstrcpynA (in: lpString1=0x42e3c0, lpString2="7", iMaxLength=1024 | out: lpString1="7") returned="7" [0059.383] lstrlenA (lpString="7") returned 1 [0059.383] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="8") returned 1 [0059.383] lstrcpynA (in: lpString1=0x42e3c0, lpString2="8", iMaxLength=1024 | out: lpString1="8") returned="8" [0059.383] lstrlenA (lpString="8") returned 1 [0059.383] lstrcpynA (in: lpString1=0x40ac38, lpString2="8", iMaxLength=1024 | out: lpString1="8") returned="8" [0059.383] lstrcpynA (in: lpString1=0x40b038, lpString2="60000", iMaxLength=1024 | out: lpString1="60000") returned="60000" [0059.383] lstrcmpiA (lpString1="8", lpString2="60000") returned 1 [0059.383] lstrcpynA (in: lpString1=0x42e3c0, lpString2="--------", iMaxLength=1024 | out: lpString1="--------") returned="--------" [0059.383] lstrlenA (lpString="--------") returned 8 [0059.383] lstrcpynA (in: lpString1=0x40a438, lpString2="---------", iMaxLength=1024 | out: lpString1="---------") returned="---------" [0059.383] lstrlenA (lpString="---------") returned 9 [0059.383] lstrcpynA (in: lpString1=0x432400, lpString2="---------", iMaxLength=1024 | out: lpString1="---------") returned="---------" [0059.383] lstrcpynA (in: lpString1=0x42e3c0, lpString2="8", iMaxLength=1024 | out: lpString1="8") returned="8" [0059.383] lstrlenA (lpString="8") returned 1 [0059.383] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="9") returned 1 [0059.383] lstrcpynA (in: lpString1=0x42e3c0, lpString2="9", iMaxLength=1024 | out: lpString1="9") returned="9" [0059.383] lstrlenA (lpString="9") returned 1 [0059.383] lstrcpynA (in: lpString1=0x40ac38, lpString2="9", iMaxLength=1024 | out: lpString1="9") returned="9" [0059.383] lstrcpynA (in: lpString1=0x40b038, lpString2="60000", iMaxLength=1024 | out: lpString1="60000") returned="60000" [0059.383] lstrcmpiA (lpString1="9", lpString2="60000") returned 1 [0059.383] lstrcpynA (in: lpString1=0x42e3c0, lpString2="---------", iMaxLength=1024 | out: lpString1="---------") returned="---------" [0059.383] lstrlenA (lpString="---------") returned 9 [0059.383] lstrcpynA (in: lpString1=0x40a438, lpString2="----------", iMaxLength=1024 | out: lpString1="----------") returned="----------" [0059.383] lstrlenA (lpString="----------") returned 10 [0059.383] lstrcpynA (in: lpString1=0x432400, lpString2="----------", iMaxLength=1024 | out: lpString1="----------") returned="----------" [0059.383] lstrcpynA (in: lpString1=0x42e3c0, lpString2="9", iMaxLength=1024 | out: lpString1="9") returned="9" [0059.383] lstrlenA (lpString="9") returned 1 [0059.383] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="10") returned 2 [0059.383] lstrcpynA (in: lpString1=0x42e3c0, lpString2="10", iMaxLength=1024 | out: lpString1="10") returned="10" [0059.383] lstrlenA (lpString="10") returned 2 [0059.383] lstrcpynA (in: lpString1=0x40ac38, lpString2="10", iMaxLength=1024 | out: lpString1="10") returned="10" [0059.383] lstrcpynA (in: lpString1=0x40b038, lpString2="60000", iMaxLength=1024 | out: lpString1="60000") returned="60000" [0059.384] lstrcmpiA (lpString1="10", lpString2="60000") returned -1 [0059.384] lstrcpynA (in: lpString1=0x42e3c0, lpString2="----------", iMaxLength=1024 | out: lpString1="----------") returned="----------" [0059.384] lstrlenA (lpString="----------") returned 10 [0059.384] lstrcpynA (in: lpString1=0x40a438, lpString2="-----------", iMaxLength=1024 | out: lpString1="-----------") returned="-----------" [0059.384] lstrlenA (lpString="-----------") returned 11 [0059.384] lstrcpynA (in: lpString1=0x432400, lpString2="-----------", iMaxLength=1024 | out: lpString1="-----------") returned="-----------" [0059.384] lstrcpynA (in: lpString1=0x42e3c0, lpString2="10", iMaxLength=1024 | out: lpString1="10") returned="10" [0059.384] lstrlenA (lpString="10") returned 2 [0059.384] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="11") returned 2 [0059.384] lstrcpynA (in: lpString1=0x42e3c0, lpString2="11", iMaxLength=1024 | out: lpString1="11") returned="11" [0059.384] lstrlenA (lpString="11") returned 2 [0059.384] lstrcpynA (in: lpString1=0x40ac38, lpString2="11", iMaxLength=1024 | out: lpString1="11") returned="11" [0059.384] lstrcpynA (in: lpString1=0x40b038, lpString2="60000", iMaxLength=1024 | out: lpString1="60000") returned="60000" [0059.384] lstrcmpiA (lpString1="11", lpString2="60000") returned -1 [0059.384] lstrcpynA (in: lpString1=0x42e3c0, lpString2="-----------", iMaxLength=1024 | out: lpString1="-----------") returned="-----------" [0059.384] lstrlenA (lpString="-----------") returned 11 [0059.384] lstrcpynA (in: lpString1=0x40a438, lpString2="------------", iMaxLength=1024 | out: lpString1="------------") returned="------------" [0059.384] lstrlenA (lpString="------------") returned 12 [0059.384] lstrcpynA (in: lpString1=0x432400, lpString2="------------", iMaxLength=1024 | out: lpString1="------------") returned="------------" [0059.384] lstrcpynA (in: lpString1=0x42e3c0, lpString2="11", iMaxLength=1024 | out: lpString1="11") returned="11" [0059.384] lstrlenA (lpString="11") returned 2 [0059.384] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="12") returned 2 [0059.384] lstrcpynA (in: lpString1=0x42e3c0, lpString2="12", iMaxLength=1024 | out: lpString1="12") returned="12" [0059.384] lstrlenA (lpString="12") returned 2 [0059.384] lstrcpynA (in: lpString1=0x40ac38, lpString2="12", iMaxLength=1024 | out: lpString1="12") returned="12" [0059.384] lstrcpynA (in: lpString1=0x40b038, lpString2="60000", iMaxLength=1024 | out: lpString1="60000") returned="60000" [0059.384] lstrcmpiA (lpString1="12", lpString2="60000") returned -1 [0059.384] lstrcpynA (in: lpString1=0x42e3c0, lpString2="------------", iMaxLength=1024 | out: lpString1="------------") returned="------------" [0059.384] lstrlenA (lpString="------------") returned 12 [0059.384] lstrcpynA (in: lpString1=0x40a438, lpString2="-------------", iMaxLength=1024 | out: lpString1="-------------") returned="-------------" [0059.384] lstrlenA (lpString="-------------") returned 13 [0059.384] lstrcpynA (in: lpString1=0x432400, lpString2="-------------", iMaxLength=1024 | out: lpString1="-------------") returned="-------------" [0059.385] lstrcpynA (in: lpString1=0x42e3c0, lpString2="12", iMaxLength=1024 | out: lpString1="12") returned="12" [0059.385] lstrlenA (lpString="12") returned 2 [0059.385] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="13") returned 2 [0059.385] lstrcpynA (in: lpString1=0x42e3c0, lpString2="13", iMaxLength=1024 | out: lpString1="13") returned="13" [0059.385] lstrlenA (lpString="13") returned 2 [0059.385] lstrcpynA (in: lpString1=0x40ac38, lpString2="13", iMaxLength=1024 | out: lpString1="13") returned="13" [0059.385] lstrcpynA (in: lpString1=0x40b038, lpString2="60000", iMaxLength=1024 | out: lpString1="60000") returned="60000" [0059.385] lstrcmpiA (lpString1="13", lpString2="60000") returned -1 [0059.385] lstrcpynA (in: lpString1=0x42e3c0, lpString2="-------------", iMaxLength=1024 | out: lpString1="-------------") returned="-------------" [0059.385] lstrlenA (lpString="-------------") returned 13 [0059.385] lstrcpynA (in: lpString1=0x40a438, lpString2="--------------", iMaxLength=1024 | out: lpString1="--------------") returned="--------------" [0059.385] lstrlenA (lpString="--------------") returned 14 [0059.385] lstrcpynA (in: lpString1=0x432400, lpString2="--------------", iMaxLength=1024 | out: lpString1="--------------") returned="--------------" [0059.385] lstrcpynA (in: lpString1=0x42e3c0, lpString2="13", iMaxLength=1024 | out: lpString1="13") returned="13" [0059.385] lstrlenA (lpString="13") returned 2 [0059.385] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="14") returned 2 [0059.385] lstrcpynA (in: lpString1=0x42e3c0, lpString2="14", iMaxLength=1024 | out: lpString1="14") returned="14" [0059.385] lstrlenA (lpString="14") returned 2 [0059.385] lstrcpynA (in: lpString1=0x40ac38, lpString2="14", iMaxLength=1024 | out: lpString1="14") returned="14" [0059.385] lstrcpynA (in: lpString1=0x40b038, lpString2="60000", iMaxLength=1024 | out: lpString1="60000") returned="60000" [0059.385] lstrcmpiA (lpString1="14", lpString2="60000") returned -1 [0059.385] lstrcpynA (in: lpString1=0x42e3c0, lpString2="--------------", iMaxLength=1024 | out: lpString1="--------------") returned="--------------" [0059.385] lstrlenA (lpString="--------------") returned 14 [0059.385] lstrcpynA (in: lpString1=0x40a438, lpString2="---------------", iMaxLength=1024 | out: lpString1="---------------") returned="---------------" [0059.385] lstrlenA (lpString="---------------") returned 15 [0059.385] lstrcpynA (in: lpString1=0x432400, lpString2="---------------", iMaxLength=1024 | out: lpString1="---------------") returned="---------------" [0059.385] lstrcpynA (in: lpString1=0x42e3c0, lpString2="14", iMaxLength=1024 | out: lpString1="14") returned="14" [0059.385] lstrlenA (lpString="14") returned 2 [0059.385] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="15") returned 2 [0059.385] lstrcpynA (in: lpString1=0x42e3c0, lpString2="15", iMaxLength=1024 | out: lpString1="15") returned="15" [0059.385] lstrlenA (lpString="15") returned 2 [0059.385] lstrcpynA (in: lpString1=0x40ac38, lpString2="15", iMaxLength=1024 | out: lpString1="15") returned="15" [0059.386] lstrcpynA (in: lpString1=0x40b038, lpString2="60000", iMaxLength=1024 | out: lpString1="60000") returned="60000" [0059.386] lstrcmpiA (lpString1="15", lpString2="60000") returned -1 [0059.386] lstrcpynA (in: lpString1=0x42e3c0, lpString2="---------------", iMaxLength=1024 | out: lpString1="---------------") returned="---------------" [0059.386] lstrlenA (lpString="---------------") returned 15 [0059.386] lstrcpynA (in: lpString1=0x40a438, lpString2="----------------", iMaxLength=1024 | out: lpString1="----------------") returned="----------------" [0059.386] lstrlenA (lpString="----------------") returned 16 [0059.386] lstrcpynA (in: lpString1=0x432400, lpString2="----------------", iMaxLength=1024 | out: lpString1="----------------") returned="----------------" [0059.386] lstrcpynA (in: lpString1=0x42e3c0, lpString2="15", iMaxLength=1024 | out: lpString1="15") returned="15" [0059.386] lstrlenA (lpString="15") returned 2 [0059.386] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="16") returned 2 [0059.386] lstrcpynA (in: lpString1=0x42e3c0, lpString2="16", iMaxLength=1024 | out: lpString1="16") returned="16" [0059.386] lstrlenA (lpString="16") returned 2 [0059.386] lstrcpynA (in: lpString1=0x40ac38, lpString2="16", iMaxLength=1024 | out: lpString1="16") returned="16" [0059.386] lstrcpynA (in: lpString1=0x40b038, lpString2="60000", iMaxLength=1024 | out: lpString1="60000") returned="60000" [0059.386] lstrcmpiA (lpString1="16", lpString2="60000") returned -1 [0059.386] lstrcpynA (in: lpString1=0x42e3c0, lpString2="----------------", iMaxLength=1024 | out: lpString1="----------------") returned="----------------" [0059.386] lstrlenA (lpString="----------------") returned 16 [0059.386] lstrcpynA (in: lpString1=0x40a438, lpString2="-----------------", iMaxLength=1024 | out: lpString1="-----------------") returned="-----------------" [0059.386] lstrlenA (lpString="-----------------") returned 17 [0059.386] lstrcpynA (in: lpString1=0x432400, lpString2="-----------------", iMaxLength=1024 | out: lpString1="-----------------") returned="-----------------" [0059.386] lstrcpynA (in: lpString1=0x42e3c0, lpString2="16", iMaxLength=1024 | out: lpString1="16") returned="16" [0059.386] lstrlenA (lpString="16") returned 2 [0059.386] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="17") returned 2 [0059.386] lstrcpynA (in: lpString1=0x42e3c0, lpString2="17", iMaxLength=1024 | out: lpString1="17") returned="17" [0059.386] lstrlenA (lpString="17") returned 2 [0059.386] lstrcpynA (in: lpString1=0x40ac38, lpString2="17", iMaxLength=1024 | out: lpString1="17") returned="17" [0059.386] lstrcpynA (in: lpString1=0x40b038, lpString2="60000", iMaxLength=1024 | out: lpString1="60000") returned="60000" [0059.386] lstrcmpiA (lpString1="17", lpString2="60000") returned -1 [0059.386] lstrcpynA (in: lpString1=0x42e3c0, lpString2="-----------------", iMaxLength=1024 | out: lpString1="-----------------") returned="-----------------" [0059.386] lstrlenA (lpString="-----------------") returned 17 [0059.386] lstrcpynA (in: lpString1=0x40a438, lpString2="------------------", iMaxLength=1024 | out: lpString1="------------------") returned="------------------" [0059.386] lstrlenA (lpString="------------------") returned 18 [0059.387] lstrcpynA (in: lpString1=0x432400, lpString2="------------------", iMaxLength=1024 | out: lpString1="------------------") returned="------------------" [0059.387] lstrcpynA (in: lpString1=0x42e3c0, lpString2="17", iMaxLength=1024 | out: lpString1="17") returned="17" [0059.387] lstrlenA (lpString="17") returned 2 [0059.387] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="18") returned 2 [0059.387] lstrcpynA (in: lpString1=0x42e3c0, lpString2="18", iMaxLength=1024 | out: lpString1="18") returned="18" [0059.387] lstrlenA (lpString="18") returned 2 [0059.387] lstrcpynA (in: lpString1=0x40ac38, lpString2="18", iMaxLength=1024 | out: lpString1="18") returned="18" [0059.387] lstrcpynA (in: lpString1=0x40b038, lpString2="60000", iMaxLength=1024 | out: lpString1="60000") returned="60000" [0059.387] lstrcmpiA (lpString1="18", lpString2="60000") returned -1 [0059.387] lstrcpynA (in: lpString1=0x42e3c0, lpString2="------------------", iMaxLength=1024 | out: lpString1="------------------") returned="------------------" [0059.387] lstrlenA (lpString="------------------") returned 18 [0059.387] lstrcpynA (in: lpString1=0x40a438, lpString2="-------------------", iMaxLength=1024 | out: lpString1="-------------------") returned="-------------------" [0059.387] lstrlenA (lpString="-------------------") returned 19 [0059.387] lstrcpynA (in: lpString1=0x432400, lpString2="-------------------", iMaxLength=1024 | out: lpString1="-------------------") returned="-------------------" [0059.387] lstrcpynA (in: lpString1=0x42e3c0, lpString2="18", iMaxLength=1024 | out: lpString1="18") returned="18" [0059.387] lstrlenA (lpString="18") returned 2 [0059.387] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="19") returned 2 [0059.387] lstrcpynA (in: lpString1=0x42e3c0, lpString2="19", iMaxLength=1024 | out: lpString1="19") returned="19" [0059.387] lstrlenA (lpString="19") returned 2 [0059.387] lstrcpynA (in: lpString1=0x40ac38, lpString2="19", iMaxLength=1024 | out: lpString1="19") returned="19" [0059.387] lstrcpynA (in: lpString1=0x40b038, lpString2="60000", iMaxLength=1024 | out: lpString1="60000") returned="60000" [0059.387] lstrcmpiA (lpString1="19", lpString2="60000") returned -1 [0059.387] lstrcpynA (in: lpString1=0x42e3c0, lpString2="-------------------", iMaxLength=1024 | out: lpString1="-------------------") returned="-------------------" [0059.387] lstrlenA (lpString="-------------------") returned 19 [0059.387] lstrcpynA (in: lpString1=0x40a438, lpString2="--------------------", iMaxLength=1024 | out: lpString1="--------------------") returned="--------------------" [0059.387] lstrlenA (lpString="--------------------") returned 20 [0059.387] lstrcpynA (in: lpString1=0x432400, lpString2="--------------------", iMaxLength=1024 | out: lpString1="--------------------") returned="--------------------" [0059.387] lstrcpynA (in: lpString1=0x42e3c0, lpString2="19", iMaxLength=1024 | out: lpString1="19") returned="19" [0059.387] lstrlenA (lpString="19") returned 2 [0059.387] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="20") returned 2 [0059.388] lstrcpynA (in: lpString1=0x42e3c0, lpString2="20", iMaxLength=1024 | out: lpString1="20") returned="20" [0059.388] lstrlenA (lpString="20") returned 2 [0059.388] lstrcpynA (in: lpString1=0x40ac38, lpString2="20", iMaxLength=1024 | out: lpString1="20") returned="20" [0059.388] lstrcpynA (in: lpString1=0x40b038, lpString2="60000", iMaxLength=1024 | out: lpString1="60000") returned="60000" [0059.388] lstrcmpiA (lpString1="20", lpString2="60000") returned -1 [0059.388] lstrcpynA (in: lpString1=0x42e3c0, lpString2="--------------------", iMaxLength=1024 | out: lpString1="--------------------") returned="--------------------" [0059.388] lstrlenA (lpString="--------------------") returned 20 [0059.388] lstrcpynA (in: lpString1=0x40a438, lpString2="---------------------", iMaxLength=1024 | out: lpString1="---------------------") returned="---------------------" [0059.388] lstrlenA (lpString="---------------------") returned 21 [0059.388] lstrcpynA (in: lpString1=0x432400, lpString2="---------------------", iMaxLength=1024 | out: lpString1="---------------------") returned="---------------------" [0059.388] lstrcpynA (in: lpString1=0x42e3c0, lpString2="20", iMaxLength=1024 | out: lpString1="20") returned="20" [0059.388] lstrlenA (lpString="20") returned 2 [0059.388] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="21") returned 2 [0059.388] lstrcpynA (in: lpString1=0x42e3c0, lpString2="21", iMaxLength=1024 | out: lpString1="21") returned="21" [0059.388] lstrlenA (lpString="21") returned 2 [0059.388] lstrcpynA (in: lpString1=0x40ac38, lpString2="21", iMaxLength=1024 | out: lpString1="21") returned="21" [0059.388] lstrcpynA (in: lpString1=0x40b038, lpString2="60000", iMaxLength=1024 | out: lpString1="60000") returned="60000" [0059.388] lstrcmpiA (lpString1="21", lpString2="60000") returned -1 [0059.388] lstrcpynA (in: lpString1=0x42e3c0, lpString2="---------------------", iMaxLength=1024 | out: lpString1="---------------------") returned="---------------------" [0059.388] lstrlenA (lpString="---------------------") returned 21 [0059.388] lstrcpynA (in: lpString1=0x40a438, lpString2="----------------------", iMaxLength=1024 | out: lpString1="----------------------") returned="----------------------" [0059.388] lstrlenA (lpString="----------------------") returned 22 [0059.388] lstrcpynA (in: lpString1=0x432400, lpString2="----------------------", iMaxLength=1024 | out: lpString1="----------------------") returned="----------------------" [0059.388] lstrcpynA (in: lpString1=0x42e3c0, lpString2="21", iMaxLength=1024 | out: lpString1="21") returned="21" [0059.388] lstrlenA (lpString="21") returned 2 [0059.388] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="22") returned 2 [0059.388] lstrcpynA (in: lpString1=0x42e3c0, lpString2="22", iMaxLength=1024 | out: lpString1="22") returned="22" [0059.388] lstrlenA (lpString="22") returned 2 [0059.388] lstrcpynA (in: lpString1=0x40ac38, lpString2="22", iMaxLength=1024 | out: lpString1="22") returned="22" [0059.388] lstrcpynA (in: lpString1=0x40b038, lpString2="60000", iMaxLength=1024 | out: lpString1="60000") returned="60000" [0059.389] lstrcmpiA (lpString1="22", lpString2="60000") returned -1 [0059.389] lstrcpynA (in: lpString1=0x42e3c0, lpString2="----------------------", iMaxLength=1024 | out: lpString1="----------------------") returned="----------------------" [0059.389] lstrlenA (lpString="----------------------") returned 22 [0059.389] lstrcpynA (in: lpString1=0x40a438, lpString2="-----------------------", iMaxLength=1024 | out: lpString1="-----------------------") returned="-----------------------" [0059.389] lstrlenA (lpString="-----------------------") returned 23 [0059.389] lstrcpynA (in: lpString1=0x432400, lpString2="-----------------------", iMaxLength=1024 | out: lpString1="-----------------------") returned="-----------------------" [0059.389] lstrcpynA (in: lpString1=0x42e3c0, lpString2="22", iMaxLength=1024 | out: lpString1="22") returned="22" [0059.389] lstrlenA (lpString="22") returned 2 [0059.389] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="23") returned 2 [0059.389] lstrcpynA (in: lpString1=0x42e3c0, lpString2="23", iMaxLength=1024 | out: lpString1="23") returned="23" [0059.389] lstrlenA (lpString="23") returned 2 [0059.389] lstrcpynA (in: lpString1=0x40ac38, lpString2="23", iMaxLength=1024 | out: lpString1="23") returned="23" [0059.389] lstrcpynA (in: lpString1=0x40b038, lpString2="60000", iMaxLength=1024 | out: lpString1="60000") returned="60000" [0059.389] lstrcmpiA (lpString1="23", lpString2="60000") returned -1 [0059.389] lstrcpynA (in: lpString1=0x42e3c0, lpString2="-----------------------", iMaxLength=1024 | out: lpString1="-----------------------") returned="-----------------------" [0059.389] lstrlenA (lpString="-----------------------") returned 23 [0059.389] lstrcpynA (in: lpString1=0x40a438, lpString2="------------------------", iMaxLength=1024 | out: lpString1="------------------------") returned="------------------------" [0059.400] lstrlenA (lpString="------------------------") returned 24 [0059.400] lstrcpynA (in: lpString1=0x432400, lpString2="------------------------", iMaxLength=1024 | out: lpString1="------------------------") returned="------------------------" [0059.400] lstrcpynA (in: lpString1=0x42e3c0, lpString2="23", iMaxLength=1024 | out: lpString1="23") returned="23" [0059.400] lstrlenA (lpString="23") returned 2 [0059.400] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="24") returned 2 [0059.400] lstrcpynA (in: lpString1=0x42e3c0, lpString2="24", iMaxLength=1024 | out: lpString1="24") returned="24" [0059.400] lstrlenA (lpString="24") returned 2 [0059.400] lstrcpynA (in: lpString1=0x40ac38, lpString2="24", iMaxLength=1024 | out: lpString1="24") returned="24" [0059.400] lstrcpynA (in: lpString1=0x40b038, lpString2="60000", iMaxLength=1024 | out: lpString1="60000") returned="60000" [0059.400] lstrcmpiA (lpString1="24", lpString2="60000") returned -1 [0059.400] lstrcpynA (in: lpString1=0x42e3c0, lpString2="------------------------", iMaxLength=1024 | out: lpString1="------------------------") returned="------------------------" [0059.400] lstrlenA (lpString="------------------------") returned 24 [0059.400] lstrcpynA (in: lpString1=0x40a438, lpString2="-------------------------", iMaxLength=1024 | out: lpString1="-------------------------") returned="-------------------------" [0059.400] lstrlenA (lpString="-------------------------") returned 25 [0059.400] lstrcpynA (in: lpString1=0x432400, lpString2="-------------------------", iMaxLength=1024 | out: lpString1="-------------------------") returned="-------------------------" [0059.400] lstrcpynA (in: lpString1=0x42e3c0, lpString2="24", iMaxLength=1024 | out: lpString1="24") returned="24" [0059.400] lstrlenA (lpString="24") returned 2 [0059.400] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="25") returned 2 [0059.400] lstrcpynA (in: lpString1=0x42e3c0, lpString2="25", iMaxLength=1024 | out: lpString1="25") returned="25" [0059.400] lstrlenA (lpString="25") returned 2 [0059.400] lstrcpynA (in: lpString1=0x40ac38, lpString2="25", iMaxLength=1024 | out: lpString1="25") returned="25" [0059.400] lstrcpynA (in: lpString1=0x40b038, lpString2="60000", iMaxLength=1024 | out: lpString1="60000") returned="60000" [0059.400] lstrcmpiA (lpString1="25", lpString2="60000") returned -1 [0059.400] lstrcpynA (in: lpString1=0x42e3c0, lpString2="-------------------------", iMaxLength=1024 | out: lpString1="-------------------------") returned="-------------------------" [0059.400] lstrlenA (lpString="-------------------------") returned 25 [0059.401] lstrcpynA (in: lpString1=0x40a438, lpString2="--------------------------", iMaxLength=1024 | out: lpString1="--------------------------") returned="--------------------------" [0059.401] lstrlenA (lpString="--------------------------") returned 26 [0059.401] lstrcpynA (in: lpString1=0x432400, lpString2="--------------------------", iMaxLength=1024 | out: lpString1="--------------------------") returned="--------------------------" [0059.401] lstrcpynA (in: lpString1=0x42e3c0, lpString2="25", iMaxLength=1024 | out: lpString1="25") returned="25" [0059.401] lstrlenA (lpString="25") returned 2 [0059.401] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="26") returned 2 [0059.401] lstrcpynA (in: lpString1=0x42e3c0, lpString2="26", iMaxLength=1024 | out: lpString1="26") returned="26" [0059.401] lstrlenA (lpString="26") returned 2 [0059.401] lstrcpynA (in: lpString1=0x40ac38, lpString2="26", iMaxLength=1024 | out: lpString1="26") returned="26" [0059.401] lstrcpynA (in: lpString1=0x40b038, lpString2="60000", iMaxLength=1024 | out: lpString1="60000") returned="60000" [0059.401] lstrcmpiA (lpString1="26", lpString2="60000") returned -1 [0059.401] lstrcpynA (in: lpString1=0x42e3c0, lpString2="--------------------------", iMaxLength=1024 | out: lpString1="--------------------------") returned="--------------------------" [0059.401] lstrlenA (lpString="--------------------------") returned 26 [0059.401] lstrcpynA (in: lpString1=0x40a438, lpString2="---------------------------", iMaxLength=1024 | out: lpString1="---------------------------") returned="---------------------------" [0059.401] lstrlenA (lpString="---------------------------") returned 27 [0059.401] lstrcpynA (in: lpString1=0x432400, lpString2="---------------------------", iMaxLength=1024 | out: lpString1="---------------------------") returned="---------------------------" [0059.401] lstrcpynA (in: lpString1=0x42e3c0, lpString2="26", iMaxLength=1024 | out: lpString1="26") returned="26" [0059.401] lstrlenA (lpString="26") returned 2 [0059.401] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="27") returned 2 [0059.401] lstrcpynA (in: lpString1=0x42e3c0, lpString2="27", iMaxLength=1024 | out: lpString1="27") returned="27" [0059.401] lstrlenA (lpString="27") returned 2 [0059.401] lstrcpynA (in: lpString1=0x40ac38, lpString2="27", iMaxLength=1024 | out: lpString1="27") returned="27" [0059.401] lstrcpynA (in: lpString1=0x40b038, lpString2="60000", iMaxLength=1024 | out: lpString1="60000") returned="60000" [0059.401] lstrcmpiA (lpString1="27", lpString2="60000") returned -1 [0059.401] lstrcpynA (in: lpString1=0x42e3c0, lpString2="---------------------------", iMaxLength=1024 | out: lpString1="---------------------------") returned="---------------------------" [0059.401] lstrlenA (lpString="---------------------------") returned 27 [0059.401] lstrcpynA (in: lpString1=0x40a438, lpString2="----------------------------", iMaxLength=1024 | out: lpString1="----------------------------") returned="----------------------------" [0059.401] lstrlenA (lpString="----------------------------") returned 28 [0059.401] lstrcpynA (in: lpString1=0x432400, lpString2="----------------------------", iMaxLength=1024 | out: lpString1="----------------------------") returned="----------------------------" [0059.401] lstrcpynA (in: lpString1=0x42e3c0, lpString2="27", iMaxLength=1024 | out: lpString1="27") returned="27" [0059.402] lstrlenA (lpString="27") returned 2 [0059.402] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="28") returned 2 [0059.402] lstrcpynA (in: lpString1=0x42e3c0, lpString2="28", iMaxLength=1024 | out: lpString1="28") returned="28" [0059.402] lstrlenA (lpString="28") returned 2 [0059.402] lstrcpynA (in: lpString1=0x40ac38, lpString2="28", iMaxLength=1024 | out: lpString1="28") returned="28" [0059.402] lstrcpynA (in: lpString1=0x40b038, lpString2="60000", iMaxLength=1024 | out: lpString1="60000") returned="60000" [0059.402] lstrcmpiA (lpString1="28", lpString2="60000") returned -1 [0059.402] lstrcpynA (in: lpString1=0x42e3c0, lpString2="----------------------------", iMaxLength=1024 | out: lpString1="----------------------------") returned="----------------------------" [0059.402] lstrlenA (lpString="----------------------------") returned 28 [0059.402] lstrcpynA (in: lpString1=0x40a438, lpString2="-----------------------------", iMaxLength=1024 | out: lpString1="-----------------------------") returned="-----------------------------" [0059.402] lstrlenA (lpString="-----------------------------") returned 29 [0059.402] lstrcpynA (in: lpString1=0x432400, lpString2="-----------------------------", iMaxLength=1024 | out: lpString1="-----------------------------") returned="-----------------------------" [0059.402] lstrcpynA (in: lpString1=0x42e3c0, lpString2="28", iMaxLength=1024 | out: lpString1="28") returned="28" [0059.402] lstrlenA (lpString="28") returned 2 [0059.402] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="29") returned 2 [0059.402] lstrcpynA (in: lpString1=0x42e3c0, lpString2="29", iMaxLength=1024 | out: lpString1="29") returned="29" [0059.402] lstrlenA (lpString="29") returned 2 [0059.402] lstrcpynA (in: lpString1=0x40ac38, lpString2="29", iMaxLength=1024 | out: lpString1="29") returned="29" [0059.402] lstrcpynA (in: lpString1=0x40b038, lpString2="60000", iMaxLength=1024 | out: lpString1="60000") returned="60000" [0059.402] lstrcmpiA (lpString1="29", lpString2="60000") returned -1 [0059.402] lstrcpynA (in: lpString1=0x42e3c0, lpString2="-----------------------------", iMaxLength=1024 | out: lpString1="-----------------------------") returned="-----------------------------" [0059.402] lstrlenA (lpString="-----------------------------") returned 29 [0059.402] lstrcpynA (in: lpString1=0x40a438, lpString2="------------------------------", iMaxLength=1024 | out: lpString1="------------------------------") returned="------------------------------" [0059.402] lstrlenA (lpString="------------------------------") returned 30 [0059.402] lstrcpynA (in: lpString1=0x432400, lpString2="------------------------------", iMaxLength=1024 | out: lpString1="------------------------------") returned="------------------------------" [0059.402] lstrcpynA (in: lpString1=0x42e3c0, lpString2="29", iMaxLength=1024 | out: lpString1="29") returned="29" [0059.402] lstrlenA (lpString="29") returned 2 [0059.402] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="30") returned 2 [0059.402] lstrcpynA (in: lpString1=0x42e3c0, lpString2="30", iMaxLength=1024 | out: lpString1="30") returned="30" [0059.402] lstrlenA (lpString="30") returned 2 [0059.403] lstrcpynA (in: lpString1=0x40ac38, lpString2="30", iMaxLength=1024 | out: lpString1="30") returned="30" [0059.403] lstrcpynA (in: lpString1=0x40b038, lpString2="60000", iMaxLength=1024 | out: lpString1="60000") returned="60000" [0059.403] lstrcmpiA (lpString1="30", lpString2="60000") returned -1 [0059.403] lstrcpynA (in: lpString1=0x42e3c0, lpString2="------------------------------", iMaxLength=1024 | out: lpString1="------------------------------") returned="------------------------------" [0059.403] lstrlenA (lpString="------------------------------") returned 30 [0059.403] lstrcpynA (in: lpString1=0x40a438, lpString2="-------------------------------", iMaxLength=1024 | out: lpString1="-------------------------------") returned="-------------------------------" [0059.403] lstrlenA (lpString="-------------------------------") returned 31 [0059.403] lstrcpynA (in: lpString1=0x432400, lpString2="-------------------------------", iMaxLength=1024 | out: lpString1="-------------------------------") returned="-------------------------------" [0059.403] lstrcpynA (in: lpString1=0x42e3c0, lpString2="30", iMaxLength=1024 | out: lpString1="30") returned="30" [0059.403] lstrlenA (lpString="30") returned 2 [0059.403] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="31") returned 2 [0059.403] lstrcpynA (in: lpString1=0x42e3c0, lpString2="31", iMaxLength=1024 | out: lpString1="31") returned="31" [0059.403] lstrlenA (lpString="31") returned 2 [0059.403] lstrcpynA (in: lpString1=0x40ac38, lpString2="31", iMaxLength=1024 | out: lpString1="31") returned="31" [0059.403] lstrcpynA (in: lpString1=0x40b038, lpString2="60000", iMaxLength=1024 | out: lpString1="60000") returned="60000" [0059.403] lstrcmpiA (lpString1="31", lpString2="60000") returned -1 [0059.403] lstrcpynA (in: lpString1=0x42e3c0, lpString2="-------------------------------", iMaxLength=1024 | out: lpString1="-------------------------------") returned="-------------------------------" [0059.403] lstrlenA (lpString="-------------------------------") returned 31 [0059.403] lstrcpynA (in: lpString1=0x40a438, lpString2="--------------------------------", iMaxLength=1024 | out: lpString1="--------------------------------") returned="--------------------------------" [0059.403] lstrlenA (lpString="--------------------------------") returned 32 [0059.403] lstrcpynA (in: lpString1=0x432400, lpString2="--------------------------------", iMaxLength=1024 | out: lpString1="--------------------------------") returned="--------------------------------" [0059.403] lstrcpynA (in: lpString1=0x42e3c0, lpString2="31", iMaxLength=1024 | out: lpString1="31") returned="31" [0059.403] lstrlenA (lpString="31") returned 2 [0059.403] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="32") returned 2 [0059.403] lstrcpynA (in: lpString1=0x42e3c0, lpString2="32", iMaxLength=1024 | out: lpString1="32") returned="32" [0059.403] lstrlenA (lpString="32") returned 2 [0059.403] lstrcpynA (in: lpString1=0x40ac38, lpString2="32", iMaxLength=1024 | out: lpString1="32") returned="32" [0059.403] lstrcpynA (in: lpString1=0x40b038, lpString2="60000", iMaxLength=1024 | out: lpString1="60000") returned="60000" [0059.403] lstrcmpiA (lpString1="32", lpString2="60000") returned -1 [0059.403] lstrcpynA (in: lpString1=0x42e3c0, lpString2="--------------------------------", iMaxLength=1024 | out: lpString1="--------------------------------") returned="--------------------------------" [0059.404] lstrlenA (lpString="--------------------------------") returned 32 [0059.404] lstrcpynA (in: lpString1=0x40a438, lpString2="---------------------------------", iMaxLength=1024 | out: lpString1="---------------------------------") returned="---------------------------------" [0059.404] lstrlenA (lpString="---------------------------------") returned 33 [0059.404] lstrcpynA (in: lpString1=0x432400, lpString2="---------------------------------", iMaxLength=1024 | out: lpString1="---------------------------------") returned="---------------------------------" [0059.404] lstrcpynA (in: lpString1=0x42e3c0, lpString2="32", iMaxLength=1024 | out: lpString1="32") returned="32" [0059.404] lstrlenA (lpString="32") returned 2 [0059.404] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="33") returned 2 [0059.404] lstrcpynA (in: lpString1=0x42e3c0, lpString2="33", iMaxLength=1024 | out: lpString1="33") returned="33" [0059.404] lstrlenA (lpString="33") returned 2 [0059.404] lstrcpynA (in: lpString1=0x40ac38, lpString2="33", iMaxLength=1024 | out: lpString1="33") returned="33" [0059.404] lstrcpynA (in: lpString1=0x40b038, lpString2="60000", iMaxLength=1024 | out: lpString1="60000") returned="60000" [0059.404] lstrcmpiA (lpString1="33", lpString2="60000") returned -1 [0059.404] lstrcpynA (in: lpString1=0x42e3c0, lpString2="---------------------------------", iMaxLength=1024 | out: lpString1="---------------------------------") returned="---------------------------------" [0059.404] lstrlenA (lpString="---------------------------------") returned 33 [0059.404] lstrcpynA (in: lpString1=0x40a438, lpString2="----------------------------------", iMaxLength=1024 | out: lpString1="----------------------------------") returned="----------------------------------" [0059.404] lstrlenA (lpString="----------------------------------") returned 34 [0059.404] lstrcpynA (in: lpString1=0x432400, lpString2="----------------------------------", iMaxLength=1024 | out: lpString1="----------------------------------") returned="----------------------------------" [0059.404] lstrcpynA (in: lpString1=0x42e3c0, lpString2="33", iMaxLength=1024 | out: lpString1="33") returned="33" [0059.404] lstrlenA (lpString="33") returned 2 [0059.404] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="34") returned 2 [0059.404] lstrcpynA (in: lpString1=0x42e3c0, lpString2="34", iMaxLength=1024 | out: lpString1="34") returned="34" [0059.404] lstrlenA (lpString="34") returned 2 [0059.404] lstrcpynA (in: lpString1=0x40ac38, lpString2="34", iMaxLength=1024 | out: lpString1="34") returned="34" [0059.404] lstrcpynA (in: lpString1=0x40b038, lpString2="60000", iMaxLength=1024 | out: lpString1="60000") returned="60000" [0059.404] lstrcmpiA (lpString1="34", lpString2="60000") returned -1 [0059.404] lstrcpynA (in: lpString1=0x42e3c0, lpString2="----------------------------------", iMaxLength=1024 | out: lpString1="----------------------------------") returned="----------------------------------" [0059.404] lstrlenA (lpString="----------------------------------") returned 34 [0059.404] lstrcpynA (in: lpString1=0x40a438, lpString2="-----------------------------------", iMaxLength=1024 | out: lpString1="-----------------------------------") returned="-----------------------------------" [0059.404] lstrlenA (lpString="-----------------------------------") returned 35 [0059.405] lstrlenA (lpString="34") returned 2 [0059.405] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="35") returned 2 [0059.405] lstrlenA (lpString="35") returned 2 [0059.405] lstrcmpiA (lpString1="35", lpString2="60000") returned -1 [0059.405] lstrlenA (lpString="-----------------------------------") returned 35 [0059.405] lstrlenA (lpString="------------------------------------") returned 36 [0059.405] lstrlenA (lpString="35") returned 2 [0059.405] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="36") returned 2 [0059.405] lstrlenA (lpString="36") returned 2 [0059.405] lstrcmpiA (lpString1="36", lpString2="60000") returned -1 [0059.405] lstrlenA (lpString="------------------------------------") returned 36 [0059.405] lstrlenA (lpString="-------------------------------------") returned 37 [0059.405] lstrlenA (lpString="36") returned 2 [0059.405] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="37") returned 2 [0059.405] lstrlenA (lpString="37") returned 2 [0059.405] lstrcmpiA (lpString1="37", lpString2="60000") returned -1 [0059.405] lstrlenA (lpString="-------------------------------------") returned 37 [0059.405] lstrlenA (lpString="--------------------------------------") returned 38 [0059.406] lstrlenA (lpString="37") returned 2 [0059.406] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="38") returned 2 [0059.406] lstrlenA (lpString="38") returned 2 [0059.406] lstrcmpiA (lpString1="38", lpString2="60000") returned -1 [0059.406] lstrlenA (lpString="--------------------------------------") returned 38 [0059.406] lstrlenA (lpString="---------------------------------------") returned 39 [0059.406] lstrlenA (lpString="38") returned 2 [0059.406] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="39") returned 2 [0059.406] lstrlenA (lpString="39") returned 2 [0059.406] lstrcmpiA (lpString1="39", lpString2="60000") returned -1 [0059.406] lstrlenA (lpString="---------------------------------------") returned 39 [0059.406] lstrlenA (lpString="----------------------------------------") returned 40 [0059.406] lstrlenA (lpString="39") returned 2 [0059.406] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="40") returned 2 [0059.406] lstrlenA (lpString="40") returned 2 [0059.406] lstrcmpiA (lpString1="40", lpString2="60000") returned -1 [0059.406] lstrlenA (lpString="----------------------------------------") returned 40 [0059.406] lstrlenA (lpString="-----------------------------------------") returned 41 [0059.406] lstrlenA (lpString="40") returned 2 [0059.406] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="41") returned 2 [0059.406] lstrlenA (lpString="41") returned 2 [0059.406] lstrcmpiA (lpString1="41", lpString2="60000") returned -1 [0059.406] lstrlenA (lpString="-----------------------------------------") returned 41 [0059.406] lstrlenA (lpString="------------------------------------------") returned 42 [0059.406] lstrlenA (lpString="41") returned 2 [0059.406] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="42") returned 2 [0059.407] lstrlenA (lpString="42") returned 2 [0059.407] lstrcmpiA (lpString1="42", lpString2="60000") returned -1 [0059.407] lstrlenA (lpString="------------------------------------------") returned 42 [0059.407] lstrlenA (lpString="-------------------------------------------") returned 43 [0059.407] lstrlenA (lpString="42") returned 2 [0059.407] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="43") returned 2 [0059.407] lstrlenA (lpString="43") returned 2 [0059.407] lstrcmpiA (lpString1="43", lpString2="60000") returned -1 [0059.407] lstrlenA (lpString="-------------------------------------------") returned 43 [0059.407] lstrlenA (lpString="--------------------------------------------") returned 44 [0059.407] lstrlenA (lpString="43") returned 2 [0059.407] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="44") returned 2 [0059.407] lstrlenA (lpString="44") returned 2 [0059.407] lstrcmpiA (lpString1="44", lpString2="60000") returned -1 [0059.407] lstrlenA (lpString="--------------------------------------------") returned 44 [0059.407] lstrlenA (lpString="---------------------------------------------") returned 45 [0059.407] lstrlenA (lpString="44") returned 2 [0059.407] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="45") returned 2 [0059.407] lstrlenA (lpString="45") returned 2 [0059.407] lstrcmpiA (lpString1="45", lpString2="60000") returned -1 [0059.407] lstrlenA (lpString="---------------------------------------------") returned 45 [0059.407] lstrlenA (lpString="----------------------------------------------") returned 46 [0059.407] lstrlenA (lpString="45") returned 2 [0059.407] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="46") returned 2 [0059.407] lstrlenA (lpString="46") returned 2 [0059.407] lstrcmpiA (lpString1="46", lpString2="60000") returned -1 [0059.408] lstrlenA (lpString="----------------------------------------------") returned 46 [0059.408] lstrlenA (lpString="-----------------------------------------------") returned 47 [0059.408] lstrlenA (lpString="46") returned 2 [0059.408] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="47") returned 2 [0059.408] lstrlenA (lpString="47") returned 2 [0059.408] lstrcmpiA (lpString1="47", lpString2="60000") returned -1 [0059.408] lstrlenA (lpString="-----------------------------------------------") returned 47 [0059.408] lstrlenA (lpString="------------------------------------------------") returned 48 [0059.408] lstrlenA (lpString="47") returned 2 [0059.408] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="48") returned 2 [0059.408] lstrlenA (lpString="48") returned 2 [0059.408] lstrcmpiA (lpString1="48", lpString2="60000") returned -1 [0059.408] lstrlenA (lpString="------------------------------------------------") returned 48 [0059.408] lstrlenA (lpString="-------------------------------------------------") returned 49 [0059.408] lstrlenA (lpString="48") returned 2 [0059.408] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="49") returned 2 [0059.408] lstrlenA (lpString="49") returned 2 [0059.408] lstrcmpiA (lpString1="49", lpString2="60000") returned -1 [0059.408] lstrlenA (lpString="-------------------------------------------------") returned 49 [0059.408] lstrlenA (lpString="--------------------------------------------------") returned 50 [0059.408] lstrlenA (lpString="49") returned 2 [0059.408] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="50") returned 2 [0059.408] lstrlenA (lpString="50") returned 2 [0059.408] lstrcmpiA (lpString1="50", lpString2="60000") returned -1 [0059.408] lstrlenA (lpString="--------------------------------------------------") returned 50 [0059.409] lstrlenA (lpString="---------------------------------------------------") returned 51 [0059.409] lstrlenA (lpString="50") returned 2 [0059.409] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="51") returned 2 [0059.409] lstrlenA (lpString="51") returned 2 [0059.409] lstrcmpiA (lpString1="51", lpString2="60000") returned -1 [0059.409] lstrlenA (lpString="---------------------------------------------------") returned 51 [0059.409] lstrlenA (lpString="----------------------------------------------------") returned 52 [0059.409] lstrlenA (lpString="51") returned 2 [0059.409] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="52") returned 2 [0059.409] lstrlenA (lpString="52") returned 2 [0059.409] lstrcmpiA (lpString1="52", lpString2="60000") returned -1 [0059.409] lstrlenA (lpString="----------------------------------------------------") returned 52 [0059.409] lstrlenA (lpString="-----------------------------------------------------") returned 53 [0059.409] lstrlenA (lpString="52") returned 2 [0059.409] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="53") returned 2 [0059.409] lstrlenA (lpString="53") returned 2 [0059.409] lstrcmpiA (lpString1="53", lpString2="60000") returned -1 [0059.409] lstrlenA (lpString="-----------------------------------------------------") returned 53 [0059.409] lstrlenA (lpString="------------------------------------------------------") returned 54 [0059.409] lstrlenA (lpString="53") returned 2 [0059.409] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="54") returned 2 [0059.409] lstrlenA (lpString="54") returned 2 [0059.409] lstrcmpiA (lpString1="54", lpString2="60000") returned -1 [0059.409] lstrlenA (lpString="------------------------------------------------------") returned 54 [0059.409] lstrlenA (lpString="-------------------------------------------------------") returned 55 [0059.410] lstrlenA (lpString="54") returned 2 [0059.410] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="55") returned 2 [0059.410] lstrlenA (lpString="55") returned 2 [0059.410] lstrcmpiA (lpString1="55", lpString2="60000") returned -1 [0059.410] lstrlenA (lpString="-------------------------------------------------------") returned 55 [0059.410] lstrlenA (lpString="--------------------------------------------------------") returned 56 [0059.410] lstrlenA (lpString="55") returned 2 [0059.410] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="56") returned 2 [0059.410] lstrlenA (lpString="56") returned 2 [0059.410] lstrcmpiA (lpString1="56", lpString2="60000") returned -1 [0059.410] lstrlenA (lpString="--------------------------------------------------------") returned 56 [0059.410] lstrlenA (lpString="---------------------------------------------------------") returned 57 [0059.410] lstrlenA (lpString="56") returned 2 [0059.410] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="57") returned 2 [0059.410] lstrlenA (lpString="57") returned 2 [0059.410] lstrcmpiA (lpString1="57", lpString2="60000") returned -1 [0059.410] lstrlenA (lpString="---------------------------------------------------------") returned 57 [0059.410] lstrlenA (lpString="----------------------------------------------------------") returned 58 [0059.410] lstrlenA (lpString="57") returned 2 [0059.410] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="58") returned 2 [0059.410] lstrlenA (lpString="58") returned 2 [0059.410] lstrcmpiA (lpString1="58", lpString2="60000") returned -1 [0059.410] lstrlenA (lpString="----------------------------------------------------------") returned 58 [0059.410] lstrlenA (lpString="-----------------------------------------------------------") returned 59 [0059.410] lstrlenA (lpString="58") returned 2 [0059.410] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="59") returned 2 [0059.411] lstrlenA (lpString="59") returned 2 [0059.411] lstrcmpiA (lpString1="59", lpString2="60000") returned -1 [0059.411] lstrlenA (lpString="-----------------------------------------------------------") returned 59 [0059.411] lstrlenA (lpString="------------------------------------------------------------") returned 60 [0059.411] lstrlenA (lpString="59") returned 2 [0059.411] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="60") returned 2 [0059.411] lstrlenA (lpString="60") returned 2 [0059.411] lstrcmpiA (lpString1="60", lpString2="60000") returned -1 [0059.411] lstrlenA (lpString="------------------------------------------------------------") returned 60 [0059.411] lstrlenA (lpString="-------------------------------------------------------------") returned 61 [0059.411] lstrlenA (lpString="60") returned 2 [0059.411] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="61") returned 2 [0059.411] lstrlenA (lpString="61") returned 2 [0059.411] lstrcmpiA (lpString1="61", lpString2="60000") returned 1 [0059.411] lstrlenA (lpString="-------------------------------------------------------------") returned 61 [0059.411] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="62") returned 2 [0059.411] lstrcmpiA (lpString1="62", lpString2="60000") returned 1 [0059.411] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="63") returned 2 [0059.411] lstrcmpiA (lpString1="63", lpString2="60000") returned 1 [0059.411] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="64") returned 2 [0059.411] lstrcmpiA (lpString1="64", lpString2="60000") returned 1 [0059.411] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="65") returned 2 [0059.411] lstrcmpiA (lpString1="65", lpString2="60000") returned 1 [0059.411] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="66") returned 2 [0059.412] lstrcmpiA (lpString1="66", lpString2="60000") returned 1 [0059.412] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="67") returned 2 [0059.412] lstrcmpiA (lpString1="67", lpString2="60000") returned 1 [0059.412] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="68") returned 2 [0059.412] lstrcmpiA (lpString1="68", lpString2="60000") returned 1 [0059.412] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="69") returned 2 [0059.412] lstrcmpiA (lpString1="69", lpString2="60000") returned 1 [0059.412] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="70") returned 2 [0059.412] lstrcmpiA (lpString1="70", lpString2="60000") returned 1 [0059.412] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="71") returned 2 [0059.412] lstrcmpiA (lpString1="71", lpString2="60000") returned 1 [0059.412] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="72") returned 2 [0059.412] lstrcmpiA (lpString1="72", lpString2="60000") returned 1 [0059.412] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="73") returned 2 [0059.412] lstrcmpiA (lpString1="73", lpString2="60000") returned 1 [0059.412] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="74") returned 2 [0059.412] lstrcmpiA (lpString1="74", lpString2="60000") returned 1 [0059.412] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="75") returned 2 [0059.412] lstrcmpiA (lpString1="75", lpString2="60000") returned 1 [0059.412] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="76") returned 2 [0059.412] lstrcmpiA (lpString1="76", lpString2="60000") returned 1 [0059.412] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="77") returned 2 [0059.412] lstrcmpiA (lpString1="77", lpString2="60000") returned 1 [0059.413] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="78") returned 2 [0059.413] lstrcmpiA (lpString1="78", lpString2="60000") returned 1 [0059.413] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="79") returned 2 [0059.413] lstrcmpiA (lpString1="79", lpString2="60000") returned 1 [0059.413] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="80") returned 2 [0059.413] lstrcmpiA (lpString1="80", lpString2="60000") returned 1 [0059.413] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="81") returned 2 [0059.413] lstrcmpiA (lpString1="81", lpString2="60000") returned 1 [0059.413] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="82") returned 2 [0059.413] lstrcmpiA (lpString1="82", lpString2="60000") returned 1 [0059.413] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="83") returned 2 [0059.413] lstrcmpiA (lpString1="83", lpString2="60000") returned 1 [0059.413] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="84") returned 2 [0059.413] lstrcmpiA (lpString1="84", lpString2="60000") returned 1 [0059.413] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="85") returned 2 [0059.413] lstrcmpiA (lpString1="85", lpString2="60000") returned 1 [0059.413] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="86") returned 2 [0059.413] lstrcmpiA (lpString1="86", lpString2="60000") returned 1 [0059.413] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="87") returned 2 [0059.413] lstrcmpiA (lpString1="87", lpString2="60000") returned 1 [0059.413] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="88") returned 2 [0059.413] lstrcmpiA (lpString1="88", lpString2="60000") returned 1 [0059.413] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="89") returned 2 [0059.414] lstrcmpiA (lpString1="89", lpString2="60000") returned 1 [0059.414] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="90") returned 2 [0059.414] lstrcmpiA (lpString1="90", lpString2="60000") returned 1 [0059.414] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="91") returned 2 [0059.414] lstrcmpiA (lpString1="91", lpString2="60000") returned 1 [0059.414] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="92") returned 2 [0059.414] lstrcmpiA (lpString1="92", lpString2="60000") returned 1 [0059.414] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="93") returned 2 [0059.414] lstrcmpiA (lpString1="93", lpString2="60000") returned 1 [0059.414] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="94") returned 2 [0059.414] lstrcmpiA (lpString1="94", lpString2="60000") returned 1 [0059.414] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="95") returned 2 [0059.414] lstrcmpiA (lpString1="95", lpString2="60000") returned 1 [0059.414] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="96") returned 2 [0059.414] lstrcmpiA (lpString1="96", lpString2="60000") returned 1 [0059.414] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="97") returned 2 [0059.414] lstrcmpiA (lpString1="97", lpString2="60000") returned 1 [0059.414] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="98") returned 2 [0059.414] lstrcmpiA (lpString1="98", lpString2="60000") returned 1 [0059.414] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="99") returned 2 [0059.414] lstrcmpiA (lpString1="99", lpString2="60000") returned 1 [0059.414] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="100") returned 3 [0059.414] lstrcmpiA (lpString1="100", lpString2="60000") returned -1 [0059.415] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="101") returned 3 [0059.415] lstrcmpiA (lpString1="101", lpString2="60000") returned -1 [0059.415] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="102") returned 3 [0059.415] lstrcmpiA (lpString1="102", lpString2="60000") returned -1 [0059.415] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="103") returned 3 [0059.415] lstrcmpiA (lpString1="103", lpString2="60000") returned -1 [0059.415] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="104") returned 3 [0059.415] lstrcmpiA (lpString1="104", lpString2="60000") returned -1 [0059.415] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="105") returned 3 [0059.415] lstrcmpiA (lpString1="105", lpString2="60000") returned -1 [0059.415] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="106") returned 3 [0059.415] lstrcmpiA (lpString1="106", lpString2="60000") returned -1 [0059.415] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="107") returned 3 [0059.415] lstrcmpiA (lpString1="107", lpString2="60000") returned -1 [0059.415] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="108") returned 3 [0059.415] lstrcmpiA (lpString1="108", lpString2="60000") returned -1 [0059.415] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="109") returned 3 [0059.415] lstrcmpiA (lpString1="109", lpString2="60000") returned -1 [0059.415] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="110") returned 3 [0059.415] lstrcmpiA (lpString1="110", lpString2="60000") returned -1 [0059.415] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="111") returned 3 [0059.415] lstrcmpiA (lpString1="111", lpString2="60000") returned -1 [0059.416] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="112") returned 3 [0059.416] lstrcmpiA (lpString1="112", lpString2="60000") returned -1 [0059.416] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="113") returned 3 [0059.416] lstrcmpiA (lpString1="113", lpString2="60000") returned -1 [0059.416] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="114") returned 3 [0059.416] lstrcmpiA (lpString1="114", lpString2="60000") returned -1 [0059.416] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="115") returned 3 [0059.416] lstrcmpiA (lpString1="115", lpString2="60000") returned -1 [0059.416] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="116") returned 3 [0059.416] lstrcmpiA (lpString1="116", lpString2="60000") returned -1 [0059.416] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="117") returned 3 [0059.416] lstrcmpiA (lpString1="117", lpString2="60000") returned -1 [0059.416] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="118") returned 3 [0059.416] lstrcmpiA (lpString1="118", lpString2="60000") returned -1 [0059.416] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="119") returned 3 [0059.416] lstrcmpiA (lpString1="119", lpString2="60000") returned -1 [0059.416] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="120") returned 3 [0059.416] lstrcmpiA (lpString1="120", lpString2="60000") returned -1 [0059.416] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="121") returned 3 [0059.416] lstrcmpiA (lpString1="121", lpString2="60000") returned -1 [0059.416] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="122") returned 3 [0059.416] lstrcmpiA (lpString1="122", lpString2="60000") returned -1 [0059.416] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="123") returned 3 [0059.417] lstrcmpiA (lpString1="123", lpString2="60000") returned -1 [0059.417] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="124") returned 3 [0059.417] lstrcmpiA (lpString1="124", lpString2="60000") returned -1 [0059.417] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="125") returned 3 [0059.417] lstrcmpiA (lpString1="125", lpString2="60000") returned -1 [0059.417] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="126") returned 3 [0059.417] lstrcmpiA (lpString1="126", lpString2="60000") returned -1 [0059.417] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="127") returned 3 [0059.417] lstrcmpiA (lpString1="127", lpString2="60000") returned -1 [0059.417] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="128") returned 3 [0059.417] lstrcmpiA (lpString1="128", lpString2="60000") returned -1 [0059.417] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="129") returned 3 [0059.417] lstrcmpiA (lpString1="129", lpString2="60000") returned -1 [0059.417] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="130") returned 3 [0059.417] lstrcmpiA (lpString1="130", lpString2="60000") returned -1 [0059.417] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="131") returned 3 [0059.417] lstrcmpiA (lpString1="131", lpString2="60000") returned -1 [0059.417] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="132") returned 3 [0059.417] lstrcmpiA (lpString1="132", lpString2="60000") returned -1 [0059.417] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="133") returned 3 [0059.417] lstrcmpiA (lpString1="133", lpString2="60000") returned -1 [0059.417] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="134") returned 3 [0059.417] lstrcmpiA (lpString1="134", lpString2="60000") returned -1 [0059.418] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="135") returned 3 [0059.418] lstrcmpiA (lpString1="135", lpString2="60000") returned -1 [0059.418] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="136") returned 3 [0059.418] lstrcmpiA (lpString1="136", lpString2="60000") returned -1 [0059.418] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="137") returned 3 [0059.418] lstrcmpiA (lpString1="137", lpString2="60000") returned -1 [0059.418] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="138") returned 3 [0059.418] lstrcmpiA (lpString1="138", lpString2="60000") returned -1 [0059.418] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="139") returned 3 [0059.418] lstrcmpiA (lpString1="139", lpString2="60000") returned -1 [0059.418] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="140") returned 3 [0059.418] lstrcmpiA (lpString1="140", lpString2="60000") returned -1 [0059.418] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="141") returned 3 [0059.418] lstrcmpiA (lpString1="141", lpString2="60000") returned -1 [0059.418] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="142") returned 3 [0059.418] lstrcmpiA (lpString1="142", lpString2="60000") returned -1 [0059.418] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="143") returned 3 [0059.418] lstrcmpiA (lpString1="143", lpString2="60000") returned -1 [0059.418] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="144") returned 3 [0059.418] lstrcmpiA (lpString1="144", lpString2="60000") returned -1 [0059.418] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="145") returned 3 [0059.418] lstrcmpiA (lpString1="145", lpString2="60000") returned -1 [0059.418] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="146") returned 3 [0059.418] lstrcmpiA (lpString1="146", lpString2="60000") returned -1 [0059.419] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="147") returned 3 [0059.419] lstrcmpiA (lpString1="147", lpString2="60000") returned -1 [0059.419] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="148") returned 3 [0059.419] lstrcmpiA (lpString1="148", lpString2="60000") returned -1 [0059.419] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="149") returned 3 [0059.419] lstrcmpiA (lpString1="149", lpString2="60000") returned -1 [0059.419] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="150") returned 3 [0059.419] lstrcmpiA (lpString1="150", lpString2="60000") returned -1 [0059.419] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="151") returned 3 [0059.419] lstrcmpiA (lpString1="151", lpString2="60000") returned -1 [0059.419] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="152") returned 3 [0059.419] lstrcmpiA (lpString1="152", lpString2="60000") returned -1 [0059.419] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="153") returned 3 [0059.419] lstrcmpiA (lpString1="153", lpString2="60000") returned -1 [0059.419] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="154") returned 3 [0059.419] lstrcmpiA (lpString1="154", lpString2="60000") returned -1 [0059.419] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="155") returned 3 [0059.419] lstrcmpiA (lpString1="155", lpString2="60000") returned -1 [0059.419] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="156") returned 3 [0059.419] lstrcmpiA (lpString1="156", lpString2="60000") returned -1 [0059.419] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="157") returned 3 [0059.419] lstrcmpiA (lpString1="157", lpString2="60000") returned -1 [0059.419] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="158") returned 3 [0059.420] lstrcmpiA (lpString1="158", lpString2="60000") returned -1 [0059.420] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="159") returned 3 [0059.420] lstrcmpiA (lpString1="159", lpString2="60000") returned -1 [0059.420] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="160") returned 3 [0059.420] lstrcmpiA (lpString1="160", lpString2="60000") returned -1 [0059.420] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="161") returned 3 [0059.420] lstrcmpiA (lpString1="161", lpString2="60000") returned -1 [0059.420] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="162") returned 3 [0059.420] lstrcmpiA (lpString1="162", lpString2="60000") returned -1 [0059.420] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="163") returned 3 [0059.420] lstrcmpiA (lpString1="163", lpString2="60000") returned -1 [0059.420] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="164") returned 3 [0059.420] lstrcmpiA (lpString1="164", lpString2="60000") returned -1 [0059.420] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="165") returned 3 [0059.420] lstrcmpiA (lpString1="165", lpString2="60000") returned -1 [0059.420] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="166") returned 3 [0059.420] lstrcmpiA (lpString1="166", lpString2="60000") returned -1 [0059.421] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="167") returned 3 [0059.421] lstrcmpiA (lpString1="167", lpString2="60000") returned -1 [0059.421] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="168") returned 3 [0059.421] lstrcmpiA (lpString1="168", lpString2="60000") returned -1 [0059.421] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="169") returned 3 [0059.421] lstrcmpiA (lpString1="169", lpString2="60000") returned -1 [0059.421] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="170") returned 3 [0059.421] lstrcmpiA (lpString1="170", lpString2="60000") returned -1 [0059.421] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="171") returned 3 [0059.421] lstrcmpiA (lpString1="171", lpString2="60000") returned -1 [0059.421] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="172") returned 3 [0059.421] lstrcmpiA (lpString1="172", lpString2="60000") returned -1 [0059.421] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="173") returned 3 [0059.421] lstrcmpiA (lpString1="173", lpString2="60000") returned -1 [0059.421] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="174") returned 3 [0059.421] lstrcmpiA (lpString1="174", lpString2="60000") returned -1 [0059.421] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="175") returned 3 [0059.421] lstrcmpiA (lpString1="175", lpString2="60000") returned -1 [0059.421] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="176") returned 3 [0059.422] lstrcmpiA (lpString1="176", lpString2="60000") returned -1 [0059.422] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="177") returned 3 [0059.422] lstrcmpiA (lpString1="177", lpString2="60000") returned -1 [0059.422] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="178") returned 3 [0059.422] lstrcmpiA (lpString1="178", lpString2="60000") returned -1 [0059.422] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="179") returned 3 [0059.422] lstrcmpiA (lpString1="179", lpString2="60000") returned -1 [0059.422] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="180") returned 3 [0059.422] lstrcmpiA (lpString1="180", lpString2="60000") returned -1 [0059.422] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="181") returned 3 [0059.422] lstrcmpiA (lpString1="181", lpString2="60000") returned -1 [0059.422] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="182") returned 3 [0059.422] lstrcmpiA (lpString1="182", lpString2="60000") returned -1 [0059.422] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="183") returned 3 [0059.422] lstrcmpiA (lpString1="183", lpString2="60000") returned -1 [0059.422] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="184") returned 3 [0059.422] lstrcmpiA (lpString1="184", lpString2="60000") returned -1 [0059.422] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="185") returned 3 [0059.422] lstrcmpiA (lpString1="185", lpString2="60000") returned -1 [0059.422] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="186") returned 3 [0059.422] lstrcmpiA (lpString1="186", lpString2="60000") returned -1 [0059.422] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="187") returned 3 [0059.422] lstrcmpiA (lpString1="187", lpString2="60000") returned -1 [0059.423] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="188") returned 3 [0059.423] lstrcmpiA (lpString1="188", lpString2="60000") returned -1 [0059.423] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="189") returned 3 [0059.423] lstrcmpiA (lpString1="189", lpString2="60000") returned -1 [0059.423] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="190") returned 3 [0059.423] lstrcmpiA (lpString1="190", lpString2="60000") returned -1 [0059.423] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="191") returned 3 [0059.423] lstrcmpiA (lpString1="191", lpString2="60000") returned -1 [0059.423] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="192") returned 3 [0059.423] lstrcmpiA (lpString1="192", lpString2="60000") returned -1 [0059.423] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="193") returned 3 [0059.423] lstrcmpiA (lpString1="193", lpString2="60000") returned -1 [0059.423] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="194") returned 3 [0059.423] lstrcmpiA (lpString1="194", lpString2="60000") returned -1 [0059.423] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="195") returned 3 [0059.423] lstrcmpiA (lpString1="195", lpString2="60000") returned -1 [0059.423] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="196") returned 3 [0059.423] lstrcmpiA (lpString1="196", lpString2="60000") returned -1 [0059.423] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="197") returned 3 [0059.423] lstrcmpiA (lpString1="197", lpString2="60000") returned -1 [0059.423] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="198") returned 3 [0059.423] lstrcmpiA (lpString1="198", lpString2="60000") returned -1 [0059.423] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="199") returned 3 [0059.423] lstrcmpiA (lpString1="199", lpString2="60000") returned -1 [0059.424] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="200") returned 3 [0059.424] lstrcmpiA (lpString1="200", lpString2="60000") returned -1 [0059.424] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="201") returned 3 [0059.424] lstrcmpiA (lpString1="201", lpString2="60000") returned -1 [0059.424] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="202") returned 3 [0059.424] lstrcmpiA (lpString1="202", lpString2="60000") returned -1 [0059.424] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="203") returned 3 [0059.424] lstrcmpiA (lpString1="203", lpString2="60000") returned -1 [0059.424] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="204") returned 3 [0059.424] lstrcmpiA (lpString1="204", lpString2="60000") returned -1 [0059.424] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="205") returned 3 [0059.424] lstrcmpiA (lpString1="205", lpString2="60000") returned -1 [0059.424] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="206") returned 3 [0059.424] lstrcmpiA (lpString1="206", lpString2="60000") returned -1 [0059.424] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="207") returned 3 [0059.424] lstrcmpiA (lpString1="207", lpString2="60000") returned -1 [0059.424] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="208") returned 3 [0059.424] lstrcmpiA (lpString1="208", lpString2="60000") returned -1 [0059.424] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="209") returned 3 [0059.424] lstrcmpiA (lpString1="209", lpString2="60000") returned -1 [0059.424] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="210") returned 3 [0059.424] lstrcmpiA (lpString1="210", lpString2="60000") returned -1 [0059.424] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="211") returned 3 [0059.425] lstrcmpiA (lpString1="211", lpString2="60000") returned -1 [0059.425] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="212") returned 3 [0059.425] lstrcmpiA (lpString1="212", lpString2="60000") returned -1 [0059.425] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="213") returned 3 [0059.425] lstrcmpiA (lpString1="213", lpString2="60000") returned -1 [0059.425] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="214") returned 3 [0059.425] lstrcmpiA (lpString1="214", lpString2="60000") returned -1 [0059.425] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="215") returned 3 [0059.425] lstrcmpiA (lpString1="215", lpString2="60000") returned -1 [0059.425] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="216") returned 3 [0059.425] lstrcmpiA (lpString1="216", lpString2="60000") returned -1 [0059.425] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="217") returned 3 [0059.425] lstrcmpiA (lpString1="217", lpString2="60000") returned -1 [0059.425] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="218") returned 3 [0059.425] lstrcmpiA (lpString1="218", lpString2="60000") returned -1 [0059.425] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="219") returned 3 [0059.425] lstrcmpiA (lpString1="219", lpString2="60000") returned -1 [0059.425] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="220") returned 3 [0059.425] lstrcmpiA (lpString1="220", lpString2="60000") returned -1 [0059.425] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="221") returned 3 [0059.425] lstrcmpiA (lpString1="221", lpString2="60000") returned -1 [0059.425] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="222") returned 3 [0059.425] lstrcmpiA (lpString1="222", lpString2="60000") returned -1 [0059.425] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="223") returned 3 [0059.426] lstrcmpiA (lpString1="223", lpString2="60000") returned -1 [0059.426] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="224") returned 3 [0059.426] lstrcmpiA (lpString1="224", lpString2="60000") returned -1 [0059.426] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="225") returned 3 [0059.426] lstrcmpiA (lpString1="225", lpString2="60000") returned -1 [0059.426] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="226") returned 3 [0059.426] lstrcmpiA (lpString1="226", lpString2="60000") returned -1 [0059.426] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="227") returned 3 [0059.426] lstrcmpiA (lpString1="227", lpString2="60000") returned -1 [0059.426] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="228") returned 3 [0059.426] lstrcmpiA (lpString1="228", lpString2="60000") returned -1 [0059.426] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="229") returned 3 [0059.426] lstrcmpiA (lpString1="229", lpString2="60000") returned -1 [0059.426] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="230") returned 3 [0059.426] lstrcmpiA (lpString1="230", lpString2="60000") returned -1 [0059.426] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="231") returned 3 [0059.426] lstrcmpiA (lpString1="231", lpString2="60000") returned -1 [0059.426] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="232") returned 3 [0059.426] lstrcmpiA (lpString1="232", lpString2="60000") returned -1 [0059.426] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="233") returned 3 [0059.426] lstrcmpiA (lpString1="233", lpString2="60000") returned -1 [0059.426] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="234") returned 3 [0059.426] lstrcmpiA (lpString1="234", lpString2="60000") returned -1 [0059.426] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="235") returned 3 [0059.427] lstrcmpiA (lpString1="235", lpString2="60000") returned -1 [0059.427] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="236") returned 3 [0059.427] lstrcmpiA (lpString1="236", lpString2="60000") returned -1 [0059.427] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="237") returned 3 [0059.427] lstrcmpiA (lpString1="237", lpString2="60000") returned -1 [0059.427] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="238") returned 3 [0059.427] lstrcmpiA (lpString1="238", lpString2="60000") returned -1 [0059.427] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="239") returned 3 [0059.427] lstrcmpiA (lpString1="239", lpString2="60000") returned -1 [0059.427] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="240") returned 3 [0059.427] lstrcmpiA (lpString1="240", lpString2="60000") returned -1 [0059.427] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="241") returned 3 [0059.427] lstrcmpiA (lpString1="241", lpString2="60000") returned -1 [0059.427] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="242") returned 3 [0059.427] lstrcmpiA (lpString1="242", lpString2="60000") returned -1 [0059.427] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="243") returned 3 [0059.427] lstrcmpiA (lpString1="243", lpString2="60000") returned -1 [0059.427] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="244") returned 3 [0059.427] lstrcmpiA (lpString1="244", lpString2="60000") returned -1 [0059.427] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="245") returned 3 [0059.427] lstrcmpiA (lpString1="245", lpString2="60000") returned -1 [0059.427] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="246") returned 3 [0059.427] lstrcmpiA (lpString1="246", lpString2="60000") returned -1 [0059.427] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="247") returned 3 [0059.428] lstrcmpiA (lpString1="247", lpString2="60000") returned -1 [0059.428] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="248") returned 3 [0059.428] lstrcmpiA (lpString1="248", lpString2="60000") returned -1 [0059.428] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="249") returned 3 [0059.428] lstrcmpiA (lpString1="249", lpString2="60000") returned -1 [0059.943] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", lpString2="\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0059.943] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="131083810" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\131083810") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\131083810" [0059.943] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\131083810" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\131083810")) returned 0xffffffff [0059.943] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\131083810" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\131083810")) returned 0xffffffff [0059.943] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\131083810" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\131083810"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0059.944] SetFilePointer (in: hFile=0x174, lDistanceToMove=216143, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x34c4f [0059.944] ReadFile (in: hFile=0x174, lpBuffer=0x18fbd0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x18fb4c, lpOverlapped=0x0 | out: lpBuffer=0x18fbd0*, lpNumberOfBytesRead=0x18fb4c*=0x4, lpOverlapped=0x0) returned 1 [0059.944] GetTickCount () returned 0x1145ee3 [0059.944] ReadFile (in: hFile=0x174, lpBuffer=0x41d448, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18fb4c, lpOverlapped=0x0 | out: lpBuffer=0x41d448*, lpNumberOfBytesRead=0x18fb4c*=0x4000, lpOverlapped=0x0) returned 1 [0059.945] GetTickCount () returned 0x1145ee3 [0059.945] WriteFile (in: hFile=0x17c, lpBuffer=0x421448*, nNumberOfBytesToWrite=0x3ffb, lpNumberOfBytesWritten=0x18fb58, lpOverlapped=0x0 | out: lpBuffer=0x421448*, lpNumberOfBytesWritten=0x18fb58*=0x3ffb, lpOverlapped=0x0) returned 1 [0059.947] GetTickCount () returned 0x1145ee3 [0059.947] ReadFile (in: hFile=0x174, lpBuffer=0x41d448, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18fb4c, lpOverlapped=0x0 | out: lpBuffer=0x41d448*, lpNumberOfBytesRead=0x18fb4c*=0x4000, lpOverlapped=0x0) returned 1 [0059.947] GetTickCount () returned 0x1145ee3 [0059.947] WriteFile (in: hFile=0x17c, lpBuffer=0x421448*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x18fb58, lpOverlapped=0x0 | out: lpBuffer=0x421448*, lpNumberOfBytesWritten=0x18fb58*=0x4000, lpOverlapped=0x0) returned 1 [0059.948] GetTickCount () returned 0x1145ee3 [0059.948] ReadFile (in: hFile=0x174, lpBuffer=0x41d448, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18fb4c, lpOverlapped=0x0 | out: lpBuffer=0x41d448*, lpNumberOfBytesRead=0x18fb4c*=0x4000, lpOverlapped=0x0) returned 1 [0059.949] GetTickCount () returned 0x1145ee3 [0059.949] WriteFile (in: hFile=0x17c, lpBuffer=0x421448*, nNumberOfBytesToWrite=0x40ac, lpNumberOfBytesWritten=0x18fb58, lpOverlapped=0x0 | out: lpBuffer=0x421448*, lpNumberOfBytesWritten=0x18fb58*=0x40ac, lpOverlapped=0x0) returned 1 [0059.949] GetTickCount () returned 0x1145ee3 [0059.949] ReadFile (in: hFile=0x174, lpBuffer=0x41d448, nNumberOfBytesToRead=0x23b4, lpNumberOfBytesRead=0x18fb4c, lpOverlapped=0x0 | out: lpBuffer=0x41d448*, lpNumberOfBytesRead=0x18fb4c*=0x23b4, lpOverlapped=0x0) returned 1 [0059.950] GetTickCount () returned 0x1145ee3 [0059.950] MulDiv (nNumber=58292, nNumerator=100, nDenominator=58292) returned 100 [0059.950] wsprintfA (in: param_1=0x18fb68, param_2="... %d%%" | out: param_1="... 100%") returned 8 [0059.950] WriteFile (in: hFile=0x17c, lpBuffer=0x421448*, nNumberOfBytesToWrite=0x2dcb, lpNumberOfBytesWritten=0x18fb58, lpOverlapped=0x0 | out: lpBuffer=0x421448*, lpNumberOfBytesWritten=0x18fb58*=0x2dcb, lpOverlapped=0x0) returned 1 [0059.950] SetFileTime (hFile=0x17c, lpCreationTime=0x18fd94, lpLastAccessTime=0x0, lpLastWriteTime=0x18fd94) returned 1 [0059.950] CloseHandle (hObject=0x17c) returned 1 [0059.953] lstrcpynA (in: lpString1=0x42e3c0, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0059.954] lstrlenA (lpString="") returned 0 [0059.954] lstrcpynA (in: lpString1=0x40ac38, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0059.954] lstrcpynA (in: lpString1=0x40b038, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0059.954] lstrcmpiA (lpString1="", lpString2="") returned 0 [0059.954] lstrcpynA (in: lpString1=0x42e3c0, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0059.954] lstrlenA (lpString="") returned 0 [0059.954] lstrcpynA (in: lpString1=0x66480c, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0059.954] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\" [0059.954] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 36 [0059.954] lstrcpynA (in: lpString1=0x40a838, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp" [0059.954] GetTickCount () returned 0x1145ef2 [0059.954] GetTempFileNameA (in: lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", lpPrefixString="nss", uUnique=0x0, lpTempFileName=0x430000 | out: lpTempFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nssb673.tmp")) returned 0xb673 [0059.955] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0059.955] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0059.955] lstrcpynA (in: lpString1=0x40a438, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0059.955] lstrcpynA (in: lpString1=0x42bc98, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0059.955] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0059.955] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", lpFindFileData=0x42c0e0 | out: lpFindFileData=0x42c0e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe50970f0, ftCreationTime.dwHighDateTime=0x1d6eae2, ftLastAccessTime.dwLowDateTime=0xe50970f0, ftLastAccessTime.dwHighDateTime=0x1d6eae2, ftLastWriteTime.dwLowDateTime=0xe50970f0, ftLastWriteTime.dwHighDateTime=0x1d6eae2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x8, cFileName="nssB673.tmp", cAlternateFileName="")) returned 0x653678 [0059.955] FindClose (in: hFindFile=0x653678 | out: hFindFile=0x653678) returned 1 [0059.956] DeleteFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nssb673.tmp")) returned 1 [0059.956] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0059.956] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0059.956] lstrcpynA (in: lpString1=0x40a838, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0059.956] CreateDirectoryA (lpPathName="C:\\Users" (normalized: "c:\\users"), lpSecurityAttributes=0x0) returned 0 [0059.956] GetLastError () returned 0xb7 [0059.956] GetFileAttributesA (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0059.956] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1" (normalized: "c:\\users\\5p5nrg~1"), lpSecurityAttributes=0x0) returned 0 [0059.956] GetLastError () returned 0xb7 [0059.956] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1" (normalized: "c:\\users\\5p5nrg~1")) returned 0x10 [0059.956] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData" (normalized: "c:\\users\\5p5nrg~1\\appdata"), lpSecurityAttributes=0x0) returned 0 [0059.957] GetLastError () returned 0xb7 [0059.957] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData" (normalized: "c:\\users\\5p5nrg~1\\appdata")) returned 0x2012 [0059.957] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local"), lpSecurityAttributes=0x0) returned 0 [0059.957] GetLastError () returned 0xb7 [0059.957] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local")) returned 0x2010 [0059.957] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp"), lpSecurityAttributes=0x0) returned 0 [0059.957] GetLastError () returned 0xb7 [0059.957] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp")) returned 0x2010 [0059.957] GetModuleHandleA (lpModuleName="SHELL32") returned 0x759d0000 [0059.958] GetProcAddress (hModule=0x759d0000, lpProcName=0x2a8) returned 0x75a244f5 [0059.958] IsUserAnAdmin () returned 1 [0059.958] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nssb673.tmp"), lpSecurityAttributes=0x18f9c4) returned 1 [0059.958] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0059.958] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0059.959] lstrcpynA (in: lpString1=0x40a438, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0059.959] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0059.959] lstrcpynA (in: lpString1=0x436800, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0059.959] lstrcpynA (in: lpString1=0x430000, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0059.959] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0059.959] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0059.959] lstrcpynA (in: lpString1=0x40b038, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" [0059.959] lstrcpynA (in: lpString1=0x40a438, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" [0059.959] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nssb673.tmp\\system.dll")) returned 0xffffffff [0059.959] CreateFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nssb673.tmp\\system.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c [0059.959] SetFilePointer (in: hFile=0x174, lDistanceToMove=274439, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x43007 [0059.959] ReadFile (in: hFile=0x174, lpBuffer=0x18fbd0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x18fb4c, lpOverlapped=0x0 | out: lpBuffer=0x18fbd0*, lpNumberOfBytesRead=0x18fb4c*=0x4, lpOverlapped=0x0) returned 1 [0059.960] GetTickCount () returned 0x1145ef2 [0059.960] ReadFile (in: hFile=0x174, lpBuffer=0x41d448, nNumberOfBytesToRead=0x1ace, lpNumberOfBytesRead=0x18fb4c, lpOverlapped=0x0 | out: lpBuffer=0x41d448*, lpNumberOfBytesRead=0x18fb4c*=0x1ace, lpOverlapped=0x0) returned 1 [0059.960] GetTickCount () returned 0x1145ef2 [0059.960] MulDiv (nNumber=6862, nNumerator=100, nDenominator=6862) returned 100 [0059.960] wsprintfA (in: param_1=0x18fb68, param_2="... %d%%" | out: param_1="... 100%") returned 8 [0059.960] WriteFile (in: hFile=0x1c, lpBuffer=0x421448*, nNumberOfBytesToWrite=0x2e00, lpNumberOfBytesWritten=0x18fb58, lpOverlapped=0x0 | out: lpBuffer=0x421448*, lpNumberOfBytesWritten=0x18fb58*=0x2e00, lpOverlapped=0x0) returned 1 [0059.961] CloseHandle (hObject=0x1c) returned 1 [0059.962] lstrcpynA (in: lpString1=0x66480c, lpString2="\x09\x09\x09\x09\x09\x09*(&t256) \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09p \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09.r5", iMaxLength=1024 | out: lpString1="\x09\x09\x09\x09\x09\x09*(&t256) \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09p \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09.r5") returned="\x09\x09\x09\x09\x09\x09*(&t256) \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09p \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09.r5" [0059.962] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0059.962] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0059.962] lstrcpynA (in: lpString1=0x40a838, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" [0059.962] lstrcpynA (in: lpString1=0x40a438, lpString2="Call", iMaxLength=1024 | out: lpString1="Call") returned="Call" [0059.963] GetModuleHandleA (lpModuleName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned 0x0 [0059.963] LoadLibraryExA (lpLibFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll", hFile=0x0, dwFlags=0x8) returned 0x75230000 [0059.971] VirtualProtect (in: lpAddress=0x7523404c, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x7523403c | out: lpflOldProtect=0x7523403c*=0x4) returned 1 [0059.972] GetProcAddress (hModule=0x75230000, lpProcName="Call") returned 0x752316db [0059.973] lstrcpyA (in: lpString1=0x665020, lpString2="" | out: lpString1="") returned="" [0059.974] lstrcpynA (in: lpString1=0x664808, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0059.974] lstrcpynA (in: lpString1=0x6660c8, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0059.974] lstrcpynA (in: lpString1=0x664808, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0059.974] lstrcpynA (in: lpString1=0x6664d0, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0059.974] wsprintfA (in: param_1=0x6664d0, param_2="%d" | out: param_1="6703112") returned 7 [0059.974] lstrcpyA (in: lpString1=0x431400, lpString2="6703112" | out: lpString1="6703112") returned="6703112" [0059.974] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0059.974] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0059.974] lstrcpynA (in: lpString1=0x40ac38, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0059.974] lstrcpynA (in: lpString1=0x40b038, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0059.974] lstrcmpiA (lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", lpString2="") returned 1 [0059.974] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0059.975] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0059.975] lstrcpynA (in: lpString1=0x40b038, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" [0059.975] lstrcpynA (in: lpString1=0x40a438, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" [0059.975] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nssb673.tmp\\system.dll")) returned 0x2020 [0059.975] CreateFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nssb673.tmp\\system.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xffffffff [0059.975] lstrcpynA (in: lpString1=0x66350c, lpString2="user32::wsprintf(p \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09r5, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 t \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 '%s\\131083810', \x09\x09\x09\x09\x09\x09\x09 t \x09\x09\x09\x09\x09\x09 o)", iMaxLength=1024 | out: lpString1="user32::wsprintf(p \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09r5, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 t \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 '%s\\131083810', \x09\x09\x09\x09\x09\x09\x09 t \x09\x09\x09\x09\x09\x09 o)") returned="user32::wsprintf(p \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09r5, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 t \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 '%s\\131083810', \x09\x09\x09\x09\x09\x09\x09 t \x09\x09\x09\x09\x09\x09 o)" [0059.975] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0059.975] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0059.975] lstrcpynA (in: lpString1=0x40a838, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" [0059.975] lstrcpynA (in: lpString1=0x40a438, lpString2="Call", iMaxLength=1024 | out: lpString1="Call") returned="Call" [0059.975] GetModuleHandleA (lpModuleName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned 0x75230000 [0059.976] GetProcAddress (hModule=0x75230000, lpProcName="Call") returned 0x752316db [0059.976] lstrcpyA (in: lpString1=0x663d20, lpString2="user32" | out: lpString1="user32") returned="user32" [0059.976] lstrcpyA (in: lpString1=0x664918, lpString2="user32" | out: lpString1="user32") returned="user32" [0059.976] lstrcpyA (in: lpString1=0x664d18, lpString2="wsprintf" | out: lpString1="wsprintf") returned="wsprintf" [0059.976] lstrcpynA (in: lpString1=0x664128, lpString2="%s\\131083810", iMaxLength=1024 | out: lpString1="%s\\131083810") returned="%s\\131083810" [0059.976] GetModuleHandleA (lpModuleName="user32") returned 0x77130000 [0059.976] GetProcAddress (hModule=0x77130000, lpProcName="wsprintf") returned 0x0 [0059.976] lstrlenA (lpString="wsprintf") returned 8 [0059.977] GetProcAddress (hModule=0x77130000, lpProcName="wsprintfA") returned 0x7715ae5f [0059.977] lstrcpynA (in: lpString1=0x663508, lpString2="6703112", iMaxLength=1024 | out: lpString1="6703112") returned="6703112" [0059.977] lstrcpynA (in: lpString1=0x663508, lpString2="%s\\131083810", iMaxLength=1024 | out: lpString1="%s\\131083810") returned="%s\\131083810" [0059.977] lstrcpynA (in: lpString1=0x663910, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", iMaxLength=1024 | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0059.977] lstrcpynA (in: lpString1=0x663d18, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", iMaxLength=1024 | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0059.977] lstrcpynA (in: lpString1=0x663910, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0059.977] wsprintfA (in: param_1=0x664808, param_2="%s\\131083810" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\131083810") returned 55 [0059.977] lstrcpynA (in: lpString1=0x663910, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", iMaxLength=1024 | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0059.977] lstrcpynA (in: lpString1=0x663910, lpString2="%s\\131083810", iMaxLength=1024 | out: lpString1="%s\\131083810") returned="%s\\131083810" [0059.977] wsprintfA (in: param_1=0x663910, param_2="%d" | out: param_1="6703112") returned 7 [0059.977] FreeLibrary (hLibModule=0x663508) returned 0 [0059.977] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0059.977] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0059.977] lstrcpynA (in: lpString1=0x40ac38, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0059.978] lstrcpynA (in: lpString1=0x40b038, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0059.978] lstrcmpiA (lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", lpString2="") returned 1 [0059.978] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0059.978] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0059.978] lstrcpynA (in: lpString1=0x40b038, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" [0059.978] lstrcpynA (in: lpString1=0x40a438, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" [0059.978] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nssb673.tmp\\system.dll")) returned 0x2020 [0059.978] CreateFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nssb673.tmp\\system.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xffffffff [0059.979] lstrcpynA (in: lpString1=0x42e3d3, lpString2="e", iMaxLength=1024 | out: lpString1="e") returned="e" [0059.979] lstrlenA (lpString="e") returned 1 [0059.979] lstrcpynA (in: lpString1=0x66492c, lpString2="kernel32::CreateFile(p\x09 r5,\x09\x09 i \x09\x090x80000000,\x09 i\x09 0,\x09\x09 p\x09 0,\x09\x09\x09 i \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x093, i 0,\x09\x09\x09\x09\x09\x09 i\x09\x09\x09\x09\x09\x09\x09 0)\x09\x09\x09 i \x09\x09\x09\x09\x09\x09\x09\x09\x09.r10", iMaxLength=1024 | out: lpString1="kernel32::CreateFile(p\x09 r5,\x09\x09 i \x09\x090x80000000,\x09 i\x09 0,\x09\x09 p\x09 0,\x09\x09\x09 i \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x093, i 0,\x09\x09\x09\x09\x09\x09 i\x09\x09\x09\x09\x09\x09\x09 0)\x09\x09\x09 i \x09\x09\x09\x09\x09\x09\x09\x09\x09.r10") returned="kernel32::CreateFile(p\x09 r5,\x09\x09 i \x09\x090x80000000,\x09 i\x09 0,\x09\x09 p\x09 0,\x09\x09\x09 i \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x093, i 0,\x09\x09\x09\x09\x09\x09 i\x09\x09\x09\x09\x09\x09\x09 0)\x09\x09\x09 i \x09\x09\x09\x09\x09\x09\x09\x09\x09.r10" [0059.979] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0059.979] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0059.979] lstrcpynA (in: lpString1=0x40a838, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" [0059.979] lstrcpynA (in: lpString1=0x40a438, lpString2="Call", iMaxLength=1024 | out: lpString1="Call") returned="Call" [0059.979] GetModuleHandleA (lpModuleName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned 0x75230000 [0059.979] GetProcAddress (hModule=0x75230000, lpProcName="Call") returned 0x752316db [0059.979] lstrcpyA (in: lpString1=0x663910, lpString2="kernel32" | out: lpString1="kernel32") returned="kernel32" [0059.979] lstrcpyA (in: lpString1=0x66c918, lpString2="kernel32" | out: lpString1="kernel32") returned="kernel32" [0059.979] lstrcpyA (in: lpString1=0x66cd18, lpString2="CreateFile" | out: lpString1="CreateFile") returned="CreateFile" [0059.980] GetModuleHandleA (lpModuleName="kernel32") returned 0x76d30000 [0059.980] GetProcAddress (hModule=0x76d30000, lpProcName="CreateFile") returned 0x0 [0059.980] lstrlenA (lpString="CreateFile") returned 10 [0059.980] GetProcAddress (hModule=0x76d30000, lpProcName="CreateFileA") returned 0x76d453c6 [0059.980] lstrcpynA (in: lpString1=0x663508, lpString2="6703112", iMaxLength=1024 | out: lpString1="6703112") returned="6703112" [0059.980] lstrcpynA (in: lpString1=0x663508, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0059.980] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\131083810" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\131083810"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c [0059.980] wsprintfA (in: param_1=0x663508, param_2="%d" | out: param_1="0") returned 1 [0059.980] wsprintfA (in: param_1=0x663508, param_2="%d" | out: param_1="0") returned 1 [0059.981] wsprintfA (in: param_1=0x663508, param_2="%d" | out: param_1="3") returned 1 [0059.981] wsprintfA (in: param_1=0x663508, param_2="%d" | out: param_1="0") returned 1 [0059.981] wsprintfA (in: param_1=0x663508, param_2="%d" | out: param_1="0") returned 1 [0059.981] wsprintfA (in: param_1=0x663508, param_2="%d" | out: param_1="-2147483648") returned 11 [0059.981] wsprintfA (in: param_1=0x663508, param_2="%d" | out: param_1="6703112") returned 7 [0059.981] wsprintfA (in: param_1=0x663508, param_2="%d" | out: param_1="28") returned 2 [0059.981] lstrcpyA (in: lpString1=0x432800, lpString2="28" | out: lpString1="28") returned="28" [0059.981] lstrcpynA (in: lpString1=0x40a438, lpString2="*(i", iMaxLength=1024 | out: lpString1="*(i") returned="*(i" [0059.981] lstrlenA (lpString="*(i") returned 3 [0059.981] lstrcpynA (in: lpString1=0x430000, lpString2="*(i", iMaxLength=1024 | out: lpString1="*(i") returned="*(i" [0059.981] lstrcpynA (in: lpString1=0x40a438, lpString2="(&", iMaxLength=1024 | out: lpString1="(&") returned="(&" [0059.981] lstrlenA (lpString="(&") returned 2 [0059.981] lstrcpynA (in: lpString1=0x430c00, lpString2="(&", iMaxLength=1024 | out: lpString1="(&") returned="(&" [0059.981] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0059.981] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0059.981] lstrcpynA (in: lpString1=0x40ac38, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0059.981] lstrcpynA (in: lpString1=0x40b038, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0059.981] lstrcmpiA (lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", lpString2="") returned 1 [0059.981] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0059.981] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0059.981] lstrcpynA (in: lpString1=0x40b038, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" [0059.981] lstrcpynA (in: lpString1=0x40a438, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" [0059.982] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nssb673.tmp\\system.dll")) returned 0x2020 [0059.982] CreateFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nssb673.tmp\\system.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xffffffff [0059.982] lstrcpynA (in: lpString1=0x66492c, lpString2="*(i) \x09\x09\x09\x09\x09\x09\x09\x09\x09 p \x09\x09\x09\x09\x09\x09\x09\x09\x09 \x09 .r2", iMaxLength=1024 | out: lpString1="*(i) \x09\x09\x09\x09\x09\x09\x09\x09\x09 p \x09\x09\x09\x09\x09\x09\x09\x09\x09 \x09 .r2") returned="*(i) \x09\x09\x09\x09\x09\x09\x09\x09\x09 p \x09\x09\x09\x09\x09\x09\x09\x09\x09 \x09 .r2" [0059.982] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0059.982] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0059.982] lstrcpynA (in: lpString1=0x40a838, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" [0059.982] lstrcpynA (in: lpString1=0x40a438, lpString2="Call", iMaxLength=1024 | out: lpString1="Call") returned="Call" [0059.983] GetModuleHandleA (lpModuleName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned 0x75230000 [0059.983] GetProcAddress (hModule=0x75230000, lpProcName="Call") returned 0x752316db [0059.983] lstrcpyA (in: lpString1=0x66cd18, lpString2="" | out: lpString1="") returned="" [0059.983] lstrcpynA (in: lpString1=0x663508, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0059.983] lstrcpynA (in: lpString1=0x663508, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0059.983] wsprintfA (in: param_1=0x663508, param_2="%d" | out: param_1="0") returned 1 [0059.983] wsprintfA (in: param_1=0x663508, param_2="%d" | out: param_1="6626120") returned 7 [0059.983] lstrcpyA (in: lpString1=0x430800, lpString2="6626120" | out: lpString1="6626120") returned="6626120" [0059.983] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0059.983] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0059.983] lstrcpynA (in: lpString1=0x40ac38, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0059.983] lstrcpynA (in: lpString1=0x40b038, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0059.983] lstrcmpiA (lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", lpString2="") returned 1 [0059.983] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0059.983] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0059.984] lstrcpynA (in: lpString1=0x40b038, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" [0059.984] lstrcpynA (in: lpString1=0x40a438, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" [0059.984] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nssb673.tmp\\system.dll")) returned 0x2020 [0059.984] CreateFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nssb673.tmp\\system.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xffffffff [0059.984] lstrcpynA (in: lpString1=0x66492c, lpString2="*(i \x09\x09\x09\x09\x09\x09 61042, \x09\x09\x09\x09\x09 \x09\x09 i \x09\x09\x09\x09\x09\x09\x09\x09 0) \x09\x09\x09\x09\x09\x09\x09 p \x09\x09\x09\x09\x09 .r1", iMaxLength=1024 | out: lpString1="*(i \x09\x09\x09\x09\x09\x09 61042, \x09\x09\x09\x09\x09 \x09\x09 i \x09\x09\x09\x09\x09\x09\x09\x09 0) \x09\x09\x09\x09\x09\x09\x09 p \x09\x09\x09\x09\x09 .r1") returned="*(i \x09\x09\x09\x09\x09\x09 61042, \x09\x09\x09\x09\x09 \x09\x09 i \x09\x09\x09\x09\x09\x09\x09\x09 0) \x09\x09\x09\x09\x09\x09\x09 p \x09\x09\x09\x09\x09 .r1" [0059.984] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0059.984] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0059.984] lstrcpynA (in: lpString1=0x40a838, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" [0059.984] lstrcpynA (in: lpString1=0x40a438, lpString2="Call", iMaxLength=1024 | out: lpString1="Call") returned="Call" [0059.984] GetModuleHandleA (lpModuleName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned 0x75230000 [0059.984] GetProcAddress (hModule=0x75230000, lpProcName="Call") returned 0x752316db [0059.984] lstrcpyA (in: lpString1=0x66cd18, lpString2="" | out: lpString1="") returned="" [0059.985] lstrcpynA (in: lpString1=0x663508, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0059.985] wsprintfA (in: param_1=0x663508, param_2="%d" | out: param_1="0") returned 1 [0059.985] wsprintfA (in: param_1=0x663508, param_2="%d" | out: param_1="61042") returned 5 [0059.985] wsprintfA (in: param_1=0x663508, param_2="%d" | out: param_1="6626136") returned 7 [0059.985] lstrcpyA (in: lpString1=0x430400, lpString2="6626136" | out: lpString1="6626136") returned="6626136" [0059.985] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0059.985] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0059.985] lstrcpynA (in: lpString1=0x40ac38, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0059.985] lstrcpynA (in: lpString1=0x40b038, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0059.985] lstrcmpiA (lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", lpString2="") returned 1 [0059.985] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0059.985] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0059.985] lstrcpynA (in: lpString1=0x40b038, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" [0059.985] lstrcpynA (in: lpString1=0x40a438, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" [0059.985] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nssb673.tmp\\system.dll")) returned 0x2020 [0059.985] CreateFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nssb673.tmp\\system.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xffffffff [0059.986] lstrcpynA (in: lpString1=0x66492c, lpString2="*(&t255) \x09\x09 p \x09 .r5", iMaxLength=1024 | out: lpString1="*(&t255) \x09\x09 p \x09 .r5") returned="*(&t255) \x09\x09 p \x09 .r5" [0059.986] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0059.986] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0059.986] lstrcpynA (in: lpString1=0x40a838, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" [0059.986] lstrcpynA (in: lpString1=0x40a438, lpString2="Call", iMaxLength=1024 | out: lpString1="Call") returned="Call" [0059.986] GetModuleHandleA (lpModuleName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned 0x75230000 [0059.986] GetProcAddress (hModule=0x75230000, lpProcName="Call") returned 0x752316db [0059.986] lstrcpyA (in: lpString1=0x66cd18, lpString2="" | out: lpString1="") returned="" [0059.986] lstrcpynA (in: lpString1=0x663508, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0059.986] lstrcpynA (in: lpString1=0x663910, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0059.986] lstrcpynA (in: lpString1=0x663508, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0059.987] lstrcpynA (in: lpString1=0x663d18, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0059.987] wsprintfA (in: param_1=0x663d18, param_2="%d" | out: param_1="6698248") returned 7 [0059.987] lstrcpyA (in: lpString1=0x431400, lpString2="6698248" | out: lpString1="6698248") returned="6698248" [0059.987] lstrcpynA (in: lpString1=0x40a438, lpString2="NtCreateSection", iMaxLength=1024 | out: lpString1="NtCreateSection") returned="NtCreateSection" [0059.987] lstrlenA (lpString="NtCreateSection") returned 15 [0059.987] lstrcpynA (in: lpString1=0x430c00, lpString2="NtCreateSection", iMaxLength=1024 | out: lpString1="NtCreateSection") returned="NtCreateSection" [0059.987] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0059.987] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0059.987] lstrcpynA (in: lpString1=0x40ac38, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0059.987] lstrcpynA (in: lpString1=0x40b038, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0059.987] lstrcmpiA (lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", lpString2="") returned 1 [0059.987] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0059.987] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0059.987] lstrcpynA (in: lpString1=0x40b038, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" [0059.987] lstrcpynA (in: lpString1=0x40a438, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" [0059.987] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nssb673.tmp\\system.dll")) returned 0x2020 [0059.987] CreateFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nssb673.tmp\\system.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xffffffff [0059.988] lstrcpynA (in: lpString1=0x66492c, lpString2="user32::wsprintf(p \x09\x09\x09\x09\x09\x09\x09r5, \x09\x09\x09\x09\x09\x09\x09\x09t \x09\x09\x09\x09\x09\x09\x09\x09 '%s%s%s%s%s%i%s' , \x09\x09\x09\x09\x09\x09\x09\x09 t \x09 \x09\x09\x09\x09\x09\x09\x09\x09 'nt',\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 t\x09 \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09'dll::NtC',t \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 'reat', \x09\x09\x09\x09\x09\x09\x09 t \x09\x09\x09\x09\x09\x09\x09\x09\x09'NtCreateSection',t'ion(p \x09\x09\x09\x09\x09\x09\x09\x09\x09 r2,i ', \x09\x09\x09\x09\x09\x09\x09\x09\x09i \x09\x09\x09\x09\x09\x09\x09\x09\x09\x090xE,t \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 ',n,')", iMaxLength=1024 | out: lpString1="user32::wsprintf(p \x09\x09\x09\x09\x09\x09\x09r5, \x09\x09\x09\x09\x09\x09\x09\x09t \x09\x09\x09\x09\x09\x09\x09\x09 '%s%s%s%s%s%i%s' , \x09\x09\x09\x09\x09\x09\x09\x09 t \x09 \x09\x09\x09\x09\x09\x09\x09\x09 'nt',\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 t\x09 \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09'dll::NtC',t \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 'reat', \x09\x09\x09\x09\x09\x09\x09 t \x09\x09\x09\x09\x09\x09\x09\x09\x09'NtCreateSection',t'ion(p \x09\x09\x09\x09\x09\x09\x09\x09\x09 r2,i ', \x09\x09\x09\x09\x09\x09\x09\x09\x09i \x09\x09\x09\x09\x09\x09\x09\x09\x09\x090xE,t \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 ',n,')") returned="user32::wsprintf(p \x09\x09\x09\x09\x09\x09\x09r5, \x09\x09\x09\x09\x09\x09\x09\x09t \x09\x09\x09\x09\x09\x09\x09\x09 '%s%s%s%s%s%i%s' , \x09\x09\x09\x09\x09\x09\x09\x09 t \x09 \x09\x09\x09\x09\x09\x09\x09\x09 'nt',\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 t\x09 \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09'dll::NtC',t \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 'reat', \x09\x09\x09\x09\x09\x09\x09 t \x09\x09\x09\x09\x09\x09\x09\x09\x09'NtCreateSection',t'ion(p \x09\x09\x09\x09\x09\x09\x09\x09\x09 r2,i ', \x09\x09\x09\x09\x09\x09\x09\x09\x09i \x09\x09\x09\x09\x09\x09\x09\x09\x09\x090xE,t \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 ',n,')" [0059.988] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0059.988] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0059.988] lstrcpynA (in: lpString1=0x40a838, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" [0059.988] lstrcpynA (in: lpString1=0x40a438, lpString2="Call", iMaxLength=1024 | out: lpString1="Call") returned="Call" [0059.988] GetModuleHandleA (lpModuleName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned 0x75230000 [0059.988] GetProcAddress (hModule=0x75230000, lpProcName="Call") returned 0x752316db [0059.988] lstrcpyA (in: lpString1=0x663a18, lpString2="user32" | out: lpString1="user32") returned="user32" [0059.988] lstrcpyA (in: lpString1=0x66c918, lpString2="user32" | out: lpString1="user32") returned="user32" [0059.988] lstrcpyA (in: lpString1=0x66cd18, lpString2="wsprintf" | out: lpString1="wsprintf") returned="wsprintf" [0059.988] lstrcpynA (in: lpString1=0x663e20, lpString2="%s%s%s%s%s%i%s", iMaxLength=1024 | out: lpString1="%s%s%s%s%s%i%s") returned="%s%s%s%s%s%i%s" [0059.988] lstrcpynA (in: lpString1=0x664228, lpString2="nt", iMaxLength=1024 | out: lpString1="nt") returned="nt" [0059.988] lstrcpynA (in: lpString1=0x66ddc0, lpString2="dll::NtC", iMaxLength=1024 | out: lpString1="dll::NtC") returned="dll::NtC" [0059.988] lstrcpynA (in: lpString1=0x66e1c8, lpString2="reat", iMaxLength=1024 | out: lpString1="reat") returned="reat" [0059.988] lstrcpynA (in: lpString1=0x66e5d0, lpString2="NtCreateSection", iMaxLength=1024 | out: lpString1="NtCreateSection") returned="NtCreateSection" [0059.988] lstrcpynA (in: lpString1=0x66e9d8, lpString2="ion(p \x09\x09\x09\x09\x09\x09\x09\x09\x09 r2,i ", iMaxLength=1024 | out: lpString1="ion(p \x09\x09\x09\x09\x09\x09\x09\x09\x09 r2,i ") returned="ion(p \x09\x09\x09\x09\x09\x09\x09\x09\x09 r2,i " [0059.989] lstrcpynA (in: lpString1=0x66f1e8, lpString2=",n,", iMaxLength=1024 | out: lpString1=",n,") returned=",n," [0059.989] GetModuleHandleA (lpModuleName="user32") returned 0x77130000 [0059.989] GetProcAddress (hModule=0x77130000, lpProcName="wsprintf") returned 0x0 [0059.989] lstrlenA (lpString="wsprintf") returned 8 [0059.989] GetProcAddress (hModule=0x77130000, lpProcName="wsprintfA") returned 0x7715ae5f [0059.989] lstrcpynA (in: lpString1=0x663610, lpString2="6698248", iMaxLength=1024 | out: lpString1="6698248") returned="6698248" [0059.989] lstrcpynA (in: lpString1=0x663610, lpString2="%s%s%s%s%s%i%s", iMaxLength=1024 | out: lpString1="%s%s%s%s%s%i%s") returned="%s%s%s%s%s%i%s" [0059.989] lstrcpynA (in: lpString1=0x663a18, lpString2="nt", iMaxLength=1024 | out: lpString1="nt") returned="nt" [0059.989] lstrcpynA (in: lpString1=0x663e20, lpString2="dll::NtC", iMaxLength=1024 | out: lpString1="dll::NtC") returned="dll::NtC" [0059.989] lstrcpynA (in: lpString1=0x66ddc0, lpString2="reat", iMaxLength=1024 | out: lpString1="reat") returned="reat" [0059.990] lstrcpynA (in: lpString1=0x66e1c8, lpString2="NtCreateSection", iMaxLength=1024 | out: lpString1="NtCreateSection") returned="NtCreateSection" [0059.990] lstrcpynA (in: lpString1=0x66e5d0, lpString2="ion(p \x09\x09\x09\x09\x09\x09\x09\x09\x09 r2,i ", iMaxLength=1024 | out: lpString1="ion(p \x09\x09\x09\x09\x09\x09\x09\x09\x09 r2,i ") returned="ion(p \x09\x09\x09\x09\x09\x09\x09\x09\x09 r2,i " [0059.990] lstrcpynA (in: lpString1=0x664228, lpString2=",n,", iMaxLength=1024 | out: lpString1=",n,") returned=",n," [0059.990] lstrcpynA (in: lpString1=0x66e9d8, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0059.990] wsprintfA (in: param_1=0x663508, param_2="%s%s%s%s%s%i%s" | out: param_1="ntdll::NtCreatNtCreateSectionion(p \x09\x09\x09\x09\x09\x09\x09\x09\x09 r2,i 14,n,") returned 55 [0059.990] lstrcpynA (in: lpString1=0x66e9d8, lpString2=",n,", iMaxLength=1024 | out: lpString1=",n,") returned=",n," [0059.990] wsprintfA (in: param_1=0x66e9d8, param_2="%d" | out: param_1="14") returned 2 [0059.990] lstrcpynA (in: lpString1=0x66e9d8, lpString2="ion(p \x09\x09\x09\x09\x09\x09\x09\x09\x09 r2,i ", iMaxLength=1024 | out: lpString1="ion(p \x09\x09\x09\x09\x09\x09\x09\x09\x09 r2,i ") returned="ion(p \x09\x09\x09\x09\x09\x09\x09\x09\x09 r2,i " [0059.990] lstrcpynA (in: lpString1=0x66e9d8, lpString2="NtCreateSection", iMaxLength=1024 | out: lpString1="NtCreateSection") returned="NtCreateSection" [0059.990] lstrcpynA (in: lpString1=0x66e9d8, lpString2="reat", iMaxLength=1024 | out: lpString1="reat") returned="reat" [0059.990] lstrcpynA (in: lpString1=0x66e9d8, lpString2="dll::NtC", iMaxLength=1024 | out: lpString1="dll::NtC") returned="dll::NtC" [0059.990] lstrcpynA (in: lpString1=0x66e9d8, lpString2="nt", iMaxLength=1024 | out: lpString1="nt") returned="nt" [0059.990] lstrcpynA (in: lpString1=0x66e9d8, lpString2="%s%s%s%s%s%i%s", iMaxLength=1024 | out: lpString1="%s%s%s%s%s%i%s") returned="%s%s%s%s%s%i%s" [0059.990] wsprintfA (in: param_1=0x66e9d8, param_2="%d" | out: param_1="6698248") returned 7 [0059.990] FreeLibrary (hLibModule=0x663610) returned 0 [0059.990] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0059.991] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0059.991] lstrcpynA (in: lpString1=0x40ac38, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0059.991] lstrcpynA (in: lpString1=0x40b038, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0059.991] lstrcmpiA (lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", lpString2="") returned 1 [0059.991] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0059.991] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0059.991] lstrcpynA (in: lpString1=0x40b038, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" [0059.991] lstrcpynA (in: lpString1=0x40a438, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" [0059.991] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nssb673.tmp\\system.dll")) returned 0x2020 [0059.991] CreateFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nssb673.tmp\\system.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xffffffff [0059.991] lstrcpynA (in: lpString1=0x42e3c1, lpString2="6698248", iMaxLength=1024 | out: lpString1="6698248") returned="6698248" [0059.991] lstrlenA (lpString="6698248") returned 7 [0059.991] lstrcpynA (in: lpString1=0x42e3cf, lpString2="NtCreateSection", iMaxLength=1024 | out: lpString1="NtCreateSection") returned="NtCreateSection" [0059.991] lstrlenA (lpString="NtCreateSection") returned 15 [0059.991] lstrcpynA (in: lpString1=0x66492c, lpString2="*6698248ntdll::NtCreateSectiont255 \x09\x09\x09\x09\x09\x09\x09\x09 .r5)", iMaxLength=1024 | out: lpString1="*6698248ntdll::NtCreateSectiont255 \x09\x09\x09\x09\x09\x09\x09\x09 .r5)") returned="*6698248ntdll::NtCreateSectiont255 \x09\x09\x09\x09\x09\x09\x09\x09 .r5)" [0059.991] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0059.991] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0059.991] lstrcpynA (in: lpString1=0x40a838, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" [0059.991] lstrcpynA (in: lpString1=0x40a438, lpString2="Call", iMaxLength=1024 | out: lpString1="Call") returned="Call" [0059.992] GetModuleHandleA (lpModuleName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned 0x75230000 [0059.992] GetProcAddress (hModule=0x75230000, lpProcName="Call") returned 0x752316db [0059.992] lstrcpyA (in: lpString1=0x663a18, lpString2="6698248ntdll" | out: lpString1="6698248ntdll") returned="6698248ntdll" [0059.992] lstrcpyA (in: lpString1=0x66c918, lpString2="6698248ntdll" | out: lpString1="6698248ntdll") returned="6698248ntdll" [0059.992] lstrcpyA (in: lpString1=0x66cd18, lpString2="NtCreateSectiont255 \x09\x09\x09\x09\x09\x09\x09\x09 .r5" | out: lpString1="NtCreateSectiont255 \x09\x09\x09\x09\x09\x09\x09\x09 .r5") returned="NtCreateSectiont255 \x09\x09\x09\x09\x09\x09\x09\x09 .r5" [0059.992] GetModuleHandleA (lpModuleName="6698248ntdll") returned 0x0 [0059.992] LoadLibraryA (lpLibFileName="6698248ntdll") returned 0x0 [0059.999] lstrcpynA (in: lpString1=0x663610, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0059.999] lstrcpyA (in: lpString1=0x18fb64, lpString2="error" | out: lpString1="error") returned="error" [0059.999] lstrcpynA (in: lpString1=0x663610, lpString2="error", iMaxLength=1024 | out: lpString1="error") returned="error" [0059.999] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0059.999] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0059.999] lstrcpynA (in: lpString1=0x40ac38, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0059.999] lstrcpynA (in: lpString1=0x40b038, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0059.999] lstrcmpiA (lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", lpString2="") returned 1 [0059.999] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0059.999] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0059.999] lstrcpynA (in: lpString1=0x40b038, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" [0059.999] lstrcpynA (in: lpString1=0x40a438, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" [0059.999] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nssb673.tmp\\system.dll")) returned 0x2020 [0060.000] CreateFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nssb673.tmp\\system.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xffffffff [0060.000] lstrcpynA (in: lpString1=0x42e3c7, lpString2="NtCreateSection", iMaxLength=1024 | out: lpString1="NtCreateSection") returned="NtCreateSection" [0060.000] lstrlenA (lpString="NtCreateSection") returned 15 [0060.000] lstrcpynA (in: lpString1=0x66492c, lpString2="ntdll::NtCreateSection(p \x09\x09r2, \x09\x09\x09i\x09\x09\x0914, \x09\x09\x09\x09n, \x09\x09p \x09\x09\x09r1, \x09\x09\x09\x09\x09 i \x09\x09 0x40, \x09 i \x09 0x8000000, \x09\x09\x09 n)", iMaxLength=1024 | out: lpString1="ntdll::NtCreateSection(p \x09\x09r2, \x09\x09\x09i\x09\x09\x0914, \x09\x09\x09\x09n, \x09\x09p \x09\x09\x09r1, \x09\x09\x09\x09\x09 i \x09\x09 0x40, \x09 i \x09 0x8000000, \x09\x09\x09 n)") returned="ntdll::NtCreateSection(p \x09\x09r2, \x09\x09\x09i\x09\x09\x0914, \x09\x09\x09\x09n, \x09\x09p \x09\x09\x09r1, \x09\x09\x09\x09\x09 i \x09\x09 0x40, \x09 i \x09 0x8000000, \x09\x09\x09 n)" [0060.000] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0060.000] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0060.000] lstrcpynA (in: lpString1=0x40a838, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" [0060.000] lstrcpynA (in: lpString1=0x40a438, lpString2="Call", iMaxLength=1024 | out: lpString1="Call") returned="Call" [0060.000] GetModuleHandleA (lpModuleName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned 0x75230000 [0060.000] GetProcAddress (hModule=0x75230000, lpProcName="Call") returned 0x752316db [0060.000] lstrcpyA (in: lpString1=0x663a18, lpString2="ntdll" | out: lpString1="ntdll") returned="ntdll" [0060.000] lstrcpyA (in: lpString1=0x66c918, lpString2="ntdll" | out: lpString1="ntdll") returned="ntdll" [0060.000] lstrcpyA (in: lpString1=0x66cd18, lpString2="NtCreateSection" | out: lpString1="NtCreateSection") returned="NtCreateSection" [0060.001] GetModuleHandleA (lpModuleName="ntdll") returned 0x77c40000 [0060.001] GetProcAddress (hModule=0x77c40000, lpProcName="NtCreateSection") returned 0x77c5ff94 [0060.001] lstrcpynA (in: lpString1=0x663610, lpString2="6626120", iMaxLength=1024 | out: lpString1="6626120") returned="6626120" [0060.001] lstrcpynA (in: lpString1=0x663610, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0060.001] lstrcpynA (in: lpString1=0x663610, lpString2="6626136", iMaxLength=1024 | out: lpString1="6626136") returned="6626136" [0060.001] lstrcpynA (in: lpString1=0x663610, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0060.001] lstrcpynA (in: lpString1=0x663610, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0060.001] NtCreateSection (in: SectionHandle=0x651b48, DesiredAccess=0xe, ObjectAttributes=0x0, MaximumSize=0x651b58, SectionPageProtection=0x40, AllocationAttributes=0x8000000, FileHandle=0x0 | out: SectionHandle=0x651b48*=0x17c) returned 0x0 [0060.001] wsprintfA (in: param_1=0x663610, param_2="%d" | out: param_1="134217728") returned 9 [0060.001] wsprintfA (in: param_1=0x663610, param_2="%d" | out: param_1="64") returned 2 [0060.001] wsprintfA (in: param_1=0x663610, param_2="%d" | out: param_1="6626136") returned 7 [0060.001] wsprintfA (in: param_1=0x663610, param_2="%d" | out: param_1="14") returned 2 [0060.001] wsprintfA (in: param_1=0x663610, param_2="%d" | out: param_1="6626120") returned 7 [0060.001] lstrcpynA (in: lpString1=0x40a438, lpString2="(p", iMaxLength=1024 | out: lpString1="(p") returned="(p" [0060.002] lstrlenA (lpString="(p") returned 2 [0060.002] lstrcpynA (in: lpString1=0x431c00, lpString2="(p", iMaxLength=1024 | out: lpString1="(p") returned="(p" [0060.002] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0060.002] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0060.002] lstrcpynA (in: lpString1=0x40ac38, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0060.002] lstrcpynA (in: lpString1=0x40b038, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0060.002] lstrcmpiA (lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", lpString2="") returned 1 [0060.002] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0060.002] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0060.002] lstrcpynA (in: lpString1=0x40b038, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" [0060.002] lstrcpynA (in: lpString1=0x40a438, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" [0060.002] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nssb673.tmp\\system.dll")) returned 0x2020 [0060.002] CreateFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nssb673.tmp\\system.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xffffffff [0060.002] lstrcpynA (in: lpString1=0x66492c, lpString2="*(p \x09\x09 \x09\x09\x09\x09\x09\x09\x09\x09\x09 0) \x09 \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 p \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 .r3", iMaxLength=1024 | out: lpString1="*(p \x09\x09 \x09\x09\x09\x09\x09\x09\x09\x09\x09 0) \x09 \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 p \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 .r3") returned="*(p \x09\x09 \x09\x09\x09\x09\x09\x09\x09\x09\x09 0) \x09 \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 p \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 .r3" [0060.002] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0060.002] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0060.002] lstrcpynA (in: lpString1=0x40a838, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" [0060.002] lstrcpynA (in: lpString1=0x40a438, lpString2="Call", iMaxLength=1024 | out: lpString1="Call") returned="Call" [0060.003] GetModuleHandleA (lpModuleName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned 0x75230000 [0060.003] GetProcAddress (hModule=0x75230000, lpProcName="Call") returned 0x752316db [0060.003] lstrcpyA (in: lpString1=0x66cd18, lpString2="" | out: lpString1="") returned="" [0060.003] lstrcpynA (in: lpString1=0x663610, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0060.003] wsprintfA (in: param_1=0x663610, param_2="%d" | out: param_1="0") returned 1 [0060.003] wsprintfA (in: param_1=0x663610, param_2="%d" | out: param_1="6626152") returned 7 [0060.003] lstrcpyA (in: lpString1=0x430c00, lpString2="6626152" | out: lpString1="6626152") returned="6626152" [0060.003] lstrcpynA (in: lpString1=0x40a438, lpString2="(", iMaxLength=1024 | out: lpString1="(") returned="(" [0060.003] lstrlenA (lpString="(") returned 1 [0060.003] lstrcpynA (in: lpString1=0x432400, lpString2="(", iMaxLength=1024 | out: lpString1="(") returned="(" [0060.003] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0060.003] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0060.003] lstrcpynA (in: lpString1=0x40ac38, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0060.003] lstrcpynA (in: lpString1=0x40b038, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0060.003] lstrcmpiA (lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", lpString2="") returned 1 [0060.004] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0060.004] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0060.004] lstrcpynA (in: lpString1=0x40b038, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" [0060.004] lstrcpynA (in: lpString1=0x40a438, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" [0060.004] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nssb673.tmp\\system.dll")) returned 0x2020 [0060.004] CreateFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nssb673.tmp\\system.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xffffffff [0060.004] lstrcpynA (in: lpString1=0x66492c, lpString2="*(i \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 0) \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 \x09p \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09.r4", iMaxLength=1024 | out: lpString1="*(i \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 0) \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 \x09p \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09.r4") returned="*(i \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 0) \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 \x09p \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09.r4" [0060.004] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0060.004] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0060.004] lstrcpynA (in: lpString1=0x40a838, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" [0060.004] lstrcpynA (in: lpString1=0x40a438, lpString2="Call", iMaxLength=1024 | out: lpString1="Call") returned="Call" [0060.004] GetModuleHandleA (lpModuleName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned 0x75230000 [0060.004] GetProcAddress (hModule=0x75230000, lpProcName="Call") returned 0x752316db [0060.005] lstrcpyA (in: lpString1=0x66cd18, lpString2="" | out: lpString1="") returned="" [0060.005] lstrcpynA (in: lpString1=0x663610, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0060.005] wsprintfA (in: param_1=0x663610, param_2="%d" | out: param_1="0") returned 1 [0060.005] wsprintfA (in: param_1=0x663610, param_2="%d" | out: param_1="6626168") returned 7 [0060.005] lstrcpyA (in: lpString1=0x431000, lpString2="6626168" | out: lpString1="6626168") returned="6626168" [0060.005] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0060.005] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0060.005] lstrcpynA (in: lpString1=0x40ac38, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0060.005] lstrcpynA (in: lpString1=0x40b038, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0060.005] lstrcmpiA (lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", lpString2="") returned 1 [0060.005] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0060.005] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0060.005] lstrcpynA (in: lpString1=0x40b038, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" [0060.005] lstrcpynA (in: lpString1=0x40a438, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" [0060.005] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nssb673.tmp\\system.dll")) returned 0x2020 [0060.005] CreateFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nssb673.tmp\\system.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xffffffff [0060.006] lstrcpynA (in: lpString1=0x42e3c1, lpString2="6626120", iMaxLength=1024 | out: lpString1="6626120") returned="6626120" [0060.006] lstrlenA (lpString="6626120") returned 7 [0060.006] lstrcpynA (in: lpString1=0x66492c, lpString2="*6626120(p \x09\x09\x09 .r2)", iMaxLength=1024 | out: lpString1="*6626120(p \x09\x09\x09 .r2)") returned="*6626120(p \x09\x09\x09 .r2)" [0060.006] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0060.006] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0060.006] lstrcpynA (in: lpString1=0x40a838, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" [0060.006] lstrcpynA (in: lpString1=0x40a438, lpString2="Call", iMaxLength=1024 | out: lpString1="Call") returned="Call" [0060.006] GetModuleHandleA (lpModuleName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned 0x75230000 [0060.006] GetProcAddress (hModule=0x75230000, lpProcName="Call") returned 0x752316db [0060.006] lstrcpyA (in: lpString1=0x66cd18, lpString2="6626120" | out: lpString1="6626120") returned="6626120" [0060.006] lstrcpynA (in: lpString1=0x663610, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0060.006] lstrcpynA (in: lpString1=0x663610, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0060.007] wsprintfA (in: param_1=0x663610, param_2="%d" | out: param_1="380") returned 3 [0060.007] lstrcpyA (in: lpString1=0x430800, lpString2="380" | out: lpString1="380") returned="380" [0060.007] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0060.007] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0060.007] lstrcpynA (in: lpString1=0x40ac38, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0060.007] lstrcpynA (in: lpString1=0x40b038, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0060.007] lstrcmpiA (lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", lpString2="") returned 1 [0060.007] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0060.007] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0060.007] lstrcpynA (in: lpString1=0x40b038, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" [0060.007] lstrcpynA (in: lpString1=0x40a438, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" [0060.007] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nssb673.tmp\\system.dll")) returned 0x2020 [0060.007] CreateFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nssb673.tmp\\system.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xffffffff [0060.007] lstrcpynA (in: lpString1=0x42e3c1, lpString2="380", iMaxLength=1024 | out: lpString1="380") returned="380" [0060.007] lstrlenA (lpString="380") returned 3 [0060.007] lstrcpynA (in: lpString1=0x66492c, lpString2="*380t255) \x09\x09\x09 p \x09 \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 .r5", iMaxLength=1024 | out: lpString1="*380t255) \x09\x09\x09 p \x09 \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 .r5") returned="*380t255) \x09\x09\x09 p \x09 \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 .r5" [0060.007] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0060.007] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0060.008] lstrcpynA (in: lpString1=0x40a838, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" [0060.008] lstrcpynA (in: lpString1=0x40a438, lpString2="Call", iMaxLength=1024 | out: lpString1="Call") returned="Call" [0060.008] GetModuleHandleA (lpModuleName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned 0x75230000 [0060.008] GetProcAddress (hModule=0x75230000, lpProcName="Call") returned 0x752316db [0060.008] lstrcpyA (in: lpString1=0x66cd18, lpString2="380t255" | out: lpString1="380t255") returned="380t255" [0060.008] lstrcpynA (in: lpString1=0x663610, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0060.008] GlobalSize (hMem=0x17c) returned 0x0 [0060.008] wsprintfA (in: param_1=0x663610, param_2="%d" | out: param_1="380") returned 3 [0060.008] lstrcpyA (in: lpString1=0x431400, lpString2="380" | out: lpString1="380") returned="380" [0060.008] lstrcpynA (in: lpString1=0x40a438, lpString2="OfSection", iMaxLength=1024 | out: lpString1="OfSection") returned="OfSection" [0060.009] lstrlenA (lpString="OfSection") returned 9 [0060.009] lstrcpynA (in: lpString1=0x431800, lpString2="OfSection", iMaxLength=1024 | out: lpString1="OfSection") returned="OfSection" [0060.009] lstrcpynA (in: lpString1=0x40a438, lpString2="ntdll::NtMapViewOfSection", iMaxLength=1024 | out: lpString1="ntdll::NtMapViewOfSection") returned="ntdll::NtMapViewOfSection" [0060.009] lstrlenA (lpString="ntdll::NtMapViewOfSection") returned 25 [0060.009] lstrcpynA (in: lpString1=0x431800, lpString2="ntdll::NtMapViewOfSection", iMaxLength=1024 | out: lpString1="ntdll::NtMapViewOfSection") returned="ntdll::NtMapViewOfSection" [0060.009] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0060.009] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0060.009] lstrcpynA (in: lpString1=0x40ac38, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0060.009] lstrcpynA (in: lpString1=0x40b038, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0060.009] lstrcmpiA (lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", lpString2="") returned 1 [0060.009] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0060.009] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0060.009] lstrcpynA (in: lpString1=0x40b038, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" [0060.009] lstrcpynA (in: lpString1=0x40a438, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" [0060.009] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nssb673.tmp\\system.dll")) returned 0x2020 [0060.009] CreateFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nssb673.tmp\\system.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xffffffff [0060.009] lstrcpynA (in: lpString1=0x66492c, lpString2="ntdll::NtMapViewOfSection(p \x09\x09\x09\x09\x09\x09 r2, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 \x09\x09 i\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 -1, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09p \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 r3, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09p \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x090, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 p \x09\x09\x09\x09\x09\x09\x09\x09\x09\x090, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09p\x09\x09\x09\x09\x09\x09\x09 0, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 p \x09\x09\x09\x09\x09\x09\x09\x09\x09 r4, \x09\x09\x09\x09\x09\x09\x09\x09\x09 i \x09\x092, \x09\x09\x09 p \x09\x09\x09\x09\x09\x09\x09 0, \x09\x09\x09\x09\x09\x09\x09\x09 i \x09\x09\x09\x09\x09\x09\x09 0x40)", iMaxLength=1024 | out: lpString1="ntdll::NtMapViewOfSection(p \x09\x09\x09\x09\x09\x09 r2, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 \x09\x09 i\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 -1, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09p \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 r3, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09p \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x090, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 p \x09\x09\x09\x09\x09\x09\x09\x09\x09\x090, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09p\x09\x09\x09\x09\x09\x09\x09 0, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 p \x09\x09\x09\x09\x09\x09\x09\x09\x09 r4, \x09\x09\x09\x09\x09\x09\x09\x09\x09 i \x09\x092, \x09\x09\x09 p \x09\x09\x09\x09\x09\x09\x09 0, \x09\x09\x09\x09\x09\x09\x09\x09 i \x09\x09\x09\x09\x09\x09\x09 0x40)") returned="ntdll::NtMapViewOfSection(p \x09\x09\x09\x09\x09\x09 r2, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 \x09\x09 i\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 -1, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09p \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 r3, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09p \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x090, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 p \x09\x09\x09\x09\x09\x09\x09\x09\x09\x090, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09p\x09\x09\x09\x09\x09\x09\x09 0, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 p \x09\x09\x09\x09\x09\x09\x09\x09\x09 r4, \x09\x09\x09\x09\x09\x09\x09\x09\x09 i \x09\x092, \x09\x09\x09 p \x09\x09\x09\x09\x09\x09\x09 0, \x09\x09\x09\x09\x09\x09\x09\x09 i \x09\x09\x09\x09\x09\x09\x09 0x40)" [0060.009] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0060.009] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0060.009] lstrcpynA (in: lpString1=0x40a838, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" [0060.010] lstrcpynA (in: lpString1=0x40a438, lpString2="Call", iMaxLength=1024 | out: lpString1="Call") returned="Call" [0060.010] GetModuleHandleA (lpModuleName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned 0x75230000 [0060.010] GetProcAddress (hModule=0x75230000, lpProcName="Call") returned 0x752316db [0060.010] lstrcpyA (in: lpString1=0x663a18, lpString2="ntdll" | out: lpString1="ntdll") returned="ntdll" [0060.010] lstrcpyA (in: lpString1=0x66c918, lpString2="ntdll" | out: lpString1="ntdll") returned="ntdll" [0060.010] lstrcpyA (in: lpString1=0x66cd18, lpString2="NtMapViewOfSection" | out: lpString1="NtMapViewOfSection") returned="NtMapViewOfSection" [0060.010] GetModuleHandleA (lpModuleName="ntdll") returned 0x77c40000 [0060.010] GetProcAddress (hModule=0x77c40000, lpProcName="NtMapViewOfSection") returned 0x77c5fc40 [0060.010] lstrcpynA (in: lpString1=0x663610, lpString2="380", iMaxLength=1024 | out: lpString1="380") returned="380" [0060.011] lstrcpynA (in: lpString1=0x663610, lpString2="6626152", iMaxLength=1024 | out: lpString1="6626152") returned="6626152" [0060.011] lstrcpynA (in: lpString1=0x66ddc0, lpString2="6626168", iMaxLength=1024 | out: lpString1="6626168") returned="6626168" [0060.011] lstrcpynA (in: lpString1=0x663610, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0060.011] NtMapViewOfSection (in: SectionHandle=0x17c, ProcessHandle=0xffffffff, BaseAddress=0x651b68*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x651b78*=0x0, InheritDisposition=0x2, AllocationType=0x0, AccessProtection=0x40 | out: BaseAddress=0x651b68*=0x2a0000, SectionOffset=0x0, ViewSize=0x651b78*=0xf000) returned 0x0 [0060.012] wsprintfA (in: param_1=0x663610, param_2="%d" | out: param_1="64") returned 2 [0060.012] wsprintfA (in: param_1=0x663610, param_2="%d" | out: param_1="0") returned 1 [0060.012] wsprintfA (in: param_1=0x663610, param_2="%d" | out: param_1="2") returned 1 [0060.012] wsprintfA (in: param_1=0x663610, param_2="%d" | out: param_1="6626168") returned 7 [0060.012] wsprintfA (in: param_1=0x663610, param_2="%d" | out: param_1="0") returned 1 [0060.012] wsprintfA (in: param_1=0x663610, param_2="%d" | out: param_1="0") returned 1 [0060.012] wsprintfA (in: param_1=0x663610, param_2="%d" | out: param_1="0") returned 1 [0060.012] wsprintfA (in: param_1=0x663610, param_2="%d" | out: param_1="6626152") returned 7 [0060.012] wsprintfA (in: param_1=0x663610, param_2="%d" | out: param_1="-1") returned 2 [0060.012] wsprintfA (in: param_1=0x663610, param_2="%d" | out: param_1="380") returned 3 [0060.012] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0060.012] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0060.012] lstrcpynA (in: lpString1=0x40ac38, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0060.012] lstrcpynA (in: lpString1=0x40b038, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0060.012] lstrcmpiA (lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", lpString2="") returned 1 [0060.012] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0060.012] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0060.012] lstrcpynA (in: lpString1=0x40b038, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" [0060.013] lstrcpynA (in: lpString1=0x40a438, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" [0060.013] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nssb673.tmp\\system.dll")) returned 0x2020 [0060.013] CreateFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nssb673.tmp\\system.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xffffffff [0060.013] lstrcpynA (in: lpString1=0x42e3c1, lpString2="6626152", iMaxLength=1024 | out: lpString1="6626152") returned="6626152" [0060.013] lstrlenA (lpString="6626152") returned 7 [0060.013] lstrcpynA (in: lpString1=0x66492c, lpString2="*6626152\x09\x09\x09\x09\x09\x09\x09\x09\x09 (p \x09\x09\x09\x09\x09\x09\x09\x09 .r11)", iMaxLength=1024 | out: lpString1="*6626152\x09\x09\x09\x09\x09\x09\x09\x09\x09 (p \x09\x09\x09\x09\x09\x09\x09\x09 .r11)") returned="*6626152\x09\x09\x09\x09\x09\x09\x09\x09\x09 (p \x09\x09\x09\x09\x09\x09\x09\x09 .r11)" [0060.013] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0060.014] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0060.014] lstrcpynA (in: lpString1=0x40a838, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" [0060.014] lstrcpynA (in: lpString1=0x40a438, lpString2="Call", iMaxLength=1024 | out: lpString1="Call") returned="Call" [0060.014] GetModuleHandleA (lpModuleName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned 0x75230000 [0060.014] GetProcAddress (hModule=0x75230000, lpProcName="Call") returned 0x752316db [0060.014] lstrcpyA (in: lpString1=0x66cd18, lpString2="6626152\x09\x09\x09\x09\x09\x09\x09\x09\x09 " | out: lpString1="6626152\x09\x09\x09\x09\x09\x09\x09\x09\x09 ") returned="6626152\x09\x09\x09\x09\x09\x09\x09\x09\x09 " [0060.014] lstrcpynA (in: lpString1=0x663610, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0060.015] lstrcpynA (in: lpString1=0x663610, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0060.015] wsprintfA (in: param_1=0x663610, param_2="%d" | out: param_1="2752512") returned 7 [0060.015] lstrcpyA (in: lpString1=0x432c00, lpString2="2752512" | out: lpString1="2752512") returned="2752512" [0060.015] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0060.015] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0060.015] lstrcpynA (in: lpString1=0x40ac38, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0060.015] lstrcpynA (in: lpString1=0x40b038, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0060.015] lstrcmpiA (lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", lpString2="") returned 1 [0060.015] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0060.015] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0060.015] lstrcpynA (in: lpString1=0x40b038, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" [0060.015] lstrcpynA (in: lpString1=0x40a438, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" [0060.015] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nssb673.tmp\\system.dll")) returned 0x2020 [0060.015] CreateFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nssb673.tmp\\system.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xffffffff [0060.016] lstrcpynA (in: lpString1=0x66492c, lpString2="kernel32::ReadFile(i \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 r10, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 p \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 r11, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 i \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 61042, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 \x09\x09\x09\x09\x09\x09\x09\x09 t., \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 n)", iMaxLength=1024 | out: lpString1="kernel32::ReadFile(i \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 r10, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 p \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 r11, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 i \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 61042, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 \x09\x09\x09\x09\x09\x09\x09\x09 t., \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 n)") returned="kernel32::ReadFile(i \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 r10, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 p \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 r11, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 i \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 61042, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 \x09\x09\x09\x09\x09\x09\x09\x09 t., \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 n)" [0060.016] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0060.016] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0060.016] lstrcpynA (in: lpString1=0x40a838, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" [0060.016] lstrcpynA (in: lpString1=0x40a438, lpString2="Call", iMaxLength=1024 | out: lpString1="Call") returned="Call" [0060.016] GetModuleHandleA (lpModuleName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned 0x75230000 [0060.016] GetProcAddress (hModule=0x75230000, lpProcName="Call") returned 0x752316db [0060.016] lstrcpyA (in: lpString1=0x663a18, lpString2="kernel32" | out: lpString1="kernel32") returned="kernel32" [0060.016] lstrcpyA (in: lpString1=0x66c918, lpString2="kernel32" | out: lpString1="kernel32") returned="kernel32" [0060.016] lstrcpyA (in: lpString1=0x66cd18, lpString2="ReadFile" | out: lpString1="ReadFile") returned="ReadFile" [0060.017] GetModuleHandleA (lpModuleName="kernel32") returned 0x76d30000 [0060.017] GetProcAddress (hModule=0x76d30000, lpProcName="ReadFile") returned 0x76d43ed3 [0060.017] lstrlenA (lpString="ReadFile") returned 8 [0060.017] GetProcAddress (hModule=0x76d30000, lpProcName="ReadFileA") returned 0x0 [0060.017] lstrcpynA (in: lpString1=0x664228, lpString2="28", iMaxLength=1024 | out: lpString1="28") returned="28" [0060.017] lstrcpynA (in: lpString1=0x664228, lpString2="2752512", iMaxLength=1024 | out: lpString1="2752512") returned="2752512" [0060.017] lstrcpynA (in: lpString1=0x663610, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0060.017] lstrcpynA (in: lpString1=0x663a18, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0060.017] lstrcpynA (in: lpString1=0x663610, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0060.018] lstrcpynA (in: lpString1=0x663610, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0060.018] ReadFile (in: hFile=0x1c, lpBuffer=0x2a0000, nNumberOfBytesToRead=0xee72, lpNumberOfBytesRead=0x663a18, lpOverlapped=0x0 | out: lpBuffer=0x2a0000*, lpNumberOfBytesRead=0x663a18*=0xee72, lpOverlapped=0x0) returned 1 [0060.018] lstrcpynA (in: lpString1=0x663610, lpString2="rî", iMaxLength=1024 | out: lpString1="rî") returned="rî" [0060.019] wsprintfA (in: param_1=0x663610, param_2="%d" | out: param_1="61042") returned 5 [0060.019] wsprintfA (in: param_1=0x663610, param_2="%d" | out: param_1="2752512") returned 7 [0060.019] wsprintfA (in: param_1=0x663610, param_2="%d" | out: param_1="28") returned 2 [0060.019] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0060.019] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0060.019] lstrcpynA (in: lpString1=0x40ac38, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0060.019] lstrcpynA (in: lpString1=0x40b038, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0060.019] lstrcmpiA (lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", lpString2="") returned 1 [0060.019] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0060.019] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0060.019] lstrcpynA (in: lpString1=0x40b038, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" [0060.019] lstrcpynA (in: lpString1=0x40a438, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" [0060.019] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nssb673.tmp\\system.dll")) returned 0x2020 [0060.019] CreateFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nssb673.tmp\\system.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xffffffff [0060.019] lstrcpynA (in: lpString1=0x66492c, lpString2="kernel32::CloseHandle(i \x09\x09\x09\x09\x09\x09 \x09 r10)", iMaxLength=1024 | out: lpString1="kernel32::CloseHandle(i \x09\x09\x09\x09\x09\x09 \x09 r10)") returned="kernel32::CloseHandle(i \x09\x09\x09\x09\x09\x09 \x09 r10)" [0060.020] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0060.020] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0060.020] lstrcpynA (in: lpString1=0x40a838, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" [0060.020] lstrcpynA (in: lpString1=0x40a438, lpString2="Call", iMaxLength=1024 | out: lpString1="Call") returned="Call" [0060.020] GetModuleHandleA (lpModuleName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned 0x75230000 [0060.020] GetProcAddress (hModule=0x75230000, lpProcName="Call") returned 0x752316db [0060.020] lstrcpyA (in: lpString1=0x663a18, lpString2="kernel32" | out: lpString1="kernel32") returned="kernel32" [0060.020] lstrcpyA (in: lpString1=0x66c918, lpString2="kernel32" | out: lpString1="kernel32") returned="kernel32" [0060.020] lstrcpyA (in: lpString1=0x66cd18, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0060.020] GetModuleHandleA (lpModuleName="kernel32") returned 0x76d30000 [0060.021] GetProcAddress (hModule=0x76d30000, lpProcName="CloseHandle") returned 0x76d41410 [0060.021] lstrcpynA (in: lpString1=0x663610, lpString2="28", iMaxLength=1024 | out: lpString1="28") returned="28" [0060.021] lstrcpynA (in: lpString1=0x663610, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0060.021] CloseHandle (hObject=0x1c) returned 1 [0060.021] wsprintfA (in: param_1=0x663610, param_2="%d" | out: param_1="28") returned 2 [0060.021] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0060.021] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0060.021] lstrcpynA (in: lpString1=0x40ac38, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0060.021] lstrcpynA (in: lpString1=0x40b038, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0060.021] lstrcmpiA (lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", lpString2="") returned 1 [0060.022] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0060.022] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0060.022] lstrcpynA (in: lpString1=0x40b038, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" [0060.022] lstrcpynA (in: lpString1=0x40a438, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" [0060.022] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nssb673.tmp\\system.dll")) returned 0x2020 [0060.022] CreateFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nssb673.tmp\\system.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xffffffff [0060.022] lstrcpynA (in: lpString1=0x66492c, lpString2="47183", iMaxLength=1024 | out: lpString1="47183") returned="47183" [0060.022] lstrcpynA (in: lpString1=0x664d74, lpString2="+", iMaxLength=1024 | out: lpString1="+") returned="+" [0060.022] lstrcpynA (in: lpString1=0x42e3c0, lpString2="2752512", iMaxLength=1024 | out: lpString1="2752512") returned="2752512" [0060.022] lstrlenA (lpString="2752512") returned 7 [0060.022] lstrcpynA (in: lpString1=0x6651bc, lpString2="2752512", iMaxLength=1024 | out: lpString1="2752512") returned="2752512" [0060.022] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0060.022] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0060.022] lstrcpynA (in: lpString1=0x40a838, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" [0060.022] lstrcpynA (in: lpString1=0x40a438, lpString2="Int64Op", iMaxLength=1024 | out: lpString1="Int64Op") returned="Int64Op" [0060.023] GetModuleHandleA (lpModuleName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned 0x75230000 [0060.023] GetProcAddress (hModule=0x75230000, lpProcName="Int64Op") returned 0x75231837 [0060.023] lstrcpynA (in: lpString1=0x66492c, lpString2="2799695", iMaxLength=1024 | out: lpString1="2799695") returned="2799695" [0060.023] lstrcpynA (in: lpString1=0x433000, lpString2="2799695", iMaxLength=1024 | out: lpString1="2799695") returned="2799695" [0060.025] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0060.025] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0060.025] lstrcpynA (in: lpString1=0x40ac38, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0060.025] lstrcpynA (in: lpString1=0x40b038, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0060.025] lstrcmpiA (lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", lpString2="") returned 1 [0060.025] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0060.025] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0060.025] lstrcpynA (in: lpString1=0x40b038, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" [0060.026] lstrcpynA (in: lpString1=0x40a438, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" [0060.026] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nssb673.tmp\\system.dll")) returned 0x2020 [0060.026] CreateFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nssb673.tmp\\system.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xffffffff [0060.026] lstrcpynA (in: lpString1=0x66492c, lpString2="2853", iMaxLength=1024 | out: lpString1="2853") returned="2853" [0060.026] lstrcpynA (in: lpString1=0x664d74, lpString2="+", iMaxLength=1024 | out: lpString1="+") returned="+" [0060.026] lstrcpynA (in: lpString1=0x42e3c0, lpString2="2752512", iMaxLength=1024 | out: lpString1="2752512") returned="2752512" [0060.026] lstrlenA (lpString="2752512") returned 7 [0060.026] lstrcpynA (in: lpString1=0x6651bc, lpString2="2752512", iMaxLength=1024 | out: lpString1="2752512") returned="2752512" [0060.026] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0060.026] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0060.026] lstrcpynA (in: lpString1=0x40a838, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" [0060.026] lstrcpynA (in: lpString1=0x40a438, lpString2="Int64Op", iMaxLength=1024 | out: lpString1="Int64Op") returned="Int64Op" [0060.026] GetModuleHandleA (lpModuleName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned 0x75230000 [0060.027] GetProcAddress (hModule=0x75230000, lpProcName="Int64Op") returned 0x75231837 [0060.027] lstrcpynA (in: lpString1=0x66492c, lpString2="2755365", iMaxLength=1024 | out: lpString1="2755365") returned="2755365" [0060.027] lstrcpynA (in: lpString1=0x433400, lpString2="2755365", iMaxLength=1024 | out: lpString1="2755365") returned="2755365" [0060.027] lstrcpynA (in: lpString1=0x40a438, lpString2="(", iMaxLength=1024 | out: lpString1="(") returned="(" [0060.027] lstrlenA (lpString="(") returned 1 [0060.027] lstrcpynA (in: lpString1=0x431800, lpString2="(", iMaxLength=1024 | out: lpString1="(") returned="(" [0060.027] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0060.027] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0060.027] lstrcpynA (in: lpString1=0x40ac38, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0060.027] lstrcpynA (in: lpString1=0x40b038, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0060.027] lstrcmpiA (lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", lpString2="") returned 1 [0060.027] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0060.027] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0060.027] lstrcpynA (in: lpString1=0x40b038, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" [0060.027] lstrcpynA (in: lpString1=0x40a438, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" [0060.027] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nssb673.tmp\\system.dll")) returned 0x2020 [0060.027] CreateFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nssb673.tmp\\system.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xffffffff [0060.027] lstrcpynA (in: lpString1=0x66492c, lpString2="*(&t255) \x09\x09\x09\x09\x09\x09\x09\x09 p \x09\x09\x09\x09\x09\x09\x09.r5", iMaxLength=1024 | out: lpString1="*(&t255) \x09\x09\x09\x09\x09\x09\x09\x09 p \x09\x09\x09\x09\x09\x09\x09.r5") returned="*(&t255) \x09\x09\x09\x09\x09\x09\x09\x09 p \x09\x09\x09\x09\x09\x09\x09.r5" [0060.027] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0060.028] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0060.028] lstrcpynA (in: lpString1=0x40a838, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" [0060.028] lstrcpynA (in: lpString1=0x40a438, lpString2="Call", iMaxLength=1024 | out: lpString1="Call") returned="Call" [0060.028] GetModuleHandleA (lpModuleName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned 0x75230000 [0060.028] GetProcAddress (hModule=0x75230000, lpProcName="Call") returned 0x752316db [0060.028] lstrcpyA (in: lpString1=0x66cd18, lpString2="" | out: lpString1="") returned="" [0060.028] lstrcpynA (in: lpString1=0x663610, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0060.028] lstrcpynA (in: lpString1=0x663a18, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0060.028] lstrcpynA (in: lpString1=0x663610, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0060.028] lstrcpynA (in: lpString1=0x663e20, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0060.028] wsprintfA (in: param_1=0x663e20, param_2="%d" | out: param_1="6698512") returned 7 [0060.028] lstrcpyA (in: lpString1=0x431400, lpString2="6698512" | out: lpString1="6698512") returned="6698512" [0060.029] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0060.029] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0060.029] lstrcpynA (in: lpString1=0x40ac38, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0060.029] lstrcpynA (in: lpString1=0x40b038, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0060.029] lstrcmpiA (lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", lpString2="") returned 1 [0060.029] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0060.029] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0060.029] lstrcpynA (in: lpString1=0x40b038, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" [0060.029] lstrcpynA (in: lpString1=0x40a438, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" [0060.029] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nssb673.tmp\\system.dll")) returned 0x2020 [0060.029] CreateFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nssb673.tmp\\system.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xffffffff [0060.029] lstrcpynA (in: lpString1=0x66492c, lpString2="user32::wsprintf(p \x09\x09\x09\x09 \x09\x09\x09\x09\x09\x09\x09\x09r5, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09t '::%d%s' , \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 \x09\x09\x09i \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 \x09\x09\x09\x09\x09 r12, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 \x09 t \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09'(')", iMaxLength=1024 | out: lpString1="user32::wsprintf(p \x09\x09\x09\x09 \x09\x09\x09\x09\x09\x09\x09\x09r5, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09t '::%d%s' , \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 \x09\x09\x09i \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 \x09\x09\x09\x09\x09 r12, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 \x09 t \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09'(')") returned="user32::wsprintf(p \x09\x09\x09\x09 \x09\x09\x09\x09\x09\x09\x09\x09r5, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09t '::%d%s' , \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 \x09\x09\x09i \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 \x09\x09\x09\x09\x09 r12, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 \x09 t \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09'(')" [0060.029] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0060.030] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0060.030] lstrcpynA (in: lpString1=0x40a838, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" [0060.030] lstrcpynA (in: lpString1=0x40a438, lpString2="Call", iMaxLength=1024 | out: lpString1="Call") returned="Call" [0060.030] GetModuleHandleA (lpModuleName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned 0x75230000 [0060.030] GetProcAddress (hModule=0x75230000, lpProcName="Call") returned 0x752316db [0060.030] lstrcpyA (in: lpString1=0x663b20, lpString2="user32" | out: lpString1="user32") returned="user32" [0060.030] lstrcpyA (in: lpString1=0x66c918, lpString2="user32" | out: lpString1="user32") returned="user32" [0060.030] lstrcpyA (in: lpString1=0x66cd18, lpString2="wsprintf" | out: lpString1="wsprintf") returned="wsprintf" [0060.030] lstrcpynA (in: lpString1=0x663f28, lpString2="::%d%s", iMaxLength=1024 | out: lpString1="::%d%s") returned="::%d%s" [0060.030] lstrcpynA (in: lpString1=0x66ddc0, lpString2="(", iMaxLength=1024 | out: lpString1="(") returned="(" [0060.030] GetModuleHandleA (lpModuleName="user32") returned 0x77130000 [0060.030] GetProcAddress (hModule=0x77130000, lpProcName="wsprintf") returned 0x0 [0060.031] lstrlenA (lpString="wsprintf") returned 8 [0060.031] GetProcAddress (hModule=0x77130000, lpProcName="wsprintfA") returned 0x7715ae5f [0060.031] lstrcpynA (in: lpString1=0x663718, lpString2="6698512", iMaxLength=1024 | out: lpString1="6698512") returned="6698512" [0060.031] lstrcpynA (in: lpString1=0x663718, lpString2="::%d%s", iMaxLength=1024 | out: lpString1="::%d%s") returned="::%d%s" [0060.031] lstrcpynA (in: lpString1=0x663b20, lpString2="2799695", iMaxLength=1024 | out: lpString1="2799695") returned="2799695" [0060.031] lstrcpynA (in: lpString1=0x663b20, lpString2="(", iMaxLength=1024 | out: lpString1="(") returned="(" [0060.031] lstrcpynA (in: lpString1=0x663f28, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0060.031] wsprintfA (in: param_1=0x663610, param_2="::%d%s" | out: param_1="::2799695(") returned 10 [0060.031] lstrcpynA (in: lpString1=0x663f28, lpString2="(", iMaxLength=1024 | out: lpString1="(") returned="(" [0060.031] wsprintfA (in: param_1=0x663f28, param_2="%d" | out: param_1="2799695") returned 7 [0060.031] lstrcpynA (in: lpString1=0x663f28, lpString2="::%d%s", iMaxLength=1024 | out: lpString1="::%d%s") returned="::%d%s" [0060.031] wsprintfA (in: param_1=0x663f28, param_2="%d" | out: param_1="6698512") returned 7 [0060.031] FreeLibrary (hLibModule=0x663718) returned 0 [0060.031] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0060.032] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0060.032] lstrcpynA (in: lpString1=0x40ac38, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0060.032] lstrcpynA (in: lpString1=0x40b038, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0060.032] lstrcmpiA (lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", lpString2="") returned 1 [0060.032] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0060.032] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0060.032] lstrcpynA (in: lpString1=0x40b038, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" [0060.032] lstrcpynA (in: lpString1=0x40a438, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" [0060.032] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nssb673.tmp\\system.dll")) returned 0x2020 [0060.032] CreateFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nssb673.tmp\\system.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xffffffff [0060.032] lstrcpynA (in: lpString1=0x42e3c1, lpString2="6698512", iMaxLength=1024 | out: lpString1="6698512") returned="6698512" [0060.032] lstrlenA (lpString="6698512") returned 7 [0060.032] lstrcpynA (in: lpString1=0x66492c, lpString2="*6698512(&t255 \x09\x09\x09\x09\x09\x09\x09.r5)", iMaxLength=1024 | out: lpString1="*6698512(&t255 \x09\x09\x09\x09\x09\x09\x09.r5)") returned="*6698512(&t255 \x09\x09\x09\x09\x09\x09\x09.r5)" [0060.032] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0060.032] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0060.032] lstrcpynA (in: lpString1=0x40a838, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" [0060.032] lstrcpynA (in: lpString1=0x40a438, lpString2="Call", iMaxLength=1024 | out: lpString1="Call") returned="Call" [0060.033] GetModuleHandleA (lpModuleName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned 0x75230000 [0060.033] GetProcAddress (hModule=0x75230000, lpProcName="Call") returned 0x752316db [0060.033] lstrcpyA (in: lpString1=0x66cd18, lpString2="6698512" | out: lpString1="6698512") returned="6698512" [0060.033] lstrcpynA (in: lpString1=0x663718, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0060.033] lstrcpynA (in: lpString1=0x663b20, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0060.033] lstrcpynA (in: lpString1=0x663718, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0060.033] lstrcpynA (in: lpString1=0x663718, lpString2="::2799695(", iMaxLength=1024 | out: lpString1="::2799695(") returned="::2799695(" [0060.033] lstrcpyA (in: lpString1=0x431400, lpString2="::2799695(" | out: lpString1="::2799695(") returned="::2799695(" [0060.033] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0060.033] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0060.033] lstrcpynA (in: lpString1=0x40ac38, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0060.033] lstrcpynA (in: lpString1=0x40b038, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0060.033] lstrcmpiA (lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", lpString2="") returned 1 [0060.033] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0060.034] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0060.034] lstrcpynA (in: lpString1=0x40b038, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" [0060.034] lstrcpynA (in: lpString1=0x40a438, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" [0060.034] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nssb673.tmp\\system.dll")) returned 0x2020 [0060.034] CreateFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nssb673.tmp\\system.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xffffffff [0060.034] lstrcpynA (in: lpString1=0x42e3c2, lpString2="2799695", iMaxLength=1024 | out: lpString1="2799695") returned="2799695" [0060.034] lstrlenA (lpString="2799695") returned 7 [0060.034] lstrcpynA (in: lpString1=0x66492c, lpString2="::2799695(p\x09\x09\x09\x09\x09\x09\x09\x09 r13,\x09\x09\x09\x09\x09\x09\x09 i \x09\x09\x09\x09\x09\x09\x09\x0942512)", iMaxLength=1024 | out: lpString1="::2799695(p\x09\x09\x09\x09\x09\x09\x09\x09 r13,\x09\x09\x09\x09\x09\x09\x09 i \x09\x09\x09\x09\x09\x09\x09\x0942512)") returned="::2799695(p\x09\x09\x09\x09\x09\x09\x09\x09 r13,\x09\x09\x09\x09\x09\x09\x09 i \x09\x09\x09\x09\x09\x09\x09\x0942512)" [0060.034] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp" [0060.034] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp") returned 48 [0060.034] lstrcpynA (in: lpString1=0x40a838, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll" [0060.034] lstrcpynA (in: lpString1=0x40a438, lpString2="Call", iMaxLength=1024 | out: lpString1="Call") returned="Call" [0060.034] GetModuleHandleA (lpModuleName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nssB673.tmp\\System.dll") returned 0x75230000 [0060.034] GetProcAddress (hModule=0x75230000, lpProcName="Call") returned 0x752316db [0060.034] lstrcpyA (in: lpString1=0x66c918, lpString2="" | out: lpString1="") returned="" [0060.035] lstrcpyA (in: lpString1=0x66cd18, lpString2="2799695" | out: lpString1="2799695") returned="2799695" [0060.035] lstrcpynA (in: lpString1=0x663718, lpString2="2755365", iMaxLength=1024 | out: lpString1="2755365") returned="2755365" [0060.035] lstrcpynA (in: lpString1=0x663718, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0069.097] LoadLibraryW (lpLibFileName="advapi32.dll") returned 0x77710000 [0069.101] LoadLibraryW (lpLibFileName="advapi32.dll") returned 0x77710000 [0069.102] CryptAcquireContextW (in: phProv=0x18f9ec, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x18f9ec*=0x6620d0) returned 1 [0069.453] CryptCreateHash (in: hProv=0x6620d0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x18f9f0 | out: phHash=0x18f9f0) returned 1 [0069.454] CryptHashData (hHash=0x653678, pbData=0x18fb24, dwDataLen=0x10, dwFlags=0x1) returned 1 [0069.454] CryptDeriveKey (in: hProv=0x6620d0, Algid=0x6610, hBaseData=0x653678, dwFlags=0x1, phKey=0x18f9e8 | out: phKey=0x18f9e8*=0x663bb8) returned 1 [0069.455] CryptDestroyHash (hHash=0x653678) returned 1 [0069.455] VirtualAlloc (lpAddress=0x0, dwSize=0xa9f8, flAllocationType=0x3000, flProtect=0x4) returned 0x3f0000 [0069.456] CryptDecrypt (in: hKey=0x663bb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3f0000, pdwDataLen=0x18fb40 | out: pbData=0x3f0000, pdwDataLen=0x18fb40) returned 1 [0069.458] CryptDestroyKey (hKey=0x663bb8) returned 1 [0069.458] CryptReleaseContext (hProv=0x6620d0, dwFlags=0x0) returned 1 [0069.458] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18f400, nSize=0x103 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QDgotnX2VapbkvCb.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qdgotnx2vapbkvcb.exe")) returned 0x3a [0069.458] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QDgotnX2VapbkvCb.exe\" " [0069.458] CreateProcessW (in: lpApplicationName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QDgotnX2VapbkvCb.exe", lpCommandLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QDgotnX2VapbkvCb.exe\" ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000004, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18f8d4*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18f94c | out: lpCommandLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QDgotnX2VapbkvCb.exe\" ", lpProcessInformation=0x18f94c*(hProcess=0x184, hThread=0x1c, dwProcessId=0x290, dwThreadId=0x7b0)) returned 1 [0069.469] GetThreadContext (in: hThread=0x1c, lpContext=0x18f608 | out: lpContext=0x18f608*(ContextFlags=0x10007, Dr0=0x8, Dr1=0x663cb0, Dr2=0x18f624, Dr3=0x7505605c, Dr6=0x663cb0, Dr7=0x0, FloatSave.ControlWord=0x18f634, FloatSave.StatusWord=0x7505600e, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x663cb0, FloatSave.ErrorSelector=0x18f84c, FloatSave.DataOffset=0x75078684, FloatSave.DataSelector=0xe33f0ca4, FloatSave.RegisterArea=([0]=0x94, [1]=0xc, [2]=0x3f, [3]=0xe3, [4]=0xe8, [5]=0xf9, [6]=0x18, [7]=0x0, [8]=0xb8, [9]=0x3b, [10]=0x66, [11]=0x0, [12]=0xc6, [13]=0x86, [14]=0x7, [15]=0x75, [16]=0xe8, [17]=0xf9, [18]=0x18, [19]=0x0, [20]=0x10, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x1, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0xa8, [33]=0x38, [34]=0x66, [35]=0x0, [36]=0x10, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x10, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x3b, [46]=0x66, [47]=0x0, [48]=0x20, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x4a, [53]=0x54, [54]=0x6, [55]=0x75, [56]=0x9c, [57]=0x3d, [58]=0x66, [59]=0x0, [60]=0xaa, [61]=0xdc, [62]=0x7, [63]=0x75, [64]=0x0, [65]=0xa6, [66]=0x3f, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x7efde000, Edx=0x0, Ecx=0x0, Eax=0x403348, Ebp=0x0, Eip=0x77c501c4, SegCs=0x23, EFlags=0x202, Esp=0x18fff0, SegSs=0x2b, ExtendedRegisters=([0]=0xc6, [1]=0xf7, [2]=0x18, [3]=0x0, [4]=0x29, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x9, [11]=0x75, [12]=0xcc, [13]=0x26, [14]=0xa, [15]=0x75, [16]=0x9b, [17]=0x1, [18]=0xc7, [19]=0x77, [20]=0x75, [21]=0x67, [22]=0xcd, [23]=0x77, [24]=0xc4, [25]=0xf7, [26]=0x18, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x63, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x63, [35]=0x0, [36]=0xa0, [37]=0x38, [38]=0x66, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x63, [43]=0x0, [44]=0xc8, [45]=0x20, [46]=0x66, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x5, [53]=0x0, [54]=0x0, [55]=0x5, [56]=0x78, [57]=0x36, [58]=0x65, [59]=0x0, [60]=0x58, [61]=0x21, [62]=0x66, [63]=0x0, [64]=0xe8, [65]=0x18, [66]=0x65, [67]=0x0, [68]=0x30, [69]=0x77, [70]=0x64, [71]=0x0, [72]=0x28, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x63, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x40, [83]=0x0, [84]=0xc8, [85]=0x20, [86]=0x66, [87]=0x0, [88]=0x1c, [89]=0xf8, [90]=0x18, [91]=0x0, [92]=0x9e, [93]=0x38, [94]=0xc7, [95]=0x77, [96]=0x38, [97]=0x1, [98]=0x63, [99]=0x0, [100]=0x7a, [101]=0x38, [102]=0xc7, [103]=0x77, [104]=0xd, [105]=0x68, [106]=0xcd, [107]=0x77, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x63, [115]=0x0, [116]=0xd0, [117]=0x20, [118]=0x66, [119]=0x0, [120]=0xe8, [121]=0xf6, [122]=0x18, [123]=0x0, [124]=0xc4, [125]=0xf7, [126]=0x18, [127]=0x0, [128]=0x10, [129]=0xf8, [130]=0x18, [131]=0x0, [132]=0x78, [133]=0x36, [134]=0x65, [135]=0x0, [136]=0x0, [137]=0x3b, [138]=0x66, [139]=0x0, [140]=0x50, [141]=0x1, [142]=0x63, [143]=0x0, [144]=0xa8, [145]=0x38, [146]=0x66, [147]=0x0, [148]=0x50, [149]=0x1, [150]=0x63, [151]=0x0, [152]=0x50, [153]=0x1, [154]=0x63, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x63, [159]=0x0, [160]=0x50, [161]=0x1, [162]=0x63, [163]=0x0, [164]=0x50, [165]=0x1, [166]=0x63, [167]=0x0, [168]=0x2, [169]=0x0, [170]=0x0, [171]=0x2, [172]=0x50, [173]=0x1, [174]=0x63, [175]=0x0, [176]=0x2, [177]=0x0, [178]=0x0, [179]=0x2, [180]=0x39, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x39, [185]=0x0, [186]=0x0, [187]=0x39, [188]=0x16, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x3, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x8, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x3, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x3, [205]=0x1, [206]=0x0, [207]=0x0, [208]=0x16, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x39, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x39, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x45, [221]=0x2, [222]=0x0, [223]=0x47, [224]=0x16, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0xc4, [229]=0xf7, [230]=0x18, [231]=0x0, [232]=0xc0, [233]=0xed, [234]=0x66, [235]=0x0, [236]=0x74, [237]=0x1, [238]=0x63, [239]=0x0, [240]=0x4c, [241]=0x36, [242]=0x63, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x78, [249]=0x1, [250]=0x63, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x50, [257]=0x1, [258]=0x63, [259]=0x0, [260]=0xa8, [261]=0x38, [262]=0x66, [263]=0x0, [264]=0x0, [265]=0x3b, [266]=0x66, [267]=0x0, [268]=0xd0, [269]=0x20, [270]=0x66, [271]=0x0, [272]=0xa8, [273]=0x38, [274]=0x66, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x16, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x88, [289]=0x1b, [290]=0x0, [291]=0x1, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0xb0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x27, [301]=0x0, [302]=0x1, [303]=0x1, [304]=0x3c, [305]=0xf7, [306]=0x18, [307]=0x0, [308]=0xcd, [309]=0x1e, [310]=0xcb, [311]=0x77, [312]=0x74, [313]=0xf8, [314]=0x18, [315]=0x0, [316]=0xcd, [317]=0x1e, [318]=0xcb, [319]=0x77, [320]=0x51, [321]=0x58, [322]=0x13, [323]=0x0, [324]=0xfe, [325]=0xff, [326]=0xff, [327]=0xff, [328]=0x7a, [329]=0x38, [330]=0xc7, [331]=0x77, [332]=0x72, [333]=0x34, [334]=0xc7, [335]=0x77, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0xd0, [341]=0x20, [342]=0x66, [343]=0x0, [344]=0xd0, [345]=0x20, [346]=0x66, [347]=0x0, [348]=0x1, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0xc8, [357]=0x20, [358]=0x66, [359]=0x0, [360]=0x84, [361]=0xf8, [362]=0x18, [363]=0x0, [364]=0x88, [365]=0x3e, [366]=0xc2, [367]=0x76, [368]=0x0, [369]=0x0, [370]=0x63, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x9f, [377]=0x3f, [378]=0xc2, [379]=0x76, [380]=0xfc, [381]=0xfd, [382]=0x9a, [383]=0x45, [384]=0x1, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0xd0, [389]=0x20, [390]=0x66, [391]=0x0, [392]=0x48, [393]=0x21, [394]=0x66, [395]=0x0, [396]=0x6c, [397]=0xf8, [398]=0x18, [399]=0x0, [400]=0x0, [401]=0x15, [402]=0x5, [403]=0x75, [404]=0x88, [405]=0x1b, [406]=0x65, [407]=0x0, [408]=0x50, [409]=0xf8, [410]=0x18, [411]=0x0, [412]=0x4a, [413]=0x5a, [414]=0x5, [415]=0x75, [416]=0xb0, [417]=0xf8, [418]=0x18, [419]=0x0, [420]=0xe0, [421]=0x5e, [422]=0xc4, [423]=0x76, [424]=0x40, [425]=0x7c, [426]=0x46, [427]=0x33, [428]=0xfe, [429]=0xff, [430]=0xff, [431]=0xff, [432]=0x9f, [433]=0x3f, [434]=0xc2, [435]=0x76, [436]=0x6c, [437]=0x2f, [438]=0x9, [439]=0x75, [440]=0xb3, [441]=0x2f, [442]=0x9, [443]=0x75, [444]=0x9d, [445]=0x3d, [446]=0x0, [447]=0xf6, [448]=0xe8, [449]=0xf9, [450]=0x18, [451]=0x0, [452]=0x60, [453]=0xf9, [454]=0x18, [455]=0x0, [456]=0xc, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x1, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x90, [469]=0xf8, [470]=0x18, [471]=0x0, [472]=0xf8, [473]=0xf9, [474]=0x18, [475]=0x0, [476]=0xc4, [477]=0xff, [478]=0x18, [479]=0x0, [480]=0xa0, [481]=0x89, [482]=0x9, [483]=0x75, [484]=0xb5, [485]=0xd0, [486]=0x12, [487]=0x83, [488]=0xfe, [489]=0xff, [490]=0xff, [491]=0xff, [492]=0xb3, [493]=0x2f, [494]=0x9, [495]=0x75, [496]=0x38, [497]=0xc9, [498]=0x2a, [499]=0x0, [500]=0xd0, [501]=0x20, [502]=0x66, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x24, [509]=0xfb, [510]=0x18, [511]=0x0))) returned 1 [0069.475] ReadProcessMemory (in: hProcess=0x184, lpBaseAddress=0x7efde008, lpBuffer=0x18f948, nSize=0x4, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x18f948*, lpNumberOfBytesRead=0x0) returned 1 [0069.479] LoadLibraryW (lpLibFileName="advapi32.dll") returned 0x77710000 [0069.480] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x18f2a4 | out: Wow64Process=0x18f2a4) returned 1 [0069.483] LoadLibraryW (lpLibFileName="advapi32.dll") returned 0x77710000 [0069.484] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0069.484] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13b740 [0069.484] VirtualAlloc (lpAddress=0x0, dwSize=0x13b740, flAllocationType=0x3000, flProtect=0x4) returned 0x2780000 [0069.484] ReadFile (in: hFile=0x188, lpBuffer=0x2780000, nNumberOfBytesToRead=0x13b740, lpNumberOfBytesRead=0x18f2e0, lpOverlapped=0x0 | out: lpBuffer=0x2780000*, lpNumberOfBytesRead=0x18f2e0*=0x13b740, lpOverlapped=0x0) returned 1 [0069.629] VirtualAlloc (lpAddress=0x0, dwSize=0x180000, flAllocationType=0x3000, flProtect=0x4) returned 0x28c0000 [0069.641] CloseHandle (hObject=0x188) returned 1 [0069.641] VirtualFree (lpAddress=0x2780000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0069.642] VirtualFree (lpAddress=0x28c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0069.642] NtUnmapViewOfSection (ProcessHandle=0x184, BaseAddress=0x400000) returned 0x0 [0069.647] LoadLibraryW (lpLibFileName="advapi32.dll") returned 0x77710000 [0069.647] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x18f260 | out: Wow64Process=0x18f260) returned 1 [0069.650] LoadLibraryW (lpLibFileName="advapi32.dll") returned 0x77710000 [0069.651] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0069.651] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13b740 [0069.651] VirtualAlloc (lpAddress=0x0, dwSize=0x13b740, flAllocationType=0x3000, flProtect=0x4) returned 0x2780000 [0069.651] ReadFile (in: hFile=0x188, lpBuffer=0x2780000, nNumberOfBytesToRead=0x13b740, lpNumberOfBytesRead=0x18f29c, lpOverlapped=0x0 | out: lpBuffer=0x2780000*, lpNumberOfBytesRead=0x18f29c*=0x13b740, lpOverlapped=0x0) returned 1 [0069.665] VirtualAlloc (lpAddress=0x0, dwSize=0x180000, flAllocationType=0x3000, flProtect=0x4) returned 0x28c0000 [0069.677] CloseHandle (hObject=0x188) returned 1 [0069.677] VirtualFree (lpAddress=0x2780000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0069.678] VirtualFree (lpAddress=0x28c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0069.678] NtCreateSection (in: SectionHandle=0x18f3c4, DesiredAccess=0xe, ObjectAttributes=0x0, MaximumSize=0x18f918, SectionPageProtection=0x40, AllocationAttributes=0x8000000, FileHandle=0x0 | out: SectionHandle=0x18f3c4*=0x188) returned 0x0 [0069.681] LoadLibraryW (lpLibFileName="advapi32.dll") returned 0x77710000 [0069.681] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x18f234 | out: Wow64Process=0x18f234) returned 1 [0069.684] LoadLibraryW (lpLibFileName="advapi32.dll") returned 0x77710000 [0069.685] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0069.685] GetFileSize (in: hFile=0x180, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13b740 [0069.685] VirtualAlloc (lpAddress=0x0, dwSize=0x13b740, flAllocationType=0x3000, flProtect=0x4) returned 0x2780000 [0069.686] ReadFile (in: hFile=0x180, lpBuffer=0x2780000, nNumberOfBytesToRead=0x13b740, lpNumberOfBytesRead=0x18f270, lpOverlapped=0x0 | out: lpBuffer=0x2780000*, lpNumberOfBytesRead=0x18f270*=0x13b740, lpOverlapped=0x0) returned 1 [0069.695] VirtualAlloc (lpAddress=0x0, dwSize=0x180000, flAllocationType=0x3000, flProtect=0x4) returned 0x28c0000 [0069.708] CloseHandle (hObject=0x180) returned 1 [0069.708] VirtualFree (lpAddress=0x2780000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0069.708] VirtualFree (lpAddress=0x28c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0069.709] NtMapViewOfSection (in: SectionHandle=0x188, ProcessHandle=0x184, BaseAddress=0x18f3b8*=0x400000, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x18f3b0*=0x0, InheritDisposition=0x2, AllocationType=0x0, AccessProtection=0x40 | out: BaseAddress=0x18f3b8*=0x400000, SectionOffset=0x0, ViewSize=0x18f3b0*=0x1e000) returned 0x0 [0069.712] LoadLibraryW (lpLibFileName="advapi32.dll") returned 0x77710000 [0069.713] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x18f234 | out: Wow64Process=0x18f234) returned 1 [0069.716] LoadLibraryW (lpLibFileName="advapi32.dll") returned 0x77710000 [0069.716] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0069.716] GetFileSize (in: hFile=0x180, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13b740 [0069.717] VirtualAlloc (lpAddress=0x0, dwSize=0x13b740, flAllocationType=0x3000, flProtect=0x4) returned 0x2780000 [0069.717] ReadFile (in: hFile=0x180, lpBuffer=0x2780000, nNumberOfBytesToRead=0x13b740, lpNumberOfBytesRead=0x18f270, lpOverlapped=0x0 | out: lpBuffer=0x2780000*, lpNumberOfBytesRead=0x18f270*=0x13b740, lpOverlapped=0x0) returned 1 [0069.726] VirtualAlloc (lpAddress=0x0, dwSize=0x180000, flAllocationType=0x3000, flProtect=0x4) returned 0x28c0000 [0069.738] CloseHandle (hObject=0x180) returned 1 [0069.739] VirtualFree (lpAddress=0x2780000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0069.739] VirtualFree (lpAddress=0x28c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0069.739] NtMapViewOfSection (in: SectionHandle=0x188, ProcessHandle=0xffffffffffffffff, BaseAddress=0x18f3b8*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x18f3b0*=0x1e000, InheritDisposition=0x2, AllocationType=0x0, AccessProtection=0x40 | out: BaseAddress=0x18f3b8*=0x600000, SectionOffset=0x0, ViewSize=0x18f3b0*=0x1e000) returned 0x0 [0069.743] LoadLibraryW (lpLibFileName="advapi32.dll") returned 0x77710000 [0069.744] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x18f274 | out: Wow64Process=0x18f274) returned 1 [0069.747] LoadLibraryW (lpLibFileName="advapi32.dll") returned 0x77710000 [0069.747] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0069.747] GetFileSize (in: hFile=0x180, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13b740 [0069.747] VirtualAlloc (lpAddress=0x0, dwSize=0x13b740, flAllocationType=0x3000, flProtect=0x4) returned 0x2780000 [0069.748] ReadFile (in: hFile=0x180, lpBuffer=0x2780000, nNumberOfBytesToRead=0x13b740, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2780000*, lpNumberOfBytesRead=0x18f2b0*=0x13b740, lpOverlapped=0x0) returned 1 [0069.757] VirtualAlloc (lpAddress=0x0, dwSize=0x180000, flAllocationType=0x3000, flProtect=0x4) returned 0x28c0000 [0069.768] CloseHandle (hObject=0x180) returned 1 [0069.768] VirtualFree (lpAddress=0x2780000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0069.769] VirtualFree (lpAddress=0x28c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0069.769] NtWriteVirtualMemory (in: ProcessHandle=0x184, BaseAddress=0x7efde008, Buffer=0x18f960*, NumberOfBytesToWrite=0x4, NumberOfBytesWritten=0x18f3c8 | out: Buffer=0x18f960*, NumberOfBytesWritten=0x18f3c8*=0x4) returned 0x0 [0069.769] SetThreadContext (hThread=0x1c, lpContext=0x18f608*(ContextFlags=0x10007, Dr0=0x8, Dr1=0x663cb0, Dr2=0x18f624, Dr3=0x7505605c, Dr6=0x663cb0, Dr7=0x0, FloatSave.ControlWord=0x18f634, FloatSave.StatusWord=0x7505600e, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x663cb0, FloatSave.ErrorSelector=0x18f84c, FloatSave.DataOffset=0x75078684, FloatSave.DataSelector=0xe33f0ca4, FloatSave.RegisterArea=([0]=0x94, [1]=0xc, [2]=0x3f, [3]=0xe3, [4]=0xe8, [5]=0xf9, [6]=0x18, [7]=0x0, [8]=0xb8, [9]=0x3b, [10]=0x66, [11]=0x0, [12]=0xc6, [13]=0x86, [14]=0x7, [15]=0x75, [16]=0xe8, [17]=0xf9, [18]=0x18, [19]=0x0, [20]=0x10, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x1, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0xa8, [33]=0x38, [34]=0x66, [35]=0x0, [36]=0x10, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x10, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x3b, [46]=0x66, [47]=0x0, [48]=0x20, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x4a, [53]=0x54, [54]=0x6, [55]=0x75, [56]=0x9c, [57]=0x3d, [58]=0x66, [59]=0x0, [60]=0xaa, [61]=0xdc, [62]=0x7, [63]=0x75, [64]=0x0, [65]=0xa6, [66]=0x3f, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x7efde000, Edx=0x0, Ecx=0x0, Eax=0x405a20, Ebp=0x0, Eip=0x77c501c4, SegCs=0x23, EFlags=0x202, Esp=0x18fff0, SegSs=0x2b, ExtendedRegisters=([0]=0xc6, [1]=0xf7, [2]=0x18, [3]=0x0, [4]=0x29, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x9, [11]=0x75, [12]=0xcc, [13]=0x26, [14]=0xa, [15]=0x75, [16]=0x9b, [17]=0x1, [18]=0xc7, [19]=0x77, [20]=0x75, [21]=0x67, [22]=0xcd, [23]=0x77, [24]=0xc4, [25]=0xf7, [26]=0x18, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x63, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x63, [35]=0x0, [36]=0xa0, [37]=0x38, [38]=0x66, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x63, [43]=0x0, [44]=0xc8, [45]=0x20, [46]=0x66, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x5, [53]=0x0, [54]=0x0, [55]=0x5, [56]=0x78, [57]=0x36, [58]=0x65, [59]=0x0, [60]=0x58, [61]=0x21, [62]=0x66, [63]=0x0, [64]=0xe8, [65]=0x18, [66]=0x65, [67]=0x0, [68]=0x30, [69]=0x77, [70]=0x64, [71]=0x0, [72]=0x28, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x63, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x40, [83]=0x0, [84]=0xc8, [85]=0x20, [86]=0x66, [87]=0x0, [88]=0x1c, [89]=0xf8, [90]=0x18, [91]=0x0, [92]=0x9e, [93]=0x38, [94]=0xc7, [95]=0x77, [96]=0x38, [97]=0x1, [98]=0x63, [99]=0x0, [100]=0x7a, [101]=0x38, [102]=0xc7, [103]=0x77, [104]=0xd, [105]=0x68, [106]=0xcd, [107]=0x77, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x63, [115]=0x0, [116]=0xd0, [117]=0x20, [118]=0x66, [119]=0x0, [120]=0xe8, [121]=0xf6, [122]=0x18, [123]=0x0, [124]=0xc4, [125]=0xf7, [126]=0x18, [127]=0x0, [128]=0x10, [129]=0xf8, [130]=0x18, [131]=0x0, [132]=0x78, [133]=0x36, [134]=0x65, [135]=0x0, [136]=0x0, [137]=0x3b, [138]=0x66, [139]=0x0, [140]=0x50, [141]=0x1, [142]=0x63, [143]=0x0, [144]=0xa8, [145]=0x38, [146]=0x66, [147]=0x0, [148]=0x50, [149]=0x1, [150]=0x63, [151]=0x0, [152]=0x50, [153]=0x1, [154]=0x63, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x63, [159]=0x0, [160]=0x50, [161]=0x1, [162]=0x63, [163]=0x0, [164]=0x50, [165]=0x1, [166]=0x63, [167]=0x0, [168]=0x2, [169]=0x0, [170]=0x0, [171]=0x2, [172]=0x50, [173]=0x1, [174]=0x63, [175]=0x0, [176]=0x2, [177]=0x0, [178]=0x0, [179]=0x2, [180]=0x39, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x39, [185]=0x0, [186]=0x0, [187]=0x39, [188]=0x16, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x3, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x8, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x3, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x3, [205]=0x1, [206]=0x0, [207]=0x0, [208]=0x16, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x39, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x39, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x45, [221]=0x2, [222]=0x0, [223]=0x47, [224]=0x16, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0xc4, [229]=0xf7, [230]=0x18, [231]=0x0, [232]=0xc0, [233]=0xed, [234]=0x66, [235]=0x0, [236]=0x74, [237]=0x1, [238]=0x63, [239]=0x0, [240]=0x4c, [241]=0x36, [242]=0x63, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x78, [249]=0x1, [250]=0x63, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x50, [257]=0x1, [258]=0x63, [259]=0x0, [260]=0xa8, [261]=0x38, [262]=0x66, [263]=0x0, [264]=0x0, [265]=0x3b, [266]=0x66, [267]=0x0, [268]=0xd0, [269]=0x20, [270]=0x66, [271]=0x0, [272]=0xa8, [273]=0x38, [274]=0x66, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x16, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x88, [289]=0x1b, [290]=0x0, [291]=0x1, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0xb0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x27, [301]=0x0, [302]=0x1, [303]=0x1, [304]=0x3c, [305]=0xf7, [306]=0x18, [307]=0x0, [308]=0xcd, [309]=0x1e, [310]=0xcb, [311]=0x77, [312]=0x74, [313]=0xf8, [314]=0x18, [315]=0x0, [316]=0xcd, [317]=0x1e, [318]=0xcb, [319]=0x77, [320]=0x51, [321]=0x58, [322]=0x13, [323]=0x0, [324]=0xfe, [325]=0xff, [326]=0xff, [327]=0xff, [328]=0x7a, [329]=0x38, [330]=0xc7, [331]=0x77, [332]=0x72, [333]=0x34, [334]=0xc7, [335]=0x77, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0xd0, [341]=0x20, [342]=0x66, [343]=0x0, [344]=0xd0, [345]=0x20, [346]=0x66, [347]=0x0, [348]=0x1, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0xc8, [357]=0x20, [358]=0x66, [359]=0x0, [360]=0x84, [361]=0xf8, [362]=0x18, [363]=0x0, [364]=0x88, [365]=0x3e, [366]=0xc2, [367]=0x76, [368]=0x0, [369]=0x0, [370]=0x63, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x9f, [377]=0x3f, [378]=0xc2, [379]=0x76, [380]=0xfc, [381]=0xfd, [382]=0x9a, [383]=0x45, [384]=0x1, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0xd0, [389]=0x20, [390]=0x66, [391]=0x0, [392]=0x48, [393]=0x21, [394]=0x66, [395]=0x0, [396]=0x6c, [397]=0xf8, [398]=0x18, [399]=0x0, [400]=0x0, [401]=0x15, [402]=0x5, [403]=0x75, [404]=0x88, [405]=0x1b, [406]=0x65, [407]=0x0, [408]=0x50, [409]=0xf8, [410]=0x18, [411]=0x0, [412]=0x4a, [413]=0x5a, [414]=0x5, [415]=0x75, [416]=0xb0, [417]=0xf8, [418]=0x18, [419]=0x0, [420]=0xe0, [421]=0x5e, [422]=0xc4, [423]=0x76, [424]=0x40, [425]=0x7c, [426]=0x46, [427]=0x33, [428]=0xfe, [429]=0xff, [430]=0xff, [431]=0xff, [432]=0x9f, [433]=0x3f, [434]=0xc2, [435]=0x76, [436]=0x6c, [437]=0x2f, [438]=0x9, [439]=0x75, [440]=0xb3, [441]=0x2f, [442]=0x9, [443]=0x75, [444]=0x9d, [445]=0x3d, [446]=0x0, [447]=0xf6, [448]=0xe8, [449]=0xf9, [450]=0x18, [451]=0x0, [452]=0x60, [453]=0xf9, [454]=0x18, [455]=0x0, [456]=0xc, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x1, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x90, [469]=0xf8, [470]=0x18, [471]=0x0, [472]=0xf8, [473]=0xf9, [474]=0x18, [475]=0x0, [476]=0xc4, [477]=0xff, [478]=0x18, [479]=0x0, [480]=0xa0, [481]=0x89, [482]=0x9, [483]=0x75, [484]=0xb5, [485]=0xd0, [486]=0x12, [487]=0x83, [488]=0xfe, [489]=0xff, [490]=0xff, [491]=0xff, [492]=0xb3, [493]=0x2f, [494]=0x9, [495]=0x75, [496]=0x38, [497]=0xc9, [498]=0x2a, [499]=0x0, [500]=0xd0, [501]=0x20, [502]=0x66, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x24, [509]=0xfb, [510]=0x18, [511]=0x0))) returned 1 [0069.773] LoadLibraryW (lpLibFileName="advapi32.dll") returned 0x77710000 [0069.774] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x18f29c | out: Wow64Process=0x18f29c) returned 1 [0069.777] LoadLibraryW (lpLibFileName="advapi32.dll") returned 0x77710000 [0069.777] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0069.778] GetFileSize (in: hFile=0x180, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13b740 [0069.778] VirtualAlloc (lpAddress=0x0, dwSize=0x13b740, flAllocationType=0x3000, flProtect=0x4) returned 0x2780000 [0069.778] ReadFile (in: hFile=0x180, lpBuffer=0x2780000, nNumberOfBytesToRead=0x13b740, lpNumberOfBytesRead=0x18f2d8, lpOverlapped=0x0 | out: lpBuffer=0x2780000*, lpNumberOfBytesRead=0x18f2d8*=0x13b740, lpOverlapped=0x0) returned 1 [0069.787] VirtualAlloc (lpAddress=0x0, dwSize=0x180000, flAllocationType=0x3000, flProtect=0x4) returned 0x28c0000 [0069.799] CloseHandle (hObject=0x180) returned 1 [0069.799] VirtualFree (lpAddress=0x2780000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0069.800] VirtualFree (lpAddress=0x28c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0069.800] NtResumeThread (in: ThreadHandle=0x1c, SuspendCount=0x18f3d8 | out: SuspendCount=0x18f3d8*=0x1) returned 0x0 [0069.850] CloseHandle (hObject=0x184) returned 1 [0069.851] CloseHandle (hObject=0x1c) returned 1 [0069.851] CloseHandle (hObject=0x188) returned 1 [0069.854] LoadLibraryW (lpLibFileName="advapi32.dll") returned 0x77710000 [0069.854] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x18f2a4 | out: Wow64Process=0x18f2a4) returned 1 [0069.858] LoadLibraryW (lpLibFileName="advapi32.dll") returned 0x77710000 [0069.858] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0069.858] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13b740 [0069.859] VirtualAlloc (lpAddress=0x0, dwSize=0x13b740, flAllocationType=0x3000, flProtect=0x4) returned 0x2780000 [0069.859] ReadFile (in: hFile=0x188, lpBuffer=0x2780000, nNumberOfBytesToRead=0x13b740, lpNumberOfBytesRead=0x18f2e0, lpOverlapped=0x0 | out: lpBuffer=0x2780000*, lpNumberOfBytesRead=0x18f2e0*=0x13b740, lpOverlapped=0x0) returned 1 [0069.868] VirtualAlloc (lpAddress=0x0, dwSize=0x180000, flAllocationType=0x3000, flProtect=0x4) returned 0x28c0000 [0069.879] CloseHandle (hObject=0x188) returned 1 [0069.880] VirtualFree (lpAddress=0x2780000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0069.880] VirtualFree (lpAddress=0x28c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0069.880] NtUnmapViewOfSection (ProcessHandle=0xffffffffffffffff, BaseAddress=0x600000) returned 0x0 [0069.886] ExitProcess (uExitCode=0x0) Thread: id = 2 os_tid = 0xa90 Thread: id = 3 os_tid = 0xa84 Process: id = "2" image_name = "qdgotnx2vapbkvcb.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qdgotnx2vapbkvcb.exe" page_root = "0x41e57000" os_pid = "0x290" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xb9c" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QDgotnX2VapbkvCb.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 4 os_tid = 0x7b0 [0069.825] GetProcessHeap () returned 0x4e0000 [0069.825] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x1) returned 0x4e3428 [0069.825] GetProcessHeap () returned 0x4e0000 [0069.825] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f01b0 [0069.826] CryptAcquireContextW (in: phProv=0x4f01b0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x4f01b0*=0x4f0590) returned 1 [0069.897] GetProcessHeap () returned 0x4e0000 [0069.897] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x4efce8 [0069.897] CryptImportKey (in: hProv=0x4f0590, pbData=0x18fee0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x4f0448) returned 1 [0069.898] CryptDecrypt (in: hKey=0x4f0448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4efce8, pdwDataLen=0x18ff44 | out: pbData=0x4efce8, pdwDataLen=0x18ff44) returned 1 [0069.898] CryptDestroyKey (hKey=0x4f0448) returned 1 [0069.898] GetProcessHeap () returned 0x4e0000 [0069.899] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f0658 [0069.899] GetProcessHeap () returned 0x4e0000 [0069.899] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xd) returned 0x4ee1b0 [0069.899] GetProcessHeap () returned 0x4e0000 [0069.899] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x11) returned 0x4f0448 [0069.899] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x77710000 [0069.899] GetProcAddress (hModule=0x77710000, lpProcName="CryptSetKeyParam") returned 0x777377b3 [0069.899] GetProcessHeap () returned 0x4e0000 [0069.899] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4efce8 | out: hHeap=0x4e0000) returned 1 [0069.899] GetProcessHeap () returned 0x4e0000 [0069.899] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa0) returned 0x4f0e48 [0069.899] CryptImportKey (in: hProv=0x4f0590, pbData=0x18fee0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x4f01e8) returned 1 [0069.899] CryptDecrypt (in: hKey=0x4f01e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f0e48, pdwDataLen=0x4f01d8 | out: pbData=0x4f0e48, pdwDataLen=0x4f01d8) returned 1 [0069.899] CryptDestroyKey (hKey=0x4f01e8) returned 1 [0069.899] GetProcessHeap () returned 0x4e0000 [0069.899] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4ee1b0 | out: hHeap=0x4e0000) returned 1 [0069.899] GetProcessHeap () returned 0x4e0000 [0069.899] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f0448 | out: hHeap=0x4e0000) returned 1 [0069.899] GetProcessHeap () returned 0x4e0000 [0069.900] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f0658 | out: hHeap=0x4e0000) returned 1 [0069.900] GetProcessHeap () returned 0x4e0000 [0069.900] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f0658 [0069.900] GetProcessHeap () returned 0x4e0000 [0069.900] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4ee1b0 [0069.900] GetProcessHeap () returned 0x4e0000 [0069.900] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x4efce8 [0069.900] CryptImportKey (in: hProv=0x4f0590, pbData=0x18fef0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x4f0448) returned 1 [0069.900] CryptDecrypt (in: hKey=0x4f0448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4efce8, pdwDataLen=0x18ff4c | out: pbData=0x4efce8, pdwDataLen=0x18ff4c) returned 1 [0069.900] CryptDestroyKey (hKey=0x4f0448) returned 1 [0069.900] GetProcessHeap () returned 0x4e0000 [0069.900] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x4efec8 [0069.900] CryptImportKey (in: hProv=0x4f0590, pbData=0x18fef0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x4f0448) returned 1 [0069.900] CryptDecrypt (in: hKey=0x4f0448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4efec8, pdwDataLen=0x18ff4c | out: pbData=0x4efec8, pdwDataLen=0x18ff4c) returned 1 [0069.900] CryptDestroyKey (hKey=0x4f0448) returned 1 [0069.900] GetProcessHeap () returned 0x4e0000 [0069.900] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f01e8 [0069.900] CryptImportKey (in: hProv=0x4f0590, pbData=0x18fef0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x4f0448) returned 1 [0069.900] CryptDecrypt (in: hKey=0x4f0448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f01e8, pdwDataLen=0x18ff4c | out: pbData=0x4f01e8, pdwDataLen=0x18ff4c) returned 1 [0069.900] CryptDestroyKey (hKey=0x4f0448) returned 1 [0069.900] GetProcessHeap () returned 0x4e0000 [0069.900] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f0230 [0069.901] GetProcessHeap () returned 0x4e0000 [0069.901] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xc0) returned 0x4f0ef0 [0069.901] CryptImportKey (in: hProv=0x4f0590, pbData=0x18ff04, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x4f0448) returned 1 [0069.901] CryptDecrypt (in: hKey=0x4f0448, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f0ef0, pdwDataLen=0x18ff6c | out: pbData=0x4f0ef0, pdwDataLen=0x18ff6c) returned 1 [0069.901] CryptDestroyKey (hKey=0x4f0448) returned 1 [0069.901] GetProcessHeap () returned 0x4e0000 [0069.901] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x4efef0 [0069.901] GetProcessHeap () returned 0x4e0000 [0069.901] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xd) returned 0x4ee1c8 [0069.901] GetProcessHeap () returned 0x4e0000 [0069.901] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x1f) returned 0x4eff18 [0069.901] GetProcessHeap () returned 0x4e0000 [0069.901] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x1e) returned 0x4eff40 [0069.901] GetProcessHeap () returned 0x4e0000 [0069.901] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xd) returned 0x4ee1e0 [0069.901] GetProcessHeap () returned 0x4e0000 [0069.901] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f0240 [0069.901] GetProcessHeap () returned 0x4e0000 [0069.901] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xc) returned 0x4ee1f8 [0069.901] GetProcessHeap () returned 0x4e0000 [0069.901] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x13) returned 0x4f0448 [0069.901] GetProcessHeap () returned 0x4e0000 [0069.901] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f0468 [0069.901] GetModuleHandleA (lpModuleName="Kernel32.dll") returned 0x76d30000 [0069.902] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0069.902] GetModuleHandleA (lpModuleName="Kernel32.dll") returned 0x76d30000 [0069.902] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x76d5d668 [0069.902] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x77710000 [0069.902] GetProcAddress (hModule=0x77710000, lpProcName="CreateProcessWithTokenW") returned 0x7775531f [0069.902] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x759d0000 [0069.945] GetProcAddress (hModule=0x759d0000, lpProcName="CommandLineToArgvW") returned 0x759e9ee8 [0069.945] GetProcAddress (hModule=0x759d0000, lpProcName="SHGetSpecialFolderPathW") returned 0x759f0468 [0069.945] GetProcAddress (hModule=0x759d0000, lpProcName=0x2a8) returned 0x75a244f5 [0069.945] GetProcessHeap () returned 0x4e0000 [0069.945] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f0ef0 | out: hHeap=0x4e0000) returned 1 [0069.945] GetProcessHeap () returned 0x4e0000 [0069.945] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4ee1c8 | out: hHeap=0x4e0000) returned 1 [0069.945] GetProcessHeap () returned 0x4e0000 [0069.945] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4eff18 | out: hHeap=0x4e0000) returned 1 [0069.945] GetProcessHeap () returned 0x4e0000 [0069.945] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4eff40 | out: hHeap=0x4e0000) returned 1 [0069.945] GetProcessHeap () returned 0x4e0000 [0069.945] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4ee1e0 | out: hHeap=0x4e0000) returned 1 [0069.945] GetProcessHeap () returned 0x4e0000 [0069.945] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f0240 | out: hHeap=0x4e0000) returned 1 [0069.945] GetProcessHeap () returned 0x4e0000 [0069.946] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4ee1f8 | out: hHeap=0x4e0000) returned 1 [0069.946] GetProcessHeap () returned 0x4e0000 [0069.946] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f0448 | out: hHeap=0x4e0000) returned 1 [0069.946] GetProcessHeap () returned 0x4e0000 [0069.946] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f0468 | out: hHeap=0x4e0000) returned 1 [0069.946] GetProcessHeap () returned 0x4e0000 [0069.946] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4efef0 | out: hHeap=0x4e0000) returned 1 [0069.946] GetProcessHeap () returned 0x4e0000 [0069.946] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f0230 | out: hHeap=0x4e0000) returned 1 [0069.949] GetSystemWindowsDirectoryW (in: lpBuffer=0x419030, uSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa [0069.949] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x419238, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QDgotnX2VapbkvCb.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qdgotnx2vapbkvcb.exe")) returned 0x3a [0069.949] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x419648, csidl=0, fCreate=0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0069.956] GetVersion () returned 0x1db10106 [0069.956] GetCurrentProcess () returned 0xffffffff [0069.956] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0xf01ff, TokenHandle=0x18ff6c | out: TokenHandle=0x18ff6c*=0xa8) returned 1 [0069.956] GetTokenInformation (in: TokenHandle=0xa8, TokenInformationClass=0x14, TokenInformation=0x18ff70, TokenInformationLength=0x4, ReturnLength=0x18ff74 | out: TokenInformation=0x18ff70, ReturnLength=0x18ff74) returned 1 [0069.956] CloseHandle (hObject=0xa8) returned 1 [0069.956] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QDgotnX2VapbkvCb.exe\" " [0069.957] CommandLineToArgvW (in: lpCmdLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QDgotnX2VapbkvCb.exe\" ", pNumArgs=0x18ff74 | out: pNumArgs=0x18ff74) returned 0x4f6a38*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QDgotnX2VapbkvCb.exe" [0069.957] GetProcessHeap () returned 0x4e0000 [0069.957] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f0478 [0069.957] GetLocaleInfoW (in: Locale=0x800, LCType=0x58, lpLCData=0x18ff50, cchData=32 | out: lpLCData="\x03") returned 16 [0069.957] GetProcessHeap () returned 0x4e0000 [0069.957] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x4) returned 0x4f6840 [0069.957] GetProcessHeap () returned 0x4e0000 [0069.957] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa0) returned 0x4f6ac0 [0069.957] CryptImportKey (in: hProv=0x4f0590, pbData=0x18fed0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x4f6b68) returned 1 [0069.957] CryptDecrypt (in: hKey=0x4f6b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f6ac0, pdwDataLen=0x18ff3c | out: pbData=0x4f6ac0, pdwDataLen=0x18ff3c) returned 1 [0069.957] CryptDestroyKey (hKey=0x4f6b68) returned 1 [0069.958] GetProcessHeap () returned 0x4e0000 [0069.958] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f6850 [0069.958] GetProcessHeap () returned 0x4e0000 [0069.958] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x12) returned 0x4f6860 [0069.958] GetProcessHeap () returned 0x4e0000 [0069.958] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f6b68 [0069.958] GetProcessHeap () returned 0x4e0000 [0069.958] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x1a) returned 0x4f4288 [0069.958] GetProcessHeap () returned 0x4e0000 [0069.958] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f6b78 [0069.958] GetProcessHeap () returned 0x4e0000 [0069.958] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xc) returned 0x4f1778 [0069.958] GetProcessHeap () returned 0x4e0000 [0069.958] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f6b88 [0069.958] GetProcessHeap () returned 0x4e0000 [0069.958] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x1a) returned 0x4f42b0 [0069.958] GetProcessHeap () returned 0x4e0000 [0069.958] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f6b98 [0069.958] GetProcessHeap () returned 0x4e0000 [0069.958] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xe) returned 0x4f1790 [0069.958] GetProcessHeap () returned 0x4e0000 [0069.958] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f6ba8 [0069.958] GetProcessHeap () returned 0x4e0000 [0069.958] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x26) returned 0x4f6bb8 [0069.958] GetProcessHeap () returned 0x4e0000 [0069.958] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f6c00 [0069.958] GetProcessHeap () returned 0x4e0000 [0069.958] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f6fe8 [0069.959] GetProcessHeap () returned 0x4e0000 [0069.959] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f6ac0 | out: hHeap=0x4e0000) returned 1 [0069.959] GetProcessHeap () returned 0x4e0000 [0069.959] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f6c10 [0069.959] GetProcessHeap () returned 0x4e0000 [0069.959] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x60) returned 0x4f6ac0 [0069.959] CryptImportKey (in: hProv=0x4f0590, pbData=0x18fed0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x4f6b28) returned 1 [0069.959] CryptDecrypt (in: hKey=0x4f6b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f6ac0, pdwDataLen=0x18ff3c | out: pbData=0x4f6ac0, pdwDataLen=0x18ff3c) returned 1 [0069.959] CryptDestroyKey (hKey=0x4f6b28) returned 1 [0069.959] GetProcessHeap () returned 0x4e0000 [0069.959] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x14) returned 0x4f6b28 [0069.959] GetProcessHeap () returned 0x4e0000 [0069.959] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xb) returned 0x4f7020 [0069.959] GetProcessHeap () returned 0x4e0000 [0069.959] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x4f7038 [0069.959] GetProcessHeap () returned 0x4e0000 [0069.959] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x4f7050 [0069.959] GetProcessHeap () returned 0x4e0000 [0069.960] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xf) returned 0x4f7068 [0069.960] GetProcessHeap () returned 0x4e0000 [0069.960] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x19) returned 0x4f42d8 [0069.960] LoadLibraryA (lpLibFileName="user32.dll") returned 0x77130000 [0069.960] GetProcAddress (hModule=0x77130000, lpProcName="wsprintfA") returned 0x7715ae5f [0069.960] GetProcAddress (hModule=0x77130000, lpProcName="wsprintfW") returned 0x7716e061 [0069.960] GetProcAddress (hModule=0x77130000, lpProcName="GetShellWindow") returned 0x7716e8a8 [0069.960] GetProcAddress (hModule=0x77130000, lpProcName="GetWindowThreadProcessId") returned 0x771491b4 [0069.960] GetProcessHeap () returned 0x4e0000 [0069.960] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f6ac0 | out: hHeap=0x4e0000) returned 1 [0069.960] GetProcessHeap () returned 0x4e0000 [0069.960] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f7020 | out: hHeap=0x4e0000) returned 1 [0069.960] GetProcessHeap () returned 0x4e0000 [0069.960] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f7038 | out: hHeap=0x4e0000) returned 1 [0069.960] GetProcessHeap () returned 0x4e0000 [0069.960] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f7050 | out: hHeap=0x4e0000) returned 1 [0069.960] GetProcessHeap () returned 0x4e0000 [0069.960] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f7068 | out: hHeap=0x4e0000) returned 1 [0069.960] GetProcessHeap () returned 0x4e0000 [0069.960] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f42d8 | out: hHeap=0x4e0000) returned 1 [0069.961] GetProcessHeap () returned 0x4e0000 [0069.961] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f6b28 | out: hHeap=0x4e0000) returned 1 [0069.961] GetProcessHeap () returned 0x4e0000 [0069.961] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f6c10 | out: hHeap=0x4e0000) returned 1 [0069.961] GetProcessHeap () returned 0x4e0000 [0069.961] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x4) returned 0x4f6c10 [0069.961] GetProcessHeap () returned 0x4e0000 [0069.961] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x60) returned 0x4f6ac0 [0069.961] CryptImportKey (in: hProv=0x4f0590, pbData=0x18fed0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x4f6b28) returned 1 [0069.961] CryptDecrypt (in: hKey=0x4f6b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f6ac0, pdwDataLen=0x18ff3c | out: pbData=0x4f6ac0, pdwDataLen=0x18ff3c) returned 1 [0069.961] CryptDestroyKey (hKey=0x4f6b28) returned 1 [0069.961] GetProcessHeap () returned 0x4e0000 [0069.961] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f6c20 [0069.961] GetProcessHeap () returned 0x4e0000 [0069.961] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xe) returned 0x4f7020 [0069.961] GetProcessHeap () returned 0x4e0000 [0069.961] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f6c30 [0069.961] GetProcessHeap () returned 0x4e0000 [0069.961] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x4f42d8 [0069.961] GetProcessHeap () returned 0x4e0000 [0069.961] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f6c40 [0069.961] GetProcessHeap () returned 0x4e0000 [0069.961] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x24) returned 0x4f6b28 [0069.961] GetProcessHeap () returned 0x4e0000 [0069.961] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f6ac0 | out: hHeap=0x4e0000) returned 1 [0069.961] GetProcessHeap () returned 0x4e0000 [0069.961] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x4) returned 0x4f6c50 [0069.961] GetProcessHeap () returned 0x4e0000 [0069.962] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x4f4300 [0069.962] CryptImportKey (in: hProv=0x4f0590, pbData=0x18fed0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x4f6ac0) returned 1 [0069.962] CryptDecrypt (in: hKey=0x4f6ac0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f4300, pdwDataLen=0x18ff3c | out: pbData=0x4f4300, pdwDataLen=0x18ff3c) returned 1 [0069.962] CryptDestroyKey (hKey=0x4f6ac0) returned 1 [0069.962] GetProcessHeap () returned 0x4e0000 [0069.962] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f6c60 [0069.962] GetProcessHeap () returned 0x4e0000 [0069.962] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x1a) returned 0x4f4328 [0069.962] GetProcessHeap () returned 0x4e0000 [0069.962] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4300 | out: hHeap=0x4e0000) returned 1 [0069.962] GetProcessHeap () returned 0x4e0000 [0069.962] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x4) returned 0x4f6c70 [0069.962] GetProcessHeap () returned 0x4e0000 [0069.962] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x1a0) returned 0x4f7408 [0069.962] CryptImportKey (in: hProv=0x4f0590, pbData=0x18fed0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x4f6ac0) returned 1 [0069.962] CryptDecrypt (in: hKey=0x4f6ac0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f7408, pdwDataLen=0x18ff3c | out: pbData=0x4f7408, pdwDataLen=0x18ff3c) returned 1 [0069.962] CryptDestroyKey (hKey=0x4f6ac0) returned 1 [0069.962] GetProcessHeap () returned 0x4e0000 [0069.962] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f6c80 [0069.962] GetProcessHeap () returned 0x4e0000 [0069.962] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f6c90 [0069.962] GetProcessHeap () returned 0x4e0000 [0069.962] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f6ca0 [0069.962] GetProcessHeap () returned 0x4e0000 [0069.962] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f6cb0 [0069.962] GetProcessHeap () returned 0x4e0000 [0069.963] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f6cc0 [0069.963] GetProcessHeap () returned 0x4e0000 [0069.963] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f6cd0 [0069.963] GetProcessHeap () returned 0x4e0000 [0069.963] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f6ce0 [0069.963] GetProcessHeap () returned 0x4e0000 [0069.963] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f6cf0 [0069.963] GetProcessHeap () returned 0x4e0000 [0069.963] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f6d00 [0069.963] GetProcessHeap () returned 0x4e0000 [0069.963] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xc) returned 0x4f7038 [0069.963] GetProcessHeap () returned 0x4e0000 [0069.963] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f6d10 [0069.963] GetProcessHeap () returned 0x4e0000 [0069.963] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xc) returned 0x4f7050 [0069.963] GetProcessHeap () returned 0x4e0000 [0069.963] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f6d20 [0069.963] GetProcessHeap () returned 0x4e0000 [0069.963] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xc) returned 0x4f7068 [0069.963] GetProcessHeap () returned 0x4e0000 [0069.963] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f6d30 [0069.963] GetProcessHeap () returned 0x4e0000 [0069.963] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f6d40 [0069.963] GetProcessHeap () returned 0x4e0000 [0069.963] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f6d50 [0069.963] GetProcessHeap () returned 0x4e0000 [0069.963] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f6d60 [0069.963] GetProcessHeap () returned 0x4e0000 [0069.963] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f6d70 [0069.964] GetProcessHeap () returned 0x4e0000 [0069.964] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f6d80 [0069.964] GetProcessHeap () returned 0x4e0000 [0069.964] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f6d90 [0069.964] GetProcessHeap () returned 0x4e0000 [0069.964] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6) returned 0x4f6da0 [0069.964] GetProcessHeap () returned 0x4e0000 [0069.964] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f6db0 [0069.964] GetProcessHeap () returned 0x4e0000 [0069.964] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x16) returned 0x4f6ac0 [0069.964] GetProcessHeap () returned 0x4e0000 [0069.964] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f6dc0 [0069.964] GetProcessHeap () returned 0x4e0000 [0069.964] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xe) returned 0x4f7080 [0069.964] GetProcessHeap () returned 0x4e0000 [0069.964] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f6dd0 [0069.964] GetProcessHeap () returned 0x4e0000 [0069.964] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xe) returned 0x4f7098 [0069.964] GetProcessHeap () returned 0x4e0000 [0069.964] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f6de0 [0069.964] GetProcessHeap () returned 0x4e0000 [0069.964] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f6df0 [0069.964] GetProcessHeap () returned 0x4e0000 [0069.964] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f6e00 [0069.964] GetProcessHeap () returned 0x4e0000 [0069.964] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f6e10 [0069.964] GetProcessHeap () returned 0x4e0000 [0069.965] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f6e20 [0069.965] GetProcessHeap () returned 0x4e0000 [0069.965] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f6e30 [0069.965] GetProcessHeap () returned 0x4e0000 [0069.965] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f6e40 [0069.965] GetProcessHeap () returned 0x4e0000 [0069.965] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f6e50 [0069.965] GetProcessHeap () returned 0x4e0000 [0069.965] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f6e60 [0069.965] GetProcessHeap () returned 0x4e0000 [0069.965] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f6e70 [0069.965] GetProcessHeap () returned 0x4e0000 [0069.965] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f6e80 [0069.965] GetProcessHeap () returned 0x4e0000 [0069.965] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f6e90 [0069.965] GetProcessHeap () returned 0x4e0000 [0069.965] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f6ea0 [0069.965] GetProcessHeap () returned 0x4e0000 [0069.965] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f6eb0 [0069.965] GetProcessHeap () returned 0x4e0000 [0069.965] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f6ec0 [0069.965] GetProcessHeap () returned 0x4e0000 [0069.965] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f6ed0 [0069.965] GetProcessHeap () returned 0x4e0000 [0069.965] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f6ee0 [0069.965] GetProcessHeap () returned 0x4e0000 [0069.965] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f6ef0 [0069.966] GetProcessHeap () returned 0x4e0000 [0069.966] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f6f00 [0069.966] GetProcessHeap () returned 0x4e0000 [0069.966] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x4f70b0 [0069.966] GetProcessHeap () returned 0x4e0000 [0069.966] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f6f10 [0069.966] GetProcessHeap () returned 0x4e0000 [0069.966] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f6f20 [0069.966] GetProcessHeap () returned 0x4e0000 [0069.966] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f6f30 [0069.966] GetProcessHeap () returned 0x4e0000 [0069.966] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f6f40 [0069.966] GetProcessHeap () returned 0x4e0000 [0069.966] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f6f50 [0069.966] GetProcessHeap () returned 0x4e0000 [0069.966] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f6f60 [0069.966] GetProcessHeap () returned 0x4e0000 [0069.966] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f6f70 [0069.966] GetProcessHeap () returned 0x4e0000 [0069.966] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x4f70c8 [0069.966] GetProcessHeap () returned 0x4e0000 [0069.966] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f6f80 [0069.966] GetProcessHeap () returned 0x4e0000 [0069.966] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f6f90 [0069.966] GetProcessHeap () returned 0x4e0000 [0069.966] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f6fa0 [0069.966] GetProcessHeap () returned 0x4e0000 [0069.966] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f6fb0 [0069.967] GetProcessHeap () returned 0x4e0000 [0069.967] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f6fc0 [0069.967] GetProcessHeap () returned 0x4e0000 [0069.967] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f6fd0 [0069.967] GetProcessHeap () returned 0x4e0000 [0069.967] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f75c8 [0069.967] GetProcessHeap () returned 0x4e0000 [0069.967] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f75d8 [0069.967] GetProcessHeap () returned 0x4e0000 [0069.967] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f75e8 [0069.967] GetProcessHeap () returned 0x4e0000 [0069.967] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f75f8 [0069.967] GetProcessHeap () returned 0x4e0000 [0069.967] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f7608 [0069.967] GetProcessHeap () returned 0x4e0000 [0069.967] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f7618 [0069.967] GetProcessHeap () returned 0x4e0000 [0069.967] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f7628 [0069.967] GetProcessHeap () returned 0x4e0000 [0069.967] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f7638 [0069.967] GetProcessHeap () returned 0x4e0000 [0069.967] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f7648 [0069.967] GetProcessHeap () returned 0x4e0000 [0069.967] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x4f70e0 [0069.967] GetProcessHeap () returned 0x4e0000 [0069.967] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f7658 [0069.967] GetProcessHeap () returned 0x4e0000 [0069.967] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f7668 [0069.968] GetProcessHeap () returned 0x4e0000 [0069.968] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f7678 [0069.968] GetProcessHeap () returned 0x4e0000 [0069.968] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x12) returned 0x4f6ae0 [0069.968] GetProcessHeap () returned 0x4e0000 [0069.968] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f7688 [0069.968] GetProcessHeap () returned 0x4e0000 [0069.968] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f70f8 [0069.968] GetProcessHeap () returned 0x4e0000 [0069.968] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f7698 [0069.968] GetProcessHeap () returned 0x4e0000 [0069.968] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xe) returned 0x4f7110 [0069.968] GetProcessHeap () returned 0x4e0000 [0069.968] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f76a8 [0069.968] GetProcessHeap () returned 0x4e0000 [0069.968] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f76b8 [0069.968] GetProcessHeap () returned 0x4e0000 [0069.968] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f76c8 [0069.968] GetProcessHeap () returned 0x4e0000 [0069.968] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x4f7128 [0069.968] GetProcessHeap () returned 0x4e0000 [0069.968] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f76d8 [0069.968] GetProcessHeap () returned 0x4e0000 [0069.968] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x4f7140 [0069.968] GetProcessHeap () returned 0x4e0000 [0069.968] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f7408 | out: hHeap=0x4e0000) returned 1 [0069.968] GetProcessHeap () returned 0x4e0000 [0069.968] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x4) returned 0x4f76e8 [0069.968] GetProcessHeap () returned 0x4e0000 [0069.969] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x180) returned 0x4f7408 [0069.969] CryptImportKey (in: hProv=0x4f0590, pbData=0x18fed0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x4f79b0) returned 1 [0069.969] CryptDecrypt (in: hKey=0x4f79b0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f7408, pdwDataLen=0x18ff3c | out: pbData=0x4f7408, pdwDataLen=0x18ff3c) returned 1 [0069.969] CryptDestroyKey (hKey=0x4f79b0) returned 1 [0069.969] GetProcessHeap () returned 0x4e0000 [0069.969] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f76f8 [0069.969] GetProcessHeap () returned 0x4e0000 [0069.969] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xc) returned 0x4f7158 [0069.969] GetProcessHeap () returned 0x4e0000 [0069.969] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f7708 [0069.969] GetProcessHeap () returned 0x4e0000 [0069.969] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xe) returned 0x4f7170 [0069.969] GetProcessHeap () returned 0x4e0000 [0069.969] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f7718 [0069.969] GetProcessHeap () returned 0x4e0000 [0069.969] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x14) returned 0x4f7590 [0069.969] GetProcessHeap () returned 0x4e0000 [0069.969] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f7728 [0069.969] GetProcessHeap () returned 0x4e0000 [0069.969] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x16) returned 0x4f6b00 [0069.969] GetProcessHeap () returned 0x4e0000 [0069.969] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f7738 [0069.969] GetProcessHeap () returned 0x4e0000 [0069.969] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x4f4300 [0069.969] GetProcessHeap () returned 0x4e0000 [0069.970] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f7748 [0069.970] GetProcessHeap () returned 0x4e0000 [0069.970] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x22) returned 0x4f79b0 [0069.970] GetProcessHeap () returned 0x4e0000 [0069.970] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f7758 [0069.970] GetProcessHeap () returned 0x4e0000 [0069.970] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f7768 [0069.970] GetProcessHeap () returned 0x4e0000 [0069.970] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f7778 [0069.970] GetProcessHeap () returned 0x4e0000 [0069.970] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x1a) returned 0x4f4350 [0069.970] GetProcessHeap () returned 0x4e0000 [0069.970] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f7788 [0069.970] GetProcessHeap () returned 0x4e0000 [0069.970] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f7188 [0069.970] GetProcessHeap () returned 0x4e0000 [0069.970] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f7798 [0069.970] GetProcessHeap () returned 0x4e0000 [0069.970] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xc) returned 0x4f71a0 [0069.970] GetProcessHeap () returned 0x4e0000 [0069.970] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f77a8 [0069.970] GetProcessHeap () returned 0x4e0000 [0069.970] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x4f71b8 [0069.970] GetProcessHeap () returned 0x4e0000 [0069.970] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f77b8 [0069.970] GetProcessHeap () returned 0x4e0000 [0069.970] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f77c8 [0069.970] GetProcessHeap () returned 0x4e0000 [0069.970] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f77d8 [0069.971] GetProcessHeap () returned 0x4e0000 [0069.971] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xe) returned 0x4f71d0 [0069.971] GetProcessHeap () returned 0x4e0000 [0069.971] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f77e8 [0069.971] GetProcessHeap () returned 0x4e0000 [0069.971] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f77f8 [0069.971] GetProcessHeap () returned 0x4e0000 [0069.971] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f7808 [0069.971] GetProcessHeap () returned 0x4e0000 [0069.971] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f71e8 [0069.971] GetProcessHeap () returned 0x4e0000 [0069.971] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f7818 [0069.971] GetProcessHeap () returned 0x4e0000 [0069.971] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x4f7200 [0069.971] GetProcessHeap () returned 0x4e0000 [0069.971] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f7828 [0069.971] GetProcessHeap () returned 0x4e0000 [0069.971] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f7838 [0069.971] GetProcessHeap () returned 0x4e0000 [0069.971] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f7848 [0069.971] GetProcessHeap () returned 0x4e0000 [0069.971] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f7218 [0069.971] GetProcessHeap () returned 0x4e0000 [0069.971] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f7858 [0069.971] GetProcessHeap () returned 0x4e0000 [0069.971] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f7230 [0069.971] GetProcessHeap () returned 0x4e0000 [0069.971] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f7868 [0069.971] GetProcessHeap () returned 0x4e0000 [0069.972] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xc) returned 0x4f7248 [0069.972] GetProcessHeap () returned 0x4e0000 [0069.972] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f7878 [0069.972] GetProcessHeap () returned 0x4e0000 [0069.972] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x4f7260 [0069.972] GetProcessHeap () returned 0x4e0000 [0069.972] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f7888 [0069.972] GetProcessHeap () returned 0x4e0000 [0069.972] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f7898 [0069.972] GetProcessHeap () returned 0x4e0000 [0069.972] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f78a8 [0069.972] GetProcessHeap () returned 0x4e0000 [0069.972] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x4f7278 [0069.972] GetProcessHeap () returned 0x4e0000 [0069.972] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f78b8 [0069.972] GetProcessHeap () returned 0x4e0000 [0069.972] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xe) returned 0x4f7290 [0069.972] GetProcessHeap () returned 0x4e0000 [0069.972] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f78c8 [0069.972] GetProcessHeap () returned 0x4e0000 [0069.972] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f78d8 [0069.972] GetProcessHeap () returned 0x4e0000 [0069.972] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f78e8 [0069.972] GetProcessHeap () returned 0x4e0000 [0069.972] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f78f8 [0069.972] GetProcessHeap () returned 0x4e0000 [0069.972] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f7408 | out: hHeap=0x4e0000) returned 1 [0069.972] GetProcessHeap () returned 0x4e0000 [0069.972] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x24) returned 0x4f7408 [0069.973] GetProcessHeap () returned 0x4e0000 [0069.973] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f7908 [0069.973] GetProcessHeap () returned 0x4e0000 [0069.973] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x60) returned 0x4f7438 [0069.973] CryptImportKey (in: hProv=0x4f0590, pbData=0x18fed0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x4f74a0) returned 1 [0069.973] CryptDecrypt (in: hKey=0x4f74a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f7438, pdwDataLen=0x18ff3c | out: pbData=0x4f7438, pdwDataLen=0x18ff3c) returned 1 [0069.973] CryptDestroyKey (hKey=0x4f74a0) returned 1 [0069.973] GetProcessHeap () returned 0x4e0000 [0069.973] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72a8 [0069.973] GetProcessHeap () returned 0x4e0000 [0069.973] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72c0 [0069.973] GetProcessHeap () returned 0x4e0000 [0069.973] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xc) returned 0x4f72d8 [0069.973] GetProcessHeap () returned 0x4e0000 [0069.973] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x14) returned 0x4f74a0 [0069.973] GetProcessHeap () returned 0x4e0000 [0069.973] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x1a) returned 0x4f43a0 [0069.973] GetProcessHeap () returned 0x4e0000 [0069.973] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f7438 | out: hHeap=0x4e0000) returned 1 [0069.973] GetProcessHeap () returned 0x4e0000 [0069.973] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f7918 [0069.973] GetProcessHeap () returned 0x4e0000 [0069.973] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f52b8 [0069.973] CryptImportKey (in: hProv=0x4f0590, pbData=0x18fed0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x4f7438) returned 1 [0069.973] CryptDecrypt (in: hKey=0x4f7438, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f52b8, pdwDataLen=0x18ff3c | out: pbData=0x4f52b8, pdwDataLen=0x18ff3c) returned 1 [0069.973] CryptDestroyKey (hKey=0x4f7438) returned 1 [0069.974] GetProcessHeap () returned 0x4e0000 [0069.974] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f7928 [0069.974] GetProcessHeap () returned 0x4e0000 [0069.974] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x12) returned 0x4f7438 [0069.974] GetProcessHeap () returned 0x4e0000 [0069.974] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x1a) returned 0x4f43c8 [0069.974] GetProcessHeap () returned 0x4e0000 [0069.974] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f52b8 | out: hHeap=0x4e0000) returned 1 [0069.974] GetShellWindow () returned 0x100f2 [0069.974] GetWindowThreadProcessId (in: hWnd=0x100f2, lpdwProcessId=0x41989c | out: lpdwProcessId=0x41989c) returned 0x458 [0069.976] GetProcessHeap () returned 0x4e0000 [0069.976] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x4f43f0 [0069.976] CryptImportKey (in: hProv=0x4f0590, pbData=0x18fed0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x4f7458) returned 1 [0069.976] CryptDecrypt (in: hKey=0x4f7458, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f43f0, pdwDataLen=0x18ff3c | out: pbData=0x4f43f0, pdwDataLen=0x18ff3c) returned 1 [0069.976] CryptDestroyKey (hKey=0x4f7458) returned 1 [0069.976] GetProcessHeap () returned 0x4e0000 [0069.976] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x4f4418 [0069.976] CryptImportKey (in: hProv=0x4f0590, pbData=0x18fed0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x4f7458) returned 1 [0069.976] CryptDecrypt (in: hKey=0x4f7458, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f4418, pdwDataLen=0x18ff3c | out: pbData=0x4f4418, pdwDataLen=0x18ff3c) returned 1 [0069.976] CryptDestroyKey (hKey=0x4f7458) returned 1 [0069.976] GetProcessHeap () returned 0x4e0000 [0069.976] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x4f4440 [0069.976] CryptImportKey (in: hProv=0x4f0590, pbData=0x18fed0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x4f7458) returned 1 [0069.976] CryptDecrypt (in: hKey=0x4f7458, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f4440, pdwDataLen=0x18ff3c | out: pbData=0x4f4440, pdwDataLen=0x18ff3c) returned 1 [0069.976] CryptDestroyKey (hKey=0x4f7458) returned 1 [0069.980] GetProcessHeap () returned 0x4e0000 [0069.980] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x4f79f8 [0069.980] CryptImportKey (in: hProv=0x4f0590, pbData=0x18fca8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x4f7458) returned 1 [0069.980] CryptDecrypt (in: hKey=0x4f7458, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f79f8, pdwDataLen=0x18fd14 | out: pbData=0x4f79f8, pdwDataLen=0x18fd14) returned 1 [0069.980] CryptDestroyKey (hKey=0x4f7458) returned 1 [0069.980] GetProcessHeap () returned 0x4e0000 [0069.980] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x60) returned 0x4f74c0 [0069.980] CryptImportKey (in: hProv=0x4f0590, pbData=0x18fca8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x4f7458) returned 1 [0069.980] CryptDecrypt (in: hKey=0x4f7458, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f74c0, pdwDataLen=0x18fd14 | out: pbData=0x4f74c0, pdwDataLen=0x18fd14) returned 1 [0069.980] CryptDestroyKey (hKey=0x4f7458) returned 1 [0069.980] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x18fd18, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0069.981] GetProcessHeap () returned 0x4e0000 [0069.981] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f79f8 | out: hHeap=0x4e0000) returned 1 [0069.981] GetProcessHeap () returned 0x4e0000 [0069.982] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x4f79f8 [0069.982] CryptImportKey (in: hProv=0x4f0590, pbData=0x18fca8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x4f7458) returned 1 [0069.982] CryptDecrypt (in: hKey=0x4f7458, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f79f8, pdwDataLen=0x18fd14 | out: pbData=0x4f79f8, pdwDataLen=0x18fd14) returned 1 [0069.982] CryptDestroyKey (hKey=0x4f7458) returned 1 [0069.982] GetProcessHeap () returned 0x4e0000 [0069.982] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x60) returned 0x4f7528 [0069.982] CryptImportKey (in: hProv=0x4f0590, pbData=0x18fca8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x4f7458) returned 1 [0069.982] CryptDecrypt (in: hKey=0x4f7458, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f7528, pdwDataLen=0x18fd14 | out: pbData=0x4f7528, pdwDataLen=0x18fd14) returned 1 [0069.982] CryptDestroyKey (hKey=0x4f7458) returned 1 [0069.982] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x18fd18, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0069.982] GetProcessHeap () returned 0x4e0000 [0069.982] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f79f8 | out: hHeap=0x4e0000) returned 1 [0069.982] GetProcessHeap () returned 0x4e0000 [0069.982] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x1e) returned 0x4f79f8 [0069.982] GetProcessHeap () returned 0x4e0000 [0069.982] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x12) returned 0x4f7458 [0069.982] GetProcessHeap () returned 0x4e0000 [0069.982] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x4f7a20 [0069.982] CryptImportKey (in: hProv=0x4f0590, pbData=0x18fee0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x4f81e0) returned 1 [0069.983] CryptDecrypt (in: hKey=0x4f81e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f7a20, pdwDataLen=0x18ff40 | out: pbData=0x4f7a20, pdwDataLen=0x18ff40) returned 1 [0069.983] CryptDestroyKey (hKey=0x4f81e0) returned 1 [0069.983] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=1, lpName="m23071644") returned 0xa8 [0069.983] GetLastError () returned 0x0 [0069.983] GetProcessHeap () returned 0x4e0000 [0069.983] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f7a20 | out: hHeap=0x4e0000) returned 1 [0069.983] GetProcessHeap () returned 0x4e0000 [0069.983] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x60) returned 0x4f81e0 [0069.983] CryptImportKey (in: hProv=0x4f0590, pbData=0x18f690, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x4f8248) returned 1 [0069.983] CryptDecrypt (in: hKey=0x4f8248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f81e0, pdwDataLen=0x18f6f4 | out: pbData=0x4f81e0, pdwDataLen=0x18f6f4) returned 1 [0069.983] CryptDestroyKey (hKey=0x4f8248) returned 1 [0069.983] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x18f6e0 | out: phkResult=0x18f6e0*=0xa4) returned 0x0 [0069.983] RegSetValueExW (in: hKey=0xa4, lpValueName="1", Reserved=0x0, dwType=0x1, lpData="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QDgotnX2VapbkvCb.exe\"", cbData=0x7a | out: lpData="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QDgotnX2VapbkvCb.exe\"") returned 0x0 [0069.985] RegCloseKey (hKey=0xa4) returned 0x0 [0069.985] GetProcessHeap () returned 0x4e0000 [0069.985] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f81e0 | out: hHeap=0x4e0000) returned 1 [0069.985] GetProcessHeap () returned 0x4e0000 [0069.985] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f52b8 [0069.985] CryptImportKey (in: hProv=0x4f0590, pbData=0x18fa80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x4f81e0) returned 1 [0069.985] CryptDecrypt (in: hKey=0x4f81e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f52b8, pdwDataLen=0x18faf0 | out: pbData=0x4f52b8, pdwDataLen=0x18faf0) returned 1 [0069.985] CryptDestroyKey (hKey=0x4f81e0) returned 1 [0069.985] GetProcessHeap () returned 0x4e0000 [0069.985] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x4f7a20 [0069.985] CryptImportKey (in: hProv=0x4f0590, pbData=0x18fa80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x4f81e0) returned 1 [0069.985] CryptDecrypt (in: hKey=0x4f81e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f7a20, pdwDataLen=0x18faf0 | out: pbData=0x4f7a20, pdwDataLen=0x18faf0) returned 1 [0069.985] CryptDestroyKey (hKey=0x4f81e0) returned 1 [0069.985] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x18faec | out: phkResult=0x18faec*=0xa4) returned 0x0 [0069.985] RegQueryValueExA (in: hKey=0xa4, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x18faf8, lpcbData=0x18faf4*=0x400 | out: lpType=0x0, lpData=0x18faf8*=0x30, lpcbData=0x18faf4*=0x18) returned 0x0 [0069.985] RegCloseKey (hKey=0xa4) returned 0x0 [0069.986] GetProcessHeap () returned 0x4e0000 [0069.986] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f52b8 | out: hHeap=0x4e0000) returned 1 [0069.986] GetProcessHeap () returned 0x4e0000 [0069.986] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f7a20 | out: hHeap=0x4e0000) returned 1 [0069.986] GetProcessHeap () returned 0x4e0000 [0069.986] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x4f7a20 [0069.986] CryptImportKey (in: hProv=0x4f0590, pbData=0x18f860, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x4f89e0) returned 1 [0069.986] CryptDecrypt (in: hKey=0x4f89e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f7a20, pdwDataLen=0x18f8c4 | out: pbData=0x4f7a20, pdwDataLen=0x18f8c4) returned 1 [0069.986] CryptDestroyKey (hKey=0x4f89e0) returned 1 [0069.986] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x18f8c8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0069.986] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x18f8c0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18f8c0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0069.986] GetProcessHeap () returned 0x4e0000 [0069.986] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f7a20 | out: hHeap=0x4e0000) returned 1 [0069.986] wsprintfA (in: param_1=0x18fb0f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0069.986] GetProcessHeap () returned 0x4e0000 [0069.986] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f7938 [0069.986] GetProcessHeap () returned 0x4e0000 [0069.986] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f52b8 [0069.986] GetProcessHeap () returned 0x4e0000 [0069.986] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x80) returned 0x4f89e0 [0069.986] CryptImportKey (in: hProv=0x4f0590, pbData=0x18fe90, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x4f8a68) returned 1 [0069.986] CryptDecrypt (in: hKey=0x4f8a68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f89e0, pdwDataLen=0x18fef8 | out: pbData=0x4f89e0, pdwDataLen=0x18fef8) returned 1 [0069.987] CryptDestroyKey (hKey=0x4f8a68) returned 1 [0069.987] GetProcessHeap () returned 0x4e0000 [0069.987] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x80) returned 0x4f8a68 [0069.987] CryptImportKey (in: hProv=0x4f0590, pbData=0x18fe90, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x4f8af0) returned 1 [0069.987] CryptDecrypt (in: hKey=0x4f8af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f8a68, pdwDataLen=0x18fef8 | out: pbData=0x4f8a68, pdwDataLen=0x18fef8) returned 1 [0069.987] CryptDestroyKey (hKey=0x4f8af0) returned 1 [0069.987] GetExitCodeProcess (in: hProcess=0x0, lpExitCode=0x18ff20 | out: lpExitCode=0x18ff20*=0x4f7a20) returned 0 [0069.987] Wow64DisableWow64FsRedirection (in: OldValue=0x18ff28 | out: OldValue=0x18ff28*=0x0) returned 1 [0069.987] GetCurrentProcessId () returned 0x290 [0069.987] wsprintfW (in: param_1=0x18f6f8, param_2="\"%s\" n%u" | out: param_1="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QDgotnX2VapbkvCb.exe\" n656") returned 65 [0069.987] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x454) returned 0xa4 [0069.987] OpenProcessToken (in: ProcessHandle=0xa4, DesiredAccess=0x2000000, TokenHandle=0x18f684 | out: TokenHandle=0x18f684*=0xac) returned 1 [0069.987] DuplicateTokenEx (in: hExistingToken=0xac, dwDesiredAccess=0x2000000, lpTokenAttributes=0x18f690, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0x18f680 | out: phNewToken=0x18f680*=0xb0) returned 1 [0069.987] CreatePipe (in: hReadPipe=0x18f68c, hWritePipe=0x18f688, lpPipeAttributes=0x18f690, nSize=0x0 | out: hReadPipe=0x18f68c*=0xb8, hWritePipe=0x18f688*=0xbc) returned 1 [0069.988] CreateProcessWithTokenW (in: hToken=0xb0, dwLogonFlags=0x0, lpApplicationName=0x0, lpCommandLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QDgotnX2VapbkvCb.exe\" n656", dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18f6b0*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0xbc, hStdError=0xbc), lpProcessInformation=0x18f6a0 | out: lpCommandLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QDgotnX2VapbkvCb.exe\" n656", lpProcessInformation=0x18f6a0*(hProcess=0x108, hThread=0x10c, dwProcessId=0x244, dwThreadId=0x3b4)) returned 1 [0070.606] CloseHandle (hObject=0x10c) returned 1 [0070.606] CloseHandle (hObject=0xb0) returned 1 [0070.606] CloseHandle (hObject=0xac) returned 1 [0070.606] CloseHandle (hObject=0xa4) returned 1 [0070.606] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0070.606] SetErrorMode (uMode=0x1) returned 0x8001 [0070.606] GetLogicalDrives () returned 0x4 [0070.606] GetProcessHeap () returned 0x4e0000 [0070.606] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5468 [0070.606] CryptImportKey (in: hProv=0x4f0590, pbData=0x18fa10, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x4f9e78) returned 1 [0070.606] CryptDecrypt (in: hKey=0x4f9e78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5468, pdwDataLen=0x18fa80 | out: pbData=0x4f5468, pdwDataLen=0x18fa80) returned 1 [0070.606] CryptDestroyKey (hKey=0x4f9e78) returned 1 [0070.606] GetProcessHeap () returned 0x4e0000 [0070.606] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x4f7d90 [0070.606] CryptImportKey (in: hProv=0x4f0590, pbData=0x18fa10, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x4f9e78) returned 1 [0070.607] CryptDecrypt (in: hKey=0x4f9e78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f7d90, pdwDataLen=0x18fa80 | out: pbData=0x4f7d90, pdwDataLen=0x18fa80) returned 1 [0070.607] CryptDestroyKey (hKey=0x4f9e78) returned 1 [0070.607] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fa7c | out: phkResult=0x18fa7c*=0xa4) returned 0x0 [0070.607] RegQueryValueExA (in: hKey=0xa4, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x18fa88, lpcbData=0x18fa84*=0x400 | out: lpType=0x0, lpData=0x18fa88*=0x30, lpcbData=0x18fa84*=0x18) returned 0x0 [0070.607] RegCloseKey (hKey=0xa4) returned 0x0 [0070.607] GetProcessHeap () returned 0x4e0000 [0070.607] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5468 | out: hHeap=0x4e0000) returned 1 [0070.607] GetProcessHeap () returned 0x4e0000 [0070.607] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f7d90 | out: hHeap=0x4e0000) returned 1 [0070.607] GetProcessHeap () returned 0x4e0000 [0070.607] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x4f7d90 [0070.607] CryptImportKey (in: hProv=0x4f0590, pbData=0x18f7f0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x4f9e78) returned 1 [0070.607] CryptDecrypt (in: hKey=0x4f9e78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f7d90, pdwDataLen=0x18f854 | out: pbData=0x4f7d90, pdwDataLen=0x18f854) returned 1 [0070.607] CryptDestroyKey (hKey=0x4f9e78) returned 1 [0070.607] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x18f858, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0070.607] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x18f850, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18f850*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0070.607] GetProcessHeap () returned 0x4e0000 [0070.607] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f7d90 | out: hHeap=0x4e0000) returned 1 [0070.607] wsprintfA (in: param_1=0x18fa9f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0070.608] wsprintfW (in: param_1=0x18feb0, param_2="\\\\.\\%c:" | out: param_1="\\\\.\\C:") returned 6 [0070.608] wsprintfW (in: param_1=0x18fec0, param_2="%c:\\" | out: param_1="C:\\") returned 3 [0070.608] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0070.608] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x18fea0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fea0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0070.608] GetProcessHeap () returned 0x4e0000 [0070.608] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x34) returned 0x4f9e78 [0070.608] wsprintfW (in: param_1=0x4f9e78, param_2="%c:" | out: param_1="C:") returned 2 [0070.608] CreateFileW (lpFileName="\\\\.\\C:" (normalized: "c:"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa4 [0070.608] DeviceIoControl (in: hDevice=0xa4, dwIoControlCode=0x560000, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x18fed0, nOutBufferSize=0x20, lpBytesReturned=0x18fea4, lpOverlapped=0x0 | out: lpOutBuffer=0x18fed0*, lpBytesReturned=0x18fea4*=0x20, lpOverlapped=0x0) returned 1 [0070.608] CloseHandle (hObject=0xa4) returned 1 [0070.608] GetProcessHeap () returned 0x4e0000 [0070.608] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f7968 [0070.608] GetProcessHeap () returned 0x4e0000 [0070.608] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2c) returned 0x4fcbf8 [0070.608] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x20, pbBuffer=0x4fcc04 | out: pbBuffer=0x4fcc04) returned 1 [0070.609] GetProcessHeap () returned 0x4e0000 [0070.609] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2c) returned 0x4fcd48 [0070.609] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x20, pbBuffer=0x4fcd54 | out: pbBuffer=0x4fcd54) returned 1 [0070.609] GetProcessHeap () returned 0x4e0000 [0070.609] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x4f7d90 [0070.609] CryptImportKey (in: hProv=0x4f0590, pbData=0x18fe90, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x4fd3a8) returned 1 [0070.609] CryptDecrypt (in: hKey=0x4fd3a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f7d90, pdwDataLen=0x18fef8 | out: pbData=0x4f7d90, pdwDataLen=0x18fef8) returned 1 [0070.609] CryptDestroyKey (hKey=0x4fd3a8) returned 1 [0070.609] GetProcessHeap () returned 0x4e0000 [0070.609] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x80) returned 0x4fd3a8 [0070.609] GetProcessHeap () returned 0x4e0000 [0070.609] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x80) returned 0x4f9798 [0070.609] CryptImportKey (in: hProv=0x4f0590, pbData=0x4f0e48, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x18fed8 | out: phKey=0x18fed8*=0x4f9820) returned 1 [0070.609] CryptEncrypt (in: hKey=0x4f9820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fd3a8*, pdwDataLen=0x18fedc*=0x75, dwBufLen=0x80 | out: pbData=0x4fd3a8*, pdwDataLen=0x18fedc*=0x80) returned 1 [0070.609] CryptDestroyKey (hKey=0x4f9820) returned 1 [0070.609] CryptImportKey (in: hProv=0x4f0590, pbData=0x4f0e48, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x18fed8 | out: phKey=0x18fed8*=0x4f9820) returned 1 [0070.609] CryptEncrypt (in: hKey=0x4f9820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f9798*, pdwDataLen=0x18fedc*=0x75, dwBufLen=0x80 | out: pbData=0x4f9798*, pdwDataLen=0x18fedc*=0x80) returned 1 [0070.609] CryptDestroyKey (hKey=0x4f9820) returned 1 [0070.609] GetProcessHeap () returned 0x4e0000 [0070.609] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f7d90 | out: hHeap=0x4e0000) returned 1 [0070.609] GetProcessHeap () returned 0x4e0000 [0070.609] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa0) returned 0x4fca30 [0070.610] CryptImportKey (in: hProv=0x4f0590, pbData=0x18fe80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x4f9820) returned 1 [0070.610] CryptDecrypt (in: hKey=0x4f9820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fca30, pdwDataLen=0x18fee8 | out: pbData=0x4fca30, pdwDataLen=0x18fee8) returned 1 [0070.610] CryptDestroyKey (hKey=0x4f9820) returned 1 [0070.610] GetProcessHeap () returned 0x4e0000 [0070.610] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x1c) returned 0x4f7d90 [0070.610] GetProcessHeap () returned 0x4e0000 [0070.610] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa) returned 0x4fc660 [0070.610] GetProcessHeap () returned 0x4e0000 [0070.610] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xe) returned 0x4fc648 [0070.610] GetProcessHeap () returned 0x4e0000 [0070.610] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x19) returned 0x4f7f20 [0070.610] GetProcessHeap () returned 0x4e0000 [0070.610] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xe) returned 0x4fc750 [0070.610] GetProcessHeap () returned 0x4e0000 [0070.610] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xd) returned 0x4fc6a8 [0070.610] GetProcessHeap () returned 0x4e0000 [0070.610] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x1a) returned 0x4f7e08 [0070.610] GetProcessHeap () returned 0x4e0000 [0070.610] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x1b) returned 0x4f7de0 [0070.610] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77c40000 [0070.610] GetProcAddress (hModule=0x77c40000, lpProcName="NtQueryObject") returned 0x77c5f9e8 [0070.610] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77c40000 [0070.610] GetProcAddress (hModule=0x77c40000, lpProcName="NtQuerySystemInformation") returned 0x77c5fda0 [0070.610] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77c40000 [0070.611] GetProcAddress (hModule=0x77c40000, lpProcName="RtlGetVersion") returned 0x77c7873a [0070.611] GetModuleHandleA (lpModuleName="Kernel32.dll") returned 0x76d30000 [0070.611] GetProcAddress (hModule=0x76d30000, lpProcName="GetFinalPathNameByHandleW") returned 0x76d60a25 [0070.611] GetModuleHandleA (lpModuleName="Kernel32.dll") returned 0x76d30000 [0070.611] GetProcAddress (hModule=0x76d30000, lpProcName="QueryFullProcessImageNameW") returned 0x76d515f7 [0070.611] GetProcessHeap () returned 0x4e0000 [0070.611] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fca30 | out: hHeap=0x4e0000) returned 1 [0070.611] GetProcessHeap () returned 0x4e0000 [0070.611] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fc660 | out: hHeap=0x4e0000) returned 1 [0070.611] GetProcessHeap () returned 0x4e0000 [0070.611] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fc648 | out: hHeap=0x4e0000) returned 1 [0070.611] GetProcessHeap () returned 0x4e0000 [0070.611] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f7f20 | out: hHeap=0x4e0000) returned 1 [0070.611] GetProcessHeap () returned 0x4e0000 [0070.611] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fc750 | out: hHeap=0x4e0000) returned 1 [0070.611] GetProcessHeap () returned 0x4e0000 [0070.611] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fc6a8 | out: hHeap=0x4e0000) returned 1 [0070.611] GetProcessHeap () returned 0x4e0000 [0070.611] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f7e08 | out: hHeap=0x4e0000) returned 1 [0070.611] GetProcessHeap () returned 0x4e0000 [0070.611] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f7de0 | out: hHeap=0x4e0000) returned 1 [0070.611] GetProcessHeap () returned 0x4e0000 [0070.611] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f7d90 | out: hHeap=0x4e0000) returned 1 [0070.611] GetProcessHeap () returned 0x4e0000 [0070.611] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x1000) returned 0x4fe858 [0070.611] NtQueryObject (in: Handle=0x0, ObjectInformationClass=0x3, ObjectInformation=0x4fe858, ObjectInformationLength=0x1000, ReturnLength=0x18fecc | out: ObjectInformation=0x4fe858, ReturnLength=0x18fecc) returned 0xc0000004 [0070.611] GetProcessHeap () returned 0x4e0000 [0070.611] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fe858 | out: hHeap=0x4e0000) returned 1 [0070.611] GetProcessHeap () returned 0x4e0000 [0070.612] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2000) returned 0x4fe858 [0070.612] NtQueryObject (in: Handle=0x0, ObjectInformationClass=0x3, ObjectInformation=0x4fe858, ObjectInformationLength=0x2000, ReturnLength=0x18fecc | out: ObjectInformation=0x4fe858, ReturnLength=0x18fecc) returned 0x0 [0070.612] RtlGetVersion (in: lpVersionInformation=0x18fdb8 | out: lpVersionInformation=0x18fdb8*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 0x0 [0070.612] GetProcessHeap () returned 0x4e0000 [0070.612] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fe858 | out: hHeap=0x4e0000) returned 1 [0070.612] GetVersion () returned 0x1db10106 [0070.612] GetCurrentProcess () returned 0xffffffff [0070.612] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0xf01ff, TokenHandle=0x18fef0 | out: TokenHandle=0x18fef0*=0xa4) returned 1 [0070.612] GetTokenInformation (in: TokenHandle=0xa4, TokenInformationClass=0x18, TokenInformation=0x18fef4, TokenInformationLength=0x4, ReturnLength=0x18fef8 | out: TokenInformation=0x18fef4, ReturnLength=0x18fef8) returned 1 [0070.612] CloseHandle (hObject=0xa4) returned 1 [0070.612] Wow64DisableWow64FsRedirection (in: OldValue=0x18ff1c | out: OldValue=0x18ff1c*=0x0) returned 1 [0070.612] GetProcessHeap () returned 0x4e0000 [0070.612] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x60) returned 0x4fca30 [0070.612] CryptImportKey (in: hProv=0x4f0590, pbData=0x18fea8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x4f9820) returned 1 [0070.612] CryptDecrypt (in: hKey=0x4f9820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fca30, pdwDataLen=0x18ff2c | out: pbData=0x4fca30, pdwDataLen=0x18ff2c) returned 1 [0070.612] CryptDestroyKey (hKey=0x4f9820) returned 1 [0070.612] GetProcessHeap () returned 0x4e0000 [0070.612] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x4f7d90 [0070.612] CryptImportKey (in: hProv=0x4f0590, pbData=0x18f7f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x4f9820) returned 1 [0070.612] CryptDecrypt (in: hKey=0x4f9820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f7d90, pdwDataLen=0x18f8a4 | out: pbData=0x4f7d90, pdwDataLen=0x18f8a4) returned 1 [0070.612] CryptDestroyKey (hKey=0x4f9820) returned 1 [0070.612] GetEnvironmentVariableW (in: lpName="ComSpec", lpBuffer=0x18f8f0, nSize=0x104 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0070.612] CreatePipe (in: hReadPipe=0x18f870, hWritePipe=0x18f868, lpPipeAttributes=0x18f898, nSize=0x0 | out: hReadPipe=0x18f870*=0xa4, hWritePipe=0x18f868*=0xac) returned 1 [0070.613] CreatePipe (in: hReadPipe=0x18f864, hWritePipe=0x18f874, lpPipeAttributes=0x18f898, nSize=0x0 | out: hReadPipe=0x18f864*=0xb0, hWritePipe=0x18f874*=0x10c) returned 1 [0070.613] SetHandleInformation (hObject=0xac, dwMask=0x1, dwFlags=0x0) returned 1 [0070.613] SetHandleInformation (hObject=0xb0, dwMask=0x1, dwFlags=0x0) returned 1 [0070.613] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18f8a8*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xa4, hStdOutput=0x10c, hStdError=0x10c), lpProcessInformation=0x18f884 | out: lpCommandLine=0x0, lpProcessInformation=0x18f884*(hProcess=0x114, hThread=0x110, dwProcessId=0x5dc, dwThreadId=0x7c4)) returned 1 [0070.987] WriteFile (in: hFile=0xac, lpBuffer=0x4fca30*, nNumberOfBytesToWrite=0x5f, lpNumberOfBytesWritten=0x18f894, lpOverlapped=0x0 | out: lpBuffer=0x4fca30*, lpNumberOfBytesWritten=0x18f894*=0x5f, lpOverlapped=0x0) returned 1 [0070.987] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0072.082] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0072.082] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0072.125] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0072.126] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0074.365] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0074.366] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0074.430] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0074.430] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0074.475] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0074.475] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0074.529] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0074.529] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0074.574] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0074.574] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0074.628] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0074.628] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0075.286] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0075.286] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0075.396] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0075.396] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0075.464] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0xbb, lpBytesLeftThisMessage=0x0) returned 1 [0075.464] ReadFile (in: hFile=0xb0, lpBuffer=0x18faf8, nNumberOfBytesToRead=0xbb, lpNumberOfBytesRead=0x18f87c, lpOverlapped=0x0 | out: lpBuffer=0x18faf8*, lpNumberOfBytesRead=0x18f87c*=0xbb, lpOverlapped=0x0) returned 1 [0075.464] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0075.527] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0075.528] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0076.116] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0076.116] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0076.173] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0076.173] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0077.454] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0077.454] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0077.501] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0077.501] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0077.548] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0077.549] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0077.600] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0077.600] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0077.644] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0077.644] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0077.689] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0077.689] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0077.736] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0077.736] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0077.806] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0077.806] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0077.846] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0077.846] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0077.892] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0077.893] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0077.940] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0077.940] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0078.032] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x77, lpBytesLeftThisMessage=0x0) returned 1 [0078.032] ReadFile (in: hFile=0xb0, lpBuffer=0x18faf8, nNumberOfBytesToRead=0x77, lpNumberOfBytesRead=0x18f87c, lpOverlapped=0x0 | out: lpBuffer=0x18faf8*, lpNumberOfBytesRead=0x18f87c*=0x77, lpOverlapped=0x0) returned 1 [0078.032] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0078.102] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0078.102] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0078.142] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0078.143] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0078.197] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0078.197] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0078.243] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0078.243] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0078.285] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0078.290] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0078.345] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0078.346] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0078.421] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0078.421] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0078.484] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0078.484] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0078.546] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0078.546] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0078.606] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0078.607] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0078.677] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0078.677] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0078.720] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0078.720] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0078.765] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0078.766] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0078.815] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0078.815] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0078.860] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0078.860] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0078.906] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0078.906] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0078.971] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0078.971] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0079.017] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0079.018] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0079.065] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0079.065] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0079.135] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0079.135] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0081.088] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0081.088] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0081.390] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0081.391] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0081.436] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0081.436] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0081.481] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0081.481] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0081.545] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0081.545] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0081.698] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0081.698] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0081.778] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0081.778] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0081.823] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0081.823] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0081.889] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0081.889] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0081.956] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0081.956] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0082.013] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0082.013] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0082.181] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0082.181] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0082.251] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0082.251] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0082.292] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0082.292] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0082.355] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0082.355] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0082.409] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0082.409] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0082.450] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0082.450] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0082.494] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0082.494] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0082.545] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0082.545] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0082.629] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0082.629] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0082.665] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0082.665] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0082.701] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0082.701] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0082.743] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0082.743] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0082.788] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0082.788] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0082.836] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0082.836] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0082.898] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0082.899] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0082.954] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0082.954] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0082.992] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0082.992] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0083.039] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0083.039] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0083.150] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0083.150] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0083.211] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0083.211] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0083.258] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0083.258] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0083.304] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0083.304] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0083.351] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0083.352] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0083.399] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0083.399] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0083.448] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0083.448] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0083.491] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0083.492] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0083.524] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0083.524] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0083.585] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0083.585] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0083.657] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0083.657] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0083.694] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0083.694] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0083.757] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0083.757] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0083.819] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0083.819] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0083.866] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0083.866] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0083.914] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0083.915] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0083.959] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0083.959] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0084.006] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0084.006] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0084.178] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0084.178] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0084.240] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0084.240] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0084.287] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0084.287] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0084.334] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0084.334] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0084.381] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0084.381] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0084.427] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0084.428] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0084.490] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0084.490] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0084.536] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0084.537] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0084.583] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0084.583] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0084.631] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0084.631] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0084.677] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0084.677] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0084.732] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0084.732] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0084.771] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0084.771] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0084.817] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0084.817] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0084.864] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0084.864] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0084.911] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0084.911] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0084.958] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0084.958] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0085.004] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0085.005] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0085.061] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0085.061] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0085.099] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0085.099] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0085.162] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0085.162] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0085.209] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0085.209] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0085.255] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0085.255] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0085.301] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0085.301] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0085.379] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0085.379] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0085.413] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0085.413] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0085.457] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0085.457] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0085.504] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0085.504] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0085.560] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0085.608] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0085.681] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0085.681] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0085.761] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0085.761] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0085.893] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0085.893] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0085.987] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0085.987] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0086.035] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0086.035] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0086.082] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0086.082] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0086.152] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0086.152] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0086.237] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0086.237] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0086.284] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0086.284] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0086.339] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0086.339] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0086.405] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0086.406] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0086.462] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0086.463] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0086.510] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0086.510] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0086.548] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0086.549] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0086.598] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0086.598] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0086.643] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0086.643] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0086.690] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0086.690] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0086.737] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0086.737] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0086.783] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0086.783] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0086.831] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0086.831] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0086.877] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0086.877] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0086.924] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0086.924] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0086.971] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0086.971] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0087.018] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0087.018] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0087.111] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0087.111] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0087.174] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0087.174] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0087.224] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0087.224] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0087.266] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0087.267] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0087.313] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0087.313] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0087.360] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0087.360] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0087.407] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0087.408] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0087.449] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0087.449] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0087.488] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0087.488] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0087.532] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0087.533] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0087.626] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0087.626] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0088.124] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0088.124] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0088.236] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0088.236] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0088.290] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0088.290] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0088.329] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0088.330] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0088.376] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0088.377] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0088.424] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0088.424] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0088.490] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0088.492] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0088.910] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0088.910] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0089.658] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0089.662] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0089.744] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0089.744] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0089.780] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0089.780] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0089.827] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0089.827] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0089.892] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0089.892] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0089.944] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0089.944] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0090.501] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0090.501] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0090.559] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0090.560] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0090.605] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0090.605] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0090.642] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0090.642] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0090.684] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0090.684] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0090.730] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0090.730] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0090.772] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0090.772] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0090.808] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0090.808] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0090.851] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0090.871] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0091.259] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0091.260] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0091.345] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0091.345] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0091.388] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0091.388] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0091.435] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0091.436] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0091.484] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0091.484] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0091.531] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0091.532] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0091.594] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0091.594] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0092.296] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0092.690] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0092.755] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0092.755] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0092.793] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0092.793] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0092.848] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0092.848] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0092.906] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0092.906] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0093.587] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0093.976] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0094.053] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.053] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0094.101] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.101] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0094.150] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.150] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0094.227] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.228] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0094.272] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.272] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0094.318] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.318] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0094.365] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.365] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0094.412] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.412] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0094.458] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.459] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0094.812] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.812] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0094.976] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.976] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0095.512] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0095.512] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0095.646] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0095.646] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0095.895] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0095.895] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0095.941] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0095.942] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0095.990] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0095.990] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0096.057] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0096.057] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0096.687] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0096.687] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0097.104] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0097.104] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0097.242] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0097.242] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0097.330] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0097.330] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0097.378] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0097.378] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0097.441] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0097.441] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0098.500] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.500] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0098.606] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.606] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0098.672] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.673] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0098.719] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.719] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0098.770] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.770] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0098.832] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.832] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0098.876] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.876] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0098.921] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.921] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0098.967] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.967] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0099.013] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0099.014] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0099.057] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0099.057] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0100.043] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.043] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0100.099] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.100] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0100.148] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.148] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0100.185] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.185] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0100.247] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.247] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0100.362] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.362] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0101.385] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.386] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0101.514] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.514] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0101.596] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.596] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0101.643] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.643] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0102.913] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.914] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0102.964] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.964] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0103.526] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.526] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0103.585] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.586] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0103.678] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.678] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0103.709] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.709] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0103.740] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.740] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0103.772] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.772] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0103.803] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.803] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0103.834] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.834] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0103.865] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.865] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0103.896] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.896] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0103.932] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.933] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0103.972] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.972] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0103.991] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.991] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0104.021] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.021] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0104.052] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.052] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0104.502] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.503] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0104.520] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.520] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0104.555] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.555] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0104.939] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.939] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0105.166] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0105.166] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0105.211] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0105.211] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0105.803] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0106.139] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0106.186] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0106.186] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0106.207] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0106.207] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0106.306] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0106.307] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0106.842] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0106.843] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0107.441] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0107.441] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0107.498] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0107.498] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0107.594] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0107.594] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0107.999] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0108.000] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0108.511] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0108.512] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0108.674] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0108.674] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0108.703] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0108.703] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0108.838] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0108.838] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0109.681] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0109.681] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0109.715] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0109.715] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0110.122] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0110.123] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0110.738] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0110.738] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0110.773] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0110.773] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0111.559] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0111.563] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0111.587] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0111.587] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0111.732] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0111.733] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0112.021] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0112.022] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0112.496] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0112.496] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0112.523] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0112.523] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0112.570] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0112.570] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0112.601] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0112.601] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0112.633] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0112.633] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0112.664] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0112.664] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0112.695] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0112.695] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0112.726] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0112.726] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0112.757] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0112.758] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0112.788] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0112.788] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0112.819] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0112.820] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0112.851] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0112.851] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0112.882] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0112.882] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0112.913] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0112.913] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0112.944] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0112.944] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0112.975] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0112.976] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0113.007] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0113.007] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0113.039] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0113.039] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0113.069] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0113.069] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0113.104] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0113.104] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0113.522] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0113.524] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0113.982] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0113.982] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0114.010] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0114.010] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0114.322] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0114.322] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0114.348] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0114.348] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0114.379] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0114.379] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0114.411] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0114.411] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0114.442] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0114.442] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0114.851] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0114.852] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0114.879] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0114.879] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0114.910] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0114.910] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0114.948] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0114.948] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0114.972] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0114.972] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0115.005] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0115.005] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0115.310] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0115.311] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0115.522] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0115.522] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0115.549] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0115.549] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0115.581] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0115.581] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0115.740] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0115.760] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0115.784] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0115.784] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0116.074] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.074] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0116.099] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.099] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0116.129] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.129] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0116.165] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.165] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0116.191] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x4e, lpBytesLeftThisMessage=0x0) returned 1 [0116.191] ReadFile (in: hFile=0xb0, lpBuffer=0x18faf8, nNumberOfBytesToRead=0x4e, lpNumberOfBytesRead=0x18f87c, lpOverlapped=0x0 | out: lpBuffer=0x18faf8*, lpNumberOfBytesRead=0x18f87c*=0x4e, lpOverlapped=0x0) returned 1 [0116.195] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0116.469] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.469] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0116.581] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.581] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0116.624] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.624] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0116.649] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x4e, lpBytesLeftThisMessage=0x0) returned 1 [0116.649] ReadFile (in: hFile=0xb0, lpBuffer=0x18faf8, nNumberOfBytesToRead=0x4e, lpNumberOfBytesRead=0x18f87c, lpOverlapped=0x0 | out: lpBuffer=0x18faf8*, lpNumberOfBytesRead=0x18f87c*=0x4e, lpOverlapped=0x0) returned 1 [0116.650] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0116.679] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.679] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0116.706] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.707] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0116.736] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.736] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0116.769] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.774] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0116.805] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.805] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0116.829] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.830] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0117.125] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0117.125] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0117.160] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0117.160] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0117.188] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0117.189] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0117.224] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0117.224] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0117.255] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0117.256] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0117.281] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0117.281] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0117.312] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0117.312] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0117.344] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0117.344] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0117.453] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0117.453] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0117.509] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0117.509] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0117.534] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x33, lpBytesLeftThisMessage=0x0) returned 1 [0117.534] ReadFile (in: hFile=0xb0, lpBuffer=0x18faf8, nNumberOfBytesToRead=0x33, lpNumberOfBytesRead=0x18f87c, lpOverlapped=0x0 | out: lpBuffer=0x18faf8*, lpNumberOfBytesRead=0x18f87c*=0x33, lpOverlapped=0x0) returned 1 [0117.534] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0117.562] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0117.562] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0117.614] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0117.615] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0117.642] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x47, lpBytesLeftThisMessage=0x0) returned 1 [0117.642] ReadFile (in: hFile=0xb0, lpBuffer=0x18faf8, nNumberOfBytesToRead=0x47, lpNumberOfBytesRead=0x18f87c, lpOverlapped=0x0 | out: lpBuffer=0x18faf8*, lpNumberOfBytesRead=0x18f87c*=0x47, lpOverlapped=0x0) returned 1 [0117.642] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0118.051] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0118.051] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0118.076] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0118.077] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0118.109] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0118.109] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0118.227] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0118.227] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0118.248] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0118.248] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0118.279] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0118.279] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0118.311] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0118.311] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0118.342] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0118.342] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0118.379] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0118.379] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0118.415] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0118.415] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0118.437] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0118.437] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0118.862] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0118.862] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0118.888] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0118.888] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0119.356] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0119.357] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0120.407] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0120.407] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0121.100] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0121.100] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0121.496] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0121.496] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0124.004] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0124.004] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0124.568] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0124.569] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0125.110] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0125.110] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0126.126] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0126.126] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0128.050] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0128.050] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0128.102] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0128.102] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0128.186] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0128.186] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0128.220] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0128.220] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0128.315] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0128.315] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0129.314] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0129.314] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0129.425] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0129.425] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0129.449] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0129.449] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0129.491] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0129.491] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0129.521] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0129.521] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0129.561] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0129.561] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0129.590] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0129.590] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0129.621] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0129.621] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0129.652] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0129.652] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0129.684] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0129.684] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0129.714] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0129.714] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0129.745] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0129.745] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0129.803] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0129.803] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0129.823] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0129.823] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0129.855] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0129.855] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0130.068] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0130.068] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0130.088] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0130.089] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0130.120] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0130.120] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0130.151] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0130.151] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0130.182] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0130.182] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0130.213] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0130.213] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0130.244] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0130.245] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0130.303] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0130.303] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0130.323] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0130.323] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0130.354] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0130.354] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0130.385] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0130.385] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0130.416] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0130.417] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0130.447] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0130.447] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0130.478] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0130.479] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0130.510] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0130.510] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0130.577] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0130.577] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0130.603] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0130.603] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0130.634] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0130.635] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0130.673] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0130.673] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0130.701] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x1c, lpBytesLeftThisMessage=0x0) returned 1 [0130.701] ReadFile (in: hFile=0xb0, lpBuffer=0x18faf8, nNumberOfBytesToRead=0x1c, lpNumberOfBytesRead=0x18f87c, lpOverlapped=0x0 | out: lpBuffer=0x18faf8*, lpNumberOfBytesRead=0x18f87c*=0x1c, lpOverlapped=0x0) returned 1 [0130.702] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0130.728] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0130.729] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0130.759] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0130.759] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0130.790] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0130.791] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0130.822] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0130.822] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0130.853] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0130.853] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0130.886] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0130.886] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0130.916] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0130.916] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0130.947] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0130.947] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0130.993] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0130.993] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0131.024] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0131.025] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x102 [0131.063] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0131.063] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x14) returned 0x0 [0131.085] PeekNamedPipe (in: hNamedPipe=0xb0, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f878*=0x35, lpBytesLeftThisMessage=0x0) returned 1 [0131.085] ReadFile (in: hFile=0xb0, lpBuffer=0x18faf8, nNumberOfBytesToRead=0x35, lpNumberOfBytesRead=0x18f87c, lpOverlapped=0x0 | out: lpBuffer=0x18faf8*, lpNumberOfBytesRead=0x18f87c*=0x35, lpOverlapped=0x0) returned 1 [0131.086] GetExitCodeProcess (in: hProcess=0x114, lpExitCode=0x18f86c | out: lpExitCode=0x18f86c*=0x0) returned 1 [0131.086] CloseHandle (hObject=0x110) returned 1 [0131.087] CloseHandle (hObject=0x114) returned 1 [0131.087] CloseHandle (hObject=0xa4) returned 1 [0131.087] CloseHandle (hObject=0xac) returned 1 [0131.087] CloseHandle (hObject=0xb0) returned 1 [0131.087] CloseHandle (hObject=0x10c) returned 1 [0131.087] GetProcessHeap () returned 0x4e0000 [0131.087] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f7d90 | out: hHeap=0x4e0000) returned 1 [0131.088] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0131.088] GetProcessHeap () returned 0x4e0000 [0131.088] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fca30 | out: hHeap=0x4e0000) returned 1 [0131.089] GetProcessHeap () returned 0x4e0000 [0131.089] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x400) returned 0x4f9a00 [0131.089] CryptImportKey (in: hProv=0x4f0590, pbData=0x18fc58, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x4f9820) returned 1 [0131.089] CryptDecrypt (in: hKey=0x4f9820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f9a00, pdwDataLen=0x18fcc8 | out: pbData=0x4f9a00, pdwDataLen=0x18fcc8) returned 1 [0131.089] CryptDestroyKey (hKey=0x4f9820) returned 1 [0131.090] GetProcessHeap () returned 0x4e0000 [0131.090] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4fc648 [0131.090] GetProcessHeap () returned 0x4e0000 [0131.090] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x1a) returned 0x4f7d90 [0131.090] GetProcessHeap () returned 0x4e0000 [0131.090] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4fc658 [0131.090] GetProcessHeap () returned 0x4e0000 [0131.090] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x1a) returned 0x4f7ea8 [0131.090] GetProcessHeap () returned 0x4e0000 [0131.090] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4fc668 [0131.090] GetProcessHeap () returned 0x4e0000 [0131.090] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x1e) returned 0x4f7de0 [0131.090] GetProcessHeap () returned 0x4e0000 [0131.090] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4fc678 [0131.090] GetProcessHeap () returned 0x4e0000 [0131.090] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x1a) returned 0x4f7e08 [0131.090] GetProcessHeap () returned 0x4e0000 [0131.090] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4fc688 [0131.090] GetProcessHeap () returned 0x4e0000 [0131.091] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x1c) returned 0x4f7f20 [0131.091] GetProcessHeap () returned 0x4e0000 [0131.091] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4fc698 [0131.091] GetProcessHeap () returned 0x4e0000 [0131.091] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x16) returned 0x4f83d8 [0131.091] GetProcessHeap () returned 0x4e0000 [0131.091] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4fc6a8 [0131.091] GetProcessHeap () returned 0x4e0000 [0131.091] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x14) returned 0x4f83f8 [0131.091] GetProcessHeap () returned 0x4e0000 [0131.091] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4fc6b8 [0131.091] GetProcessHeap () returned 0x4e0000 [0131.091] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x16) returned 0x4f8418 [0131.091] GetProcessHeap () returned 0x4e0000 [0131.091] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4fc6c8 [0131.091] GetProcessHeap () returned 0x4e0000 [0131.091] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x1a) returned 0x4f7f70 [0131.091] GetProcessHeap () returned 0x4e0000 [0131.091] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4fc6d8 [0131.091] GetProcessHeap () returned 0x4e0000 [0131.091] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x1a) returned 0x4f7fe8 [0131.091] GetProcessHeap () returned 0x4e0000 [0131.091] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4fc6e8 [0131.091] GetProcessHeap () returned 0x4e0000 [0131.091] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x22) returned 0x4f9820 [0131.091] GetProcessHeap () returned 0x4e0000 [0131.091] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4fc6f8 [0131.091] GetProcessHeap () returned 0x4e0000 [0131.091] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x4f8010 [0131.091] GetProcessHeap () returned 0x4e0000 [0131.091] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4fc708 [0131.091] GetProcessHeap () returned 0x4e0000 [0131.091] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x1c) returned 0x4f8038 [0131.091] GetProcessHeap () returned 0x4e0000 [0131.091] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4fc718 [0131.091] GetProcessHeap () returned 0x4e0000 [0131.091] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2a) returned 0x4fcd10 [0131.091] GetProcessHeap () returned 0x4e0000 [0131.091] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4fc728 [0131.091] GetProcessHeap () returned 0x4e0000 [0131.092] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x1e) returned 0x4f8060 [0131.092] GetProcessHeap () returned 0x4e0000 [0131.092] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4fc738 [0131.092] GetProcessHeap () returned 0x4e0000 [0131.092] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x16) returned 0x4f8438 [0131.092] GetProcessHeap () returned 0x4e0000 [0131.092] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4fc748 [0131.092] GetProcessHeap () returned 0x4e0000 [0131.092] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x24) returned 0x4fe470 [0131.092] GetProcessHeap () returned 0x4e0000 [0131.092] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4fc758 [0131.092] GetProcessHeap () returned 0x4e0000 [0131.092] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x4f8088 [0131.092] GetProcessHeap () returned 0x4e0000 [0131.092] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4fc768 [0131.092] GetProcessHeap () returned 0x4e0000 [0131.092] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x14) returned 0x4f8458 [0131.092] GetProcessHeap () returned 0x4e0000 [0131.092] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4fc778 [0131.092] GetProcessHeap () returned 0x4e0000 [0131.092] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x16) returned 0x4f8478 [0131.092] GetProcessHeap () returned 0x4e0000 [0131.092] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4fc788 [0131.092] GetProcessHeap () returned 0x4e0000 [0131.092] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x1c) returned 0x4f80b0 [0131.092] GetProcessHeap () returned 0x4e0000 [0131.092] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4fc798 [0131.092] GetProcessHeap () returned 0x4e0000 [0131.092] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x1e) returned 0x4f80d8 [0131.092] GetProcessHeap () returned 0x4e0000 [0131.092] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4fc7a8 [0131.092] GetProcessHeap () returned 0x4e0000 [0131.092] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8498 [0131.092] GetProcessHeap () returned 0x4e0000 [0131.092] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4fc7b8 [0131.092] GetProcessHeap () returned 0x4e0000 [0131.092] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x26) returned 0x4fe4a0 [0131.092] GetProcessHeap () returned 0x4e0000 [0131.092] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4fc7c8 [0131.093] GetProcessHeap () returned 0x4e0000 [0131.093] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x14) returned 0x4f84b8 [0131.093] GetProcessHeap () returned 0x4e0000 [0131.093] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4fc7d8 [0131.093] GetProcessHeap () returned 0x4e0000 [0131.093] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x1a) returned 0x4f8100 [0131.093] GetProcessHeap () returned 0x4e0000 [0131.093] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4fc7e8 [0131.093] GetProcessHeap () returned 0x4e0000 [0131.093] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x1a) returned 0x4f8128 [0131.093] GetProcessHeap () returned 0x4e0000 [0131.093] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4fc7f8 [0131.093] GetProcessHeap () returned 0x4e0000 [0131.093] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x14) returned 0x4f84d8 [0131.093] GetProcessHeap () returned 0x4e0000 [0131.093] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4fc808 [0131.093] GetProcessHeap () returned 0x4e0000 [0131.093] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f84f8 [0131.093] GetProcessHeap () returned 0x4e0000 [0131.093] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4fc818 [0131.093] GetProcessHeap () returned 0x4e0000 [0131.093] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8518 [0131.093] GetProcessHeap () returned 0x4e0000 [0131.093] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4fc828 [0131.093] GetProcessHeap () returned 0x4e0000 [0131.093] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x1a) returned 0x4f8150 [0131.093] GetProcessHeap () returned 0x4e0000 [0131.093] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4fc838 [0131.093] GetProcessHeap () returned 0x4e0000 [0131.093] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x14) returned 0x4f8538 [0131.093] GetProcessHeap () returned 0x4e0000 [0131.093] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4fc848 [0131.093] GetProcessHeap () returned 0x4e0000 [0131.093] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x16) returned 0x4f8558 [0131.093] GetProcessHeap () returned 0x4e0000 [0131.093] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4fc858 [0131.093] GetProcessHeap () returned 0x4e0000 [0131.093] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x1a) returned 0x4f8178 [0131.093] GetProcessHeap () returned 0x4e0000 [0131.093] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4fc868 [0131.094] GetProcessHeap () returned 0x4e0000 [0131.094] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x4f81a0 [0131.094] GetProcessHeap () returned 0x4e0000 [0131.094] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4fc878 [0131.094] GetProcessHeap () returned 0x4e0000 [0131.094] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x14) returned 0x4f8578 [0131.094] GetProcessHeap () returned 0x4e0000 [0131.094] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4fc888 [0131.094] GetProcessHeap () returned 0x4e0000 [0131.094] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8598 [0131.094] GetProcessHeap () returned 0x4e0000 [0131.094] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4fc898 [0131.094] GetProcessHeap () returned 0x4e0000 [0131.094] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f85b8 [0131.094] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x10c [0131.100] Process32FirstW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0131.100] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x47, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0131.100] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0131.100] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0131.103] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0131.103] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0131.104] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0131.104] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0131.104] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0131.104] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0131.104] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0131.105] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0131.105] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0131.105] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0131.106] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0131.106] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0131.106] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0131.106] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0131.106] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0131.107] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0131.107] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0131.107] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0131.107] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0131.108] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0131.108] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="wiring.exe")) returned 1 [0131.108] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="deborah frames food.exe")) returned 1 [0131.108] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="influence-yr-pizza.exe")) returned 1 [0131.109] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="sims.exe")) returned 1 [0131.109] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="organizational.exe")) returned 1 [0131.109] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="dynamics.exe")) returned 1 [0131.109] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="italic.exe")) returned 1 [0131.110] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="knock.exe")) returned 1 [0131.110] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leisure constitute warcraft.exe")) returned 1 [0131.110] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="finger.exe")) returned 1 [0131.110] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="allows holly notice.exe")) returned 1 [0131.111] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="organizeellis.exe")) returned 1 [0131.111] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x40c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="canada_watch.exe")) returned 1 [0131.111] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="consumer_dec.exe")) returned 1 [0131.111] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fonthood.exe")) returned 1 [0131.112] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0131.112] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0131.112] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0131.112] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0131.113] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0131.113] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0131.113] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0131.113] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0131.114] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0131.114] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0131.114] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0131.114] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x48c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0131.115] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x790, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0131.115] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0131.115] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0131.115] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0131.116] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0131.116] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0131.116] OpenProcess (dwDesiredAccess=0x1, bInheritHandle=0, dwProcessId=0x3f8) returned 0xb0 [0131.116] TerminateProcess (hProcess=0xb0, uExitCode=0xffffffff) returned 1 [0131.118] CloseHandle (hObject=0xb0) returned 1 [0131.118] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0131.119] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0131.119] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0131.120] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0131.120] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0131.120] OpenProcess (dwDesiredAccess=0x1, bInheritHandle=0, dwProcessId=0x844) returned 0xb0 [0131.120] TerminateProcess (hProcess=0xb0, uExitCode=0xffffffff) returned 1 [0131.136] CloseHandle (hObject=0xb0) returned 1 [0131.136] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0131.137] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0131.137] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0131.138] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0131.138] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0131.138] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0131.139] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0131.139] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0131.139] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0131.140] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0131.140] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0131.141] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0131.141] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0131.141] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0131.141] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0131.142] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0131.142] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0131.142] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0131.143] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0131.143] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0131.143] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="past-accessing.exe")) returned 1 [0131.144] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="permission.exe")) returned 1 [0131.144] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="warnings.exe")) returned 1 [0131.144] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="training directors mistakes.exe")) returned 1 [0131.145] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0131.145] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0131.145] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0131.146] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb9c, pcPriClassBase=8, dwFlags=0x0, szExeFile="QDgotnX2VapbkvCb.exe")) returned 1 [0131.146] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0131.147] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0131.147] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0131.147] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0131.148] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="QDgotnX2VapbkvCb.exe")) returned 1 [0131.148] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0131.148] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="wbengine.exe")) returned 1 [0131.148] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="vdsldr.exe")) returned 1 [0131.149] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="vds.exe")) returned 1 [0131.149] Process32NextW (in: hSnapshot=0x10c, lppe=0x18fccc | out: lppe=0x18fccc*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="vds.exe")) returned 0 [0131.149] CloseHandle (hObject=0x10c) returned 1 [0131.149] GetProcessHeap () returned 0x4e0000 [0131.150] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f9a00 | out: hHeap=0x4e0000) returned 1 [0131.150] GetProcessHeap () returned 0x4e0000 [0131.150] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f7d90 | out: hHeap=0x4e0000) returned 1 [0131.150] GetProcessHeap () returned 0x4e0000 [0131.150] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fc648 | out: hHeap=0x4e0000) returned 1 [0131.150] GetProcessHeap () returned 0x4e0000 [0131.150] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f7ea8 | out: hHeap=0x4e0000) returned 1 [0131.150] GetProcessHeap () returned 0x4e0000 [0131.150] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fc658 | out: hHeap=0x4e0000) returned 1 [0131.150] GetProcessHeap () returned 0x4e0000 [0131.150] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f7de0 | out: hHeap=0x4e0000) returned 1 [0131.150] GetProcessHeap () returned 0x4e0000 [0131.150] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fc668 | out: hHeap=0x4e0000) returned 1 [0131.150] GetProcessHeap () returned 0x4e0000 [0131.150] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f7e08 | out: hHeap=0x4e0000) returned 1 [0131.150] GetProcessHeap () returned 0x4e0000 [0131.150] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fc678 | out: hHeap=0x4e0000) returned 1 [0131.150] GetProcessHeap () returned 0x4e0000 [0131.150] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f7f20 | out: hHeap=0x4e0000) returned 1 [0131.150] GetProcessHeap () returned 0x4e0000 [0131.150] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fc688 | out: hHeap=0x4e0000) returned 1 [0131.150] GetProcessHeap () returned 0x4e0000 [0131.150] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f83d8 | out: hHeap=0x4e0000) returned 1 [0131.150] GetProcessHeap () returned 0x4e0000 [0131.150] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fc698 | out: hHeap=0x4e0000) returned 1 [0131.150] GetProcessHeap () returned 0x4e0000 [0131.150] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f83f8 | out: hHeap=0x4e0000) returned 1 [0131.150] GetProcessHeap () returned 0x4e0000 [0131.150] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fc6a8 | out: hHeap=0x4e0000) returned 1 [0131.150] GetProcessHeap () returned 0x4e0000 [0131.150] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f8418 | out: hHeap=0x4e0000) returned 1 [0131.150] GetProcessHeap () returned 0x4e0000 [0131.150] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fc6b8 | out: hHeap=0x4e0000) returned 1 [0131.150] GetProcessHeap () returned 0x4e0000 [0131.150] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f7f70 | out: hHeap=0x4e0000) returned 1 [0131.150] GetProcessHeap () returned 0x4e0000 [0131.150] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fc6c8 | out: hHeap=0x4e0000) returned 1 [0131.150] GetProcessHeap () returned 0x4e0000 [0131.150] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f7fe8 | out: hHeap=0x4e0000) returned 1 [0131.150] GetProcessHeap () returned 0x4e0000 [0131.151] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fc6d8 | out: hHeap=0x4e0000) returned 1 [0131.151] GetProcessHeap () returned 0x4e0000 [0131.151] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f9820 | out: hHeap=0x4e0000) returned 1 [0131.151] GetProcessHeap () returned 0x4e0000 [0131.151] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fc6e8 | out: hHeap=0x4e0000) returned 1 [0131.151] GetProcessHeap () returned 0x4e0000 [0131.151] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f8010 | out: hHeap=0x4e0000) returned 1 [0131.151] GetProcessHeap () returned 0x4e0000 [0131.151] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fc6f8 | out: hHeap=0x4e0000) returned 1 [0131.151] GetProcessHeap () returned 0x4e0000 [0131.151] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f8038 | out: hHeap=0x4e0000) returned 1 [0131.151] GetProcessHeap () returned 0x4e0000 [0131.151] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fc708 | out: hHeap=0x4e0000) returned 1 [0131.151] GetProcessHeap () returned 0x4e0000 [0131.151] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0131.151] GetProcessHeap () returned 0x4e0000 [0131.151] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fc718 | out: hHeap=0x4e0000) returned 1 [0131.151] GetProcessHeap () returned 0x4e0000 [0131.151] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f8060 | out: hHeap=0x4e0000) returned 1 [0131.151] GetProcessHeap () returned 0x4e0000 [0131.151] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fc728 | out: hHeap=0x4e0000) returned 1 [0131.151] GetProcessHeap () returned 0x4e0000 [0131.151] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f8438 | out: hHeap=0x4e0000) returned 1 [0131.151] GetProcessHeap () returned 0x4e0000 [0131.151] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fc738 | out: hHeap=0x4e0000) returned 1 [0131.151] GetProcessHeap () returned 0x4e0000 [0131.151] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fe470 | out: hHeap=0x4e0000) returned 1 [0131.151] GetProcessHeap () returned 0x4e0000 [0131.151] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fc748 | out: hHeap=0x4e0000) returned 1 [0131.151] GetProcessHeap () returned 0x4e0000 [0131.151] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f8088 | out: hHeap=0x4e0000) returned 1 [0131.151] GetProcessHeap () returned 0x4e0000 [0131.151] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fc758 | out: hHeap=0x4e0000) returned 1 [0131.151] GetProcessHeap () returned 0x4e0000 [0131.151] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f8458 | out: hHeap=0x4e0000) returned 1 [0131.151] GetProcessHeap () returned 0x4e0000 [0131.151] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fc768 | out: hHeap=0x4e0000) returned 1 [0131.151] GetProcessHeap () returned 0x4e0000 [0131.151] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f8478 | out: hHeap=0x4e0000) returned 1 [0131.151] GetProcessHeap () returned 0x4e0000 [0131.151] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fc778 | out: hHeap=0x4e0000) returned 1 [0131.151] GetProcessHeap () returned 0x4e0000 [0131.152] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f80b0 | out: hHeap=0x4e0000) returned 1 [0131.152] GetProcessHeap () returned 0x4e0000 [0131.152] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fc788 | out: hHeap=0x4e0000) returned 1 [0131.152] GetProcessHeap () returned 0x4e0000 [0131.152] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f80d8 | out: hHeap=0x4e0000) returned 1 [0131.152] GetProcessHeap () returned 0x4e0000 [0131.152] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fc798 | out: hHeap=0x4e0000) returned 1 [0131.152] GetProcessHeap () returned 0x4e0000 [0131.152] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f8498 | out: hHeap=0x4e0000) returned 1 [0131.152] GetProcessHeap () returned 0x4e0000 [0131.152] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fc7a8 | out: hHeap=0x4e0000) returned 1 [0131.152] GetProcessHeap () returned 0x4e0000 [0131.152] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fe4a0 | out: hHeap=0x4e0000) returned 1 [0131.152] GetProcessHeap () returned 0x4e0000 [0131.152] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fc7b8 | out: hHeap=0x4e0000) returned 1 [0131.152] GetProcessHeap () returned 0x4e0000 [0131.152] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f84b8 | out: hHeap=0x4e0000) returned 1 [0131.152] GetProcessHeap () returned 0x4e0000 [0131.152] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fc7c8 | out: hHeap=0x4e0000) returned 1 [0131.152] GetProcessHeap () returned 0x4e0000 [0131.152] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f8100 | out: hHeap=0x4e0000) returned 1 [0131.152] GetProcessHeap () returned 0x4e0000 [0131.152] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fc7d8 | out: hHeap=0x4e0000) returned 1 [0131.152] GetProcessHeap () returned 0x4e0000 [0131.152] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f8128 | out: hHeap=0x4e0000) returned 1 [0131.152] GetProcessHeap () returned 0x4e0000 [0131.152] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fc7e8 | out: hHeap=0x4e0000) returned 1 [0131.152] GetProcessHeap () returned 0x4e0000 [0131.152] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f84d8 | out: hHeap=0x4e0000) returned 1 [0131.152] GetProcessHeap () returned 0x4e0000 [0131.152] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fc7f8 | out: hHeap=0x4e0000) returned 1 [0131.152] GetProcessHeap () returned 0x4e0000 [0131.152] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f84f8 | out: hHeap=0x4e0000) returned 1 [0131.152] GetProcessHeap () returned 0x4e0000 [0131.152] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fc808 | out: hHeap=0x4e0000) returned 1 [0131.152] GetProcessHeap () returned 0x4e0000 [0131.152] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f8518 | out: hHeap=0x4e0000) returned 1 [0131.152] GetProcessHeap () returned 0x4e0000 [0131.152] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fc818 | out: hHeap=0x4e0000) returned 1 [0131.152] GetProcessHeap () returned 0x4e0000 [0131.152] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f8150 | out: hHeap=0x4e0000) returned 1 [0131.152] GetProcessHeap () returned 0x4e0000 [0131.153] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fc828 | out: hHeap=0x4e0000) returned 1 [0131.153] GetProcessHeap () returned 0x4e0000 [0131.153] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f8538 | out: hHeap=0x4e0000) returned 1 [0131.153] GetProcessHeap () returned 0x4e0000 [0131.153] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fc838 | out: hHeap=0x4e0000) returned 1 [0131.153] GetProcessHeap () returned 0x4e0000 [0131.153] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f8558 | out: hHeap=0x4e0000) returned 1 [0131.153] GetProcessHeap () returned 0x4e0000 [0131.153] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fc848 | out: hHeap=0x4e0000) returned 1 [0131.153] GetProcessHeap () returned 0x4e0000 [0131.153] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f8178 | out: hHeap=0x4e0000) returned 1 [0131.153] GetProcessHeap () returned 0x4e0000 [0131.153] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fc858 | out: hHeap=0x4e0000) returned 1 [0131.153] GetProcessHeap () returned 0x4e0000 [0131.153] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f81a0 | out: hHeap=0x4e0000) returned 1 [0131.153] GetProcessHeap () returned 0x4e0000 [0131.153] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fc868 | out: hHeap=0x4e0000) returned 1 [0131.153] GetProcessHeap () returned 0x4e0000 [0131.153] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f8578 | out: hHeap=0x4e0000) returned 1 [0131.153] GetProcessHeap () returned 0x4e0000 [0131.153] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fc878 | out: hHeap=0x4e0000) returned 1 [0131.153] GetProcessHeap () returned 0x4e0000 [0131.153] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f8598 | out: hHeap=0x4e0000) returned 1 [0131.153] GetProcessHeap () returned 0x4e0000 [0131.153] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fc888 | out: hHeap=0x4e0000) returned 1 [0131.153] GetProcessHeap () returned 0x4e0000 [0131.153] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f85b8 | out: hHeap=0x4e0000) returned 1 [0131.153] GetProcessHeap () returned 0x4e0000 [0131.153] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fc898 | out: hHeap=0x4e0000) returned 1 [0131.153] GetProcessHeap () returned 0x4e0000 [0131.153] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x4f81a0 [0131.153] CryptImportKey (in: hProv=0x4f0590, pbData=0x18fe70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x4f9820) returned 1 [0131.153] CryptDecrypt (in: hKey=0x4f9820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f81a0, pdwDataLen=0x18fed8 | out: pbData=0x4f81a0, pdwDataLen=0x18fed8) returned 1 [0131.153] CryptDestroyKey (hKey=0x4f9820) returned 1 [0131.153] GetProcessHeap () returned 0x4e0000 [0131.153] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x4f8178 [0131.154] CryptImportKey (in: hProv=0x4f0590, pbData=0x18fe70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x4f9820) returned 1 [0131.154] CryptDecrypt (in: hKey=0x4f9820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f8178, pdwDataLen=0x18fed8 | out: pbData=0x4f8178, pdwDataLen=0x18fed8) returned 1 [0131.154] CryptDestroyKey (hKey=0x4f9820) returned 1 [0131.154] GetProcessHeap () returned 0x4e0000 [0131.154] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x4f8150 [0131.154] CryptImportKey (in: hProv=0x4f0590, pbData=0x18fe70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x4f9820) returned 1 [0131.154] CryptDecrypt (in: hKey=0x4f9820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f8150, pdwDataLen=0x18fed8 | out: pbData=0x4f8150, pdwDataLen=0x18fed8) returned 1 [0131.154] CryptDestroyKey (hKey=0x4f9820) returned 1 [0131.154] GetProcessHeap () returned 0x4e0000 [0131.154] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5390 [0131.154] CryptImportKey (in: hProv=0x4f0590, pbData=0x18fe70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x4f9820) returned 1 [0131.154] CryptDecrypt (in: hKey=0x4f9820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5390, pdwDataLen=0x18fed8 | out: pbData=0x4f5390, pdwDataLen=0x18fed8) returned 1 [0131.154] CryptDestroyKey (hKey=0x4f9820) returned 1 [0131.154] GetProcessHeap () returned 0x4e0000 [0131.154] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10838) returned 0x4fea50 [0131.154] GetProcessHeap () returned 0x4e0000 [0131.154] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x100000) returned 0x22d0020 [0131.155] wsprintfW (in: param_1=0x50ea82, param_2=".[%08X].[%s].%s" | out: param_1=".[4B2E4630].[agares_helpdesk@tutanota.com].moloch") returned 49 [0131.155] GetProcessHeap () returned 0x4e0000 [0131.155] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10058) returned 0x50f290 [0131.155] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4027f0, lpParameter=0x4fea50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10c [0131.156] WaitForSingleObject (hHandle=0x10c, dwMilliseconds=0xffffffff) returned 0x0 [0131.769] CloseHandle (hObject=0x10c) returned 1 [0131.769] GetProcessHeap () returned 0x4e0000 [0131.769] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x22d0020 | out: hHeap=0x4e0000) returned 1 [0131.769] GetProcessHeap () returned 0x4e0000 [0131.769] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fea50 | out: hHeap=0x4e0000) returned 1 [0131.769] GetProcessHeap () returned 0x4e0000 [0131.769] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5390 | out: hHeap=0x4e0000) returned 1 [0131.769] GetProcessHeap () returned 0x4e0000 [0131.770] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f8150 | out: hHeap=0x4e0000) returned 1 [0131.770] GetProcessHeap () returned 0x4e0000 [0131.770] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f8178 | out: hHeap=0x4e0000) returned 1 [0131.770] GetProcessHeap () returned 0x4e0000 [0131.770] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f81a0 | out: hHeap=0x4e0000) returned 1 [0131.770] GetProcessHeap () returned 0x4e0000 [0131.770] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x4f81a0 [0131.770] CryptImportKey (in: hProv=0x4f0590, pbData=0x18fe68, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x4f9820) returned 1 [0131.770] CryptDecrypt (in: hKey=0x4f9820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f81a0, pdwDataLen=0x18fed8 | out: pbData=0x4f81a0, pdwDataLen=0x18fed8) returned 1 [0131.770] CryptDestroyKey (hKey=0x4f9820) returned 1 [0131.770] GetProcessHeap () returned 0x4e0000 [0131.770] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x4f8178 [0131.770] CryptImportKey (in: hProv=0x4f0590, pbData=0x18fe68, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x4f9820) returned 1 [0131.770] CryptDecrypt (in: hKey=0x4f9820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f8178, pdwDataLen=0x18fed8 | out: pbData=0x4f8178, pdwDataLen=0x18fed8) returned 1 [0131.770] CryptDestroyKey (hKey=0x4f9820) returned 1 [0131.770] GetProcessHeap () returned 0x4e0000 [0131.770] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x4f8150 [0131.770] CryptImportKey (in: hProv=0x4f0590, pbData=0x18fe68, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x4f9820) returned 1 [0131.770] CryptDecrypt (in: hKey=0x4f9820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f8150, pdwDataLen=0x18fed8 | out: pbData=0x4f8150, pdwDataLen=0x18fed8) returned 1 [0131.770] CryptDestroyKey (hKey=0x4f9820) returned 1 [0131.770] GetProcessHeap () returned 0x4e0000 [0131.770] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5390 [0131.770] CryptImportKey (in: hProv=0x4f0590, pbData=0x18fe68, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x4f9820) returned 1 [0131.770] CryptDecrypt (in: hKey=0x4f9820, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5390, pdwDataLen=0x18fed8 | out: pbData=0x4f5390, pdwDataLen=0x18fed8) returned 1 [0131.770] CryptDestroyKey (hKey=0x4f9820) returned 1 [0131.770] GetProcessHeap () returned 0x4e0000 [0131.770] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x4) returned 0x4fc648 [0131.770] GetProcessHeap () returned 0x4e0000 [0131.770] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x4) returned 0x4fc658 [0131.770] GetProcessHeap () returned 0x4e0000 [0131.770] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10838) returned 0x4fea50 [0131.770] GetProcessHeap () returned 0x4e0000 [0131.771] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x100000) returned 0x22d0020 [0131.771] wsprintfW (in: param_1=0x50ea82, param_2=".[%08X].[%s].%s" | out: param_1=".[4B2E4630].[agares_helpdesk@tutanota.com].moloch") returned 49 [0131.771] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4027f0, lpParameter=0x4fea50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10c [0131.771] WaitForMultipleObjects (nCount=0x1, lpHandles=0x4fc658*=0x10c, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 5 os_tid = 0x780 Thread: id = 33 os_tid = 0xb44 Thread: id = 34 os_tid = 0xb0c Thread: id = 138 os_tid = 0xa68 [0131.162] GetProcessHeap () returned 0x4e0000 [0131.162] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x5c) returned 0x4fca30 [0131.163] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.*", lpFindFileData=0x24dfd20 | out: lpFindFileData=0x24dfd20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdb87c180, ftLastAccessTime.dwHighDateTime=0x1d6eae2, ftLastWriteTime.dwLowDateTime=0xdb87c180, ftLastWriteTime.dwHighDateTime=0x1d6eae2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xffff, cFileName=".", cAlternateFileName="")) returned 0x4f9820 [0131.163] GetProcessHeap () returned 0x4e0000 [0131.163] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fca30 | out: hHeap=0x4e0000) returned 1 [0131.163] FindNextFileW (in: hFindFile=0x4f9820, lpFindFileData=0x24dfd20 | out: lpFindFileData=0x24dfd20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdb87c180, ftLastAccessTime.dwHighDateTime=0x1d6eae2, ftLastWriteTime.dwLowDateTime=0xdb87c180, ftLastWriteTime.dwHighDateTime=0x1d6eae2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xffff, cFileName="..", cAlternateFileName="")) returned 1 [0131.163] FindNextFileW (in: hFindFile=0x4f9820, lpFindFileData=0x24dfd20 | out: lpFindFileData=0x24dfd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80aa8660, ftCreationTime.dwHighDateTime=0x1d5e829, ftLastAccessTime.dwLowDateTime=0x63af1550, ftLastAccessTime.dwHighDateTime=0x1d5dcce, ftLastWriteTime.dwLowDateTime=0x63af1550, ftLastWriteTime.dwHighDateTime=0x1d5dcce, nFileSizeHigh=0x0, nFileSizeLow=0x5672, dwReserved0=0x0, dwReserved1=0xffff, cFileName="5K3gdoBlg.ppt", cAlternateFileName="5K3GDO~1.PPT")) returned 1 [0131.163] GetProcessHeap () returned 0x4e0000 [0131.163] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x25e) returned 0x5202f8 [0131.163] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\5K3gdoBlg.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\5k3gdoblg.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xac [0131.163] GetProcessHeap () returned 0x4e0000 [0131.164] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0131.164] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0131.164] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfcb0 | out: lpNewFilePointer=0x0) returned 1 [0131.164] WriteFile (in: hFile=0xac, lpBuffer=0x24dfcc0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfcc0*, lpNumberOfBytesWritten=0x24dfc98*=0xe, lpOverlapped=0x0) returned 1 [0131.165] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfc9c | out: phKey=0x24dfc9c*=0x4fca30) returned 1 [0131.165] CryptSetKeyParam (hKey=0x4fca30, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.165] GetProcessHeap () returned 0x4e0000 [0131.165] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0131.166] CryptEncrypt (in: hKey=0x4fca30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24dfc78*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24dfc78*=0x40) returned 1 [0131.166] CryptDestroyKey (hKey=0x4fca30) returned 1 [0131.166] WriteFile (in: hFile=0xac, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24dfc98*=0x40, lpOverlapped=0x0) returned 1 [0131.166] WriteFile (in: hFile=0xac, lpBuffer=0x24dfca0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfca0*, lpNumberOfBytesWritten=0x24dfc98*=0x4, lpOverlapped=0x0) returned 1 [0131.166] WriteFile (in: hFile=0xac, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24dfc98*=0x10, lpOverlapped=0x0) returned 1 [0131.166] WriteFile (in: hFile=0xac, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24dfc98*=0x80, lpOverlapped=0x0) returned 1 [0131.166] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfca8 | out: lpNewFilePointer=0x0) returned 1 [0131.166] WriteFile (in: hFile=0xac, lpBuffer=0x24dfcb8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfcb8*, lpNumberOfBytesWritten=0x24dfc98*=0x8, lpOverlapped=0x0) returned 1 [0131.167] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfc9c | out: phKey=0x24dfc9c*=0x4fca30) returned 1 [0131.167] CryptSetKeyParam (hKey=0x4fca30, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.167] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.167] ReadFile (in: hFile=0xac, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5672, lpNumberOfBytesRead=0x24dfc50, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24dfc50*=0x5672, lpOverlapped=0x0) returned 1 [0131.167] CryptEncrypt (in: hKey=0x4fca30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24dfc58*=0x5680, dwBufLen=0x5680 | out: pbData=0x22d0020*, pdwDataLen=0x24dfc58*=0x5680) returned 1 [0131.167] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.167] WriteFile (in: hFile=0xac, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5680, lpNumberOfBytesWritten=0x24dfc54, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24dfc54*=0x5680, lpOverlapped=0x0) returned 1 [0131.167] CryptDestroyKey (hKey=0x4fca30) returned 1 [0131.167] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x5754, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.168] SetEndOfFile (hFile=0xac) returned 1 [0131.171] GetProcessHeap () returned 0x4e0000 [0131.171] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0131.171] GetProcessHeap () returned 0x4e0000 [0131.171] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0131.171] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\5K3gdoBlg.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\5k3gdoblg.ppt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\5K3gdoBlg.ppt.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\5k3gdoblg.ppt.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0131.175] CloseHandle (hObject=0xac) returned 1 [0131.175] FindNextFileW (in: hFindFile=0x4f9820, lpFindFileData=0x24dfd20 | out: lpFindFileData=0x24dfd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26ae72f0, ftCreationTime.dwHighDateTime=0x1d5dacf, ftLastAccessTime.dwLowDateTime=0x9da144b0, ftLastAccessTime.dwHighDateTime=0x1d5e71c, ftLastWriteTime.dwLowDateTime=0x9da144b0, ftLastWriteTime.dwHighDateTime=0x1d5e71c, nFileSizeHigh=0x0, nFileSizeLow=0xc92d, dwReserved0=0x0, dwReserved1=0xffff, cFileName="b7Yg9V3.csv", cAlternateFileName="")) returned 1 [0131.175] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\b7Yg9V3.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\b7yg9v3.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xac [0131.175] GetProcessHeap () returned 0x4e0000 [0131.175] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0131.175] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0131.175] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfcb0 | out: lpNewFilePointer=0x0) returned 1 [0131.175] WriteFile (in: hFile=0xac, lpBuffer=0x24dfcc0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfcc0*, lpNumberOfBytesWritten=0x24dfc98*=0x3, lpOverlapped=0x0) returned 1 [0131.176] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfc9c | out: phKey=0x24dfc9c*=0x4fca30) returned 1 [0131.176] CryptSetKeyParam (hKey=0x4fca30, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.176] GetProcessHeap () returned 0x4e0000 [0131.176] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0131.176] CryptEncrypt (in: hKey=0x4fca30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24dfc78*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24dfc78*=0x40) returned 1 [0131.176] CryptDestroyKey (hKey=0x4fca30) returned 1 [0131.176] WriteFile (in: hFile=0xac, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24dfc98*=0x40, lpOverlapped=0x0) returned 1 [0131.176] WriteFile (in: hFile=0xac, lpBuffer=0x24dfca0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfca0*, lpNumberOfBytesWritten=0x24dfc98*=0x4, lpOverlapped=0x0) returned 1 [0131.176] WriteFile (in: hFile=0xac, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24dfc98*=0x10, lpOverlapped=0x0) returned 1 [0131.176] WriteFile (in: hFile=0xac, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24dfc98*=0x80, lpOverlapped=0x0) returned 1 [0131.177] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfca8 | out: lpNewFilePointer=0x0) returned 1 [0131.177] WriteFile (in: hFile=0xac, lpBuffer=0x24dfcb8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfcb8*, lpNumberOfBytesWritten=0x24dfc98*=0x8, lpOverlapped=0x0) returned 1 [0131.177] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfc9c | out: phKey=0x24dfc9c*=0x4fca30) returned 1 [0131.177] CryptSetKeyParam (hKey=0x4fca30, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.177] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.177] ReadFile (in: hFile=0xac, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xc92d, lpNumberOfBytesRead=0x24dfc50, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24dfc50*=0xc92d, lpOverlapped=0x0) returned 1 [0131.177] CryptEncrypt (in: hKey=0x4fca30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24dfc58*=0xc930, dwBufLen=0xc930 | out: pbData=0x22d0020*, pdwDataLen=0x24dfc58*=0xc930) returned 1 [0131.178] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.178] WriteFile (in: hFile=0xac, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc930, lpNumberOfBytesWritten=0x24dfc54, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24dfc54*=0xc930, lpOverlapped=0x0) returned 1 [0131.178] CryptDestroyKey (hKey=0x4fca30) returned 1 [0131.178] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0xca04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.178] SetEndOfFile (hFile=0xac) returned 1 [0131.181] GetProcessHeap () returned 0x4e0000 [0131.181] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0131.181] GetProcessHeap () returned 0x4e0000 [0131.181] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0131.181] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\b7Yg9V3.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\b7yg9v3.csv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\b7Yg9V3.csv.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\b7yg9v3.csv.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0131.185] CloseHandle (hObject=0xac) returned 1 [0131.185] FindNextFileW (in: hFindFile=0x4f9820, lpFindFileData=0x24dfd20 | out: lpFindFileData=0x24dfd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0724b60, ftCreationTime.dwHighDateTime=0x1d5e77e, ftLastAccessTime.dwLowDateTime=0x99a70780, ftLastAccessTime.dwHighDateTime=0x1d5e188, ftLastWriteTime.dwLowDateTime=0x99a70780, ftLastWriteTime.dwHighDateTime=0x1d5e188, nFileSizeHigh=0x0, nFileSizeLow=0x17aa1, dwReserved0=0x0, dwReserved1=0xffff, cFileName="BzLVN6t6Lf9s_.wav", cAlternateFileName="BZLVN6~1.WAV")) returned 1 [0131.185] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\BzLVN6t6Lf9s_.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bzlvn6t6lf9s_.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xac [0131.185] GetProcessHeap () returned 0x4e0000 [0131.185] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0131.186] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0131.186] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfcb0 | out: lpNewFilePointer=0x0) returned 1 [0131.186] WriteFile (in: hFile=0xac, lpBuffer=0x24dfcc0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfcc0*, lpNumberOfBytesWritten=0x24dfc98*=0xf, lpOverlapped=0x0) returned 1 [0131.186] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfc9c | out: phKey=0x24dfc9c*=0x4fca30) returned 1 [0131.186] CryptSetKeyParam (hKey=0x4fca30, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.186] GetProcessHeap () returned 0x4e0000 [0131.186] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0131.187] CryptEncrypt (in: hKey=0x4fca30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24dfc78*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24dfc78*=0x40) returned 1 [0131.187] CryptDestroyKey (hKey=0x4fca30) returned 1 [0131.187] WriteFile (in: hFile=0xac, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24dfc98*=0x40, lpOverlapped=0x0) returned 1 [0131.187] WriteFile (in: hFile=0xac, lpBuffer=0x24dfca0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfca0*, lpNumberOfBytesWritten=0x24dfc98*=0x4, lpOverlapped=0x0) returned 1 [0131.187] WriteFile (in: hFile=0xac, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24dfc98*=0x10, lpOverlapped=0x0) returned 1 [0131.187] WriteFile (in: hFile=0xac, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24dfc98*=0x80, lpOverlapped=0x0) returned 1 [0131.187] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfca8 | out: lpNewFilePointer=0x0) returned 1 [0131.187] WriteFile (in: hFile=0xac, lpBuffer=0x24dfcb8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfcb8*, lpNumberOfBytesWritten=0x24dfc98*=0x8, lpOverlapped=0x0) returned 1 [0131.187] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfc9c | out: phKey=0x24dfc9c*=0x4fca30) returned 1 [0131.187] CryptSetKeyParam (hKey=0x4fca30, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.187] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.187] ReadFile (in: hFile=0xac, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x17aa1, lpNumberOfBytesRead=0x24dfc50, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24dfc50*=0x17aa1, lpOverlapped=0x0) returned 1 [0131.188] CryptEncrypt (in: hKey=0x4fca30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24dfc58*=0x17ab0, dwBufLen=0x17ab0 | out: pbData=0x22d0020*, pdwDataLen=0x24dfc58*=0x17ab0) returned 1 [0131.189] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.189] WriteFile (in: hFile=0xac, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x17ab0, lpNumberOfBytesWritten=0x24dfc54, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24dfc54*=0x17ab0, lpOverlapped=0x0) returned 1 [0131.189] CryptDestroyKey (hKey=0x4fca30) returned 1 [0131.189] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x17b84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.189] SetEndOfFile (hFile=0xac) returned 1 [0131.192] GetProcessHeap () returned 0x4e0000 [0131.192] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0131.192] GetProcessHeap () returned 0x4e0000 [0131.193] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0131.193] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\BzLVN6t6Lf9s_.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bzlvn6t6lf9s_.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\BzLVN6t6Lf9s_.wav.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bzlvn6t6lf9s_.wav.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0131.197] CloseHandle (hObject=0xac) returned 1 [0131.198] FindNextFileW (in: hFindFile=0x4f9820, lpFindFileData=0x24dfd20 | out: lpFindFileData=0x24dfd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89fab740, ftCreationTime.dwHighDateTime=0x1d5e6bb, ftLastAccessTime.dwLowDateTime=0xc611f0, ftLastAccessTime.dwHighDateTime=0x1d5e4b2, ftLastWriteTime.dwLowDateTime=0xc611f0, ftLastWriteTime.dwHighDateTime=0x1d5e4b2, nFileSizeHigh=0x0, nFileSizeLow=0x18ad6, dwReserved0=0x0, dwReserved1=0xffff, cFileName="CHUzJlugY9.jpg", cAlternateFileName="CHUZJL~1.JPG")) returned 1 [0131.198] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CHUzJlugY9.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\chuzjlugy9.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xac [0131.198] GetProcessHeap () returned 0x4e0000 [0131.198] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0131.198] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0131.198] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfcb0 | out: lpNewFilePointer=0x0) returned 1 [0131.198] WriteFile (in: hFile=0xac, lpBuffer=0x24dfcc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfcc0*, lpNumberOfBytesWritten=0x24dfc98*=0xa, lpOverlapped=0x0) returned 1 [0131.199] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfc9c | out: phKey=0x24dfc9c*=0x4fca30) returned 1 [0131.199] CryptSetKeyParam (hKey=0x4fca30, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.199] GetProcessHeap () returned 0x4e0000 [0131.199] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0131.199] CryptEncrypt (in: hKey=0x4fca30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24dfc78*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24dfc78*=0x40) returned 1 [0131.199] CryptDestroyKey (hKey=0x4fca30) returned 1 [0131.199] WriteFile (in: hFile=0xac, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24dfc98*=0x40, lpOverlapped=0x0) returned 1 [0131.199] WriteFile (in: hFile=0xac, lpBuffer=0x24dfca0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfca0*, lpNumberOfBytesWritten=0x24dfc98*=0x4, lpOverlapped=0x0) returned 1 [0131.199] WriteFile (in: hFile=0xac, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24dfc98*=0x10, lpOverlapped=0x0) returned 1 [0131.199] WriteFile (in: hFile=0xac, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24dfc98*=0x80, lpOverlapped=0x0) returned 1 [0131.199] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfca8 | out: lpNewFilePointer=0x0) returned 1 [0131.199] WriteFile (in: hFile=0xac, lpBuffer=0x24dfcb8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfcb8*, lpNumberOfBytesWritten=0x24dfc98*=0x8, lpOverlapped=0x0) returned 1 [0131.199] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfc9c | out: phKey=0x24dfc9c*=0x4fca30) returned 1 [0131.199] CryptSetKeyParam (hKey=0x4fca30, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.200] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.200] ReadFile (in: hFile=0xac, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x18ad6, lpNumberOfBytesRead=0x24dfc50, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24dfc50*=0x18ad6, lpOverlapped=0x0) returned 1 [0131.200] CryptEncrypt (in: hKey=0x4fca30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24dfc58*=0x18ae0, dwBufLen=0x18ae0 | out: pbData=0x22d0020*, pdwDataLen=0x24dfc58*=0x18ae0) returned 1 [0131.201] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.201] WriteFile (in: hFile=0xac, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x18ae0, lpNumberOfBytesWritten=0x24dfc54, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24dfc54*=0x18ae0, lpOverlapped=0x0) returned 1 [0131.202] CryptDestroyKey (hKey=0x4fca30) returned 1 [0131.202] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x18bb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.202] SetEndOfFile (hFile=0xac) returned 1 [0131.205] GetProcessHeap () returned 0x4e0000 [0131.205] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0131.205] GetProcessHeap () returned 0x4e0000 [0131.205] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0131.205] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CHUzJlugY9.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\chuzjlugy9.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CHUzJlugY9.jpg.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\chuzjlugy9.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0131.208] CloseHandle (hObject=0xac) returned 1 [0131.208] FindNextFileW (in: hFindFile=0x4f9820, lpFindFileData=0x24dfd20 | out: lpFindFileData=0x24dfd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f6b7db0, ftCreationTime.dwHighDateTime=0x1d5e592, ftLastAccessTime.dwLowDateTime=0x41688370, ftLastAccessTime.dwHighDateTime=0x1d5d81c, ftLastWriteTime.dwLowDateTime=0x41688370, ftLastWriteTime.dwHighDateTime=0x1d5d81c, nFileSizeHigh=0x0, nFileSizeLow=0x2283, dwReserved0=0x0, dwReserved1=0xffff, cFileName="cqb yy.avi", cAlternateFileName="CQBYY~1.AVI")) returned 1 [0131.208] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cqb yy.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cqb yy.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xac [0131.208] GetProcessHeap () returned 0x4e0000 [0131.208] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0131.208] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0131.208] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfcb0 | out: lpNewFilePointer=0x0) returned 1 [0131.208] WriteFile (in: hFile=0xac, lpBuffer=0x24dfcc0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfcc0*, lpNumberOfBytesWritten=0x24dfc98*=0xd, lpOverlapped=0x0) returned 1 [0131.209] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfc9c | out: phKey=0x24dfc9c*=0x4fca30) returned 1 [0131.209] CryptSetKeyParam (hKey=0x4fca30, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.209] GetProcessHeap () returned 0x4e0000 [0131.209] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0131.209] CryptEncrypt (in: hKey=0x4fca30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24dfc78*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24dfc78*=0x30) returned 1 [0131.209] CryptDestroyKey (hKey=0x4fca30) returned 1 [0131.209] WriteFile (in: hFile=0xac, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24dfc98*=0x30, lpOverlapped=0x0) returned 1 [0131.209] WriteFile (in: hFile=0xac, lpBuffer=0x24dfca0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfca0*, lpNumberOfBytesWritten=0x24dfc98*=0x4, lpOverlapped=0x0) returned 1 [0131.209] WriteFile (in: hFile=0xac, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24dfc98*=0x10, lpOverlapped=0x0) returned 1 [0131.209] WriteFile (in: hFile=0xac, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24dfc98*=0x80, lpOverlapped=0x0) returned 1 [0131.210] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfca8 | out: lpNewFilePointer=0x0) returned 1 [0131.210] WriteFile (in: hFile=0xac, lpBuffer=0x24dfcb8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfcb8*, lpNumberOfBytesWritten=0x24dfc98*=0x8, lpOverlapped=0x0) returned 1 [0131.210] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfc9c | out: phKey=0x24dfc9c*=0x4fca30) returned 1 [0131.210] CryptSetKeyParam (hKey=0x4fca30, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.210] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.210] ReadFile (in: hFile=0xac, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2283, lpNumberOfBytesRead=0x24dfc50, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24dfc50*=0x2283, lpOverlapped=0x0) returned 1 [0131.210] CryptEncrypt (in: hKey=0x4fca30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24dfc58*=0x2290, dwBufLen=0x2290 | out: pbData=0x22d0020*, pdwDataLen=0x24dfc58*=0x2290) returned 1 [0131.210] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.210] WriteFile (in: hFile=0xac, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2290, lpNumberOfBytesWritten=0x24dfc54, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24dfc54*=0x2290, lpOverlapped=0x0) returned 1 [0131.210] CryptDestroyKey (hKey=0x4fca30) returned 1 [0131.210] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x2354, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.210] SetEndOfFile (hFile=0xac) returned 1 [0131.213] GetProcessHeap () returned 0x4e0000 [0131.213] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0131.213] GetProcessHeap () returned 0x4e0000 [0131.213] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0131.213] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cqb yy.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cqb yy.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cqb yy.avi.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cqb yy.avi.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0131.215] CloseHandle (hObject=0xac) returned 1 [0131.216] FindNextFileW (in: hFindFile=0x4f9820, lpFindFileData=0x24dfd20 | out: lpFindFileData=0x24dfd20*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0xffff, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0131.216] FindNextFileW (in: hFindFile=0x4f9820, lpFindFileData=0x24dfd20 | out: lpFindFileData=0x24dfd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87abce70, ftCreationTime.dwHighDateTime=0x1d5e7dd, ftLastAccessTime.dwLowDateTime=0x546732e0, ftLastAccessTime.dwHighDateTime=0x1d5e7f9, ftLastWriteTime.dwLowDateTime=0x546732e0, ftLastWriteTime.dwHighDateTime=0x1d5e7f9, nFileSizeHigh=0x0, nFileSizeLow=0x16d38, dwReserved0=0x0, dwReserved1=0xffff, cFileName="DKCxtaDeFHnnl9.bmp", cAlternateFileName="DKCXTA~1.BMP")) returned 1 [0131.216] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\DKCxtaDeFHnnl9.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\dkcxtadefhnnl9.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xac [0131.216] GetProcessHeap () returned 0x4e0000 [0131.216] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0131.216] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0131.216] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfcb0 | out: lpNewFilePointer=0x0) returned 1 [0131.216] WriteFile (in: hFile=0xac, lpBuffer=0x24dfcc0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfcc0*, lpNumberOfBytesWritten=0x24dfc98*=0x8, lpOverlapped=0x0) returned 1 [0131.217] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfc9c | out: phKey=0x24dfc9c*=0x4fca30) returned 1 [0131.217] CryptSetKeyParam (hKey=0x4fca30, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.217] GetProcessHeap () returned 0x4e0000 [0131.217] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0131.217] CryptEncrypt (in: hKey=0x4fca30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24dfc78*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24dfc78*=0x40) returned 1 [0131.217] CryptDestroyKey (hKey=0x4fca30) returned 1 [0131.217] WriteFile (in: hFile=0xac, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24dfc98*=0x40, lpOverlapped=0x0) returned 1 [0131.217] WriteFile (in: hFile=0xac, lpBuffer=0x24dfca0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfca0*, lpNumberOfBytesWritten=0x24dfc98*=0x4, lpOverlapped=0x0) returned 1 [0131.217] WriteFile (in: hFile=0xac, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24dfc98*=0x10, lpOverlapped=0x0) returned 1 [0131.217] WriteFile (in: hFile=0xac, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24dfc98*=0x80, lpOverlapped=0x0) returned 1 [0131.217] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfca8 | out: lpNewFilePointer=0x0) returned 1 [0131.217] WriteFile (in: hFile=0xac, lpBuffer=0x24dfcb8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfcb8*, lpNumberOfBytesWritten=0x24dfc98*=0x8, lpOverlapped=0x0) returned 1 [0131.217] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfc9c | out: phKey=0x24dfc9c*=0x4fca30) returned 1 [0131.217] CryptSetKeyParam (hKey=0x4fca30, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.218] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.218] ReadFile (in: hFile=0xac, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x16d38, lpNumberOfBytesRead=0x24dfc50, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24dfc50*=0x16d38, lpOverlapped=0x0) returned 1 [0131.218] CryptEncrypt (in: hKey=0x4fca30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24dfc58*=0x16d40, dwBufLen=0x16d40 | out: pbData=0x22d0020*, pdwDataLen=0x24dfc58*=0x16d40) returned 1 [0131.219] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.219] WriteFile (in: hFile=0xac, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x16d40, lpNumberOfBytesWritten=0x24dfc54, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24dfc54*=0x16d40, lpOverlapped=0x0) returned 1 [0131.219] CryptDestroyKey (hKey=0x4fca30) returned 1 [0131.219] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x16e14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.220] SetEndOfFile (hFile=0xac) returned 1 [0131.223] GetProcessHeap () returned 0x4e0000 [0131.223] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0131.223] GetProcessHeap () returned 0x4e0000 [0131.223] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0131.223] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\DKCxtaDeFHnnl9.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\dkcxtadefhnnl9.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\DKCxtaDeFHnnl9.bmp.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\dkcxtadefhnnl9.bmp.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0131.226] CloseHandle (hObject=0xac) returned 1 [0131.226] FindNextFileW (in: hFindFile=0x4f9820, lpFindFileData=0x24dfd20 | out: lpFindFileData=0x24dfd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e493700, ftCreationTime.dwHighDateTime=0x1d5e407, ftLastAccessTime.dwLowDateTime=0xe1b54ec0, ftLastAccessTime.dwHighDateTime=0x1d5e475, ftLastWriteTime.dwLowDateTime=0xe1b54ec0, ftLastWriteTime.dwHighDateTime=0x1d5e475, nFileSizeHigh=0x0, nFileSizeLow=0x11d27, dwReserved0=0x0, dwReserved1=0xffff, cFileName="eWZCHi3eLkUgrC9.swf", cAlternateFileName="EWZCHI~1.SWF")) returned 1 [0131.226] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\eWZCHi3eLkUgrC9.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ewzchi3elkugrc9.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xac [0131.227] GetProcessHeap () returned 0x4e0000 [0131.227] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0131.227] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0131.227] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfcb0 | out: lpNewFilePointer=0x0) returned 1 [0131.227] WriteFile (in: hFile=0xac, lpBuffer=0x24dfcc0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfcc0*, lpNumberOfBytesWritten=0x24dfc98*=0x9, lpOverlapped=0x0) returned 1 [0131.228] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfc9c | out: phKey=0x24dfc9c*=0x4fca30) returned 1 [0131.228] CryptSetKeyParam (hKey=0x4fca30, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.228] GetProcessHeap () returned 0x4e0000 [0131.228] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x50) returned 0x4fd470 [0131.228] CryptEncrypt (in: hKey=0x4fca30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fd470*, pdwDataLen=0x24dfc78*=0x50, dwBufLen=0x50 | out: pbData=0x4fd470*, pdwDataLen=0x24dfc78*=0x50) returned 1 [0131.228] CryptDestroyKey (hKey=0x4fca30) returned 1 [0131.228] WriteFile (in: hFile=0xac, lpBuffer=0x4fd470*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4fd470*, lpNumberOfBytesWritten=0x24dfc98*=0x50, lpOverlapped=0x0) returned 1 [0131.228] WriteFile (in: hFile=0xac, lpBuffer=0x24dfca0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfca0*, lpNumberOfBytesWritten=0x24dfc98*=0x4, lpOverlapped=0x0) returned 1 [0131.228] WriteFile (in: hFile=0xac, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24dfc98*=0x10, lpOverlapped=0x0) returned 1 [0131.228] WriteFile (in: hFile=0xac, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24dfc98*=0x80, lpOverlapped=0x0) returned 1 [0131.228] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfca8 | out: lpNewFilePointer=0x0) returned 1 [0131.229] WriteFile (in: hFile=0xac, lpBuffer=0x24dfcb8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfcb8*, lpNumberOfBytesWritten=0x24dfc98*=0x8, lpOverlapped=0x0) returned 1 [0131.229] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfc9c | out: phKey=0x24dfc9c*=0x4fca30) returned 1 [0131.229] CryptSetKeyParam (hKey=0x4fca30, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.229] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.229] ReadFile (in: hFile=0xac, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x11d27, lpNumberOfBytesRead=0x24dfc50, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24dfc50*=0x11d27, lpOverlapped=0x0) returned 1 [0131.229] CryptEncrypt (in: hKey=0x4fca30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24dfc58*=0x11d30, dwBufLen=0x11d30 | out: pbData=0x22d0020*, pdwDataLen=0x24dfc58*=0x11d30) returned 1 [0131.230] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.230] WriteFile (in: hFile=0xac, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x11d30, lpNumberOfBytesWritten=0x24dfc54, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24dfc54*=0x11d30, lpOverlapped=0x0) returned 1 [0131.230] CryptDestroyKey (hKey=0x4fca30) returned 1 [0131.230] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x11e14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.230] SetEndOfFile (hFile=0xac) returned 1 [0131.234] GetProcessHeap () returned 0x4e0000 [0131.234] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fd470 | out: hHeap=0x4e0000) returned 1 [0131.234] GetProcessHeap () returned 0x4e0000 [0131.234] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0131.234] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\eWZCHi3eLkUgrC9.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ewzchi3elkugrc9.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\eWZCHi3eLkUgrC9.swf.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ewzchi3elkugrc9.swf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0131.237] CloseHandle (hObject=0xac) returned 1 [0131.237] FindNextFileW (in: hFindFile=0x4f9820, lpFindFileData=0x24dfd20 | out: lpFindFileData=0x24dfd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79556480, ftCreationTime.dwHighDateTime=0x1d5e0cb, ftLastAccessTime.dwLowDateTime=0xfa69c840, ftLastAccessTime.dwHighDateTime=0x1d5e1e3, ftLastWriteTime.dwLowDateTime=0xfa69c840, ftLastWriteTime.dwHighDateTime=0x1d5e1e3, nFileSizeHigh=0x0, nFileSizeLow=0x169f6, dwReserved0=0x0, dwReserved1=0xffff, cFileName="fhE tWg_t_PnWedmM.ppt", cAlternateFileName="FHETWG~1.PPT")) returned 1 [0131.237] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fhE tWg_t_PnWedmM.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fhe twg_t_pnwedmm.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xac [0131.237] GetProcessHeap () returned 0x4e0000 [0131.237] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0131.238] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0131.238] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfcb0 | out: lpNewFilePointer=0x0) returned 1 [0131.238] WriteFile (in: hFile=0xac, lpBuffer=0x24dfcc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfcc0*, lpNumberOfBytesWritten=0x24dfc98*=0xa, lpOverlapped=0x0) returned 1 [0131.238] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfc9c | out: phKey=0x24dfc9c*=0x4fca30) returned 1 [0131.238] CryptSetKeyParam (hKey=0x4fca30, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.239] GetProcessHeap () returned 0x4e0000 [0131.239] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x50) returned 0x4fd470 [0131.239] CryptEncrypt (in: hKey=0x4fca30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fd470*, pdwDataLen=0x24dfc78*=0x50, dwBufLen=0x50 | out: pbData=0x4fd470*, pdwDataLen=0x24dfc78*=0x50) returned 1 [0131.239] CryptDestroyKey (hKey=0x4fca30) returned 1 [0131.239] WriteFile (in: hFile=0xac, lpBuffer=0x4fd470*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4fd470*, lpNumberOfBytesWritten=0x24dfc98*=0x50, lpOverlapped=0x0) returned 1 [0131.239] WriteFile (in: hFile=0xac, lpBuffer=0x24dfca0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfca0*, lpNumberOfBytesWritten=0x24dfc98*=0x4, lpOverlapped=0x0) returned 1 [0131.239] WriteFile (in: hFile=0xac, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24dfc98*=0x10, lpOverlapped=0x0) returned 1 [0131.239] WriteFile (in: hFile=0xac, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24dfc98*=0x80, lpOverlapped=0x0) returned 1 [0131.240] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfca8 | out: lpNewFilePointer=0x0) returned 1 [0131.240] WriteFile (in: hFile=0xac, lpBuffer=0x24dfcb8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfcb8*, lpNumberOfBytesWritten=0x24dfc98*=0x8, lpOverlapped=0x0) returned 1 [0131.240] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfc9c | out: phKey=0x24dfc9c*=0x4fca30) returned 1 [0131.240] CryptSetKeyParam (hKey=0x4fca30, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.240] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.240] ReadFile (in: hFile=0xac, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x169f6, lpNumberOfBytesRead=0x24dfc50, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24dfc50*=0x169f6, lpOverlapped=0x0) returned 1 [0131.241] CryptEncrypt (in: hKey=0x4fca30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24dfc58*=0x16a00, dwBufLen=0x16a00 | out: pbData=0x22d0020*, pdwDataLen=0x24dfc58*=0x16a00) returned 1 [0131.242] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.242] WriteFile (in: hFile=0xac, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x16a00, lpNumberOfBytesWritten=0x24dfc54, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24dfc54*=0x16a00, lpOverlapped=0x0) returned 1 [0131.242] CryptDestroyKey (hKey=0x4fca30) returned 1 [0131.242] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x16ae4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.242] SetEndOfFile (hFile=0xac) returned 1 [0131.246] GetProcessHeap () returned 0x4e0000 [0131.246] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fd470 | out: hHeap=0x4e0000) returned 1 [0131.246] GetProcessHeap () returned 0x4e0000 [0131.246] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0131.246] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fhE tWg_t_PnWedmM.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fhe twg_t_pnwedmm.ppt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fhE tWg_t_PnWedmM.ppt.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fhe twg_t_pnwedmm.ppt.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0131.251] CloseHandle (hObject=0xac) returned 1 [0131.252] FindNextFileW (in: hFindFile=0x4f9820, lpFindFileData=0x24dfd20 | out: lpFindFileData=0x24dfd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaeb936b0, ftCreationTime.dwHighDateTime=0x1d5df27, ftLastAccessTime.dwLowDateTime=0xe9b80620, ftLastAccessTime.dwHighDateTime=0x1d5e7eb, ftLastWriteTime.dwLowDateTime=0xe9b80620, ftLastWriteTime.dwHighDateTime=0x1d5e7eb, nFileSizeHigh=0x0, nFileSizeLow=0x5847, dwReserved0=0x0, dwReserved1=0xffff, cFileName="Gl2n.ppt", cAlternateFileName="")) returned 1 [0131.252] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Gl2n.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gl2n.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xac [0131.252] GetProcessHeap () returned 0x4e0000 [0131.252] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0131.252] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0131.252] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfcb0 | out: lpNewFilePointer=0x0) returned 1 [0131.252] WriteFile (in: hFile=0xac, lpBuffer=0x24dfcc0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfcc0*, lpNumberOfBytesWritten=0x24dfc98*=0x9, lpOverlapped=0x0) returned 1 [0131.253] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfc9c | out: phKey=0x24dfc9c*=0x4fca30) returned 1 [0131.253] CryptSetKeyParam (hKey=0x4fca30, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.253] GetProcessHeap () returned 0x4e0000 [0131.253] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0131.253] CryptEncrypt (in: hKey=0x4fca30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24dfc78*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24dfc78*=0x30) returned 1 [0131.253] CryptDestroyKey (hKey=0x4fca30) returned 1 [0131.253] WriteFile (in: hFile=0xac, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24dfc98*=0x30, lpOverlapped=0x0) returned 1 [0131.254] WriteFile (in: hFile=0xac, lpBuffer=0x24dfca0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfca0*, lpNumberOfBytesWritten=0x24dfc98*=0x4, lpOverlapped=0x0) returned 1 [0131.254] WriteFile (in: hFile=0xac, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24dfc98*=0x10, lpOverlapped=0x0) returned 1 [0131.254] WriteFile (in: hFile=0xac, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24dfc98*=0x80, lpOverlapped=0x0) returned 1 [0131.254] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfca8 | out: lpNewFilePointer=0x0) returned 1 [0131.254] WriteFile (in: hFile=0xac, lpBuffer=0x24dfcb8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfcb8*, lpNumberOfBytesWritten=0x24dfc98*=0x8, lpOverlapped=0x0) returned 1 [0131.254] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfc9c | out: phKey=0x24dfc9c*=0x4fca30) returned 1 [0131.254] CryptSetKeyParam (hKey=0x4fca30, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.254] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.254] ReadFile (in: hFile=0xac, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5847, lpNumberOfBytesRead=0x24dfc50, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24dfc50*=0x5847, lpOverlapped=0x0) returned 1 [0131.254] CryptEncrypt (in: hKey=0x4fca30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24dfc58*=0x5850, dwBufLen=0x5850 | out: pbData=0x22d0020*, pdwDataLen=0x24dfc58*=0x5850) returned 1 [0131.255] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.255] WriteFile (in: hFile=0xac, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5850, lpNumberOfBytesWritten=0x24dfc54, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24dfc54*=0x5850, lpOverlapped=0x0) returned 1 [0131.255] CryptDestroyKey (hKey=0x4fca30) returned 1 [0131.255] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x5914, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.255] SetEndOfFile (hFile=0xac) returned 1 [0131.258] GetProcessHeap () returned 0x4e0000 [0131.258] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0131.258] GetProcessHeap () returned 0x4e0000 [0131.258] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0131.258] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Gl2n.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gl2n.ppt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Gl2n.ppt.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gl2n.ppt.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0131.268] CloseHandle (hObject=0xac) returned 1 [0131.269] FindNextFileW (in: hFindFile=0x4f9820, lpFindFileData=0x24dfd20 | out: lpFindFileData=0x24dfd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c786de0, ftCreationTime.dwHighDateTime=0x1d5e2fe, ftLastAccessTime.dwLowDateTime=0x549325a0, ftLastAccessTime.dwHighDateTime=0x1d5e13a, ftLastWriteTime.dwLowDateTime=0x549325a0, ftLastWriteTime.dwHighDateTime=0x1d5e13a, nFileSizeHigh=0x0, nFileSizeLow=0xb750, dwReserved0=0x0, dwReserved1=0xffff, cFileName="Gpt4_-2dPkKgmz.mp4", cAlternateFileName="GPT4_-~1.MP4")) returned 1 [0131.269] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Gpt4_-2dPkKgmz.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gpt4_-2dpkkgmz.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xac [0131.269] GetProcessHeap () returned 0x4e0000 [0131.269] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0131.269] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0131.269] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfcb0 | out: lpNewFilePointer=0x0) returned 1 [0131.269] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfc9c | out: phKey=0x24dfc9c*=0x4fca30) returned 1 [0131.269] CryptSetKeyParam (hKey=0x4fca30, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.269] GetProcessHeap () returned 0x4e0000 [0131.269] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0131.269] CryptEncrypt (in: hKey=0x4fca30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24dfc78*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24dfc78*=0x40) returned 1 [0131.269] CryptDestroyKey (hKey=0x4fca30) returned 1 [0131.269] WriteFile (in: hFile=0xac, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24dfc98*=0x40, lpOverlapped=0x0) returned 1 [0131.270] WriteFile (in: hFile=0xac, lpBuffer=0x24dfca0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfca0*, lpNumberOfBytesWritten=0x24dfc98*=0x4, lpOverlapped=0x0) returned 1 [0131.270] WriteFile (in: hFile=0xac, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24dfc98*=0x10, lpOverlapped=0x0) returned 1 [0131.270] WriteFile (in: hFile=0xac, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24dfc98*=0x80, lpOverlapped=0x0) returned 1 [0131.270] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfca8 | out: lpNewFilePointer=0x0) returned 1 [0131.270] WriteFile (in: hFile=0xac, lpBuffer=0x24dfcb8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfcb8*, lpNumberOfBytesWritten=0x24dfc98*=0x8, lpOverlapped=0x0) returned 1 [0131.270] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfc9c | out: phKey=0x24dfc9c*=0x4fca30) returned 1 [0131.271] CryptSetKeyParam (hKey=0x4fca30, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.271] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.271] ReadFile (in: hFile=0xac, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb750, lpNumberOfBytesRead=0x24dfc50, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24dfc50*=0xb750, lpOverlapped=0x0) returned 1 [0131.271] CryptEncrypt (in: hKey=0x4fca30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24dfc58*=0xb750, dwBufLen=0xb750 | out: pbData=0x22d0020*, pdwDataLen=0x24dfc58*=0xb750) returned 1 [0131.271] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.271] WriteFile (in: hFile=0xac, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xb750, lpNumberOfBytesWritten=0x24dfc54, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24dfc54*=0xb750, lpOverlapped=0x0) returned 1 [0131.272] CryptDestroyKey (hKey=0x4fca30) returned 1 [0131.272] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0xb824, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.272] SetEndOfFile (hFile=0xac) returned 1 [0131.275] GetProcessHeap () returned 0x4e0000 [0131.275] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0131.275] GetProcessHeap () returned 0x4e0000 [0131.275] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0131.275] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Gpt4_-2dPkKgmz.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gpt4_-2dpkkgmz.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Gpt4_-2dPkKgmz.mp4.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gpt4_-2dpkkgmz.mp4.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0131.279] CloseHandle (hObject=0xac) returned 1 [0131.279] FindNextFileW (in: hFindFile=0x4f9820, lpFindFileData=0x24dfd20 | out: lpFindFileData=0x24dfd20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89bd7dc0, ftCreationTime.dwHighDateTime=0x1d5e2b6, ftLastAccessTime.dwLowDateTime=0x7c5bc6b0, ftLastAccessTime.dwHighDateTime=0x1d5e33c, ftLastWriteTime.dwLowDateTime=0x7c5bc6b0, ftLastWriteTime.dwHighDateTime=0x1d5e33c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xffff, cFileName="gvDuBJ", cAlternateFileName="")) returned 1 [0131.279] GetProcessHeap () returned 0x4e0000 [0131.279] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6a) returned 0x4fa058 [0131.279] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gvDuBJ\\*.*", lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89bd7dc0, ftCreationTime.dwHighDateTime=0x1d5e2b6, ftLastAccessTime.dwLowDateTime=0x7c5bc6b0, ftLastAccessTime.dwHighDateTime=0x1d5e33c, ftLastWriteTime.dwLowDateTime=0x7c5bc6b0, ftLastWriteTime.dwHighDateTime=0x1d5e33c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24dfba4, dwReserved1=0x77c7389e, cFileName=".", cAlternateFileName="")) returned 0x4fca30 [0131.279] GetProcessHeap () returned 0x4e0000 [0131.279] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0131.279] FindNextFileW (in: hFindFile=0x4fca30, lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89bd7dc0, ftCreationTime.dwHighDateTime=0x1d5e2b6, ftLastAccessTime.dwLowDateTime=0x7c5bc6b0, ftLastAccessTime.dwHighDateTime=0x1d5e33c, ftLastWriteTime.dwLowDateTime=0x7c5bc6b0, ftLastWriteTime.dwHighDateTime=0x1d5e33c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24dfba4, dwReserved1=0x77c7389e, cFileName="..", cAlternateFileName="")) returned 1 [0131.279] FindNextFileW (in: hFindFile=0x4fca30, lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ac7b420, ftCreationTime.dwHighDateTime=0x1d5e19f, ftLastAccessTime.dwLowDateTime=0x3a061130, ftLastAccessTime.dwHighDateTime=0x1d5e661, ftLastWriteTime.dwLowDateTime=0x3a061130, ftLastWriteTime.dwHighDateTime=0x1d5e661, nFileSizeHigh=0x0, nFileSizeLow=0x48dd, dwReserved0=0x24dfba4, dwReserved1=0x77c7389e, cFileName="-B9r-KtnTtb6sFmY.jpg", cAlternateFileName="-B9R-K~1.JPG")) returned 1 [0131.279] GetProcessHeap () returned 0x4e0000 [0131.279] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x26c) returned 0x521568 [0131.279] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gvDuBJ\\-B9r-KtnTtb6sFmY.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gvdubj\\-b9r-ktnttb6sfmy.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa4 [0131.280] GetProcessHeap () returned 0x4e0000 [0131.280] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0131.280] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0131.280] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfa20 | out: lpNewFilePointer=0x0) returned 1 [0131.280] WriteFile (in: hFile=0xa4, lpBuffer=0x24dfa30*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x24dfa30*, lpNumberOfBytesWritten=0x24dfa08*=0x3, lpOverlapped=0x0) returned 1 [0131.281] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfa0c | out: phKey=0x24dfa0c*=0x4fa058) returned 1 [0131.281] CryptSetKeyParam (hKey=0x4fa058, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.281] GetProcessHeap () returned 0x4e0000 [0131.281] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x50) returned 0x4fd470 [0131.281] CryptEncrypt (in: hKey=0x4fa058, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fd470*, pdwDataLen=0x24df9e8*=0x50, dwBufLen=0x50 | out: pbData=0x4fd470*, pdwDataLen=0x24df9e8*=0x50) returned 1 [0131.281] CryptDestroyKey (hKey=0x4fa058) returned 1 [0131.281] WriteFile (in: hFile=0xa4, lpBuffer=0x4fd470*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x4fd470*, lpNumberOfBytesWritten=0x24dfa08*=0x50, lpOverlapped=0x0) returned 1 [0131.281] WriteFile (in: hFile=0xa4, lpBuffer=0x24dfa10*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x24dfa10*, lpNumberOfBytesWritten=0x24dfa08*=0x4, lpOverlapped=0x0) returned 1 [0131.281] WriteFile (in: hFile=0xa4, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24dfa08*=0x10, lpOverlapped=0x0) returned 1 [0131.281] WriteFile (in: hFile=0xa4, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24dfa08*=0x80, lpOverlapped=0x0) returned 1 [0131.281] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfa18 | out: lpNewFilePointer=0x0) returned 1 [0131.281] WriteFile (in: hFile=0xa4, lpBuffer=0x24dfa28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x24dfa28*, lpNumberOfBytesWritten=0x24dfa08*=0x8, lpOverlapped=0x0) returned 1 [0131.281] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfa0c | out: phKey=0x24dfa0c*=0x4fa058) returned 1 [0131.281] CryptSetKeyParam (hKey=0x4fa058, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.281] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.281] ReadFile (in: hFile=0xa4, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x48dd, lpNumberOfBytesRead=0x24df9c0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df9c0*=0x48dd, lpOverlapped=0x0) returned 1 [0131.282] CryptEncrypt (in: hKey=0x4fa058, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df9c8*=0x48e0, dwBufLen=0x48e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df9c8*=0x48e0) returned 1 [0131.282] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.282] WriteFile (in: hFile=0xa4, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x48e0, lpNumberOfBytesWritten=0x24df9c4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df9c4*=0x48e0, lpOverlapped=0x0) returned 1 [0131.282] CryptDestroyKey (hKey=0x4fa058) returned 1 [0131.282] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x49c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.282] SetEndOfFile (hFile=0xa4) returned 1 [0131.284] GetProcessHeap () returned 0x4e0000 [0131.284] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fd470 | out: hHeap=0x4e0000) returned 1 [0131.284] GetProcessHeap () returned 0x4e0000 [0131.285] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0131.285] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gvDuBJ\\-B9r-KtnTtb6sFmY.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gvdubj\\-b9r-ktnttb6sfmy.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gvDuBJ\\-B9r-KtnTtb6sFmY.jpg.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gvdubj\\-b9r-ktnttb6sfmy.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0131.285] CloseHandle (hObject=0xa4) returned 1 [0131.286] FindNextFileW (in: hFindFile=0x4fca30, lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf42ea990, ftCreationTime.dwHighDateTime=0x1d5e072, ftLastAccessTime.dwLowDateTime=0x496e1980, ftLastAccessTime.dwHighDateTime=0x1d5d83b, ftLastWriteTime.dwLowDateTime=0x496e1980, ftLastWriteTime.dwHighDateTime=0x1d5d83b, nFileSizeHigh=0x0, nFileSizeLow=0x102f2, dwReserved0=0x24dfba4, dwReserved1=0x77c7389e, cFileName="8Yobms8rZN7qFP.ots", cAlternateFileName="8YOBMS~1.OTS")) returned 1 [0131.286] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gvDuBJ\\8Yobms8rZN7qFP.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gvdubj\\8yobms8rzn7qfp.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa4 [0131.286] GetProcessHeap () returned 0x4e0000 [0131.286] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0131.286] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0131.286] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfa20 | out: lpNewFilePointer=0x0) returned 1 [0131.286] WriteFile (in: hFile=0xa4, lpBuffer=0x24dfa30*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x24dfa30*, lpNumberOfBytesWritten=0x24dfa08*=0xe, lpOverlapped=0x0) returned 1 [0131.287] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfa0c | out: phKey=0x24dfa0c*=0x4fa058) returned 1 [0131.287] CryptSetKeyParam (hKey=0x4fa058, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.287] GetProcessHeap () returned 0x4e0000 [0131.287] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0131.287] CryptEncrypt (in: hKey=0x4fa058, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df9e8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df9e8*=0x40) returned 1 [0131.287] CryptDestroyKey (hKey=0x4fa058) returned 1 [0131.287] WriteFile (in: hFile=0xa4, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24dfa08*=0x40, lpOverlapped=0x0) returned 1 [0131.287] WriteFile (in: hFile=0xa4, lpBuffer=0x24dfa10*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x24dfa10*, lpNumberOfBytesWritten=0x24dfa08*=0x4, lpOverlapped=0x0) returned 1 [0131.287] WriteFile (in: hFile=0xa4, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24dfa08*=0x10, lpOverlapped=0x0) returned 1 [0131.287] WriteFile (in: hFile=0xa4, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24dfa08*=0x80, lpOverlapped=0x0) returned 1 [0131.287] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfa18 | out: lpNewFilePointer=0x0) returned 1 [0131.287] WriteFile (in: hFile=0xa4, lpBuffer=0x24dfa28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x24dfa28*, lpNumberOfBytesWritten=0x24dfa08*=0x8, lpOverlapped=0x0) returned 1 [0131.287] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfa0c | out: phKey=0x24dfa0c*=0x4fa058) returned 1 [0131.287] CryptSetKeyParam (hKey=0x4fa058, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.287] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.288] ReadFile (in: hFile=0xa4, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x102f2, lpNumberOfBytesRead=0x24df9c0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df9c0*=0x102f2, lpOverlapped=0x0) returned 1 [0131.288] CryptEncrypt (in: hKey=0x4fa058, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df9c8*=0x10300, dwBufLen=0x10300 | out: pbData=0x22d0020*, pdwDataLen=0x24df9c8*=0x10300) returned 1 [0131.289] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.289] WriteFile (in: hFile=0xa4, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x10300, lpNumberOfBytesWritten=0x24df9c4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df9c4*=0x10300, lpOverlapped=0x0) returned 1 [0131.289] CryptDestroyKey (hKey=0x4fa058) returned 1 [0131.289] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x103d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.289] SetEndOfFile (hFile=0xa4) returned 1 [0131.292] GetProcessHeap () returned 0x4e0000 [0131.292] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0131.292] GetProcessHeap () returned 0x4e0000 [0131.292] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0131.292] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gvDuBJ\\8Yobms8rZN7qFP.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gvdubj\\8yobms8rzn7qfp.ots"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gvDuBJ\\8Yobms8rZN7qFP.ots.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gvdubj\\8yobms8rzn7qfp.ots.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0131.293] CloseHandle (hObject=0xa4) returned 1 [0131.293] FindNextFileW (in: hFindFile=0x4fca30, lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe34de540, ftCreationTime.dwHighDateTime=0x1d5dc13, ftLastAccessTime.dwLowDateTime=0x82f04dc0, ftLastAccessTime.dwHighDateTime=0x1d5d92d, ftLastWriteTime.dwLowDateTime=0x82f04dc0, ftLastWriteTime.dwHighDateTime=0x1d5d92d, nFileSizeHigh=0x0, nFileSizeLow=0x13569, dwReserved0=0x24dfba4, dwReserved1=0x77c7389e, cFileName="Fi_B6.wav", cAlternateFileName="")) returned 1 [0131.293] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gvDuBJ\\Fi_B6.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gvdubj\\fi_b6.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa4 [0131.293] GetProcessHeap () returned 0x4e0000 [0131.293] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0131.293] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0131.293] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfa20 | out: lpNewFilePointer=0x0) returned 1 [0131.293] WriteFile (in: hFile=0xa4, lpBuffer=0x24dfa30*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x24dfa30*, lpNumberOfBytesWritten=0x24dfa08*=0x7, lpOverlapped=0x0) returned 1 [0131.294] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfa0c | out: phKey=0x24dfa0c*=0x4fa058) returned 1 [0131.294] CryptSetKeyParam (hKey=0x4fa058, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.294] GetProcessHeap () returned 0x4e0000 [0131.294] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0131.294] CryptEncrypt (in: hKey=0x4fa058, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df9e8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df9e8*=0x30) returned 1 [0131.294] CryptDestroyKey (hKey=0x4fa058) returned 1 [0131.294] WriteFile (in: hFile=0xa4, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24dfa08*=0x30, lpOverlapped=0x0) returned 1 [0131.294] WriteFile (in: hFile=0xa4, lpBuffer=0x24dfa10*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x24dfa10*, lpNumberOfBytesWritten=0x24dfa08*=0x4, lpOverlapped=0x0) returned 1 [0131.294] WriteFile (in: hFile=0xa4, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24dfa08*=0x10, lpOverlapped=0x0) returned 1 [0131.295] WriteFile (in: hFile=0xa4, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24dfa08*=0x80, lpOverlapped=0x0) returned 1 [0131.295] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfa18 | out: lpNewFilePointer=0x0) returned 1 [0131.295] WriteFile (in: hFile=0xa4, lpBuffer=0x24dfa28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x24dfa28*, lpNumberOfBytesWritten=0x24dfa08*=0x8, lpOverlapped=0x0) returned 1 [0131.295] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfa0c | out: phKey=0x24dfa0c*=0x4fa058) returned 1 [0131.295] CryptSetKeyParam (hKey=0x4fa058, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.295] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.295] ReadFile (in: hFile=0xa4, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x13569, lpNumberOfBytesRead=0x24df9c0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df9c0*=0x13569, lpOverlapped=0x0) returned 1 [0131.295] CryptEncrypt (in: hKey=0x4fa058, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df9c8*=0x13570, dwBufLen=0x13570 | out: pbData=0x22d0020*, pdwDataLen=0x24df9c8*=0x13570) returned 1 [0131.296] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.296] WriteFile (in: hFile=0xa4, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x13570, lpNumberOfBytesWritten=0x24df9c4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df9c4*=0x13570, lpOverlapped=0x0) returned 1 [0131.297] CryptDestroyKey (hKey=0x4fa058) returned 1 [0131.297] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x13634, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.297] SetEndOfFile (hFile=0xa4) returned 1 [0131.299] GetProcessHeap () returned 0x4e0000 [0131.299] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0131.299] GetProcessHeap () returned 0x4e0000 [0131.299] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0131.299] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gvDuBJ\\Fi_B6.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gvdubj\\fi_b6.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gvDuBJ\\Fi_B6.wav.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gvdubj\\fi_b6.wav.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0131.303] CloseHandle (hObject=0xa4) returned 1 [0131.303] FindNextFileW (in: hFindFile=0x4fca30, lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x367b1d20, ftCreationTime.dwHighDateTime=0x1d5e0b8, ftLastAccessTime.dwLowDateTime=0x3b03fac0, ftLastAccessTime.dwHighDateTime=0x1d5dd01, ftLastWriteTime.dwLowDateTime=0x3b03fac0, ftLastWriteTime.dwHighDateTime=0x1d5dd01, nFileSizeHigh=0x0, nFileSizeLow=0x74f3, dwReserved0=0x24dfba4, dwReserved1=0x77c7389e, cFileName="J9z0-TpNYonIEIg1GaU.csv", cAlternateFileName="J9Z0-T~1.CSV")) returned 1 [0131.303] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gvDuBJ\\J9z0-TpNYonIEIg1GaU.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gvdubj\\j9z0-tpnyonieig1gau.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa4 [0131.303] GetProcessHeap () returned 0x4e0000 [0131.303] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0131.303] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0131.303] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfa20 | out: lpNewFilePointer=0x0) returned 1 [0131.303] WriteFile (in: hFile=0xa4, lpBuffer=0x24dfa30*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x24dfa30*, lpNumberOfBytesWritten=0x24dfa08*=0xd, lpOverlapped=0x0) returned 1 [0131.304] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfa0c | out: phKey=0x24dfa0c*=0x4fa058) returned 1 [0131.304] CryptSetKeyParam (hKey=0x4fa058, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.304] GetProcessHeap () returned 0x4e0000 [0131.304] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x50) returned 0x4fd470 [0131.304] CryptEncrypt (in: hKey=0x4fa058, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fd470*, pdwDataLen=0x24df9e8*=0x50, dwBufLen=0x50 | out: pbData=0x4fd470*, pdwDataLen=0x24df9e8*=0x50) returned 1 [0131.304] CryptDestroyKey (hKey=0x4fa058) returned 1 [0131.304] WriteFile (in: hFile=0xa4, lpBuffer=0x4fd470*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x4fd470*, lpNumberOfBytesWritten=0x24dfa08*=0x50, lpOverlapped=0x0) returned 1 [0131.304] WriteFile (in: hFile=0xa4, lpBuffer=0x24dfa10*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x24dfa10*, lpNumberOfBytesWritten=0x24dfa08*=0x4, lpOverlapped=0x0) returned 1 [0131.305] WriteFile (in: hFile=0xa4, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24dfa08*=0x10, lpOverlapped=0x0) returned 1 [0131.305] WriteFile (in: hFile=0xa4, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24dfa08*=0x80, lpOverlapped=0x0) returned 1 [0131.305] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfa18 | out: lpNewFilePointer=0x0) returned 1 [0131.305] WriteFile (in: hFile=0xa4, lpBuffer=0x24dfa28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x24dfa28*, lpNumberOfBytesWritten=0x24dfa08*=0x8, lpOverlapped=0x0) returned 1 [0131.305] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfa0c | out: phKey=0x24dfa0c*=0x4fa058) returned 1 [0131.305] CryptSetKeyParam (hKey=0x4fa058, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.305] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.305] ReadFile (in: hFile=0xa4, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x74f3, lpNumberOfBytesRead=0x24df9c0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df9c0*=0x74f3, lpOverlapped=0x0) returned 1 [0131.324] CryptEncrypt (in: hKey=0x4fa058, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df9c8*=0x7500, dwBufLen=0x7500 | out: pbData=0x22d0020*, pdwDataLen=0x24df9c8*=0x7500) returned 1 [0131.324] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.324] WriteFile (in: hFile=0xa4, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7500, lpNumberOfBytesWritten=0x24df9c4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df9c4*=0x7500, lpOverlapped=0x0) returned 1 [0131.325] CryptDestroyKey (hKey=0x4fa058) returned 1 [0131.325] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x75e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.325] SetEndOfFile (hFile=0xa4) returned 1 [0131.327] GetProcessHeap () returned 0x4e0000 [0131.327] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fd470 | out: hHeap=0x4e0000) returned 1 [0131.327] GetProcessHeap () returned 0x4e0000 [0131.327] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0131.327] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gvDuBJ\\J9z0-TpNYonIEIg1GaU.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gvdubj\\j9z0-tpnyonieig1gau.csv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gvDuBJ\\J9z0-TpNYonIEIg1GaU.csv.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gvdubj\\j9z0-tpnyonieig1gau.csv.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0131.328] CloseHandle (hObject=0xa4) returned 1 [0131.328] FindNextFileW (in: hFindFile=0x4fca30, lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74c2bef0, ftCreationTime.dwHighDateTime=0x1d5e65b, ftLastAccessTime.dwLowDateTime=0xb20db040, ftLastAccessTime.dwHighDateTime=0x1d5dd63, ftLastWriteTime.dwLowDateTime=0xb20db040, ftLastWriteTime.dwHighDateTime=0x1d5dd63, nFileSizeHigh=0x0, nFileSizeLow=0x8f41, dwReserved0=0x24dfba4, dwReserved1=0x77c7389e, cFileName="QBM_pxHOkKNCJ6.wav", cAlternateFileName="QBM_PX~1.WAV")) returned 1 [0131.329] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gvDuBJ\\QBM_pxHOkKNCJ6.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gvdubj\\qbm_pxhokkncj6.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa4 [0131.329] GetProcessHeap () returned 0x4e0000 [0131.329] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0131.329] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0131.329] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfa20 | out: lpNewFilePointer=0x0) returned 1 [0131.329] WriteFile (in: hFile=0xa4, lpBuffer=0x24dfa30*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x24dfa30*, lpNumberOfBytesWritten=0x24dfa08*=0xf, lpOverlapped=0x0) returned 1 [0131.330] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfa0c | out: phKey=0x24dfa0c*=0x4fa058) returned 1 [0131.330] CryptSetKeyParam (hKey=0x4fa058, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.330] GetProcessHeap () returned 0x4e0000 [0131.330] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0131.330] CryptEncrypt (in: hKey=0x4fa058, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df9e8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df9e8*=0x40) returned 1 [0131.330] CryptDestroyKey (hKey=0x4fa058) returned 1 [0131.330] WriteFile (in: hFile=0xa4, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24dfa08*=0x40, lpOverlapped=0x0) returned 1 [0131.330] WriteFile (in: hFile=0xa4, lpBuffer=0x24dfa10*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x24dfa10*, lpNumberOfBytesWritten=0x24dfa08*=0x4, lpOverlapped=0x0) returned 1 [0131.330] WriteFile (in: hFile=0xa4, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24dfa08*=0x10, lpOverlapped=0x0) returned 1 [0131.330] WriteFile (in: hFile=0xa4, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24dfa08*=0x80, lpOverlapped=0x0) returned 1 [0131.339] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfa18 | out: lpNewFilePointer=0x0) returned 1 [0131.339] WriteFile (in: hFile=0xa4, lpBuffer=0x24dfa28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x24dfa28*, lpNumberOfBytesWritten=0x24dfa08*=0x8, lpOverlapped=0x0) returned 1 [0131.339] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfa0c | out: phKey=0x24dfa0c*=0x4fa058) returned 1 [0131.339] CryptSetKeyParam (hKey=0x4fa058, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.339] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.339] ReadFile (in: hFile=0xa4, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x8f41, lpNumberOfBytesRead=0x24df9c0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df9c0*=0x8f41, lpOverlapped=0x0) returned 1 [0131.340] CryptEncrypt (in: hKey=0x4fa058, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df9c8*=0x8f50, dwBufLen=0x8f50 | out: pbData=0x22d0020*, pdwDataLen=0x24df9c8*=0x8f50) returned 1 [0131.340] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.340] WriteFile (in: hFile=0xa4, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x8f50, lpNumberOfBytesWritten=0x24df9c4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df9c4*=0x8f50, lpOverlapped=0x0) returned 1 [0131.340] CryptDestroyKey (hKey=0x4fa058) returned 1 [0131.340] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x9024, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.341] SetEndOfFile (hFile=0xa4) returned 1 [0131.343] GetProcessHeap () returned 0x4e0000 [0131.343] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0131.343] GetProcessHeap () returned 0x4e0000 [0131.343] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0131.343] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gvDuBJ\\QBM_pxHOkKNCJ6.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gvdubj\\qbm_pxhokkncj6.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gvDuBJ\\QBM_pxHOkKNCJ6.wav.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gvdubj\\qbm_pxhokkncj6.wav.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0131.344] CloseHandle (hObject=0xa4) returned 1 [0131.344] FindNextFileW (in: hFindFile=0x4fca30, lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec64fe10, ftCreationTime.dwHighDateTime=0x1d5de71, ftLastAccessTime.dwLowDateTime=0x4ad4d200, ftLastAccessTime.dwHighDateTime=0x1d5e77c, ftLastWriteTime.dwLowDateTime=0x4ad4d200, ftLastWriteTime.dwHighDateTime=0x1d5e77c, nFileSizeHigh=0x0, nFileSizeLow=0xadd2, dwReserved0=0x24dfba4, dwReserved1=0x77c7389e, cFileName="vILuce_NAfE5.odp", cAlternateFileName="VILUCE~1.ODP")) returned 1 [0131.344] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gvDuBJ\\vILuce_NAfE5.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gvdubj\\viluce_nafe5.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa4 [0131.344] GetProcessHeap () returned 0x4e0000 [0131.344] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0131.344] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0131.344] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfa20 | out: lpNewFilePointer=0x0) returned 1 [0131.344] WriteFile (in: hFile=0xa4, lpBuffer=0x24dfa30*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x24dfa30*, lpNumberOfBytesWritten=0x24dfa08*=0xe, lpOverlapped=0x0) returned 1 [0131.345] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfa0c | out: phKey=0x24dfa0c*=0x4fa058) returned 1 [0131.345] CryptSetKeyParam (hKey=0x4fa058, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.345] GetProcessHeap () returned 0x4e0000 [0131.345] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0131.345] CryptEncrypt (in: hKey=0x4fa058, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df9e8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df9e8*=0x40) returned 1 [0131.345] CryptDestroyKey (hKey=0x4fa058) returned 1 [0131.345] WriteFile (in: hFile=0xa4, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24dfa08*=0x40, lpOverlapped=0x0) returned 1 [0131.346] WriteFile (in: hFile=0xa4, lpBuffer=0x24dfa10*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x24dfa10*, lpNumberOfBytesWritten=0x24dfa08*=0x4, lpOverlapped=0x0) returned 1 [0131.346] WriteFile (in: hFile=0xa4, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24dfa08*=0x10, lpOverlapped=0x0) returned 1 [0131.346] WriteFile (in: hFile=0xa4, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24dfa08*=0x80, lpOverlapped=0x0) returned 1 [0131.346] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfa18 | out: lpNewFilePointer=0x0) returned 1 [0131.346] WriteFile (in: hFile=0xa4, lpBuffer=0x24dfa28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x24dfa28*, lpNumberOfBytesWritten=0x24dfa08*=0x8, lpOverlapped=0x0) returned 1 [0131.346] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfa0c | out: phKey=0x24dfa0c*=0x4fa058) returned 1 [0131.346] CryptSetKeyParam (hKey=0x4fa058, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.346] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.346] ReadFile (in: hFile=0xa4, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xadd2, lpNumberOfBytesRead=0x24df9c0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df9c0*=0xadd2, lpOverlapped=0x0) returned 1 [0131.346] CryptEncrypt (in: hKey=0x4fa058, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df9c8*=0xade0, dwBufLen=0xade0 | out: pbData=0x22d0020*, pdwDataLen=0x24df9c8*=0xade0) returned 1 [0131.347] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.347] WriteFile (in: hFile=0xa4, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xade0, lpNumberOfBytesWritten=0x24df9c4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df9c4*=0xade0, lpOverlapped=0x0) returned 1 [0131.347] CryptDestroyKey (hKey=0x4fa058) returned 1 [0131.347] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xaeb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.347] SetEndOfFile (hFile=0xa4) returned 1 [0131.350] GetProcessHeap () returned 0x4e0000 [0131.350] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0131.350] GetProcessHeap () returned 0x4e0000 [0131.350] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0131.350] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gvDuBJ\\vILuce_NAfE5.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gvdubj\\viluce_nafe5.odp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gvDuBJ\\vILuce_NAfE5.odp.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gvdubj\\viluce_nafe5.odp.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0131.400] CloseHandle (hObject=0xa4) returned 1 [0131.401] FindNextFileW (in: hFindFile=0x4fca30, lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec64fe10, ftCreationTime.dwHighDateTime=0x1d5de71, ftLastAccessTime.dwLowDateTime=0x4ad4d200, ftLastAccessTime.dwHighDateTime=0x1d5e77c, ftLastWriteTime.dwLowDateTime=0x4ad4d200, ftLastWriteTime.dwHighDateTime=0x1d5e77c, nFileSizeHigh=0x0, nFileSizeLow=0xadd2, dwReserved0=0x24dfba4, dwReserved1=0x77c7389e, cFileName="vILuce_NAfE5.odp", cAlternateFileName="VILUCE~1.ODP")) returned 0 [0131.401] GetProcessHeap () returned 0x4e0000 [0131.401] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0131.401] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df9f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x4fa058) returned 1 [0131.401] CryptDecrypt (in: hKey=0x4fa058, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24dfa60 | out: pbData=0x4f53d8, pdwDataLen=0x24dfa60) returned 1 [0131.401] CryptDestroyKey (hKey=0x4fa058) returned 1 [0131.401] GetProcessHeap () returned 0x4e0000 [0131.401] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0131.401] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df9f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x4fa058) returned 1 [0131.401] CryptDecrypt (in: hKey=0x4fa058, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24dfa60 | out: pbData=0x4f5420, pdwDataLen=0x24dfa60) returned 1 [0131.401] CryptDestroyKey (hKey=0x4fa058) returned 1 [0131.401] GetProcessHeap () returned 0x4e0000 [0131.401] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5217e0 [0131.401] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df9f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x4fa058) returned 1 [0131.401] CryptDecrypt (in: hKey=0x4fa058, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5217e0, pdwDataLen=0x24dfa60 | out: pbData=0x5217e0, pdwDataLen=0x24dfa60) returned 1 [0131.401] CryptDestroyKey (hKey=0x4fa058) returned 1 [0131.401] wsprintfW (in: param_1=0x24dea3c, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gvDuBJ\\readme-warning.txt") returned 63 [0131.401] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gvDuBJ\\readme-warning.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gvdubj\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa4 [0131.402] WriteFile (in: hFile=0xa4, lpBuffer=0x5217e0*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24dea38, lpOverlapped=0x0 | out: lpBuffer=0x5217e0*, lpNumberOfBytesWritten=0x24dea38*=0x6c3, lpOverlapped=0x0) returned 1 [0131.403] CloseHandle (hObject=0xa4) returned 1 [0131.405] GetProcessHeap () returned 0x4e0000 [0131.405] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5217e0 | out: hHeap=0x4e0000) returned 1 [0131.405] GetProcessHeap () returned 0x4e0000 [0131.405] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0131.405] GetProcessHeap () returned 0x4e0000 [0131.405] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0131.405] FindClose (in: hFindFile=0x4fca30 | out: hFindFile=0x4fca30) returned 1 [0131.405] GetProcessHeap () returned 0x4e0000 [0131.405] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x521568 | out: hHeap=0x4e0000) returned 1 [0131.405] FindNextFileW (in: hFindFile=0x4f9820, lpFindFileData=0x24dfd20 | out: lpFindFileData=0x24dfd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecad74d0, ftCreationTime.dwHighDateTime=0x1d5e04a, ftLastAccessTime.dwLowDateTime=0xc7701a70, ftLastAccessTime.dwHighDateTime=0x1d5d9d2, ftLastWriteTime.dwLowDateTime=0xc7701a70, ftLastWriteTime.dwHighDateTime=0x1d5d9d2, nFileSizeHigh=0x0, nFileSizeLow=0x7964, dwReserved0=0x0, dwReserved1=0xffff, cFileName="Gy7 Owab66F.mp3", cAlternateFileName="GY7OWA~1.MP3")) returned 1 [0131.405] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Gy7 Owab66F.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gy7 owab66f.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xac [0131.405] GetProcessHeap () returned 0x4e0000 [0131.405] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0131.405] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0131.405] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfcb0 | out: lpNewFilePointer=0x0) returned 1 [0131.405] WriteFile (in: hFile=0xac, lpBuffer=0x24dfcc0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfcc0*, lpNumberOfBytesWritten=0x24dfc98*=0xc, lpOverlapped=0x0) returned 1 [0131.406] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfc9c | out: phKey=0x24dfc9c*=0x4fca30) returned 1 [0131.406] CryptSetKeyParam (hKey=0x4fca30, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.406] GetProcessHeap () returned 0x4e0000 [0131.406] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0131.406] CryptEncrypt (in: hKey=0x4fca30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24dfc78*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24dfc78*=0x40) returned 1 [0131.406] CryptDestroyKey (hKey=0x4fca30) returned 1 [0131.406] WriteFile (in: hFile=0xac, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24dfc98*=0x40, lpOverlapped=0x0) returned 1 [0131.406] WriteFile (in: hFile=0xac, lpBuffer=0x24dfca0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfca0*, lpNumberOfBytesWritten=0x24dfc98*=0x4, lpOverlapped=0x0) returned 1 [0131.406] WriteFile (in: hFile=0xac, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24dfc98*=0x10, lpOverlapped=0x0) returned 1 [0131.406] WriteFile (in: hFile=0xac, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24dfc98*=0x80, lpOverlapped=0x0) returned 1 [0131.406] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfca8 | out: lpNewFilePointer=0x0) returned 1 [0131.407] WriteFile (in: hFile=0xac, lpBuffer=0x24dfcb8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfcb8*, lpNumberOfBytesWritten=0x24dfc98*=0x8, lpOverlapped=0x0) returned 1 [0131.407] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfc9c | out: phKey=0x24dfc9c*=0x4fca30) returned 1 [0131.407] CryptSetKeyParam (hKey=0x4fca30, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.407] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.407] ReadFile (in: hFile=0xac, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7964, lpNumberOfBytesRead=0x24dfc50, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24dfc50*=0x7964, lpOverlapped=0x0) returned 1 [0131.407] CryptEncrypt (in: hKey=0x4fca30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24dfc58*=0x7970, dwBufLen=0x7970 | out: pbData=0x22d0020*, pdwDataLen=0x24dfc58*=0x7970) returned 1 [0131.407] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.407] WriteFile (in: hFile=0xac, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7970, lpNumberOfBytesWritten=0x24dfc54, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24dfc54*=0x7970, lpOverlapped=0x0) returned 1 [0131.407] CryptDestroyKey (hKey=0x4fca30) returned 1 [0131.407] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x7a44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.408] SetEndOfFile (hFile=0xac) returned 1 [0131.410] GetProcessHeap () returned 0x4e0000 [0131.410] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0131.410] GetProcessHeap () returned 0x4e0000 [0131.410] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0131.410] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Gy7 Owab66F.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gy7 owab66f.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Gy7 Owab66F.mp3.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gy7 owab66f.mp3.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0131.420] CloseHandle (hObject=0xac) returned 1 [0131.420] FindNextFileW (in: hFindFile=0x4f9820, lpFindFileData=0x24dfd20 | out: lpFindFileData=0x24dfd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25c08220, ftCreationTime.dwHighDateTime=0x1d5db1f, ftLastAccessTime.dwLowDateTime=0x4a222a90, ftLastAccessTime.dwHighDateTime=0x1d5e07b, ftLastWriteTime.dwLowDateTime=0x4a222a90, ftLastWriteTime.dwHighDateTime=0x1d5e07b, nFileSizeHigh=0x0, nFileSizeLow=0xaa2a, dwReserved0=0x0, dwReserved1=0xffff, cFileName="i5PQjm b3BTXy.jpg", cAlternateFileName="I5PQJM~1.JPG")) returned 1 [0131.420] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\i5PQjm b3BTXy.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\i5pqjm b3btxy.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xac [0131.420] GetProcessHeap () returned 0x4e0000 [0131.420] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0131.420] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0131.421] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfcb0 | out: lpNewFilePointer=0x0) returned 1 [0131.421] WriteFile (in: hFile=0xac, lpBuffer=0x24dfcc0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfcc0*, lpNumberOfBytesWritten=0x24dfc98*=0x6, lpOverlapped=0x0) returned 1 [0131.421] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfc9c | out: phKey=0x24dfc9c*=0x4fca30) returned 1 [0131.421] CryptSetKeyParam (hKey=0x4fca30, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.421] GetProcessHeap () returned 0x4e0000 [0131.422] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0131.422] CryptEncrypt (in: hKey=0x4fca30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24dfc78*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24dfc78*=0x40) returned 1 [0131.422] CryptDestroyKey (hKey=0x4fca30) returned 1 [0131.422] WriteFile (in: hFile=0xac, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24dfc98*=0x40, lpOverlapped=0x0) returned 1 [0131.422] WriteFile (in: hFile=0xac, lpBuffer=0x24dfca0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfca0*, lpNumberOfBytesWritten=0x24dfc98*=0x4, lpOverlapped=0x0) returned 1 [0131.422] WriteFile (in: hFile=0xac, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24dfc98*=0x10, lpOverlapped=0x0) returned 1 [0131.422] WriteFile (in: hFile=0xac, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24dfc98*=0x80, lpOverlapped=0x0) returned 1 [0131.422] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfca8 | out: lpNewFilePointer=0x0) returned 1 [0131.422] WriteFile (in: hFile=0xac, lpBuffer=0x24dfcb8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfcb8*, lpNumberOfBytesWritten=0x24dfc98*=0x8, lpOverlapped=0x0) returned 1 [0131.422] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfc9c | out: phKey=0x24dfc9c*=0x4fca30) returned 1 [0131.422] CryptSetKeyParam (hKey=0x4fca30, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.422] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.422] ReadFile (in: hFile=0xac, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xaa2a, lpNumberOfBytesRead=0x24dfc50, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24dfc50*=0xaa2a, lpOverlapped=0x0) returned 1 [0131.423] CryptEncrypt (in: hKey=0x4fca30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24dfc58*=0xaa30, dwBufLen=0xaa30 | out: pbData=0x22d0020*, pdwDataLen=0x24dfc58*=0xaa30) returned 1 [0131.423] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.423] WriteFile (in: hFile=0xac, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xaa30, lpNumberOfBytesWritten=0x24dfc54, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24dfc54*=0xaa30, lpOverlapped=0x0) returned 1 [0131.423] CryptDestroyKey (hKey=0x4fca30) returned 1 [0131.423] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0xab04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.423] SetEndOfFile (hFile=0xac) returned 1 [0131.426] GetProcessHeap () returned 0x4e0000 [0131.426] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0131.426] GetProcessHeap () returned 0x4e0000 [0131.426] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0131.426] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\i5PQjm b3BTXy.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\i5pqjm b3btxy.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\i5PQjm b3BTXy.jpg.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\i5pqjm b3btxy.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0131.431] CloseHandle (hObject=0xac) returned 1 [0131.431] FindNextFileW (in: hFindFile=0x4f9820, lpFindFileData=0x24dfd20 | out: lpFindFileData=0x24dfd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2b4f3c0, ftCreationTime.dwHighDateTime=0x1d5dfd5, ftLastAccessTime.dwLowDateTime=0xa9aa37c0, ftLastAccessTime.dwHighDateTime=0x1d5e781, ftLastWriteTime.dwLowDateTime=0xa9aa37c0, ftLastWriteTime.dwHighDateTime=0x1d5e781, nFileSizeHigh=0x0, nFileSizeLow=0x9746, dwReserved0=0x0, dwReserved1=0xffff, cFileName="IwUXVtS6JYZ.png", cAlternateFileName="IWUXVT~1.PNG")) returned 1 [0131.432] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\IwUXVtS6JYZ.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\iwuxvts6jyz.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xac [0131.432] GetProcessHeap () returned 0x4e0000 [0131.432] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0131.432] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0131.432] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfcb0 | out: lpNewFilePointer=0x0) returned 1 [0131.432] WriteFile (in: hFile=0xac, lpBuffer=0x24dfcc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfcc0*, lpNumberOfBytesWritten=0x24dfc98*=0xa, lpOverlapped=0x0) returned 1 [0131.433] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfc9c | out: phKey=0x24dfc9c*=0x4fca30) returned 1 [0131.433] CryptSetKeyParam (hKey=0x4fca30, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.433] GetProcessHeap () returned 0x4e0000 [0131.433] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0131.433] CryptEncrypt (in: hKey=0x4fca30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24dfc78*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24dfc78*=0x40) returned 1 [0131.433] CryptDestroyKey (hKey=0x4fca30) returned 1 [0131.433] WriteFile (in: hFile=0xac, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24dfc98*=0x40, lpOverlapped=0x0) returned 1 [0131.433] WriteFile (in: hFile=0xac, lpBuffer=0x24dfca0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfca0*, lpNumberOfBytesWritten=0x24dfc98*=0x4, lpOverlapped=0x0) returned 1 [0131.433] WriteFile (in: hFile=0xac, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24dfc98*=0x10, lpOverlapped=0x0) returned 1 [0131.433] WriteFile (in: hFile=0xac, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24dfc98*=0x80, lpOverlapped=0x0) returned 1 [0131.433] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfca8 | out: lpNewFilePointer=0x0) returned 1 [0131.433] WriteFile (in: hFile=0xac, lpBuffer=0x24dfcb8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfcb8*, lpNumberOfBytesWritten=0x24dfc98*=0x8, lpOverlapped=0x0) returned 1 [0131.433] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfc9c | out: phKey=0x24dfc9c*=0x4fca30) returned 1 [0131.433] CryptSetKeyParam (hKey=0x4fca30, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.433] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.433] ReadFile (in: hFile=0xac, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x9746, lpNumberOfBytesRead=0x24dfc50, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24dfc50*=0x9746, lpOverlapped=0x0) returned 1 [0131.434] CryptEncrypt (in: hKey=0x4fca30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24dfc58*=0x9750, dwBufLen=0x9750 | out: pbData=0x22d0020*, pdwDataLen=0x24dfc58*=0x9750) returned 1 [0131.434] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.434] WriteFile (in: hFile=0xac, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x9750, lpNumberOfBytesWritten=0x24dfc54, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24dfc54*=0x9750, lpOverlapped=0x0) returned 1 [0131.434] CryptDestroyKey (hKey=0x4fca30) returned 1 [0131.434] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x9824, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.434] SetEndOfFile (hFile=0xac) returned 1 [0131.512] GetProcessHeap () returned 0x4e0000 [0131.512] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0131.512] GetProcessHeap () returned 0x4e0000 [0131.512] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0131.512] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\IwUXVtS6JYZ.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\iwuxvts6jyz.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\IwUXVtS6JYZ.png.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\iwuxvts6jyz.png.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0131.516] CloseHandle (hObject=0xac) returned 1 [0131.516] FindNextFileW (in: hFindFile=0x4f9820, lpFindFileData=0x24dfd20 | out: lpFindFileData=0x24dfd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc75ba650, ftCreationTime.dwHighDateTime=0x1d5dbba, ftLastAccessTime.dwLowDateTime=0x38abb440, ftLastAccessTime.dwHighDateTime=0x1d5d85e, ftLastWriteTime.dwLowDateTime=0x38abb440, ftLastWriteTime.dwHighDateTime=0x1d5d85e, nFileSizeHigh=0x0, nFileSizeLow=0x9728, dwReserved0=0x0, dwReserved1=0xffff, cFileName="jvY-yDYl.jpg", cAlternateFileName="")) returned 1 [0131.516] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\jvY-yDYl.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jvy-ydyl.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xac [0131.516] GetProcessHeap () returned 0x4e0000 [0131.516] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0131.516] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0131.516] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfcb0 | out: lpNewFilePointer=0x0) returned 1 [0131.516] WriteFile (in: hFile=0xac, lpBuffer=0x24dfcc0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfcc0*, lpNumberOfBytesWritten=0x24dfc98*=0x8, lpOverlapped=0x0) returned 1 [0131.517] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfc9c | out: phKey=0x24dfc9c*=0x4fca30) returned 1 [0131.517] CryptSetKeyParam (hKey=0x4fca30, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.517] GetProcessHeap () returned 0x4e0000 [0131.517] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0131.517] CryptEncrypt (in: hKey=0x4fca30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24dfc78*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24dfc78*=0x40) returned 1 [0131.517] CryptDestroyKey (hKey=0x4fca30) returned 1 [0131.517] WriteFile (in: hFile=0xac, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24dfc98*=0x40, lpOverlapped=0x0) returned 1 [0131.517] WriteFile (in: hFile=0xac, lpBuffer=0x24dfca0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfca0*, lpNumberOfBytesWritten=0x24dfc98*=0x4, lpOverlapped=0x0) returned 1 [0131.518] WriteFile (in: hFile=0xac, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24dfc98*=0x10, lpOverlapped=0x0) returned 1 [0131.518] WriteFile (in: hFile=0xac, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24dfc98*=0x80, lpOverlapped=0x0) returned 1 [0131.518] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfca8 | out: lpNewFilePointer=0x0) returned 1 [0131.518] WriteFile (in: hFile=0xac, lpBuffer=0x24dfcb8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfcb8*, lpNumberOfBytesWritten=0x24dfc98*=0x8, lpOverlapped=0x0) returned 1 [0131.518] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfc9c | out: phKey=0x24dfc9c*=0x4fca30) returned 1 [0131.518] CryptSetKeyParam (hKey=0x4fca30, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.518] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.518] ReadFile (in: hFile=0xac, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x9728, lpNumberOfBytesRead=0x24dfc50, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24dfc50*=0x9728, lpOverlapped=0x0) returned 1 [0131.518] CryptEncrypt (in: hKey=0x4fca30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24dfc58*=0x9730, dwBufLen=0x9730 | out: pbData=0x22d0020*, pdwDataLen=0x24dfc58*=0x9730) returned 1 [0131.519] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.519] WriteFile (in: hFile=0xac, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x9730, lpNumberOfBytesWritten=0x24dfc54, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24dfc54*=0x9730, lpOverlapped=0x0) returned 1 [0131.519] CryptDestroyKey (hKey=0x4fca30) returned 1 [0131.519] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x9804, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.519] SetEndOfFile (hFile=0xac) returned 1 [0131.522] GetProcessHeap () returned 0x4e0000 [0131.522] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0131.522] GetProcessHeap () returned 0x4e0000 [0131.522] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0131.522] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\jvY-yDYl.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jvy-ydyl.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\jvY-yDYl.jpg.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jvy-ydyl.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0131.525] CloseHandle (hObject=0xac) returned 1 [0131.525] FindNextFileW (in: hFindFile=0x4f9820, lpFindFileData=0x24dfd20 | out: lpFindFileData=0x24dfd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x715c8310, ftCreationTime.dwHighDateTime=0x1d5e4a6, ftLastAccessTime.dwLowDateTime=0x25595ee0, ftLastAccessTime.dwHighDateTime=0x1d5e733, ftLastWriteTime.dwLowDateTime=0x25595ee0, ftLastWriteTime.dwHighDateTime=0x1d5e733, nFileSizeHigh=0x0, nFileSizeLow=0x10da0, dwReserved0=0x0, dwReserved1=0xffff, cFileName="kCPs7-4LI.odt", cAlternateFileName="KCPS7-~1.ODT")) returned 1 [0131.526] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\kCPs7-4LI.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\kcps7-4li.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xac [0131.526] GetProcessHeap () returned 0x4e0000 [0131.526] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0131.526] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0131.526] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfcb0 | out: lpNewFilePointer=0x0) returned 1 [0131.526] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfc9c | out: phKey=0x24dfc9c*=0x4fca30) returned 1 [0131.526] CryptSetKeyParam (hKey=0x4fca30, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.526] GetProcessHeap () returned 0x4e0000 [0131.526] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0131.526] CryptEncrypt (in: hKey=0x4fca30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24dfc78*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24dfc78*=0x40) returned 1 [0131.526] CryptDestroyKey (hKey=0x4fca30) returned 1 [0131.526] WriteFile (in: hFile=0xac, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24dfc98*=0x40, lpOverlapped=0x0) returned 1 [0131.527] WriteFile (in: hFile=0xac, lpBuffer=0x24dfca0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfca0*, lpNumberOfBytesWritten=0x24dfc98*=0x4, lpOverlapped=0x0) returned 1 [0131.527] WriteFile (in: hFile=0xac, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24dfc98*=0x10, lpOverlapped=0x0) returned 1 [0131.527] WriteFile (in: hFile=0xac, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24dfc98*=0x80, lpOverlapped=0x0) returned 1 [0131.528] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfca8 | out: lpNewFilePointer=0x0) returned 1 [0131.528] WriteFile (in: hFile=0xac, lpBuffer=0x24dfcb8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfcb8*, lpNumberOfBytesWritten=0x24dfc98*=0x8, lpOverlapped=0x0) returned 1 [0131.528] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfc9c | out: phKey=0x24dfc9c*=0x4fca30) returned 1 [0131.528] CryptSetKeyParam (hKey=0x4fca30, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.528] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.528] ReadFile (in: hFile=0xac, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x10da0, lpNumberOfBytesRead=0x24dfc50, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24dfc50*=0x10da0, lpOverlapped=0x0) returned 1 [0131.528] CryptEncrypt (in: hKey=0x4fca30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24dfc58*=0x10da0, dwBufLen=0x10da0 | out: pbData=0x22d0020*, pdwDataLen=0x24dfc58*=0x10da0) returned 1 [0131.529] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.529] WriteFile (in: hFile=0xac, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x10da0, lpNumberOfBytesWritten=0x24dfc54, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24dfc54*=0x10da0, lpOverlapped=0x0) returned 1 [0131.529] CryptDestroyKey (hKey=0x4fca30) returned 1 [0131.529] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x10e74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.529] SetEndOfFile (hFile=0xac) returned 1 [0131.532] GetProcessHeap () returned 0x4e0000 [0131.532] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0131.532] GetProcessHeap () returned 0x4e0000 [0131.532] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0131.533] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\kCPs7-4LI.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\kcps7-4li.odt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\kCPs7-4LI.odt.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\kcps7-4li.odt.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0131.541] CloseHandle (hObject=0xac) returned 1 [0131.541] FindNextFileW (in: hFindFile=0x4f9820, lpFindFileData=0x24dfd20 | out: lpFindFileData=0x24dfd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f2e25b0, ftCreationTime.dwHighDateTime=0x1d5d940, ftLastAccessTime.dwLowDateTime=0x69247780, ftLastAccessTime.dwHighDateTime=0x1d5dcd5, ftLastWriteTime.dwLowDateTime=0x69247780, ftLastWriteTime.dwHighDateTime=0x1d5dcd5, nFileSizeHigh=0x0, nFileSizeLow=0x13b7a, dwReserved0=0x0, dwReserved1=0xffff, cFileName="lr16-fIb.png", cAlternateFileName="")) returned 1 [0131.541] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lr16-fIb.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lr16-fib.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xac [0131.541] GetProcessHeap () returned 0x4e0000 [0131.541] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0131.541] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0131.541] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfcb0 | out: lpNewFilePointer=0x0) returned 1 [0131.541] WriteFile (in: hFile=0xac, lpBuffer=0x24dfcc0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfcc0*, lpNumberOfBytesWritten=0x24dfc98*=0x6, lpOverlapped=0x0) returned 1 [0131.542] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfc9c | out: phKey=0x24dfc9c*=0x4fca30) returned 1 [0131.542] CryptSetKeyParam (hKey=0x4fca30, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.542] GetProcessHeap () returned 0x4e0000 [0131.542] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0131.542] CryptEncrypt (in: hKey=0x4fca30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24dfc78*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24dfc78*=0x40) returned 1 [0131.542] CryptDestroyKey (hKey=0x4fca30) returned 1 [0131.542] WriteFile (in: hFile=0xac, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24dfc98*=0x40, lpOverlapped=0x0) returned 1 [0131.542] WriteFile (in: hFile=0xac, lpBuffer=0x24dfca0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfca0*, lpNumberOfBytesWritten=0x24dfc98*=0x4, lpOverlapped=0x0) returned 1 [0131.542] WriteFile (in: hFile=0xac, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24dfc98*=0x10, lpOverlapped=0x0) returned 1 [0131.542] WriteFile (in: hFile=0xac, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24dfc98*=0x80, lpOverlapped=0x0) returned 1 [0131.542] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfca8 | out: lpNewFilePointer=0x0) returned 1 [0131.542] WriteFile (in: hFile=0xac, lpBuffer=0x24dfcb8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfcb8*, lpNumberOfBytesWritten=0x24dfc98*=0x8, lpOverlapped=0x0) returned 1 [0131.543] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfc9c | out: phKey=0x24dfc9c*=0x4fca30) returned 1 [0131.543] CryptSetKeyParam (hKey=0x4fca30, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.543] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.543] ReadFile (in: hFile=0xac, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x13b7a, lpNumberOfBytesRead=0x24dfc50, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24dfc50*=0x13b7a, lpOverlapped=0x0) returned 1 [0131.543] CryptEncrypt (in: hKey=0x4fca30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24dfc58*=0x13b80, dwBufLen=0x13b80 | out: pbData=0x22d0020*, pdwDataLen=0x24dfc58*=0x13b80) returned 1 [0131.544] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.544] WriteFile (in: hFile=0xac, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x13b80, lpNumberOfBytesWritten=0x24dfc54, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24dfc54*=0x13b80, lpOverlapped=0x0) returned 1 [0131.544] CryptDestroyKey (hKey=0x4fca30) returned 1 [0131.544] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x13c54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.544] SetEndOfFile (hFile=0xac) returned 1 [0131.558] GetProcessHeap () returned 0x4e0000 [0131.558] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0131.558] GetProcessHeap () returned 0x4e0000 [0131.558] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0131.558] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lr16-fIb.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lr16-fib.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lr16-fIb.png.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lr16-fib.png.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0131.563] CloseHandle (hObject=0xac) returned 1 [0131.563] FindNextFileW (in: hFindFile=0x4f9820, lpFindFileData=0x24dfd20 | out: lpFindFileData=0x24dfd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49fd6c00, ftCreationTime.dwHighDateTime=0x1d5def0, ftLastAccessTime.dwLowDateTime=0x4debfb10, ftLastAccessTime.dwHighDateTime=0x1d5d8ec, ftLastWriteTime.dwLowDateTime=0x4debfb10, ftLastWriteTime.dwHighDateTime=0x1d5d8ec, nFileSizeHigh=0x0, nFileSizeLow=0x7010, dwReserved0=0x0, dwReserved1=0xffff, cFileName="mw5riY.png", cAlternateFileName="")) returned 1 [0131.563] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mw5riY.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mw5riy.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xac [0131.563] GetProcessHeap () returned 0x4e0000 [0131.563] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0131.563] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0131.563] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfcb0 | out: lpNewFilePointer=0x0) returned 1 [0131.563] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfc9c | out: phKey=0x24dfc9c*=0x4fca30) returned 1 [0131.563] CryptSetKeyParam (hKey=0x4fca30, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.563] GetProcessHeap () returned 0x4e0000 [0131.563] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0131.563] CryptEncrypt (in: hKey=0x4fca30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24dfc78*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24dfc78*=0x30) returned 1 [0131.563] CryptDestroyKey (hKey=0x4fca30) returned 1 [0131.563] WriteFile (in: hFile=0xac, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24dfc98*=0x30, lpOverlapped=0x0) returned 1 [0131.564] WriteFile (in: hFile=0xac, lpBuffer=0x24dfca0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfca0*, lpNumberOfBytesWritten=0x24dfc98*=0x4, lpOverlapped=0x0) returned 1 [0131.564] WriteFile (in: hFile=0xac, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24dfc98*=0x10, lpOverlapped=0x0) returned 1 [0131.564] WriteFile (in: hFile=0xac, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24dfc98*=0x80, lpOverlapped=0x0) returned 1 [0131.564] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfca8 | out: lpNewFilePointer=0x0) returned 1 [0131.565] WriteFile (in: hFile=0xac, lpBuffer=0x24dfcb8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfcb8*, lpNumberOfBytesWritten=0x24dfc98*=0x8, lpOverlapped=0x0) returned 1 [0131.565] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfc9c | out: phKey=0x24dfc9c*=0x4fca30) returned 1 [0131.565] CryptSetKeyParam (hKey=0x4fca30, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.565] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.565] ReadFile (in: hFile=0xac, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7010, lpNumberOfBytesRead=0x24dfc50, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24dfc50*=0x7010, lpOverlapped=0x0) returned 1 [0131.565] CryptEncrypt (in: hKey=0x4fca30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24dfc58*=0x7010, dwBufLen=0x7010 | out: pbData=0x22d0020*, pdwDataLen=0x24dfc58*=0x7010) returned 1 [0131.565] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.565] WriteFile (in: hFile=0xac, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7010, lpNumberOfBytesWritten=0x24dfc54, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24dfc54*=0x7010, lpOverlapped=0x0) returned 1 [0131.565] CryptDestroyKey (hKey=0x4fca30) returned 1 [0131.566] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x70d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.566] SetEndOfFile (hFile=0xac) returned 1 [0131.568] GetProcessHeap () returned 0x4e0000 [0131.568] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0131.568] GetProcessHeap () returned 0x4e0000 [0131.568] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0131.568] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mw5riY.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mw5riy.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mw5riY.png.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mw5riy.png.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0131.571] CloseHandle (hObject=0xac) returned 1 [0131.571] FindNextFileW (in: hFindFile=0x4f9820, lpFindFileData=0x24dfd20 | out: lpFindFileData=0x24dfd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd15fbcc0, ftCreationTime.dwHighDateTime=0x1d5e814, ftLastAccessTime.dwLowDateTime=0x9f7fecb0, ftLastAccessTime.dwHighDateTime=0x1d5dbcc, ftLastWriteTime.dwLowDateTime=0x9f7fecb0, ftLastWriteTime.dwHighDateTime=0x1d5dbcc, nFileSizeHigh=0x0, nFileSizeLow=0x18192, dwReserved0=0x0, dwReserved1=0xffff, cFileName="njlflq.wav", cAlternateFileName="")) returned 1 [0131.571] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\njlflq.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\njlflq.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xac [0131.572] GetProcessHeap () returned 0x4e0000 [0131.572] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0131.572] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0131.572] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfcb0 | out: lpNewFilePointer=0x0) returned 1 [0131.572] WriteFile (in: hFile=0xac, lpBuffer=0x24dfcc0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfcc0*, lpNumberOfBytesWritten=0x24dfc98*=0xe, lpOverlapped=0x0) returned 1 [0131.573] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfc9c | out: phKey=0x24dfc9c*=0x4fca30) returned 1 [0131.573] CryptSetKeyParam (hKey=0x4fca30, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.573] GetProcessHeap () returned 0x4e0000 [0131.573] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0131.573] CryptEncrypt (in: hKey=0x4fca30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24dfc78*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24dfc78*=0x30) returned 1 [0131.573] CryptDestroyKey (hKey=0x4fca30) returned 1 [0131.573] WriteFile (in: hFile=0xac, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24dfc98*=0x30, lpOverlapped=0x0) returned 1 [0131.573] WriteFile (in: hFile=0xac, lpBuffer=0x24dfca0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfca0*, lpNumberOfBytesWritten=0x24dfc98*=0x4, lpOverlapped=0x0) returned 1 [0131.573] WriteFile (in: hFile=0xac, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24dfc98*=0x10, lpOverlapped=0x0) returned 1 [0131.573] WriteFile (in: hFile=0xac, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24dfc98*=0x80, lpOverlapped=0x0) returned 1 [0131.573] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfca8 | out: lpNewFilePointer=0x0) returned 1 [0131.573] WriteFile (in: hFile=0xac, lpBuffer=0x24dfcb8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfcb8*, lpNumberOfBytesWritten=0x24dfc98*=0x8, lpOverlapped=0x0) returned 1 [0131.573] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfc9c | out: phKey=0x24dfc9c*=0x4fca30) returned 1 [0131.573] CryptSetKeyParam (hKey=0x4fca30, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.573] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.573] ReadFile (in: hFile=0xac, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x18192, lpNumberOfBytesRead=0x24dfc50, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24dfc50*=0x18192, lpOverlapped=0x0) returned 1 [0131.574] CryptEncrypt (in: hKey=0x4fca30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24dfc58*=0x181a0, dwBufLen=0x181a0 | out: pbData=0x22d0020*, pdwDataLen=0x24dfc58*=0x181a0) returned 1 [0131.575] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.575] WriteFile (in: hFile=0xac, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x181a0, lpNumberOfBytesWritten=0x24dfc54, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24dfc54*=0x181a0, lpOverlapped=0x0) returned 1 [0131.576] CryptDestroyKey (hKey=0x4fca30) returned 1 [0131.576] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x18264, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.576] SetEndOfFile (hFile=0xac) returned 1 [0131.579] GetProcessHeap () returned 0x4e0000 [0131.579] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0131.579] GetProcessHeap () returned 0x4e0000 [0131.579] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0131.579] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\njlflq.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\njlflq.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\njlflq.wav.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\njlflq.wav.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0131.582] CloseHandle (hObject=0xac) returned 1 [0131.583] FindNextFileW (in: hFindFile=0x4f9820, lpFindFileData=0x24dfd20 | out: lpFindFileData=0x24dfd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b4af860, ftCreationTime.dwHighDateTime=0x1d5daea, ftLastAccessTime.dwLowDateTime=0x55f00d30, ftLastAccessTime.dwHighDateTime=0x1d5df2f, ftLastWriteTime.dwLowDateTime=0x55f00d30, ftLastWriteTime.dwHighDateTime=0x1d5df2f, nFileSizeHigh=0x0, nFileSizeLow=0xef4e, dwReserved0=0x0, dwReserved1=0xffff, cFileName="oUc0yc-q8kf b.gif", cAlternateFileName="OUC0YC~1.GIF")) returned 1 [0131.583] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\oUc0yc-q8kf b.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ouc0yc-q8kf b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xac [0131.583] GetProcessHeap () returned 0x4e0000 [0131.583] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0131.583] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0131.583] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfcb0 | out: lpNewFilePointer=0x0) returned 1 [0131.583] WriteFile (in: hFile=0xac, lpBuffer=0x24dfcc0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfcc0*, lpNumberOfBytesWritten=0x24dfc98*=0x2, lpOverlapped=0x0) returned 1 [0131.584] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfc9c | out: phKey=0x24dfc9c*=0x4fca30) returned 1 [0131.584] CryptSetKeyParam (hKey=0x4fca30, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.584] GetProcessHeap () returned 0x4e0000 [0131.584] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0131.584] CryptEncrypt (in: hKey=0x4fca30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24dfc78*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24dfc78*=0x40) returned 1 [0131.584] CryptDestroyKey (hKey=0x4fca30) returned 1 [0131.584] WriteFile (in: hFile=0xac, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24dfc98*=0x40, lpOverlapped=0x0) returned 1 [0131.584] WriteFile (in: hFile=0xac, lpBuffer=0x24dfca0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfca0*, lpNumberOfBytesWritten=0x24dfc98*=0x4, lpOverlapped=0x0) returned 1 [0131.584] WriteFile (in: hFile=0xac, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24dfc98*=0x10, lpOverlapped=0x0) returned 1 [0131.584] WriteFile (in: hFile=0xac, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24dfc98*=0x80, lpOverlapped=0x0) returned 1 [0131.584] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfca8 | out: lpNewFilePointer=0x0) returned 1 [0131.584] WriteFile (in: hFile=0xac, lpBuffer=0x24dfcb8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfcb8*, lpNumberOfBytesWritten=0x24dfc98*=0x8, lpOverlapped=0x0) returned 1 [0131.585] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfc9c | out: phKey=0x24dfc9c*=0x4fca30) returned 1 [0131.585] CryptSetKeyParam (hKey=0x4fca30, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.585] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.585] ReadFile (in: hFile=0xac, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xef4e, lpNumberOfBytesRead=0x24dfc50, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24dfc50*=0xef4e, lpOverlapped=0x0) returned 1 [0131.585] CryptEncrypt (in: hKey=0x4fca30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24dfc58*=0xef50, dwBufLen=0xef50 | out: pbData=0x22d0020*, pdwDataLen=0x24dfc58*=0xef50) returned 1 [0131.586] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.586] WriteFile (in: hFile=0xac, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xef50, lpNumberOfBytesWritten=0x24dfc54, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24dfc54*=0xef50, lpOverlapped=0x0) returned 1 [0131.586] CryptDestroyKey (hKey=0x4fca30) returned 1 [0131.586] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0xf024, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.586] SetEndOfFile (hFile=0xac) returned 1 [0131.589] GetProcessHeap () returned 0x4e0000 [0131.589] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0131.589] GetProcessHeap () returned 0x4e0000 [0131.589] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0131.589] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\oUc0yc-q8kf b.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ouc0yc-q8kf b.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\oUc0yc-q8kf b.gif.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ouc0yc-q8kf b.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0131.592] CloseHandle (hObject=0xac) returned 1 [0131.592] FindNextFileW (in: hFindFile=0x4f9820, lpFindFileData=0x24dfd20 | out: lpFindFileData=0x24dfd20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59112760, ftCreationTime.dwHighDateTime=0x1d5e0b0, ftLastAccessTime.dwLowDateTime=0xe3b9ad00, ftLastAccessTime.dwHighDateTime=0x1d5db2f, ftLastWriteTime.dwLowDateTime=0xe3b9ad00, ftLastWriteTime.dwHighDateTime=0x1d5db2f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xffff, cFileName="PHDNs62mGH2-Qp", cAlternateFileName="PHDNS6~1")) returned 1 [0131.592] GetProcessHeap () returned 0x4e0000 [0131.592] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x7a) returned 0x4fa058 [0131.592] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PHDNs62mGH2-Qp\\*.*", lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59112760, ftCreationTime.dwHighDateTime=0x1d5e0b0, ftLastAccessTime.dwLowDateTime=0xe3b9ad00, ftLastAccessTime.dwHighDateTime=0x1d5db2f, ftLastWriteTime.dwLowDateTime=0xe3b9ad00, ftLastWriteTime.dwHighDateTime=0x1d5db2f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24dfba4, dwReserved1=0x77c7389e, cFileName=".", cAlternateFileName="")) returned 0x4fca30 [0131.592] GetProcessHeap () returned 0x4e0000 [0131.592] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0131.592] FindNextFileW (in: hFindFile=0x4fca30, lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59112760, ftCreationTime.dwHighDateTime=0x1d5e0b0, ftLastAccessTime.dwLowDateTime=0xe3b9ad00, ftLastAccessTime.dwHighDateTime=0x1d5db2f, ftLastWriteTime.dwLowDateTime=0xe3b9ad00, ftLastWriteTime.dwHighDateTime=0x1d5db2f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24dfba4, dwReserved1=0x77c7389e, cFileName="..", cAlternateFileName="")) returned 1 [0131.592] FindNextFileW (in: hFindFile=0x4fca30, lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886cfe00, ftCreationTime.dwHighDateTime=0x1d5d8a7, ftLastAccessTime.dwLowDateTime=0xb20ee820, ftLastAccessTime.dwHighDateTime=0x1d5e77c, ftLastWriteTime.dwLowDateTime=0xb20ee820, ftLastWriteTime.dwHighDateTime=0x1d5e77c, nFileSizeHigh=0x0, nFileSizeLow=0x12e62, dwReserved0=0x24dfba4, dwReserved1=0x77c7389e, cFileName="DnBAhivGwsISpeW.odp", cAlternateFileName="DNBAHI~1.ODP")) returned 1 [0131.592] GetProcessHeap () returned 0x4e0000 [0131.592] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x27c) returned 0x521568 [0131.592] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PHDNs62mGH2-Qp\\DnBAhivGwsISpeW.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\phdns62mgh2-qp\\dnbahivgwsispew.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa4 [0131.592] GetProcessHeap () returned 0x4e0000 [0131.593] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0131.593] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0131.593] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfa20 | out: lpNewFilePointer=0x0) returned 1 [0131.593] WriteFile (in: hFile=0xa4, lpBuffer=0x24dfa30*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x24dfa30*, lpNumberOfBytesWritten=0x24dfa08*=0xe, lpOverlapped=0x0) returned 1 [0131.593] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfa0c | out: phKey=0x24dfa0c*=0x4fa058) returned 1 [0131.593] CryptSetKeyParam (hKey=0x4fa058, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.593] GetProcessHeap () returned 0x4e0000 [0131.593] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x50) returned 0x4fd470 [0131.594] CryptEncrypt (in: hKey=0x4fa058, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fd470*, pdwDataLen=0x24df9e8*=0x50, dwBufLen=0x50 | out: pbData=0x4fd470*, pdwDataLen=0x24df9e8*=0x50) returned 1 [0131.594] CryptDestroyKey (hKey=0x4fa058) returned 1 [0131.594] WriteFile (in: hFile=0xa4, lpBuffer=0x4fd470*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x4fd470*, lpNumberOfBytesWritten=0x24dfa08*=0x50, lpOverlapped=0x0) returned 1 [0131.594] WriteFile (in: hFile=0xa4, lpBuffer=0x24dfa10*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x24dfa10*, lpNumberOfBytesWritten=0x24dfa08*=0x4, lpOverlapped=0x0) returned 1 [0131.594] WriteFile (in: hFile=0xa4, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24dfa08*=0x10, lpOverlapped=0x0) returned 1 [0131.594] WriteFile (in: hFile=0xa4, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24dfa08*=0x80, lpOverlapped=0x0) returned 1 [0131.594] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfa18 | out: lpNewFilePointer=0x0) returned 1 [0131.594] WriteFile (in: hFile=0xa4, lpBuffer=0x24dfa28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x24dfa28*, lpNumberOfBytesWritten=0x24dfa08*=0x8, lpOverlapped=0x0) returned 1 [0131.594] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfa0c | out: phKey=0x24dfa0c*=0x4fa058) returned 1 [0131.594] CryptSetKeyParam (hKey=0x4fa058, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.594] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.594] ReadFile (in: hFile=0xa4, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x12e62, lpNumberOfBytesRead=0x24df9c0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df9c0*=0x12e62, lpOverlapped=0x0) returned 1 [0131.595] CryptEncrypt (in: hKey=0x4fa058, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df9c8*=0x12e70, dwBufLen=0x12e70 | out: pbData=0x22d0020*, pdwDataLen=0x24df9c8*=0x12e70) returned 1 [0131.595] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.595] WriteFile (in: hFile=0xa4, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x12e70, lpNumberOfBytesWritten=0x24df9c4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df9c4*=0x12e70, lpOverlapped=0x0) returned 1 [0131.596] CryptDestroyKey (hKey=0x4fa058) returned 1 [0131.596] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x12f54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.596] SetEndOfFile (hFile=0xa4) returned 1 [0131.599] GetProcessHeap () returned 0x4e0000 [0131.599] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fd470 | out: hHeap=0x4e0000) returned 1 [0131.599] GetProcessHeap () returned 0x4e0000 [0131.599] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0131.599] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PHDNs62mGH2-Qp\\DnBAhivGwsISpeW.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\phdns62mgh2-qp\\dnbahivgwsispew.odp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PHDNs62mGH2-Qp\\DnBAhivGwsISpeW.odp.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\phdns62mgh2-qp\\dnbahivgwsispew.odp.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0131.600] CloseHandle (hObject=0xa4) returned 1 [0131.600] FindNextFileW (in: hFindFile=0x4fca30, lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36c99a20, ftCreationTime.dwHighDateTime=0x1d5e40c, ftLastAccessTime.dwLowDateTime=0xf50ab0f0, ftLastAccessTime.dwHighDateTime=0x1d5dd6d, ftLastWriteTime.dwLowDateTime=0xf50ab0f0, ftLastWriteTime.dwHighDateTime=0x1d5dd6d, nFileSizeHigh=0x0, nFileSizeLow=0xd594, dwReserved0=0x24dfba4, dwReserved1=0x77c7389e, cFileName="LfRLZs2V5BEED.bmp", cAlternateFileName="LFRLZS~1.BMP")) returned 1 [0131.600] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PHDNs62mGH2-Qp\\LfRLZs2V5BEED.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\phdns62mgh2-qp\\lfrlzs2v5beed.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa4 [0131.600] GetProcessHeap () returned 0x4e0000 [0131.601] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0131.601] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0131.601] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfa20 | out: lpNewFilePointer=0x0) returned 1 [0131.601] WriteFile (in: hFile=0xa4, lpBuffer=0x24dfa30*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x24dfa30*, lpNumberOfBytesWritten=0x24dfa08*=0xc, lpOverlapped=0x0) returned 1 [0131.601] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfa0c | out: phKey=0x24dfa0c*=0x4fa058) returned 1 [0131.601] CryptSetKeyParam (hKey=0x4fa058, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.602] GetProcessHeap () returned 0x4e0000 [0131.602] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0131.602] CryptEncrypt (in: hKey=0x4fa058, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df9e8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df9e8*=0x40) returned 1 [0131.602] CryptDestroyKey (hKey=0x4fa058) returned 1 [0131.602] WriteFile (in: hFile=0xa4, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24dfa08*=0x40, lpOverlapped=0x0) returned 1 [0131.602] WriteFile (in: hFile=0xa4, lpBuffer=0x24dfa10*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x24dfa10*, lpNumberOfBytesWritten=0x24dfa08*=0x4, lpOverlapped=0x0) returned 1 [0131.602] WriteFile (in: hFile=0xa4, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24dfa08*=0x10, lpOverlapped=0x0) returned 1 [0131.602] WriteFile (in: hFile=0xa4, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24dfa08*=0x80, lpOverlapped=0x0) returned 1 [0131.602] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfa18 | out: lpNewFilePointer=0x0) returned 1 [0131.602] WriteFile (in: hFile=0xa4, lpBuffer=0x24dfa28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x24dfa28*, lpNumberOfBytesWritten=0x24dfa08*=0x8, lpOverlapped=0x0) returned 1 [0131.602] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfa0c | out: phKey=0x24dfa0c*=0x4fa058) returned 1 [0131.602] CryptSetKeyParam (hKey=0x4fa058, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.602] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.602] ReadFile (in: hFile=0xa4, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xd594, lpNumberOfBytesRead=0x24df9c0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df9c0*=0xd594, lpOverlapped=0x0) returned 1 [0131.603] CryptEncrypt (in: hKey=0x4fa058, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df9c8*=0xd5a0, dwBufLen=0xd5a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df9c8*=0xd5a0) returned 1 [0131.603] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.603] WriteFile (in: hFile=0xa4, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xd5a0, lpNumberOfBytesWritten=0x24df9c4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df9c4*=0xd5a0, lpOverlapped=0x0) returned 1 [0131.603] CryptDestroyKey (hKey=0x4fa058) returned 1 [0131.603] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xd674, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.604] SetEndOfFile (hFile=0xa4) returned 1 [0131.606] GetProcessHeap () returned 0x4e0000 [0131.606] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0131.606] GetProcessHeap () returned 0x4e0000 [0131.606] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0131.606] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PHDNs62mGH2-Qp\\LfRLZs2V5BEED.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\phdns62mgh2-qp\\lfrlzs2v5beed.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PHDNs62mGH2-Qp\\LfRLZs2V5BEED.bmp.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\phdns62mgh2-qp\\lfrlzs2v5beed.bmp.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0131.607] CloseHandle (hObject=0xa4) returned 1 [0131.607] FindNextFileW (in: hFindFile=0x4fca30, lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cd86260, ftCreationTime.dwHighDateTime=0x1d5e2f0, ftLastAccessTime.dwLowDateTime=0x90259070, ftLastAccessTime.dwHighDateTime=0x1d5d911, ftLastWriteTime.dwLowDateTime=0x90259070, ftLastWriteTime.dwHighDateTime=0x1d5d911, nFileSizeHigh=0x0, nFileSizeLow=0x480d, dwReserved0=0x24dfba4, dwReserved1=0x77c7389e, cFileName="n2z-A4u0p5Bysrwb.ppt", cAlternateFileName="N2Z-A4~1.PPT")) returned 1 [0131.607] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PHDNs62mGH2-Qp\\n2z-A4u0p5Bysrwb.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\phdns62mgh2-qp\\n2z-a4u0p5bysrwb.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa4 [0131.607] GetProcessHeap () returned 0x4e0000 [0131.607] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0131.607] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0131.607] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfa20 | out: lpNewFilePointer=0x0) returned 1 [0131.607] WriteFile (in: hFile=0xa4, lpBuffer=0x24dfa30*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x24dfa30*, lpNumberOfBytesWritten=0x24dfa08*=0x3, lpOverlapped=0x0) returned 1 [0131.608] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfa0c | out: phKey=0x24dfa0c*=0x4fa058) returned 1 [0131.608] CryptSetKeyParam (hKey=0x4fa058, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.608] GetProcessHeap () returned 0x4e0000 [0131.608] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x50) returned 0x4fd470 [0131.608] CryptEncrypt (in: hKey=0x4fa058, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fd470*, pdwDataLen=0x24df9e8*=0x50, dwBufLen=0x50 | out: pbData=0x4fd470*, pdwDataLen=0x24df9e8*=0x50) returned 1 [0131.608] CryptDestroyKey (hKey=0x4fa058) returned 1 [0131.608] WriteFile (in: hFile=0xa4, lpBuffer=0x4fd470*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x4fd470*, lpNumberOfBytesWritten=0x24dfa08*=0x50, lpOverlapped=0x0) returned 1 [0131.608] WriteFile (in: hFile=0xa4, lpBuffer=0x24dfa10*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x24dfa10*, lpNumberOfBytesWritten=0x24dfa08*=0x4, lpOverlapped=0x0) returned 1 [0131.608] WriteFile (in: hFile=0xa4, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24dfa08*=0x10, lpOverlapped=0x0) returned 1 [0131.608] WriteFile (in: hFile=0xa4, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24dfa08*=0x80, lpOverlapped=0x0) returned 1 [0131.608] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfa18 | out: lpNewFilePointer=0x0) returned 1 [0131.609] WriteFile (in: hFile=0xa4, lpBuffer=0x24dfa28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x24dfa28*, lpNumberOfBytesWritten=0x24dfa08*=0x8, lpOverlapped=0x0) returned 1 [0131.609] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfa0c | out: phKey=0x24dfa0c*=0x4fa058) returned 1 [0131.609] CryptSetKeyParam (hKey=0x4fa058, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.609] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.609] ReadFile (in: hFile=0xa4, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x480d, lpNumberOfBytesRead=0x24df9c0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df9c0*=0x480d, lpOverlapped=0x0) returned 1 [0131.609] CryptEncrypt (in: hKey=0x4fa058, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df9c8*=0x4810, dwBufLen=0x4810 | out: pbData=0x22d0020*, pdwDataLen=0x24df9c8*=0x4810) returned 1 [0131.609] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.609] WriteFile (in: hFile=0xa4, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4810, lpNumberOfBytesWritten=0x24df9c4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df9c4*=0x4810, lpOverlapped=0x0) returned 1 [0131.609] CryptDestroyKey (hKey=0x4fa058) returned 1 [0131.609] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x48f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.609] SetEndOfFile (hFile=0xa4) returned 1 [0131.611] GetProcessHeap () returned 0x4e0000 [0131.611] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fd470 | out: hHeap=0x4e0000) returned 1 [0131.611] GetProcessHeap () returned 0x4e0000 [0131.611] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0131.612] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PHDNs62mGH2-Qp\\n2z-A4u0p5Bysrwb.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\phdns62mgh2-qp\\n2z-a4u0p5bysrwb.ppt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PHDNs62mGH2-Qp\\n2z-A4u0p5Bysrwb.ppt.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\phdns62mgh2-qp\\n2z-a4u0p5bysrwb.ppt.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0131.613] CloseHandle (hObject=0xa4) returned 1 [0131.613] FindNextFileW (in: hFindFile=0x4fca30, lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafd79010, ftCreationTime.dwHighDateTime=0x1d5da26, ftLastAccessTime.dwLowDateTime=0x1fa12680, ftLastAccessTime.dwHighDateTime=0x1d5e4eb, ftLastWriteTime.dwLowDateTime=0x1fa12680, ftLastWriteTime.dwHighDateTime=0x1d5e4eb, nFileSizeHigh=0x0, nFileSizeLow=0x18a65, dwReserved0=0x24dfba4, dwReserved1=0x77c7389e, cFileName="nvZfSv.mp3", cAlternateFileName="")) returned 1 [0131.613] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PHDNs62mGH2-Qp\\nvZfSv.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\phdns62mgh2-qp\\nvzfsv.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa4 [0131.613] GetProcessHeap () returned 0x4e0000 [0131.613] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0131.613] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0131.613] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfa20 | out: lpNewFilePointer=0x0) returned 1 [0131.613] WriteFile (in: hFile=0xa4, lpBuffer=0x24dfa30*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x24dfa30*, lpNumberOfBytesWritten=0x24dfa08*=0xb, lpOverlapped=0x0) returned 1 [0131.614] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfa0c | out: phKey=0x24dfa0c*=0x4fa058) returned 1 [0131.614] CryptSetKeyParam (hKey=0x4fa058, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.614] GetProcessHeap () returned 0x4e0000 [0131.614] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0131.614] CryptEncrypt (in: hKey=0x4fa058, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df9e8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df9e8*=0x30) returned 1 [0131.614] CryptDestroyKey (hKey=0x4fa058) returned 1 [0131.614] WriteFile (in: hFile=0xa4, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24dfa08*=0x30, lpOverlapped=0x0) returned 1 [0131.614] WriteFile (in: hFile=0xa4, lpBuffer=0x24dfa10*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x24dfa10*, lpNumberOfBytesWritten=0x24dfa08*=0x4, lpOverlapped=0x0) returned 1 [0131.614] WriteFile (in: hFile=0xa4, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24dfa08*=0x10, lpOverlapped=0x0) returned 1 [0131.614] WriteFile (in: hFile=0xa4, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24dfa08*=0x80, lpOverlapped=0x0) returned 1 [0131.614] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfa18 | out: lpNewFilePointer=0x0) returned 1 [0131.614] WriteFile (in: hFile=0xa4, lpBuffer=0x24dfa28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x24dfa28*, lpNumberOfBytesWritten=0x24dfa08*=0x8, lpOverlapped=0x0) returned 1 [0131.614] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfa0c | out: phKey=0x24dfa0c*=0x4fa058) returned 1 [0131.614] CryptSetKeyParam (hKey=0x4fa058, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.614] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.614] ReadFile (in: hFile=0xa4, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x18a65, lpNumberOfBytesRead=0x24df9c0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df9c0*=0x18a65, lpOverlapped=0x0) returned 1 [0131.615] CryptEncrypt (in: hKey=0x4fa058, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df9c8*=0x18a70, dwBufLen=0x18a70 | out: pbData=0x22d0020*, pdwDataLen=0x24df9c8*=0x18a70) returned 1 [0131.616] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.616] WriteFile (in: hFile=0xa4, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x18a70, lpNumberOfBytesWritten=0x24df9c4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df9c4*=0x18a70, lpOverlapped=0x0) returned 1 [0131.616] CryptDestroyKey (hKey=0x4fa058) returned 1 [0131.616] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x18b34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.617] SetEndOfFile (hFile=0xa4) returned 1 [0131.619] GetProcessHeap () returned 0x4e0000 [0131.619] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0131.619] GetProcessHeap () returned 0x4e0000 [0131.619] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0131.619] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PHDNs62mGH2-Qp\\nvZfSv.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\phdns62mgh2-qp\\nvzfsv.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PHDNs62mGH2-Qp\\nvZfSv.mp3.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\phdns62mgh2-qp\\nvzfsv.mp3.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0131.620] CloseHandle (hObject=0xa4) returned 1 [0131.620] FindNextFileW (in: hFindFile=0x4fca30, lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x175ad7f0, ftCreationTime.dwHighDateTime=0x1d5d8d9, ftLastAccessTime.dwLowDateTime=0xcc187690, ftLastAccessTime.dwHighDateTime=0x1d5da03, ftLastWriteTime.dwLowDateTime=0xcc187690, ftLastWriteTime.dwHighDateTime=0x1d5da03, nFileSizeHigh=0x0, nFileSizeLow=0xa7da, dwReserved0=0x24dfba4, dwReserved1=0x77c7389e, cFileName="OjIokWpJpEtX.png", cAlternateFileName="OJIOKW~1.PNG")) returned 1 [0131.620] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PHDNs62mGH2-Qp\\OjIokWpJpEtX.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\phdns62mgh2-qp\\ojiokwpjpetx.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa4 [0131.620] GetProcessHeap () returned 0x4e0000 [0131.620] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0131.620] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0131.620] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfa20 | out: lpNewFilePointer=0x0) returned 1 [0131.620] WriteFile (in: hFile=0xa4, lpBuffer=0x24dfa30*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x24dfa30*, lpNumberOfBytesWritten=0x24dfa08*=0x6, lpOverlapped=0x0) returned 1 [0131.621] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfa0c | out: phKey=0x24dfa0c*=0x4fa058) returned 1 [0131.621] CryptSetKeyParam (hKey=0x4fa058, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.621] GetProcessHeap () returned 0x4e0000 [0131.621] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0131.621] CryptEncrypt (in: hKey=0x4fa058, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df9e8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df9e8*=0x40) returned 1 [0131.621] CryptDestroyKey (hKey=0x4fa058) returned 1 [0131.621] WriteFile (in: hFile=0xa4, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24dfa08*=0x40, lpOverlapped=0x0) returned 1 [0131.621] WriteFile (in: hFile=0xa4, lpBuffer=0x24dfa10*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x24dfa10*, lpNumberOfBytesWritten=0x24dfa08*=0x4, lpOverlapped=0x0) returned 1 [0131.622] WriteFile (in: hFile=0xa4, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24dfa08*=0x10, lpOverlapped=0x0) returned 1 [0131.622] WriteFile (in: hFile=0xa4, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24dfa08*=0x80, lpOverlapped=0x0) returned 1 [0131.622] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfa18 | out: lpNewFilePointer=0x0) returned 1 [0131.622] WriteFile (in: hFile=0xa4, lpBuffer=0x24dfa28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x24dfa28*, lpNumberOfBytesWritten=0x24dfa08*=0x8, lpOverlapped=0x0) returned 1 [0131.622] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfa0c | out: phKey=0x24dfa0c*=0x4fa058) returned 1 [0131.622] CryptSetKeyParam (hKey=0x4fa058, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.622] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.622] ReadFile (in: hFile=0xa4, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xa7da, lpNumberOfBytesRead=0x24df9c0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df9c0*=0xa7da, lpOverlapped=0x0) returned 1 [0131.622] CryptEncrypt (in: hKey=0x4fa058, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df9c8*=0xa7e0, dwBufLen=0xa7e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df9c8*=0xa7e0) returned 1 [0131.623] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.623] WriteFile (in: hFile=0xa4, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xa7e0, lpNumberOfBytesWritten=0x24df9c4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df9c4*=0xa7e0, lpOverlapped=0x0) returned 1 [0131.623] CryptDestroyKey (hKey=0x4fa058) returned 1 [0131.623] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xa8b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.623] SetEndOfFile (hFile=0xa4) returned 1 [0131.625] GetProcessHeap () returned 0x4e0000 [0131.625] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0131.625] GetProcessHeap () returned 0x4e0000 [0131.625] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0131.625] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PHDNs62mGH2-Qp\\OjIokWpJpEtX.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\phdns62mgh2-qp\\ojiokwpjpetx.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PHDNs62mGH2-Qp\\OjIokWpJpEtX.png.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\phdns62mgh2-qp\\ojiokwpjpetx.png.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0131.628] CloseHandle (hObject=0xa4) returned 1 [0131.628] FindNextFileW (in: hFindFile=0x4fca30, lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44cd0dc0, ftCreationTime.dwHighDateTime=0x1d5e239, ftLastAccessTime.dwLowDateTime=0x509da260, ftLastAccessTime.dwHighDateTime=0x1d5e575, ftLastWriteTime.dwLowDateTime=0x509da260, ftLastWriteTime.dwHighDateTime=0x1d5e575, nFileSizeHigh=0x0, nFileSizeLow=0x182d0, dwReserved0=0x24dfba4, dwReserved1=0x77c7389e, cFileName="VD6WmNOwvSAW.docx", cAlternateFileName="VD6WMN~1.DOC")) returned 1 [0131.628] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PHDNs62mGH2-Qp\\VD6WmNOwvSAW.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\phdns62mgh2-qp\\vd6wmnowvsaw.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa4 [0131.628] GetProcessHeap () returned 0x4e0000 [0131.628] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0131.628] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0131.628] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfa20 | out: lpNewFilePointer=0x0) returned 1 [0131.628] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfa0c | out: phKey=0x24dfa0c*=0x4fa058) returned 1 [0131.628] CryptSetKeyParam (hKey=0x4fa058, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.628] GetProcessHeap () returned 0x4e0000 [0131.628] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0131.628] CryptEncrypt (in: hKey=0x4fa058, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df9e8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df9e8*=0x40) returned 1 [0131.628] CryptDestroyKey (hKey=0x4fa058) returned 1 [0131.628] WriteFile (in: hFile=0xa4, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24dfa08*=0x40, lpOverlapped=0x0) returned 1 [0131.629] WriteFile (in: hFile=0xa4, lpBuffer=0x24dfa10*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x24dfa10*, lpNumberOfBytesWritten=0x24dfa08*=0x4, lpOverlapped=0x0) returned 1 [0131.629] WriteFile (in: hFile=0xa4, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24dfa08*=0x10, lpOverlapped=0x0) returned 1 [0131.629] WriteFile (in: hFile=0xa4, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24dfa08*=0x80, lpOverlapped=0x0) returned 1 [0131.630] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfa18 | out: lpNewFilePointer=0x0) returned 1 [0131.630] WriteFile (in: hFile=0xa4, lpBuffer=0x24dfa28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x24dfa28*, lpNumberOfBytesWritten=0x24dfa08*=0x8, lpOverlapped=0x0) returned 1 [0131.630] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfa0c | out: phKey=0x24dfa0c*=0x4fa058) returned 1 [0131.630] CryptSetKeyParam (hKey=0x4fa058, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.630] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.630] ReadFile (in: hFile=0xa4, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x182d0, lpNumberOfBytesRead=0x24df9c0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df9c0*=0x182d0, lpOverlapped=0x0) returned 1 [0131.630] CryptEncrypt (in: hKey=0x4fa058, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df9c8*=0x182d0, dwBufLen=0x182d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df9c8*=0x182d0) returned 1 [0131.631] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.631] WriteFile (in: hFile=0xa4, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x182d0, lpNumberOfBytesWritten=0x24df9c4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df9c4*=0x182d0, lpOverlapped=0x0) returned 1 [0131.632] CryptDestroyKey (hKey=0x4fa058) returned 1 [0131.632] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x183a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.632] SetEndOfFile (hFile=0xa4) returned 1 [0131.651] GetProcessHeap () returned 0x4e0000 [0131.651] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0131.651] GetProcessHeap () returned 0x4e0000 [0131.651] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0131.651] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PHDNs62mGH2-Qp\\VD6WmNOwvSAW.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\phdns62mgh2-qp\\vd6wmnowvsaw.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PHDNs62mGH2-Qp\\VD6WmNOwvSAW.docx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\phdns62mgh2-qp\\vd6wmnowvsaw.docx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0131.652] CloseHandle (hObject=0xa4) returned 1 [0131.656] FindNextFileW (in: hFindFile=0x4fca30, lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbb25070, ftCreationTime.dwHighDateTime=0x1d5dc96, ftLastAccessTime.dwLowDateTime=0x9b162890, ftLastAccessTime.dwHighDateTime=0x1d5d91c, ftLastWriteTime.dwLowDateTime=0x9b162890, ftLastWriteTime.dwHighDateTime=0x1d5d91c, nFileSizeHigh=0x0, nFileSizeLow=0x16ebe, dwReserved0=0x24dfba4, dwReserved1=0x77c7389e, cFileName="YiGuCSIuHl4NVOXR1S.csv", cAlternateFileName="YIGUCS~1.CSV")) returned 1 [0131.656] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PHDNs62mGH2-Qp\\YiGuCSIuHl4NVOXR1S.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\phdns62mgh2-qp\\yigucsiuhl4nvoxr1s.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa4 [0131.656] GetProcessHeap () returned 0x4e0000 [0131.656] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0131.656] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0131.656] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfa20 | out: lpNewFilePointer=0x0) returned 1 [0131.656] WriteFile (in: hFile=0xa4, lpBuffer=0x24dfa30*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x24dfa30*, lpNumberOfBytesWritten=0x24dfa08*=0x2, lpOverlapped=0x0) returned 1 [0131.657] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfa0c | out: phKey=0x24dfa0c*=0x4fa058) returned 1 [0131.657] CryptSetKeyParam (hKey=0x4fa058, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.657] GetProcessHeap () returned 0x4e0000 [0131.657] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x50) returned 0x4fd470 [0131.657] CryptEncrypt (in: hKey=0x4fa058, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fd470*, pdwDataLen=0x24df9e8*=0x50, dwBufLen=0x50 | out: pbData=0x4fd470*, pdwDataLen=0x24df9e8*=0x50) returned 1 [0131.657] CryptDestroyKey (hKey=0x4fa058) returned 1 [0131.657] WriteFile (in: hFile=0xa4, lpBuffer=0x4fd470*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x4fd470*, lpNumberOfBytesWritten=0x24dfa08*=0x50, lpOverlapped=0x0) returned 1 [0131.657] WriteFile (in: hFile=0xa4, lpBuffer=0x24dfa10*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x24dfa10*, lpNumberOfBytesWritten=0x24dfa08*=0x4, lpOverlapped=0x0) returned 1 [0131.657] WriteFile (in: hFile=0xa4, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24dfa08*=0x10, lpOverlapped=0x0) returned 1 [0131.657] WriteFile (in: hFile=0xa4, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24dfa08*=0x80, lpOverlapped=0x0) returned 1 [0131.657] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfa18 | out: lpNewFilePointer=0x0) returned 1 [0131.657] WriteFile (in: hFile=0xa4, lpBuffer=0x24dfa28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24dfa08, lpOverlapped=0x0 | out: lpBuffer=0x24dfa28*, lpNumberOfBytesWritten=0x24dfa08*=0x8, lpOverlapped=0x0) returned 1 [0131.658] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfa0c | out: phKey=0x24dfa0c*=0x4fa058) returned 1 [0131.658] CryptSetKeyParam (hKey=0x4fa058, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.658] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.658] ReadFile (in: hFile=0xa4, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x16ebe, lpNumberOfBytesRead=0x24df9c0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df9c0*=0x16ebe, lpOverlapped=0x0) returned 1 [0131.658] CryptEncrypt (in: hKey=0x4fa058, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df9c8*=0x16ec0, dwBufLen=0x16ec0 | out: pbData=0x22d0020*, pdwDataLen=0x24df9c8*=0x16ec0) returned 1 [0131.659] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.659] WriteFile (in: hFile=0xa4, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x16ec0, lpNumberOfBytesWritten=0x24df9c4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df9c4*=0x16ec0, lpOverlapped=0x0) returned 1 [0131.659] CryptDestroyKey (hKey=0x4fa058) returned 1 [0131.659] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x16fa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.660] SetEndOfFile (hFile=0xa4) returned 1 [0131.663] GetProcessHeap () returned 0x4e0000 [0131.663] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fd470 | out: hHeap=0x4e0000) returned 1 [0131.663] GetProcessHeap () returned 0x4e0000 [0131.663] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0131.663] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PHDNs62mGH2-Qp\\YiGuCSIuHl4NVOXR1S.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\phdns62mgh2-qp\\yigucsiuhl4nvoxr1s.csv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PHDNs62mGH2-Qp\\YiGuCSIuHl4NVOXR1S.csv.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\phdns62mgh2-qp\\yigucsiuhl4nvoxr1s.csv.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0131.664] CloseHandle (hObject=0xa4) returned 1 [0131.666] FindNextFileW (in: hFindFile=0x4fca30, lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbb25070, ftCreationTime.dwHighDateTime=0x1d5dc96, ftLastAccessTime.dwLowDateTime=0x9b162890, ftLastAccessTime.dwHighDateTime=0x1d5d91c, ftLastWriteTime.dwLowDateTime=0x9b162890, ftLastWriteTime.dwHighDateTime=0x1d5d91c, nFileSizeHigh=0x0, nFileSizeLow=0x16ebe, dwReserved0=0x24dfba4, dwReserved1=0x77c7389e, cFileName="YiGuCSIuHl4NVOXR1S.csv", cAlternateFileName="YIGUCS~1.CSV")) returned 0 [0131.666] GetProcessHeap () returned 0x4e0000 [0131.666] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0131.666] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df9f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x4fa058) returned 1 [0131.666] CryptDecrypt (in: hKey=0x4fa058, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24dfa60 | out: pbData=0x4f53d8, pdwDataLen=0x24dfa60) returned 1 [0131.666] CryptDestroyKey (hKey=0x4fa058) returned 1 [0131.666] GetProcessHeap () returned 0x4e0000 [0131.666] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0131.666] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df9f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x4fa058) returned 1 [0131.666] CryptDecrypt (in: hKey=0x4fa058, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24dfa60 | out: pbData=0x4f5420, pdwDataLen=0x24dfa60) returned 1 [0131.666] CryptDestroyKey (hKey=0x4fa058) returned 1 [0131.666] GetProcessHeap () returned 0x4e0000 [0131.666] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5217f0 [0131.666] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df9f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x4fa058) returned 1 [0131.666] CryptDecrypt (in: hKey=0x4fa058, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5217f0, pdwDataLen=0x24dfa60 | out: pbData=0x5217f0, pdwDataLen=0x24dfa60) returned 1 [0131.666] CryptDestroyKey (hKey=0x4fa058) returned 1 [0131.667] wsprintfW (in: param_1=0x24dea3c, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PHDNs62mGH2-Qp\\readme-warning.txt") returned 71 [0131.667] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PHDNs62mGH2-Qp\\readme-warning.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\phdns62mgh2-qp\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa4 [0131.667] WriteFile (in: hFile=0xa4, lpBuffer=0x5217f0*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24dea38, lpOverlapped=0x0 | out: lpBuffer=0x5217f0*, lpNumberOfBytesWritten=0x24dea38*=0x6c3, lpOverlapped=0x0) returned 1 [0131.668] CloseHandle (hObject=0xa4) returned 1 [0131.668] GetProcessHeap () returned 0x4e0000 [0131.668] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5217f0 | out: hHeap=0x4e0000) returned 1 [0131.668] GetProcessHeap () returned 0x4e0000 [0131.668] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0131.668] GetProcessHeap () returned 0x4e0000 [0131.668] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0131.668] FindClose (in: hFindFile=0x4fca30 | out: hFindFile=0x4fca30) returned 1 [0131.669] GetProcessHeap () returned 0x4e0000 [0131.669] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x521568 | out: hHeap=0x4e0000) returned 1 [0131.669] FindNextFileW (in: hFindFile=0x4f9820, lpFindFileData=0x24dfd20 | out: lpFindFileData=0x24dfd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20aad490, ftCreationTime.dwHighDateTime=0x1d5d7d5, ftLastAccessTime.dwLowDateTime=0x890f70c0, ftLastAccessTime.dwHighDateTime=0x1d5de53, ftLastWriteTime.dwLowDateTime=0x890f70c0, ftLastWriteTime.dwHighDateTime=0x1d5de53, nFileSizeHigh=0x0, nFileSizeLow=0x545b, dwReserved0=0x0, dwReserved1=0xffff, cFileName="pKZPIllC8laOeEzH3xt.avi", cAlternateFileName="PKZPIL~1.AVI")) returned 1 [0131.669] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\pKZPIllC8laOeEzH3xt.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pkzpillc8laoeezh3xt.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xac [0131.669] GetProcessHeap () returned 0x4e0000 [0131.669] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0131.669] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0131.669] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfcb0 | out: lpNewFilePointer=0x0) returned 1 [0131.669] WriteFile (in: hFile=0xac, lpBuffer=0x24dfcc0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfcc0*, lpNumberOfBytesWritten=0x24dfc98*=0x5, lpOverlapped=0x0) returned 1 [0131.670] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfc9c | out: phKey=0x24dfc9c*=0x4fca30) returned 1 [0131.670] CryptSetKeyParam (hKey=0x4fca30, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.670] GetProcessHeap () returned 0x4e0000 [0131.670] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x50) returned 0x4fd470 [0131.670] CryptEncrypt (in: hKey=0x4fca30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fd470*, pdwDataLen=0x24dfc78*=0x50, dwBufLen=0x50 | out: pbData=0x4fd470*, pdwDataLen=0x24dfc78*=0x50) returned 1 [0131.670] CryptDestroyKey (hKey=0x4fca30) returned 1 [0131.670] WriteFile (in: hFile=0xac, lpBuffer=0x4fd470*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4fd470*, lpNumberOfBytesWritten=0x24dfc98*=0x50, lpOverlapped=0x0) returned 1 [0131.670] WriteFile (in: hFile=0xac, lpBuffer=0x24dfca0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfca0*, lpNumberOfBytesWritten=0x24dfc98*=0x4, lpOverlapped=0x0) returned 1 [0131.670] WriteFile (in: hFile=0xac, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24dfc98*=0x10, lpOverlapped=0x0) returned 1 [0131.670] WriteFile (in: hFile=0xac, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24dfc98*=0x80, lpOverlapped=0x0) returned 1 [0131.670] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfca8 | out: lpNewFilePointer=0x0) returned 1 [0131.670] WriteFile (in: hFile=0xac, lpBuffer=0x24dfcb8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfcb8*, lpNumberOfBytesWritten=0x24dfc98*=0x8, lpOverlapped=0x0) returned 1 [0131.670] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfc9c | out: phKey=0x24dfc9c*=0x4fca30) returned 1 [0131.670] CryptSetKeyParam (hKey=0x4fca30, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.670] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.670] ReadFile (in: hFile=0xac, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x545b, lpNumberOfBytesRead=0x24dfc50, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24dfc50*=0x545b, lpOverlapped=0x0) returned 1 [0131.671] CryptEncrypt (in: hKey=0x4fca30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24dfc58*=0x5460, dwBufLen=0x5460 | out: pbData=0x22d0020*, pdwDataLen=0x24dfc58*=0x5460) returned 1 [0131.671] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.671] WriteFile (in: hFile=0xac, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5460, lpNumberOfBytesWritten=0x24dfc54, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24dfc54*=0x5460, lpOverlapped=0x0) returned 1 [0131.671] CryptDestroyKey (hKey=0x4fca30) returned 1 [0131.671] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x5544, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.671] SetEndOfFile (hFile=0xac) returned 1 [0131.674] GetProcessHeap () returned 0x4e0000 [0131.674] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fd470 | out: hHeap=0x4e0000) returned 1 [0131.674] GetProcessHeap () returned 0x4e0000 [0131.674] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0131.674] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\pKZPIllC8laOeEzH3xt.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pkzpillc8laoeezh3xt.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\pKZPIllC8laOeEzH3xt.avi.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pkzpillc8laoeezh3xt.avi.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0131.676] CloseHandle (hObject=0xac) returned 1 [0131.676] FindNextFileW (in: hFindFile=0x4f9820, lpFindFileData=0x24dfd20 | out: lpFindFileData=0x24dfd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc73a3f00, ftCreationTime.dwHighDateTime=0x1d6eae2, ftLastAccessTime.dwLowDateTime=0xc73a3f00, ftLastAccessTime.dwHighDateTime=0x1d6eae2, ftLastWriteTime.dwLowDateTime=0x9eb24500, ftLastWriteTime.dwHighDateTime=0x1d6eae2, nFileSizeHigh=0x0, nFileSizeLow=0x44ad9, dwReserved0=0x0, dwReserved1=0xffff, cFileName="QDgotnX2VapbkvCb.exe", cAlternateFileName="QDGOTN~1.EXE")) returned 1 [0131.676] FindNextFileW (in: hFindFile=0x4f9820, lpFindFileData=0x24dfd20 | out: lpFindFileData=0x24dfd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x357029d0, ftCreationTime.dwHighDateTime=0x1d5e66b, ftLastAccessTime.dwLowDateTime=0xa81740a0, ftLastAccessTime.dwHighDateTime=0x1d5e59d, ftLastWriteTime.dwLowDateTime=0xa81740a0, ftLastWriteTime.dwHighDateTime=0x1d5e59d, nFileSizeHigh=0x0, nFileSizeLow=0xccab, dwReserved0=0x0, dwReserved1=0xffff, cFileName="rLYHZPzQbRGc5nDx8e.m4a", cAlternateFileName="RLYHZP~1.M4A")) returned 1 [0131.676] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLYHZPzQbRGc5nDx8e.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rlyhzpzqbrgc5ndx8e.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xac [0131.677] GetProcessHeap () returned 0x4e0000 [0131.677] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0131.677] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0131.677] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfcb0 | out: lpNewFilePointer=0x0) returned 1 [0131.677] WriteFile (in: hFile=0xac, lpBuffer=0x24dfcc0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfcc0*, lpNumberOfBytesWritten=0x24dfc98*=0x5, lpOverlapped=0x0) returned 1 [0131.678] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfc9c | out: phKey=0x24dfc9c*=0x4fca30) returned 1 [0131.678] CryptSetKeyParam (hKey=0x4fca30, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.678] GetProcessHeap () returned 0x4e0000 [0131.678] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x50) returned 0x4fd470 [0131.678] CryptEncrypt (in: hKey=0x4fca30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fd470*, pdwDataLen=0x24dfc78*=0x50, dwBufLen=0x50 | out: pbData=0x4fd470*, pdwDataLen=0x24dfc78*=0x50) returned 1 [0131.678] CryptDestroyKey (hKey=0x4fca30) returned 1 [0131.678] WriteFile (in: hFile=0xac, lpBuffer=0x4fd470*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4fd470*, lpNumberOfBytesWritten=0x24dfc98*=0x50, lpOverlapped=0x0) returned 1 [0131.678] WriteFile (in: hFile=0xac, lpBuffer=0x24dfca0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfca0*, lpNumberOfBytesWritten=0x24dfc98*=0x4, lpOverlapped=0x0) returned 1 [0131.678] WriteFile (in: hFile=0xac, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24dfc98*=0x10, lpOverlapped=0x0) returned 1 [0131.678] WriteFile (in: hFile=0xac, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24dfc98*=0x80, lpOverlapped=0x0) returned 1 [0131.678] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfca8 | out: lpNewFilePointer=0x0) returned 1 [0131.678] WriteFile (in: hFile=0xac, lpBuffer=0x24dfcb8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfcb8*, lpNumberOfBytesWritten=0x24dfc98*=0x8, lpOverlapped=0x0) returned 1 [0131.678] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfc9c | out: phKey=0x24dfc9c*=0x4fca30) returned 1 [0131.678] CryptSetKeyParam (hKey=0x4fca30, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.678] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.678] ReadFile (in: hFile=0xac, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xccab, lpNumberOfBytesRead=0x24dfc50, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24dfc50*=0xccab, lpOverlapped=0x0) returned 1 [0131.679] CryptEncrypt (in: hKey=0x4fca30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24dfc58*=0xccb0, dwBufLen=0xccb0 | out: pbData=0x22d0020*, pdwDataLen=0x24dfc58*=0xccb0) returned 1 [0131.679] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.679] WriteFile (in: hFile=0xac, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xccb0, lpNumberOfBytesWritten=0x24dfc54, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24dfc54*=0xccb0, lpOverlapped=0x0) returned 1 [0131.679] CryptDestroyKey (hKey=0x4fca30) returned 1 [0131.679] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0xcd94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.679] SetEndOfFile (hFile=0xac) returned 1 [0131.683] GetProcessHeap () returned 0x4e0000 [0131.683] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fd470 | out: hHeap=0x4e0000) returned 1 [0131.683] GetProcessHeap () returned 0x4e0000 [0131.683] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0131.683] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLYHZPzQbRGc5nDx8e.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rlyhzpzqbrgc5ndx8e.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLYHZPzQbRGc5nDx8e.m4a.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rlyhzpzqbrgc5ndx8e.m4a.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0131.686] CloseHandle (hObject=0xac) returned 1 [0131.686] FindNextFileW (in: hFindFile=0x4f9820, lpFindFileData=0x24dfd20 | out: lpFindFileData=0x24dfd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b62a140, ftCreationTime.dwHighDateTime=0x1d5daab, ftLastAccessTime.dwLowDateTime=0x8d430010, ftLastAccessTime.dwHighDateTime=0x1d5e1bb, ftLastWriteTime.dwLowDateTime=0x8d430010, ftLastWriteTime.dwHighDateTime=0x1d5e1bb, nFileSizeHigh=0x0, nFileSizeLow=0x3ab6, dwReserved0=0x0, dwReserved1=0xffff, cFileName="Ruu9nGXRTFgb.ppt", cAlternateFileName="RUU9NG~1.PPT")) returned 1 [0131.686] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ruu9nGXRTFgb.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ruu9ngxrtfgb.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xac [0131.686] GetProcessHeap () returned 0x4e0000 [0131.686] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0131.686] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0131.686] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfcb0 | out: lpNewFilePointer=0x0) returned 1 [0131.686] WriteFile (in: hFile=0xac, lpBuffer=0x24dfcc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfcc0*, lpNumberOfBytesWritten=0x24dfc98*=0xa, lpOverlapped=0x0) returned 1 [0131.687] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfc9c | out: phKey=0x24dfc9c*=0x4fca30) returned 1 [0131.687] CryptSetKeyParam (hKey=0x4fca30, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.687] GetProcessHeap () returned 0x4e0000 [0131.687] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0131.687] CryptEncrypt (in: hKey=0x4fca30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24dfc78*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24dfc78*=0x40) returned 1 [0131.687] CryptDestroyKey (hKey=0x4fca30) returned 1 [0131.687] WriteFile (in: hFile=0xac, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24dfc98*=0x40, lpOverlapped=0x0) returned 1 [0131.687] WriteFile (in: hFile=0xac, lpBuffer=0x24dfca0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfca0*, lpNumberOfBytesWritten=0x24dfc98*=0x4, lpOverlapped=0x0) returned 1 [0131.687] WriteFile (in: hFile=0xac, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24dfc98*=0x10, lpOverlapped=0x0) returned 1 [0131.687] WriteFile (in: hFile=0xac, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24dfc98*=0x80, lpOverlapped=0x0) returned 1 [0131.687] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfca8 | out: lpNewFilePointer=0x0) returned 1 [0131.687] WriteFile (in: hFile=0xac, lpBuffer=0x24dfcb8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfcb8*, lpNumberOfBytesWritten=0x24dfc98*=0x8, lpOverlapped=0x0) returned 1 [0131.687] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfc9c | out: phKey=0x24dfc9c*=0x4fca30) returned 1 [0131.688] CryptSetKeyParam (hKey=0x4fca30, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.688] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.688] ReadFile (in: hFile=0xac, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3ab6, lpNumberOfBytesRead=0x24dfc50, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24dfc50*=0x3ab6, lpOverlapped=0x0) returned 1 [0131.688] CryptEncrypt (in: hKey=0x4fca30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24dfc58*=0x3ac0, dwBufLen=0x3ac0 | out: pbData=0x22d0020*, pdwDataLen=0x24dfc58*=0x3ac0) returned 1 [0131.688] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.688] WriteFile (in: hFile=0xac, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3ac0, lpNumberOfBytesWritten=0x24dfc54, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24dfc54*=0x3ac0, lpOverlapped=0x0) returned 1 [0131.688] CryptDestroyKey (hKey=0x4fca30) returned 1 [0131.688] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x3b94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.688] SetEndOfFile (hFile=0xac) returned 1 [0131.691] GetProcessHeap () returned 0x4e0000 [0131.691] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0131.691] GetProcessHeap () returned 0x4e0000 [0131.691] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0131.691] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ruu9nGXRTFgb.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ruu9ngxrtfgb.ppt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ruu9nGXRTFgb.ppt.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ruu9ngxrtfgb.ppt.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0131.693] CloseHandle (hObject=0xac) returned 1 [0131.693] FindNextFileW (in: hFindFile=0x4f9820, lpFindFileData=0x24dfd20 | out: lpFindFileData=0x24dfd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x334cc290, ftCreationTime.dwHighDateTime=0x1d5dbc0, ftLastAccessTime.dwLowDateTime=0x5c769750, ftLastAccessTime.dwHighDateTime=0x1d5e7f4, ftLastWriteTime.dwLowDateTime=0x5c769750, ftLastWriteTime.dwHighDateTime=0x1d5e7f4, nFileSizeHigh=0x0, nFileSizeLow=0x1084d, dwReserved0=0x0, dwReserved1=0xffff, cFileName="rYBfz3.mkv", cAlternateFileName="")) returned 1 [0131.693] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rYBfz3.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rybfz3.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xac [0131.694] GetProcessHeap () returned 0x4e0000 [0131.694] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0131.694] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0131.694] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfcb0 | out: lpNewFilePointer=0x0) returned 1 [0131.694] WriteFile (in: hFile=0xac, lpBuffer=0x24dfcc0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfcc0*, lpNumberOfBytesWritten=0x24dfc98*=0x3, lpOverlapped=0x0) returned 1 [0131.694] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfc9c | out: phKey=0x24dfc9c*=0x4fca30) returned 1 [0131.695] CryptSetKeyParam (hKey=0x4fca30, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.695] GetProcessHeap () returned 0x4e0000 [0131.695] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0131.695] CryptEncrypt (in: hKey=0x4fca30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24dfc78*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24dfc78*=0x30) returned 1 [0131.695] CryptDestroyKey (hKey=0x4fca30) returned 1 [0131.695] WriteFile (in: hFile=0xac, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24dfc98*=0x30, lpOverlapped=0x0) returned 1 [0131.695] WriteFile (in: hFile=0xac, lpBuffer=0x24dfca0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfca0*, lpNumberOfBytesWritten=0x24dfc98*=0x4, lpOverlapped=0x0) returned 1 [0131.695] WriteFile (in: hFile=0xac, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24dfc98*=0x10, lpOverlapped=0x0) returned 1 [0131.695] WriteFile (in: hFile=0xac, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24dfc98*=0x80, lpOverlapped=0x0) returned 1 [0131.695] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfca8 | out: lpNewFilePointer=0x0) returned 1 [0131.695] WriteFile (in: hFile=0xac, lpBuffer=0x24dfcb8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfcb8*, lpNumberOfBytesWritten=0x24dfc98*=0x8, lpOverlapped=0x0) returned 1 [0131.695] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfc9c | out: phKey=0x24dfc9c*=0x4fca30) returned 1 [0131.695] CryptSetKeyParam (hKey=0x4fca30, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.695] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.695] ReadFile (in: hFile=0xac, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1084d, lpNumberOfBytesRead=0x24dfc50, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24dfc50*=0x1084d, lpOverlapped=0x0) returned 1 [0131.696] CryptEncrypt (in: hKey=0x4fca30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24dfc58*=0x10850, dwBufLen=0x10850 | out: pbData=0x22d0020*, pdwDataLen=0x24dfc58*=0x10850) returned 1 [0131.696] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.696] WriteFile (in: hFile=0xac, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x10850, lpNumberOfBytesWritten=0x24dfc54, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24dfc54*=0x10850, lpOverlapped=0x0) returned 1 [0131.697] CryptDestroyKey (hKey=0x4fca30) returned 1 [0131.697] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x10914, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.697] SetEndOfFile (hFile=0xac) returned 1 [0131.699] GetProcessHeap () returned 0x4e0000 [0131.700] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0131.700] GetProcessHeap () returned 0x4e0000 [0131.700] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0131.700] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rYBfz3.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rybfz3.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rYBfz3.mkv.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rybfz3.mkv.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0131.702] CloseHandle (hObject=0xac) returned 1 [0131.703] FindNextFileW (in: hFindFile=0x4f9820, lpFindFileData=0x24dfd20 | out: lpFindFileData=0x24dfd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2ffe030, ftCreationTime.dwHighDateTime=0x1d5e069, ftLastAccessTime.dwLowDateTime=0x8364b410, ftLastAccessTime.dwHighDateTime=0x1d5e078, ftLastWriteTime.dwLowDateTime=0x8364b410, ftLastWriteTime.dwHighDateTime=0x1d5e078, nFileSizeHigh=0x0, nFileSizeLow=0x16d71, dwReserved0=0x0, dwReserved1=0xffff, cFileName="TRLAK.mp3", cAlternateFileName="")) returned 1 [0131.703] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\TRLAK.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\trlak.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xac [0131.703] GetProcessHeap () returned 0x4e0000 [0131.703] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0131.703] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0131.703] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfcb0 | out: lpNewFilePointer=0x0) returned 1 [0131.703] WriteFile (in: hFile=0xac, lpBuffer=0x24dfcc0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfcc0*, lpNumberOfBytesWritten=0x24dfc98*=0xf, lpOverlapped=0x0) returned 1 [0131.704] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfc9c | out: phKey=0x24dfc9c*=0x4fca30) returned 1 [0131.704] CryptSetKeyParam (hKey=0x4fca30, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.704] GetProcessHeap () returned 0x4e0000 [0131.704] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0131.704] CryptEncrypt (in: hKey=0x4fca30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24dfc78*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24dfc78*=0x30) returned 1 [0131.704] CryptDestroyKey (hKey=0x4fca30) returned 1 [0131.704] WriteFile (in: hFile=0xac, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24dfc98*=0x30, lpOverlapped=0x0) returned 1 [0131.704] WriteFile (in: hFile=0xac, lpBuffer=0x24dfca0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfca0*, lpNumberOfBytesWritten=0x24dfc98*=0x4, lpOverlapped=0x0) returned 1 [0131.704] WriteFile (in: hFile=0xac, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24dfc98*=0x10, lpOverlapped=0x0) returned 1 [0131.704] WriteFile (in: hFile=0xac, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24dfc98*=0x80, lpOverlapped=0x0) returned 1 [0131.704] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfca8 | out: lpNewFilePointer=0x0) returned 1 [0131.704] WriteFile (in: hFile=0xac, lpBuffer=0x24dfcb8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfcb8*, lpNumberOfBytesWritten=0x24dfc98*=0x8, lpOverlapped=0x0) returned 1 [0131.704] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfc9c | out: phKey=0x24dfc9c*=0x4fca30) returned 1 [0131.704] CryptSetKeyParam (hKey=0x4fca30, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.704] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.704] ReadFile (in: hFile=0xac, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x16d71, lpNumberOfBytesRead=0x24dfc50, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24dfc50*=0x16d71, lpOverlapped=0x0) returned 1 [0131.705] CryptEncrypt (in: hKey=0x4fca30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24dfc58*=0x16d80, dwBufLen=0x16d80 | out: pbData=0x22d0020*, pdwDataLen=0x24dfc58*=0x16d80) returned 1 [0131.706] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.706] WriteFile (in: hFile=0xac, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x16d80, lpNumberOfBytesWritten=0x24dfc54, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24dfc54*=0x16d80, lpOverlapped=0x0) returned 1 [0131.706] CryptDestroyKey (hKey=0x4fca30) returned 1 [0131.706] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x16e44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.706] SetEndOfFile (hFile=0xac) returned 1 [0131.709] GetProcessHeap () returned 0x4e0000 [0131.709] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0131.709] GetProcessHeap () returned 0x4e0000 [0131.709] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0131.709] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\TRLAK.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\trlak.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\TRLAK.mp3.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\trlak.mp3.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0131.730] CloseHandle (hObject=0xac) returned 1 [0131.730] FindNextFileW (in: hFindFile=0x4f9820, lpFindFileData=0x24dfd20 | out: lpFindFileData=0x24dfd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56036c90, ftCreationTime.dwHighDateTime=0x1d5e61e, ftLastAccessTime.dwLowDateTime=0xa21775e0, ftLastAccessTime.dwHighDateTime=0x1d5da6b, ftLastWriteTime.dwLowDateTime=0xa21775e0, ftLastWriteTime.dwHighDateTime=0x1d5da6b, nFileSizeHigh=0x0, nFileSizeLow=0xe4d0, dwReserved0=0x0, dwReserved1=0xffff, cFileName="U4kDOkCafKFZKBgA.mkv", cAlternateFileName="U4KDOK~1.MKV")) returned 1 [0131.730] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\U4kDOkCafKFZKBgA.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\u4kdokcafkfzkbga.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xac [0131.730] GetProcessHeap () returned 0x4e0000 [0131.730] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0131.730] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0131.730] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfcb0 | out: lpNewFilePointer=0x0) returned 1 [0131.731] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfc9c | out: phKey=0x24dfc9c*=0x4fca30) returned 1 [0131.731] CryptSetKeyParam (hKey=0x4fca30, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.731] GetProcessHeap () returned 0x4e0000 [0131.731] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x50) returned 0x4fd470 [0131.731] CryptEncrypt (in: hKey=0x4fca30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fd470*, pdwDataLen=0x24dfc78*=0x50, dwBufLen=0x50 | out: pbData=0x4fd470*, pdwDataLen=0x24dfc78*=0x50) returned 1 [0131.731] CryptDestroyKey (hKey=0x4fca30) returned 1 [0131.731] WriteFile (in: hFile=0xac, lpBuffer=0x4fd470*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4fd470*, lpNumberOfBytesWritten=0x24dfc98*=0x50, lpOverlapped=0x0) returned 1 [0131.731] WriteFile (in: hFile=0xac, lpBuffer=0x24dfca0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfca0*, lpNumberOfBytesWritten=0x24dfc98*=0x4, lpOverlapped=0x0) returned 1 [0131.732] WriteFile (in: hFile=0xac, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24dfc98*=0x10, lpOverlapped=0x0) returned 1 [0131.732] WriteFile (in: hFile=0xac, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24dfc98*=0x80, lpOverlapped=0x0) returned 1 [0131.732] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfca8 | out: lpNewFilePointer=0x0) returned 1 [0131.732] WriteFile (in: hFile=0xac, lpBuffer=0x24dfcb8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfcb8*, lpNumberOfBytesWritten=0x24dfc98*=0x8, lpOverlapped=0x0) returned 1 [0131.732] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfc9c | out: phKey=0x24dfc9c*=0x4fca30) returned 1 [0131.732] CryptSetKeyParam (hKey=0x4fca30, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.732] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.732] ReadFile (in: hFile=0xac, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xe4d0, lpNumberOfBytesRead=0x24dfc50, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24dfc50*=0xe4d0, lpOverlapped=0x0) returned 1 [0131.732] CryptEncrypt (in: hKey=0x4fca30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24dfc58*=0xe4d0, dwBufLen=0xe4d0 | out: pbData=0x22d0020*, pdwDataLen=0x24dfc58*=0xe4d0) returned 1 [0131.734] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.734] WriteFile (in: hFile=0xac, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe4d0, lpNumberOfBytesWritten=0x24dfc54, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24dfc54*=0xe4d0, lpOverlapped=0x0) returned 1 [0131.734] CryptDestroyKey (hKey=0x4fca30) returned 1 [0131.735] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0xe5b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.735] SetEndOfFile (hFile=0xac) returned 1 [0131.737] GetProcessHeap () returned 0x4e0000 [0131.737] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fd470 | out: hHeap=0x4e0000) returned 1 [0131.737] GetProcessHeap () returned 0x4e0000 [0131.737] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0131.738] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\U4kDOkCafKFZKBgA.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\u4kdokcafkfzkbga.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\U4kDOkCafKFZKBgA.mkv.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\u4kdokcafkfzkbga.mkv.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0131.741] CloseHandle (hObject=0xac) returned 1 [0131.741] FindNextFileW (in: hFindFile=0x4f9820, lpFindFileData=0x24dfd20 | out: lpFindFileData=0x24dfd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c977880, ftCreationTime.dwHighDateTime=0x1d5e74d, ftLastAccessTime.dwLowDateTime=0x85394eb0, ftLastAccessTime.dwHighDateTime=0x1d5d801, ftLastWriteTime.dwLowDateTime=0x85394eb0, ftLastWriteTime.dwHighDateTime=0x1d5d801, nFileSizeHigh=0x0, nFileSizeLow=0x5e6c, dwReserved0=0x0, dwReserved1=0xffff, cFileName="v6TS3PBwROiFp.wav", cAlternateFileName="V6TS3P~1.WAV")) returned 1 [0131.741] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\v6TS3PBwROiFp.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v6ts3pbwroifp.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xac [0131.741] GetProcessHeap () returned 0x4e0000 [0131.741] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0131.741] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0131.741] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfcb0 | out: lpNewFilePointer=0x0) returned 1 [0131.741] WriteFile (in: hFile=0xac, lpBuffer=0x24dfcc0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfcc0*, lpNumberOfBytesWritten=0x24dfc98*=0x4, lpOverlapped=0x0) returned 1 [0131.742] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfc9c | out: phKey=0x24dfc9c*=0x4fca30) returned 1 [0131.742] CryptSetKeyParam (hKey=0x4fca30, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.742] GetProcessHeap () returned 0x4e0000 [0131.742] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0131.742] CryptEncrypt (in: hKey=0x4fca30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24dfc78*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24dfc78*=0x40) returned 1 [0131.742] CryptDestroyKey (hKey=0x4fca30) returned 1 [0131.742] WriteFile (in: hFile=0xac, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24dfc98*=0x40, lpOverlapped=0x0) returned 1 [0131.742] WriteFile (in: hFile=0xac, lpBuffer=0x24dfca0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfca0*, lpNumberOfBytesWritten=0x24dfc98*=0x4, lpOverlapped=0x0) returned 1 [0131.742] WriteFile (in: hFile=0xac, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24dfc98*=0x10, lpOverlapped=0x0) returned 1 [0131.742] WriteFile (in: hFile=0xac, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24dfc98*=0x80, lpOverlapped=0x0) returned 1 [0131.742] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfca8 | out: lpNewFilePointer=0x0) returned 1 [0131.742] WriteFile (in: hFile=0xac, lpBuffer=0x24dfcb8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfcb8*, lpNumberOfBytesWritten=0x24dfc98*=0x8, lpOverlapped=0x0) returned 1 [0131.742] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfc9c | out: phKey=0x24dfc9c*=0x4fca30) returned 1 [0131.742] CryptSetKeyParam (hKey=0x4fca30, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.742] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.743] ReadFile (in: hFile=0xac, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5e6c, lpNumberOfBytesRead=0x24dfc50, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24dfc50*=0x5e6c, lpOverlapped=0x0) returned 1 [0131.743] CryptEncrypt (in: hKey=0x4fca30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24dfc58*=0x5e70, dwBufLen=0x5e70 | out: pbData=0x22d0020*, pdwDataLen=0x24dfc58*=0x5e70) returned 1 [0131.743] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.743] WriteFile (in: hFile=0xac, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5e70, lpNumberOfBytesWritten=0x24dfc54, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24dfc54*=0x5e70, lpOverlapped=0x0) returned 1 [0131.743] CryptDestroyKey (hKey=0x4fca30) returned 1 [0131.743] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x5f44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.743] SetEndOfFile (hFile=0xac) returned 1 [0131.746] GetProcessHeap () returned 0x4e0000 [0131.746] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0131.746] GetProcessHeap () returned 0x4e0000 [0131.746] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0131.746] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\v6TS3PBwROiFp.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v6ts3pbwroifp.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\v6TS3PBwROiFp.wav.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v6ts3pbwroifp.wav.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0131.748] CloseHandle (hObject=0xac) returned 1 [0131.749] FindNextFileW (in: hFindFile=0x4f9820, lpFindFileData=0x24dfd20 | out: lpFindFileData=0x24dfd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d744a20, ftCreationTime.dwHighDateTime=0x1d5e757, ftLastAccessTime.dwLowDateTime=0x6c81e450, ftLastAccessTime.dwHighDateTime=0x1d5e5de, ftLastWriteTime.dwLowDateTime=0x6c81e450, ftLastWriteTime.dwHighDateTime=0x1d5e5de, nFileSizeHigh=0x0, nFileSizeLow=0x7621, dwReserved0=0x0, dwReserved1=0xffff, cFileName="_CnL XD D.flv", cAlternateFileName="_CNLXD~1.FLV")) returned 1 [0131.749] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_CnL XD D.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\_cnl xd d.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xac [0131.749] GetProcessHeap () returned 0x4e0000 [0131.749] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0131.749] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0131.749] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfcb0 | out: lpNewFilePointer=0x0) returned 1 [0131.749] WriteFile (in: hFile=0xac, lpBuffer=0x24dfcc0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfcc0*, lpNumberOfBytesWritten=0x24dfc98*=0xf, lpOverlapped=0x0) returned 1 [0131.750] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfc9c | out: phKey=0x24dfc9c*=0x4fca30) returned 1 [0131.750] CryptSetKeyParam (hKey=0x4fca30, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.750] GetProcessHeap () returned 0x4e0000 [0131.750] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0131.750] CryptEncrypt (in: hKey=0x4fca30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24dfc78*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24dfc78*=0x40) returned 1 [0131.750] CryptDestroyKey (hKey=0x4fca30) returned 1 [0131.750] WriteFile (in: hFile=0xac, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24dfc98*=0x40, lpOverlapped=0x0) returned 1 [0131.750] WriteFile (in: hFile=0xac, lpBuffer=0x24dfca0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfca0*, lpNumberOfBytesWritten=0x24dfc98*=0x4, lpOverlapped=0x0) returned 1 [0131.750] WriteFile (in: hFile=0xac, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24dfc98*=0x10, lpOverlapped=0x0) returned 1 [0131.750] WriteFile (in: hFile=0xac, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24dfc98*=0x80, lpOverlapped=0x0) returned 1 [0131.750] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24dfca8 | out: lpNewFilePointer=0x0) returned 1 [0131.750] WriteFile (in: hFile=0xac, lpBuffer=0x24dfcb8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24dfc98, lpOverlapped=0x0 | out: lpBuffer=0x24dfcb8*, lpNumberOfBytesWritten=0x24dfc98*=0x8, lpOverlapped=0x0) returned 1 [0131.750] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24dfc9c | out: phKey=0x24dfc9c*=0x4fca30) returned 1 [0131.750] CryptSetKeyParam (hKey=0x4fca30, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0131.750] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.750] ReadFile (in: hFile=0xac, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7621, lpNumberOfBytesRead=0x24dfc50, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24dfc50*=0x7621, lpOverlapped=0x0) returned 1 [0131.751] CryptEncrypt (in: hKey=0x4fca30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24dfc58*=0x7630, dwBufLen=0x7630 | out: pbData=0x22d0020*, pdwDataLen=0x24dfc58*=0x7630) returned 1 [0131.751] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.751] WriteFile (in: hFile=0xac, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7630, lpNumberOfBytesWritten=0x24dfc54, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24dfc54*=0x7630, lpOverlapped=0x0) returned 1 [0131.751] CryptDestroyKey (hKey=0x4fca30) returned 1 [0131.751] SetFilePointerEx (in: hFile=0xac, liDistanceToMove=0x7704, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.751] SetEndOfFile (hFile=0xac) returned 1 [0131.754] GetProcessHeap () returned 0x4e0000 [0131.754] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0131.754] GetProcessHeap () returned 0x4e0000 [0131.754] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0131.754] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_CnL XD D.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\_cnl xd d.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_CnL XD D.flv.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\_cnl xd d.flv.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0131.756] CloseHandle (hObject=0xac) returned 1 [0131.757] FindNextFileW (in: hFindFile=0x4f9820, lpFindFileData=0x24dfd20 | out: lpFindFileData=0x24dfd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d744a20, ftCreationTime.dwHighDateTime=0x1d5e757, ftLastAccessTime.dwLowDateTime=0x6c81e450, ftLastAccessTime.dwHighDateTime=0x1d5e5de, ftLastWriteTime.dwLowDateTime=0x6c81e450, ftLastWriteTime.dwHighDateTime=0x1d5e5de, nFileSizeHigh=0x0, nFileSizeLow=0x7621, dwReserved0=0x0, dwReserved1=0xffff, cFileName="_CnL XD D.flv", cAlternateFileName="_CNLXD~1.FLV")) returned 0 [0131.757] GetProcessHeap () returned 0x4e0000 [0131.757] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0131.757] CryptImportKey (in: hProv=0x4f0590, pbData=0x24dfc88, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x4fca30) returned 1 [0131.757] CryptDecrypt (in: hKey=0x4fca30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24dfcf0 | out: pbData=0x4f53d8, pdwDataLen=0x24dfcf0) returned 1 [0131.757] CryptDestroyKey (hKey=0x4fca30) returned 1 [0131.757] GetProcessHeap () returned 0x4e0000 [0131.757] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0131.757] CryptImportKey (in: hProv=0x4f0590, pbData=0x24dfc88, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x4fca30) returned 1 [0131.757] CryptDecrypt (in: hKey=0x4fca30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24dfcf0 | out: pbData=0x4f5420, pdwDataLen=0x24dfcf0) returned 1 [0131.757] CryptDestroyKey (hKey=0x4fca30) returned 1 [0131.757] GetProcessHeap () returned 0x4e0000 [0131.757] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x520560 [0131.757] CryptImportKey (in: hProv=0x4f0590, pbData=0x24dfc88, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x4fca30) returned 1 [0131.757] CryptDecrypt (in: hKey=0x4fca30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x520560, pdwDataLen=0x24dfcf0 | out: pbData=0x520560, pdwDataLen=0x24dfcf0) returned 1 [0131.757] CryptDestroyKey (hKey=0x4fca30) returned 1 [0131.757] wsprintfW (in: param_1=0x24deccc, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\readme-warning.txt") returned 56 [0131.757] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\readme-warning.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xac [0131.758] WriteFile (in: hFile=0xac, lpBuffer=0x520560*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24decc8, lpOverlapped=0x0 | out: lpBuffer=0x520560*, lpNumberOfBytesWritten=0x24decc8*=0x6c3, lpOverlapped=0x0) returned 1 [0131.759] CloseHandle (hObject=0xac) returned 1 [0131.759] GetProcessHeap () returned 0x4e0000 [0131.759] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x520560 | out: hHeap=0x4e0000) returned 1 [0131.759] GetProcessHeap () returned 0x4e0000 [0131.759] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0131.759] GetProcessHeap () returned 0x4e0000 [0131.759] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0131.759] FindClose (in: hFindFile=0x4f9820 | out: hFindFile=0x4f9820) returned 1 [0131.759] GetProcessHeap () returned 0x4e0000 [0131.759] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5202f8 | out: hHeap=0x4e0000) returned 1 Thread: id = 140 os_tid = 0x540 [0131.772] GetProcessHeap () returned 0x4e0000 [0131.772] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x16) returned 0x4f8598 [0131.772] FindFirstFileW (in: lpFileName="C:\\*.*", lpFindFileData=0x24dfd20 | out: lpFindFileData=0x24dfd20*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xffff, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x4f9820 [0131.772] GetProcessHeap () returned 0x4e0000 [0131.772] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f8598 | out: hHeap=0x4e0000) returned 1 [0131.772] GetProcessHeap () returned 0x4e0000 [0131.772] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x218) returned 0x51f2f0 [0131.772] GetProcessHeap () returned 0x4e0000 [0131.772] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0131.772] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*.*", lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x4fca30 [0131.772] GetProcessHeap () returned 0x4e0000 [0131.772] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0131.772] FindNextFileW (in: hFindFile=0x4fca30, lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0131.772] FindNextFileW (in: hFindFile=0x4fca30, lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0131.772] GetProcessHeap () returned 0x4e0000 [0131.772] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x232) returned 0x520518 [0131.772] GetProcessHeap () returned 0x4e0000 [0131.772] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8e) returned 0x4fc578 [0131.772] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*.*", lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4fa058 [0131.773] GetProcessHeap () returned 0x4e0000 [0131.773] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fc578 | out: hHeap=0x4e0000) returned 1 [0131.773] FindNextFileW (in: hFindFile=0x4fa058, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0131.773] FindNextFileW (in: hFindFile=0x4fa058, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0131.773] GetProcessHeap () returned 0x4e0000 [0131.773] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x290) returned 0x521760 [0131.773] FindNextFileW (in: hFindFile=0x4fa058, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0131.773] FindClose (in: hFindFile=0x4fa058 | out: hFindFile=0x4fa058) returned 1 [0131.773] GetProcessHeap () returned 0x4e0000 [0131.773] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x521760 | out: hHeap=0x4e0000) returned 1 [0131.773] FindNextFileW (in: hFindFile=0x4fca30, lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0131.773] FindClose (in: hFindFile=0x4fca30 | out: hFindFile=0x4fca30) returned 1 [0131.773] GetProcessHeap () returned 0x4e0000 [0131.773] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x520518 | out: hHeap=0x4e0000) returned 1 [0131.773] FindNextFileW (in: hFindFile=0x4f9820, lpFindFileData=0x24dfd20 | out: lpFindFileData=0x24dfd20*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xffff, cFileName="Boot", cAlternateFileName="")) returned 1 [0131.773] GetProcessHeap () returned 0x4e0000 [0131.774] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x4f8128 [0131.774] FindFirstFileW (in: lpFileName="C:\\Boot\\*.*", lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x4fca30 [0131.774] GetProcessHeap () returned 0x4e0000 [0131.774] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f8128 | out: hHeap=0x4e0000) returned 1 [0131.774] FindNextFileW (in: hFindFile=0x4fca30, lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0131.774] FindNextFileW (in: hFindFile=0x4fca30, lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x90cd45e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x90cd45e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD", cAlternateFileName="")) returned 1 [0131.774] GetProcessHeap () returned 0x4e0000 [0131.774] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x222) returned 0x521520 [0131.774] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0131.774] GetLastError () returned 0x20 [0131.777] GetProcessHeap () returned 0x4e0000 [0131.777] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x100000) returned 0x24e0020 [0131.777] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x24e0020, Length=0x100000, ResultLength=0x0 | out: SystemInformation=0x24e0020, ResultLength=0x0) returned 0x0 [0131.809] GetCurrentProcessId () returned 0x290 [0131.809] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.809] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.809] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.809] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.809] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.809] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.810] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.810] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.810] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.810] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.810] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.810] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.810] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.810] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.810] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.810] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.810] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.810] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.810] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.811] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.811] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.811] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.811] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.811] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.811] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.811] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.811] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.811] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.811] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.811] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.811] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.811] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.812] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.812] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.812] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.812] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.812] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.812] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.812] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.812] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.812] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.812] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.812] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.812] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.812] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.813] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.813] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.813] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.813] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.813] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.813] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.813] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.813] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.813] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.813] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.813] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.813] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.813] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.814] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.814] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.814] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.814] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.814] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.814] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.814] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.814] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.814] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.814] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.814] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.814] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.814] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.815] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.815] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.815] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.815] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.815] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.815] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.815] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.815] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.815] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.815] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.815] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.815] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.815] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.816] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.816] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.816] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.816] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.816] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.816] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.816] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.816] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.816] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.816] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.816] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.816] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.816] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.817] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.817] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.817] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.817] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.817] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.817] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.817] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.817] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.817] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.817] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.817] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.817] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.817] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.817] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.818] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.818] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.818] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.818] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.818] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.818] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.818] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.818] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.818] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.818] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.818] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.818] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.819] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.819] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.819] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.819] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.819] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.819] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.819] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.819] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.819] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.819] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.819] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.819] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.819] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.819] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.820] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.820] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.820] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.820] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.820] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.820] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.820] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.820] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.820] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.820] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.820] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.820] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.821] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.821] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.821] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.821] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.821] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.821] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.821] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.821] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.821] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.821] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.821] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.821] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.821] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.821] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.822] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.822] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.822] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.822] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.822] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.822] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.822] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.822] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.822] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.822] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.822] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.822] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.822] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.823] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.823] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.823] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.823] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.823] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.823] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.823] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.823] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.823] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.823] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.823] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.823] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.823] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.824] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.824] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.824] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.824] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.824] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.824] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.824] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.824] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.824] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.824] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.824] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.824] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.824] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.825] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.825] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.825] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.825] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.825] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.825] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.825] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.825] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.825] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.825] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.825] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.825] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.828] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.828] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.828] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.828] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.828] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.828] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.828] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.828] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.828] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.828] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.828] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0131.828] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0131.829] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0131.829] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0131.829] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0131.829] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0131.829] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0131.829] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0131.829] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0131.829] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0131.829] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x148) returned 0x0 [0131.829] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x148) returned 0x0 [0131.829] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0131.829] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0131.829] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0131.830] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0131.830] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0131.830] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0131.830] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0131.830] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0131.830] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0131.830] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0131.830] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x184) returned 0x0 [0131.830] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x184) returned 0x0 [0131.830] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x184) returned 0x0 [0131.831] GetFileType (hFile=0x114) returned 0x1 [0131.831] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32") returned 0x17 [0131.832] CloseHandle (hObject=0x114) returned 1 [0131.832] GetFileType (hFile=0xa4) returned 0x1 [0131.832] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32") returned 0x17 [0131.833] CloseHandle (hObject=0xa4) returned 1 [0131.833] GetFileType (hFile=0x114) returned 0x1 [0131.833] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a") returned 0x6b [0131.834] CloseHandle (hObject=0x114) returned 1 [0131.834] GetFileType (hFile=0xa4) returned 0x0 [0131.834] CloseHandle (hObject=0xa4) returned 1 [0131.834] GetFileType (hFile=0x114) returned 0x1 [0131.834] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0131.834] CloseHandle (hObject=0x114) returned 1 [0131.835] GetFileType (hFile=0xa4) returned 0x1 [0131.835] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0131.835] CloseHandle (hObject=0xa4) returned 1 [0131.835] GetFileType (hFile=0x114) returned 0x1 [0131.835] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_08e61857a83bc251") returned 0x64 [0131.836] CloseHandle (hObject=0x114) returned 1 [0131.836] GetFileType (hFile=0xa4) returned 0x1 [0131.836] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.6161_none_0a1fd3a3a768b895") returned 0x64 [0131.837] CloseHandle (hObject=0xa4) returned 1 [0131.837] GetFileType (hFile=0x114) returned 0x1 [0131.837] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0131.838] CloseHandle (hObject=0x114) returned 1 [0131.838] GetFileType (hFile=0xa4) returned 0x1 [0131.838] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0131.838] CloseHandle (hObject=0xa4) returned 1 [0131.838] GetFileType (hFile=0x114) returned 0x1 [0131.838] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0131.839] CloseHandle (hObject=0x114) returned 1 [0131.839] GetFileType (hFile=0xa4) returned 0x1 [0131.839] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0131.840] CloseHandle (hObject=0xa4) returned 1 [0131.840] GetFileType (hFile=0x114) returned 0x1 [0131.840] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0131.840] CloseHandle (hObject=0x114) returned 1 [0131.840] GetFileType (hFile=0xa4) returned 0x1 [0131.840] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\Fonts\\StaticCache.dat") returned 0x24 [0131.841] CloseHandle (hObject=0xa4) returned 1 [0131.841] GetFileType (hFile=0x114) returned 0x1 [0131.841] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_106f9be843a9b4e3") returned 0x7b [0131.842] CloseHandle (hObject=0x114) returned 1 [0131.842] GetFileType (hFile=0xa4) returned 0x1 [0131.842] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_106f9be843a9b4e3\\comctl32.dll.mui") returned 0x8c [0131.842] CloseHandle (hObject=0xa4) returned 1 [0131.843] GetFileType (hFile=0x114) returned 0x1 [0131.843] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0131.843] CloseHandle (hObject=0x114) returned 1 [0131.843] GetFileType (hFile=0xa4) returned 0x1 [0131.843] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0131.844] CloseHandle (hObject=0xa4) returned 1 [0131.844] GetFileType (hFile=0x114) returned 0x1 [0131.844] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0131.844] CloseHandle (hObject=0x114) returned 1 [0131.844] GetFileType (hFile=0xa4) returned 0x1 [0131.845] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned") returned 0x66 [0131.845] CloseHandle (hObject=0xa4) returned 1 [0131.845] GetFileType (hFile=0x114) returned 0x1 [0131.845] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0131.846] CloseHandle (hObject=0x114) returned 1 [0131.846] GetFileType (hFile=0xa4) returned 0x1 [0131.846] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries") returned 0x4d [0131.847] CloseHandle (hObject=0xa4) returned 1 [0131.847] GetFileType (hFile=0x114) returned 0x1 [0131.847] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries") returned 0x4d [0131.848] CloseHandle (hObject=0x114) returned 1 [0131.848] GetFileType (hFile=0xa4) returned 0x1 [0131.848] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned") returned 0x66 [0131.848] CloseHandle (hObject=0xa4) returned 1 [0131.848] GetFileType (hFile=0x114) returned 0x1 [0131.848] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\index.dat") returned 0x58 [0131.849] CloseHandle (hObject=0x114) returned 1 [0131.849] GetFileType (hFile=0xa4) returned 0x1 [0131.849] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu") returned 0x2f [0131.850] CloseHandle (hObject=0xa4) returned 1 [0131.850] GetFileType (hFile=0x114) returned 0x1 [0131.850] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu") returned 0x2f [0131.850] CloseHandle (hObject=0x114) returned 1 [0131.851] GetFileType (hFile=0xa4) returned 0x1 [0131.851] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu") returned 0x4e [0131.856] CloseHandle (hObject=0xa4) returned 1 [0131.856] GetFileType (hFile=0x114) returned 0x1 [0131.856] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu") returned 0x4e [0131.857] CloseHandle (hObject=0x114) returned 1 [0131.857] GetFileType (hFile=0xa4) returned 0x1 [0131.857] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x29 [0131.857] CloseHandle (hObject=0xa4) returned 1 [0131.857] GetFileType (hFile=0x114) returned 0x1 [0131.857] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x29 [0131.858] CloseHandle (hObject=0x114) returned 1 [0131.858] GetFileType (hFile=0xa4) returned 0x1 [0131.858] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\Public\\Desktop") returned 0x1b [0131.859] CloseHandle (hObject=0xa4) returned 1 [0131.859] GetFileType (hFile=0x114) returned 0x1 [0131.859] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\Public\\Desktop") returned 0x1b [0131.860] CloseHandle (hObject=0x114) returned 1 [0131.860] GetFileType (hFile=0xa4) returned 0x1 [0131.860] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn") returned 0x46 [0131.861] CloseHandle (hObject=0xa4) returned 1 [0131.861] GetFileType (hFile=0x114) returned 0x1 [0131.861] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn") returned 0x46 [0131.862] CloseHandle (hObject=0x114) returned 1 [0131.862] GetFileType (hFile=0xa4) returned 0x1 [0131.862] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\wdmaud.drv.mui") returned 0x2c [0131.896] CloseHandle (hObject=0xa4) returned 1 [0131.897] GetFileType (hFile=0x114) returned 0x1 [0131.897] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\MMDevAPI.dll.mui") returned 0x2e [0131.911] CloseHandle (hObject=0x114) returned 1 [0131.911] GetFileType (hFile=0xa4) returned 0x1 [0131.911] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\bthprops.cpl.mui") returned 0x2e [0132.069] CloseHandle (hObject=0xa4) returned 1 [0132.069] GetFileType (hFile=0x114) returned 0x1 [0132.069] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0132.070] CloseHandle (hObject=0x114) returned 1 [0132.070] GetFileType (hFile=0xa4) returned 0x1 [0132.070] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0132.070] CloseHandle (hObject=0xa4) returned 1 [0132.071] GetFileType (hFile=0x114) returned 0x1 [0132.071] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\msutb.dll.mui") returned 0x2b [0132.326] CloseHandle (hObject=0x114) returned 1 [0132.327] GetFileType (hFile=0xa4) returned 0x1 [0132.327] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\msctf.dll.mui") returned 0x2b [0132.329] CloseHandle (hObject=0xa4) returned 1 [0132.330] GetFileType (hFile=0x114) returned 0x1 [0132.330] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0132.330] CloseHandle (hObject=0x114) returned 1 [0132.330] GetFileType (hFile=0xa4) returned 0x0 [0132.330] CloseHandle (hObject=0xa4) returned 1 [0132.330] GetFileType (hFile=0x114) returned 0x1 [0132.330] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0132.331] CloseHandle (hObject=0x114) returned 1 [0132.331] GetFileType (hFile=0xa4) returned 0x1 [0132.331] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts") returned 0x55 [0132.332] CloseHandle (hObject=0xa4) returned 1 [0132.332] GetFileType (hFile=0x114) returned 0x1 [0132.332] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts") returned 0x55 [0132.333] CloseHandle (hObject=0x114) returned 1 [0132.333] GetFileType (hFile=0xa4) returned 0x1 [0132.333] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0132.333] CloseHandle (hObject=0xa4) returned 1 [0132.334] GetFileType (hFile=0x114) returned 0x1 [0132.334] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\netshell.dll.mui") returned 0x2e [0132.425] CloseHandle (hObject=0x114) returned 1 [0132.425] GetFileType (hFile=0xa4) returned 0x0 [0132.426] CloseHandle (hObject=0xa4) returned 1 [0132.426] GetFileType (hFile=0x114) returned 0x1 [0132.426] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\KernelBase.dll.mui") returned 0x30 [0132.427] CloseHandle (hObject=0x114) returned 1 [0132.427] GetFileType (hFile=0xa4) returned 0x1 [0132.427] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0132.427] CloseHandle (hObject=0xa4) returned 1 [0132.427] GetFileType (hFile=0x114) returned 0x1 [0132.427] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0132.428] CloseHandle (hObject=0x114) returned 1 [0132.428] GetFileType (hFile=0xa4) returned 0x1 [0132.428] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0132.430] CloseHandle (hObject=0xa4) returned 1 [0132.430] GetFileType (hFile=0x114) returned 0x1 [0132.430] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0132.431] CloseHandle (hObject=0x114) returned 1 [0132.431] GetFileType (hFile=0xa4) returned 0x1 [0132.431] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0132.431] CloseHandle (hObject=0xa4) returned 1 [0132.432] GetFileType (hFile=0x114) returned 0x1 [0132.432] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt") returned 0x4b [0132.433] CloseHandle (hObject=0x114) returned 1 [0132.433] GetFileType (hFile=0xa4) returned 0x1 [0132.433] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0132.433] CloseHandle (hObject=0xa4) returned 1 [0132.433] GetFileType (hFile=0x114) returned 0x1 [0132.433] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\ActionCenter.dll.mui") returned 0x32 [0132.436] CloseHandle (hObject=0x114) returned 1 [0132.436] GetFileType (hFile=0xa4) returned 0x1 [0132.436] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0132.437] CloseHandle (hObject=0xa4) returned 1 [0132.437] GetFileType (hFile=0x114) returned 0x0 [0132.437] CloseHandle (hObject=0x114) returned 1 [0132.437] GetFileType (hFile=0xa4) returned 0x1 [0132.437] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat") returned 0x70 [0132.438] CloseHandle (hObject=0xa4) returned 1 [0132.438] GetFileType (hFile=0x114) returned 0x1 [0132.438] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat") returned 0x55 [0132.439] CloseHandle (hObject=0x114) returned 1 [0132.439] GetFileType (hFile=0xa4) returned 0x1 [0132.439] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat") returned 0x5f [0132.440] CloseHandle (hObject=0xa4) returned 1 [0132.440] GetFileType (hFile=0x114) returned 0x1 [0132.440] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012020022120200222\\index.dat") returned 0x78 [0132.441] CloseHandle (hObject=0x114) returned 1 [0132.441] GetFileType (hFile=0xa4) returned 0x1 [0132.441] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32") returned 0x17 [0132.442] CloseHandle (hObject=0xa4) returned 1 [0132.442] GetFileType (hFile=0x114) returned 0x0 [0132.442] CloseHandle (hObject=0x114) returned 1 [0132.442] GetFileType (hFile=0xa4) returned 0x0 [0132.442] CloseHandle (hObject=0xa4) returned 1 [0132.442] GetFileType (hFile=0x114) returned 0x1 [0132.442] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\KernelBase.dll.mui") returned 0x30 [0132.443] CloseHandle (hObject=0x114) returned 1 [0132.443] GetFileType (hFile=0xa4) returned 0x1 [0132.443] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\msutb.dll.mui") returned 0x2b [0132.444] CloseHandle (hObject=0xa4) returned 1 [0132.444] GetFileType (hFile=0x114) returned 0x1 [0132.444] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32") returned 0x17 [0132.444] CloseHandle (hObject=0x114) returned 1 [0132.444] GetFileType (hFile=0xa4) returned 0x0 [0132.444] CloseHandle (hObject=0xa4) returned 1 [0132.445] GetFileType (hFile=0x114) returned 0x1 [0132.445] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0132.445] CloseHandle (hObject=0x114) returned 1 [0132.445] GetFileType (hFile=0xa4) returned 0x1 [0132.445] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\DVD Maker") returned 0x1e [0132.445] CloseHandle (hObject=0xa4) returned 1 [0132.446] GetFileType (hFile=0x114) returned 0x1 [0132.446] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0132.446] CloseHandle (hObject=0x114) returned 1 [0132.446] GetFileType (hFile=0xa4) returned 0x1 [0132.446] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Reference Assemblies") returned 0x2f [0132.446] CloseHandle (hObject=0xa4) returned 1 [0132.446] GetFileType (hFile=0x114) returned 0x1 [0132.447] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0132.447] CloseHandle (hObject=0x114) returned 1 [0132.447] GetFileType (hFile=0xa4) returned 0x1 [0132.447] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Common Files") returned 0x21 [0132.447] CloseHandle (hObject=0xa4) returned 1 [0132.447] GetFileType (hFile=0x114) returned 0x1 [0132.447] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0132.448] CloseHandle (hObject=0x114) returned 1 [0132.448] GetFileType (hFile=0xa4) returned 0x1 [0132.448] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Common Files") returned 0x27 [0132.448] CloseHandle (hObject=0xa4) returned 1 [0132.448] GetFileType (hFile=0x114) returned 0x1 [0132.448] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0132.449] CloseHandle (hObject=0x114) returned 1 [0132.449] GetFileType (hFile=0xa4) returned 0x1 [0132.449] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Reference Assemblies") returned 0x29 [0132.449] CloseHandle (hObject=0xa4) returned 1 [0132.449] GetFileType (hFile=0x114) returned 0x1 [0132.449] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0132.450] CloseHandle (hObject=0x114) returned 1 [0132.450] GetFileType (hFile=0xa4) returned 0x1 [0132.450] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft Visual Studio 8") returned 0x34 [0132.450] CloseHandle (hObject=0xa4) returned 1 [0132.450] GetFileType (hFile=0x114) returned 0x1 [0132.450] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0132.451] CloseHandle (hObject=0x114) returned 1 [0132.451] GetFileType (hFile=0xa4) returned 0x1 [0132.451] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Office") returned 0x25 [0132.451] CloseHandle (hObject=0xa4) returned 1 [0132.451] GetFileType (hFile=0x114) returned 0x1 [0132.451] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0132.452] CloseHandle (hObject=0x114) returned 1 [0132.452] GetFileType (hFile=0xa4) returned 0x1 [0132.452] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Mail") returned 0x21 [0132.452] CloseHandle (hObject=0xa4) returned 1 [0132.452] GetFileType (hFile=0x114) returned 0x1 [0132.452] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0132.453] CloseHandle (hObject=0x114) returned 1 [0132.453] GetFileType (hFile=0xa4) returned 0x1 [0132.453] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft.NET") returned 0x28 [0132.453] CloseHandle (hObject=0xa4) returned 1 [0132.453] GetFileType (hFile=0x114) returned 0x1 [0132.453] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0132.454] CloseHandle (hObject=0x114) returned 1 [0132.454] GetFileType (hFile=0xa4) returned 0x1 [0132.454] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Media Player") returned 0x29 [0132.454] CloseHandle (hObject=0xa4) returned 1 [0132.454] GetFileType (hFile=0x114) returned 0x1 [0132.454] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0132.455] CloseHandle (hObject=0x114) returned 1 [0132.455] GetFileType (hFile=0xa4) returned 0x1 [0132.455] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox") returned 0x2a [0132.455] CloseHandle (hObject=0xa4) returned 1 [0132.455] GetFileType (hFile=0x114) returned 0x1 [0132.455] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0132.456] CloseHandle (hObject=0x114) returned 1 [0132.456] GetFileType (hFile=0xa4) returned 0x1 [0132.456] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Common Files") returned 0x21 [0132.456] CloseHandle (hObject=0xa4) returned 1 [0132.456] GetFileType (hFile=0x114) returned 0x1 [0132.456] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0132.457] CloseHandle (hObject=0x114) returned 1 [0132.457] GetFileType (hFile=0xa4) returned 0x1 [0132.457] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Google") returned 0x21 [0132.457] CloseHandle (hObject=0xa4) returned 1 [0132.457] GetFileType (hFile=0x114) returned 0x1 [0132.457] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0132.458] CloseHandle (hObject=0x114) returned 1 [0132.458] GetFileType (hFile=0xa4) returned 0x1 [0132.458] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\MSBuild") returned 0x1c [0132.458] CloseHandle (hObject=0xa4) returned 1 [0132.458] GetFileType (hFile=0x114) returned 0x1 [0132.458] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0132.459] CloseHandle (hObject=0x114) returned 1 [0132.459] GetFileType (hFile=0xa4) returned 0x1 [0132.459] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Portable Devices") returned 0x2d [0132.459] CloseHandle (hObject=0xa4) returned 1 [0132.459] GetFileType (hFile=0x114) returned 0x1 [0132.459] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0132.460] CloseHandle (hObject=0x114) returned 1 [0132.460] GetFileType (hFile=0xa4) returned 0x1 [0132.460] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services") returned 0x36 [0132.460] CloseHandle (hObject=0xa4) returned 1 [0132.460] GetFileType (hFile=0x114) returned 0x1 [0132.460] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0132.461] CloseHandle (hObject=0x114) returned 1 [0132.461] GetFileType (hFile=0xa4) returned 0x1 [0132.461] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Google") returned 0x21 [0132.461] CloseHandle (hObject=0xa4) returned 1 [0132.461] GetFileType (hFile=0x114) returned 0x1 [0132.461] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0132.462] CloseHandle (hObject=0x114) returned 1 [0132.462] GetFileType (hFile=0xa4) returned 0x1 [0132.462] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Journal") returned 0x24 [0132.462] CloseHandle (hObject=0xa4) returned 1 [0132.462] GetFileType (hFile=0x114) returned 0x1 [0132.462] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0132.463] CloseHandle (hObject=0x114) returned 1 [0132.463] GetFileType (hFile=0xa4) returned 0x1 [0132.463] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows NT") returned 0x25 [0132.463] CloseHandle (hObject=0xa4) returned 1 [0132.463] GetFileType (hFile=0x114) returned 0x1 [0132.463] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0132.464] CloseHandle (hObject=0x114) returned 1 [0132.464] GetFileType (hFile=0xa4) returned 0x1 [0132.464] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\DVD Maker") returned 0x1e [0132.464] CloseHandle (hObject=0xa4) returned 1 [0132.464] GetFileType (hFile=0x114) returned 0x1 [0132.464] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0132.465] CloseHandle (hObject=0x114) returned 1 [0132.465] GetFileType (hFile=0xa4) returned 0x1 [0132.465] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Analysis Services") returned 0x30 [0132.465] CloseHandle (hObject=0xa4) returned 1 [0132.465] GetFileType (hFile=0x114) returned 0x1 [0132.465] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0132.466] CloseHandle (hObject=0x114) returned 1 [0132.466] GetFileType (hFile=0xa4) returned 0x1 [0132.466] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows NT") returned 0x25 [0132.466] CloseHandle (hObject=0xa4) returned 1 [0132.466] GetFileType (hFile=0x114) returned 0x1 [0132.466] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0132.467] CloseHandle (hObject=0x114) returned 1 [0132.467] GetFileType (hFile=0xa4) returned 0x1 [0132.467] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Uninstall Information") returned 0x30 [0132.467] CloseHandle (hObject=0xa4) returned 1 [0132.467] GetFileType (hFile=0x114) returned 0x1 [0132.467] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0132.467] CloseHandle (hObject=0x114) returned 1 [0132.468] GetFileType (hFile=0xa4) returned 0x1 [0132.468] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Mail") returned 0x27 [0132.468] CloseHandle (hObject=0xa4) returned 1 [0132.468] GetFileType (hFile=0x114) returned 0x1 [0132.468] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0132.468] CloseHandle (hObject=0x114) returned 1 [0132.469] GetFileType (hFile=0xa4) returned 0x1 [0132.469] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Portable Devices") returned 0x2d [0132.469] CloseHandle (hObject=0xa4) returned 1 [0132.469] GetFileType (hFile=0x114) returned 0x1 [0132.469] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0132.469] CloseHandle (hObject=0x114) returned 1 [0132.470] GetFileType (hFile=0xa4) returned 0x1 [0132.470] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Uninstall Information") returned 0x30 [0132.470] CloseHandle (hObject=0xa4) returned 1 [0132.470] GetFileType (hFile=0x114) returned 0x1 [0132.470] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0132.470] CloseHandle (hObject=0x114) returned 1 [0132.471] GetFileType (hFile=0xa4) returned 0x1 [0132.471] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Uninstall Information") returned 0x30 [0132.471] CloseHandle (hObject=0xa4) returned 1 [0132.471] GetFileType (hFile=0x114) returned 0x1 [0132.471] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0132.471] CloseHandle (hObject=0x114) returned 1 [0132.472] GetFileType (hFile=0xa4) returned 0x1 [0132.472] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Reference Assemblies") returned 0x29 [0132.472] CloseHandle (hObject=0xa4) returned 1 [0132.472] GetFileType (hFile=0x114) returned 0x1 [0132.472] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0132.472] CloseHandle (hObject=0x114) returned 1 [0132.472] GetFileType (hFile=0xa4) returned 0x1 [0132.473] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Photo Viewer") returned 0x29 [0132.473] CloseHandle (hObject=0xa4) returned 1 [0132.473] GetFileType (hFile=0x114) returned 0x1 [0132.473] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0132.473] CloseHandle (hObject=0x114) returned 1 [0132.473] GetFileType (hFile=0xa4) returned 0x1 [0132.473] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows NT") returned 0x1f [0132.474] CloseHandle (hObject=0xa4) returned 1 [0132.474] GetFileType (hFile=0x114) returned 0x1 [0132.474] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0132.474] CloseHandle (hObject=0x114) returned 1 [0132.474] GetFileType (hFile=0xa4) returned 0x1 [0132.474] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Defender") returned 0x2b [0132.475] CloseHandle (hObject=0xa4) returned 1 [0132.475] GetFileType (hFile=0x114) returned 0x1 [0132.475] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0132.475] CloseHandle (hObject=0x114) returned 1 [0132.476] GetFileType (hFile=0xa4) returned 0x1 [0132.476] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Analysis Services") returned 0x30 [0132.476] CloseHandle (hObject=0xa4) returned 1 [0132.476] GetFileType (hFile=0x114) returned 0x1 [0132.476] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0132.476] CloseHandle (hObject=0x114) returned 1 [0132.476] GetFileType (hFile=0xa4) returned 0x1 [0132.477] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\DVD Maker") returned 0x1e [0132.477] CloseHandle (hObject=0xa4) returned 1 [0132.477] GetFileType (hFile=0x114) returned 0x1 [0132.477] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0132.477] CloseHandle (hObject=0x114) returned 1 [0132.477] GetFileType (hFile=0xa4) returned 0x1 [0132.477] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox") returned 0x2a [0132.478] CloseHandle (hObject=0xa4) returned 1 [0132.478] GetFileType (hFile=0x114) returned 0x1 [0132.478] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0132.478] CloseHandle (hObject=0x114) returned 1 [0132.478] GetFileType (hFile=0xa4) returned 0x1 [0132.478] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Uninstall Information") returned 0x30 [0132.479] CloseHandle (hObject=0xa4) returned 1 [0132.479] GetFileType (hFile=0x114) returned 0x1 [0132.479] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0132.479] CloseHandle (hObject=0x114) returned 1 [0132.479] GetFileType (hFile=0xa4) returned 0x1 [0132.479] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Internet Explorer") returned 0x2c [0132.480] CloseHandle (hObject=0xa4) returned 1 [0132.480] GetFileType (hFile=0x114) returned 0x1 [0132.480] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0132.480] CloseHandle (hObject=0x114) returned 1 [0132.480] GetFileType (hFile=0xa4) returned 0x1 [0132.480] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\MSBuild") returned 0x1c [0132.481] CloseHandle (hObject=0xa4) returned 1 [0132.481] GetFileType (hFile=0x114) returned 0x1 [0132.481] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0132.481] CloseHandle (hObject=0x114) returned 1 [0132.481] GetFileType (hFile=0xa4) returned 0x1 [0132.481] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Defender") returned 0x25 [0132.482] CloseHandle (hObject=0xa4) returned 1 [0132.482] GetFileType (hFile=0x114) returned 0x1 [0132.482] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0132.482] CloseHandle (hObject=0x114) returned 1 [0132.482] GetFileType (hFile=0xa4) returned 0x1 [0132.482] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\DVD Maker") returned 0x1e [0132.483] CloseHandle (hObject=0xa4) returned 1 [0132.483] GetFileType (hFile=0x114) returned 0x1 [0132.483] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0132.483] CloseHandle (hObject=0x114) returned 1 [0132.483] GetFileType (hFile=0xa4) returned 0x1 [0132.483] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Java") returned 0x1f [0132.484] CloseHandle (hObject=0xa4) returned 1 [0132.484] GetFileType (hFile=0x114) returned 0x1 [0132.484] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0132.484] CloseHandle (hObject=0x114) returned 1 [0132.484] GetFileType (hFile=0xa4) returned 0x1 [0132.484] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Synchronization Services") returned 0x37 [0132.485] CloseHandle (hObject=0xa4) returned 1 [0132.485] GetFileType (hFile=0x114) returned 0x1 [0132.485] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0132.485] CloseHandle (hObject=0x114) returned 1 [0132.485] GetFileType (hFile=0xa4) returned 0x1 [0132.485] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows NT") returned 0x1f [0132.486] CloseHandle (hObject=0xa4) returned 1 [0132.486] GetFileType (hFile=0x114) returned 0x1 [0132.486] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0132.486] CloseHandle (hObject=0x114) returned 1 [0132.486] GetFileType (hFile=0xa4) returned 0x1 [0132.486] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Common Files") returned 0x27 [0132.487] CloseHandle (hObject=0xa4) returned 1 [0132.487] GetFileType (hFile=0x114) returned 0x1 [0132.487] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0132.487] CloseHandle (hObject=0x114) returned 1 [0132.487] GetFileType (hFile=0xa4) returned 0x1 [0132.487] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Uninstall Information") returned 0x30 [0132.488] CloseHandle (hObject=0xa4) returned 1 [0132.488] GetFileType (hFile=0x114) returned 0x1 [0132.488] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0132.488] CloseHandle (hObject=0x114) returned 1 [0132.488] GetFileType (hFile=0xa4) returned 0x1 [0132.488] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services") returned 0x36 [0132.489] CloseHandle (hObject=0xa4) returned 1 [0132.489] GetFileType (hFile=0x114) returned 0x1 [0132.489] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0132.489] CloseHandle (hObject=0x114) returned 1 [0132.489] GetFileType (hFile=0xa4) returned 0x1 [0132.489] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft SQL Server Compact Edition") returned 0x39 [0132.490] CloseHandle (hObject=0xa4) returned 1 [0132.490] GetFileType (hFile=0x114) returned 0x1 [0132.490] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0132.490] CloseHandle (hObject=0x114) returned 1 [0132.490] GetFileType (hFile=0xa4) returned 0x1 [0132.490] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Reference Assemblies") returned 0x2f [0132.490] CloseHandle (hObject=0xa4) returned 1 [0132.491] GetFileType (hFile=0x114) returned 0x1 [0132.491] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0132.491] CloseHandle (hObject=0x114) returned 1 [0132.491] GetFileType (hFile=0xa4) returned 0x1 [0132.491] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Adobe") returned 0x20 [0132.492] CloseHandle (hObject=0xa4) returned 1 [0132.492] GetFileType (hFile=0x114) returned 0x1 [0132.492] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0132.492] CloseHandle (hObject=0x114) returned 1 [0132.492] GetFileType (hFile=0xa4) returned 0x1 [0132.492] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Mail") returned 0x27 [0132.493] CloseHandle (hObject=0xa4) returned 1 [0132.493] GetFileType (hFile=0x114) returned 0x1 [0132.493] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0132.493] CloseHandle (hObject=0x114) returned 1 [0132.493] GetFileType (hFile=0xa4) returned 0x1 [0132.493] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Sync Framework") returned 0x2d [0132.493] CloseHandle (hObject=0xa4) returned 1 [0132.494] GetFileType (hFile=0x114) returned 0x1 [0132.494] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0132.494] CloseHandle (hObject=0x114) returned 1 [0132.494] GetFileType (hFile=0xa4) returned 0x1 [0132.494] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Uninstall Information") returned 0x2a [0132.494] CloseHandle (hObject=0xa4) returned 1 [0132.494] GetFileType (hFile=0x114) returned 0x1 [0132.495] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0132.495] CloseHandle (hObject=0x114) returned 1 [0132.495] GetFileType (hFile=0xa4) returned 0x1 [0132.495] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Portable Devices") returned 0x2d [0132.495] CloseHandle (hObject=0xa4) returned 1 [0132.495] GetFileType (hFile=0x114) returned 0x1 [0132.495] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0132.496] CloseHandle (hObject=0x114) returned 1 [0132.496] GetFileType (hFile=0xa4) returned 0x1 [0132.496] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Internet Explorer") returned 0x26 [0132.496] CloseHandle (hObject=0xa4) returned 1 [0132.496] GetFileType (hFile=0x114) returned 0x1 [0132.496] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0132.497] CloseHandle (hObject=0x114) returned 1 [0132.497] GetFileType (hFile=0xa4) returned 0x1 [0132.497] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Internet Explorer") returned 0x26 [0132.497] CloseHandle (hObject=0xa4) returned 1 [0132.497] GetFileType (hFile=0x114) returned 0x1 [0132.497] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0132.498] CloseHandle (hObject=0x114) returned 1 [0132.498] GetFileType (hFile=0xa4) returned 0x1 [0132.498] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows NT") returned 0x1f [0132.498] CloseHandle (hObject=0xa4) returned 1 [0132.498] GetFileType (hFile=0x114) returned 0x1 [0132.498] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0132.499] CloseHandle (hObject=0x114) returned 1 [0132.499] GetFileType (hFile=0xa4) returned 0x1 [0132.499] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\MSBuild") returned 0x22 [0132.499] CloseHandle (hObject=0xa4) returned 1 [0132.499] GetFileType (hFile=0x114) returned 0x1 [0132.499] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0132.500] CloseHandle (hObject=0x114) returned 1 [0132.500] GetFileType (hFile=0xa4) returned 0x1 [0132.500] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Journal") returned 0x24 [0132.500] CloseHandle (hObject=0xa4) returned 1 [0132.500] GetFileType (hFile=0x114) returned 0x1 [0132.500] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\Fonts\\StaticCache.dat") returned 0x24 [0132.501] CloseHandle (hObject=0x114) returned 1 [0132.501] GetFileType (hFile=0xa4) returned 0x1 [0132.501] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0132.501] CloseHandle (hObject=0xa4) returned 1 [0132.501] GetFileType (hFile=0x114) returned 0x1 [0132.502] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Google") returned 0x21 [0132.502] CloseHandle (hObject=0x114) returned 1 [0132.502] GetFileType (hFile=0xa4) returned 0x1 [0132.502] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\Fonts\\StaticCache.dat") returned 0x24 [0132.503] CloseHandle (hObject=0xa4) returned 1 [0132.503] GetFileType (hFile=0x114) returned 0x1 [0132.503] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0132.503] CloseHandle (hObject=0x114) returned 1 [0132.503] GetFileType (hFile=0xa4) returned 0x1 [0132.503] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft.NET") returned 0x28 [0132.504] CloseHandle (hObject=0xa4) returned 1 [0132.504] GetFileType (hFile=0x114) returned 0x1 [0132.504] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\Fonts\\StaticCache.dat") returned 0x24 [0132.504] CloseHandle (hObject=0x114) returned 1 [0132.504] GetFileType (hFile=0xa4) returned 0x1 [0132.504] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0132.505] CloseHandle (hObject=0xa4) returned 1 [0132.505] GetFileType (hFile=0x114) returned 0x1 [0132.505] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Mail") returned 0x21 [0132.505] CloseHandle (hObject=0x114) returned 1 [0132.505] GetFileType (hFile=0xa4) returned 0x1 [0132.505] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\Fonts\\StaticCache.dat") returned 0x24 [0132.506] CloseHandle (hObject=0xa4) returned 1 [0132.506] GetFileType (hFile=0x114) returned 0x1 [0132.506] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0132.507] CloseHandle (hObject=0x114) returned 1 [0132.507] GetFileType (hFile=0xa4) returned 0x1 [0132.507] GetFinalPathNameByHandleW (in: hFile=0xa4, lpszFilePath=0x24df248, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x31 [0132.507] CloseHandle (hObject=0xa4) returned 1 [0132.507] GetFileType (hFile=0x114) returned 0x0 [0132.507] CloseHandle (hObject=0x114) returned 1 [0132.507] GetFileType (hFile=0xa4) returned 0x3 [0132.507] CloseHandle (hObject=0xa4) returned 1 [0132.508] GetFileType (hFile=0x114) returned 0x0 [0132.508] CloseHandle (hObject=0x114) returned 1 [0132.522] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0132.522] FindNextFileW (in: hFindFile=0x4fca30, lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac2e8a60, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x9098e7a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0132.522] FindNextFileW (in: hFindFile=0x4fca30, lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0132.522] FindNextFileW (in: hFindFile=0x4fca30, lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0132.522] FindNextFileW (in: hFindFile=0x4fca30, lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0132.522] FindNextFileW (in: hFindFile=0x4fca30, lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0132.522] GetProcessHeap () returned 0x4e0000 [0132.523] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2c) returned 0x4fcd10 [0132.523] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*.*", lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522e98 [0132.523] GetProcessHeap () returned 0x4e0000 [0132.523] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0132.524] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.524] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0132.524] GetProcessHeap () returned 0x4e0000 [0132.524] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x22e) returned 0x521750 [0132.524] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0132.524] GetLastError () returned 0x5 [0132.524] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0132.524] FindClose (in: hFindFile=0x522e98 | out: hFindFile=0x522e98) returned 1 [0132.524] GetProcessHeap () returned 0x4e0000 [0132.524] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x521750 | out: hHeap=0x4e0000) returned 1 [0132.524] FindNextFileW (in: hFindFile=0x4fca30, lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="da-DK", cAlternateFileName="")) returned 1 [0132.524] GetProcessHeap () returned 0x4e0000 [0132.524] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2c) returned 0x4fcd10 [0132.524] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*.*", lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522e98 [0132.524] GetProcessHeap () returned 0x4e0000 [0132.524] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0132.524] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.525] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0132.525] GetProcessHeap () returned 0x4e0000 [0132.525] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x22e) returned 0x521750 [0132.525] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0132.526] GetLastError () returned 0x5 [0132.526] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0132.526] FindClose (in: hFindFile=0x522e98 | out: hFindFile=0x522e98) returned 1 [0132.526] GetProcessHeap () returned 0x4e0000 [0132.527] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x521750 | out: hHeap=0x4e0000) returned 1 [0132.527] FindNextFileW (in: hFindFile=0x4fca30, lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="de-DE", cAlternateFileName="")) returned 1 [0132.527] GetProcessHeap () returned 0x4e0000 [0132.527] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2c) returned 0x4fcd10 [0132.527] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*.*", lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522e98 [0132.527] GetProcessHeap () returned 0x4e0000 [0132.527] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0132.527] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.527] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0132.527] GetProcessHeap () returned 0x4e0000 [0132.527] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x22e) returned 0x521750 [0132.527] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0132.527] GetLastError () returned 0x5 [0132.527] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0132.527] FindClose (in: hFindFile=0x522e98 | out: hFindFile=0x522e98) returned 1 [0132.527] GetProcessHeap () returned 0x4e0000 [0132.527] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x521750 | out: hHeap=0x4e0000) returned 1 [0132.527] FindNextFileW (in: hFindFile=0x4fca30, lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="el-GR", cAlternateFileName="")) returned 1 [0132.527] GetProcessHeap () returned 0x4e0000 [0132.527] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2c) returned 0x4fcd10 [0132.527] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*.*", lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522e98 [0132.528] GetProcessHeap () returned 0x4e0000 [0132.528] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0132.528] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.528] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0132.528] GetProcessHeap () returned 0x4e0000 [0132.528] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x22e) returned 0x521750 [0132.528] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0132.529] GetLastError () returned 0x5 [0132.529] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0132.529] FindClose (in: hFindFile=0x522e98 | out: hFindFile=0x522e98) returned 1 [0132.529] GetProcessHeap () returned 0x4e0000 [0132.529] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x521750 | out: hHeap=0x4e0000) returned 1 [0132.529] FindNextFileW (in: hFindFile=0x4fca30, lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-US", cAlternateFileName="")) returned 1 [0132.529] GetProcessHeap () returned 0x4e0000 [0132.529] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2c) returned 0x4fcd10 [0132.529] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*.*", lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522e98 [0132.529] GetProcessHeap () returned 0x4e0000 [0132.529] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0132.529] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.529] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0132.529] GetProcessHeap () returned 0x4e0000 [0132.529] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x22e) returned 0x521750 [0132.529] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0132.529] GetLastError () returned 0x5 [0132.530] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0132.530] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0132.530] GetLastError () returned 0x5 [0132.530] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0132.530] FindClose (in: hFindFile=0x522e98 | out: hFindFile=0x522e98) returned 1 [0132.530] GetProcessHeap () returned 0x4e0000 [0132.530] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x521750 | out: hHeap=0x4e0000) returned 1 [0132.530] FindNextFileW (in: hFindFile=0x4fca30, lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="es-ES", cAlternateFileName="")) returned 1 [0132.530] GetProcessHeap () returned 0x4e0000 [0132.530] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2c) returned 0x4fcd10 [0132.530] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*.*", lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522e98 [0132.531] GetProcessHeap () returned 0x4e0000 [0132.531] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0132.531] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.531] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0132.531] GetProcessHeap () returned 0x4e0000 [0132.531] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x22e) returned 0x521750 [0132.531] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0132.531] GetLastError () returned 0x5 [0132.531] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0132.531] FindClose (in: hFindFile=0x522e98 | out: hFindFile=0x522e98) returned 1 [0132.531] GetProcessHeap () returned 0x4e0000 [0132.531] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x521750 | out: hHeap=0x4e0000) returned 1 [0132.531] FindNextFileW (in: hFindFile=0x4fca30, lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0132.531] GetProcessHeap () returned 0x4e0000 [0132.531] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2c) returned 0x4fcd10 [0132.531] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*.*", lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522e98 [0132.532] GetProcessHeap () returned 0x4e0000 [0132.532] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0132.532] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.532] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0132.532] GetProcessHeap () returned 0x4e0000 [0132.532] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x22e) returned 0x521750 [0132.532] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0132.532] GetLastError () returned 0x5 [0132.532] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0132.532] FindClose (in: hFindFile=0x522e98 | out: hFindFile=0x522e98) returned 1 [0132.532] GetProcessHeap () returned 0x4e0000 [0132.532] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x521750 | out: hHeap=0x4e0000) returned 1 [0132.532] FindNextFileW (in: hFindFile=0x4fca30, lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Fonts", cAlternateFileName="")) returned 1 [0132.532] GetProcessHeap () returned 0x4e0000 [0132.532] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2c) returned 0x4fcd10 [0132.532] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*.*", lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522e98 [0132.533] GetProcessHeap () returned 0x4e0000 [0132.533] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0132.533] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.533] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0132.533] GetProcessHeap () returned 0x4e0000 [0132.533] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x22e) returned 0x521750 [0132.533] CreateFileW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0132.533] GetLastError () returned 0x5 [0132.533] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac191e00, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac191e00, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6505f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0132.533] CreateFileW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0132.534] GetLastError () returned 0x5 [0132.534] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac204220, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac204220, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65274577, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0132.534] CreateFileW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0132.534] GetLastError () returned 0x5 [0132.534] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac22a380, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac22a380, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6530caef, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x242f20, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0132.534] CreateFileW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0132.534] GetLastError () returned 0x5 [0132.534] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0132.535] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0132.535] GetLastError () returned 0x5 [0132.535] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0 [0132.535] FindClose (in: hFindFile=0x522e98 | out: hFindFile=0x522e98) returned 1 [0132.535] GetProcessHeap () returned 0x4e0000 [0132.535] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x521750 | out: hHeap=0x4e0000) returned 1 [0132.535] FindNextFileW (in: hFindFile=0x4fca30, lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0132.535] GetProcessHeap () returned 0x4e0000 [0132.535] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2c) returned 0x4fcd10 [0132.535] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*.*", lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522e98 [0132.536] GetProcessHeap () returned 0x4e0000 [0132.536] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0132.536] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.536] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0132.536] GetProcessHeap () returned 0x4e0000 [0132.536] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x22e) returned 0x521750 [0132.536] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0132.536] GetLastError () returned 0x5 [0132.536] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0132.536] FindClose (in: hFindFile=0x522e98 | out: hFindFile=0x522e98) returned 1 [0132.536] GetProcessHeap () returned 0x4e0000 [0132.536] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x521750 | out: hHeap=0x4e0000) returned 1 [0132.536] FindNextFileW (in: hFindFile=0x4fca30, lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0132.536] GetProcessHeap () returned 0x4e0000 [0132.536] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2c) returned 0x4fcd10 [0132.536] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*.*", lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522e98 [0132.537] GetProcessHeap () returned 0x4e0000 [0132.537] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0132.537] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.537] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0132.537] GetProcessHeap () returned 0x4e0000 [0132.537] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x22e) returned 0x521750 [0132.537] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0132.537] GetLastError () returned 0x5 [0132.537] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0132.537] FindClose (in: hFindFile=0x522e98 | out: hFindFile=0x522e98) returned 1 [0132.537] GetProcessHeap () returned 0x4e0000 [0132.537] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x521750 | out: hHeap=0x4e0000) returned 1 [0132.537] FindNextFileW (in: hFindFile=0x4fca30, lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="it-IT", cAlternateFileName="")) returned 1 [0132.537] GetProcessHeap () returned 0x4e0000 [0132.537] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2c) returned 0x4fcd10 [0132.537] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*.*", lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522e98 [0132.538] GetProcessHeap () returned 0x4e0000 [0132.538] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0132.538] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.538] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0132.538] GetProcessHeap () returned 0x4e0000 [0132.538] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x22e) returned 0x521750 [0132.538] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0132.538] GetLastError () returned 0x5 [0132.538] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0132.538] FindClose (in: hFindFile=0x522e98 | out: hFindFile=0x522e98) returned 1 [0132.538] GetProcessHeap () returned 0x4e0000 [0132.539] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x521750 | out: hHeap=0x4e0000) returned 1 [0132.539] FindNextFileW (in: hFindFile=0x4fca30, lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0132.539] GetProcessHeap () returned 0x4e0000 [0132.539] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2c) returned 0x4fcd10 [0132.539] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*.*", lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522e98 [0132.539] GetProcessHeap () returned 0x4e0000 [0132.539] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0132.539] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.539] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0132.539] GetProcessHeap () returned 0x4e0000 [0132.539] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x22e) returned 0x521750 [0132.539] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0132.539] GetLastError () returned 0x5 [0132.539] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0132.539] FindClose (in: hFindFile=0x522e98 | out: hFindFile=0x522e98) returned 1 [0132.539] GetProcessHeap () returned 0x4e0000 [0132.539] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x521750 | out: hHeap=0x4e0000) returned 1 [0132.539] FindNextFileW (in: hFindFile=0x4fca30, lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0132.539] GetProcessHeap () returned 0x4e0000 [0132.539] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2c) returned 0x4fcd10 [0132.539] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*.*", lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522e98 [0132.540] GetProcessHeap () returned 0x4e0000 [0132.540] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0132.540] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.540] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0132.540] GetProcessHeap () returned 0x4e0000 [0132.540] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x22e) returned 0x521750 [0132.540] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0132.541] GetLastError () returned 0x5 [0132.541] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0132.541] FindClose (in: hFindFile=0x522e98 | out: hFindFile=0x522e98) returned 1 [0132.541] GetProcessHeap () returned 0x4e0000 [0132.541] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x521750 | out: hHeap=0x4e0000) returned 1 [0132.541] FindNextFileW (in: hFindFile=0x4fca30, lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x240000, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0132.541] FindNextFileW (in: hFindFile=0x4fca30, lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0132.541] GetProcessHeap () returned 0x4e0000 [0132.541] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2c) returned 0x4fcd10 [0132.541] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*.*", lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522e98 [0132.541] GetProcessHeap () returned 0x4e0000 [0132.541] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0132.541] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.541] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0132.541] GetProcessHeap () returned 0x4e0000 [0132.541] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x22e) returned 0x521750 [0132.541] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0132.544] GetLastError () returned 0x5 [0132.544] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0132.544] FindClose (in: hFindFile=0x522e98 | out: hFindFile=0x522e98) returned 1 [0132.544] GetProcessHeap () returned 0x4e0000 [0132.544] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x521750 | out: hHeap=0x4e0000) returned 1 [0132.544] FindNextFileW (in: hFindFile=0x4fca30, lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0132.544] GetProcessHeap () returned 0x4e0000 [0132.544] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2c) returned 0x4fcd10 [0132.544] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*.*", lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522e98 [0132.545] GetProcessHeap () returned 0x4e0000 [0132.545] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0132.545] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.545] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0132.545] GetProcessHeap () returned 0x4e0000 [0132.545] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x22e) returned 0x521750 [0132.545] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0132.545] GetLastError () returned 0x5 [0132.545] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0132.545] FindClose (in: hFindFile=0x522e98 | out: hFindFile=0x522e98) returned 1 [0132.545] GetProcessHeap () returned 0x4e0000 [0132.545] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x521750 | out: hHeap=0x4e0000) returned 1 [0132.545] FindNextFileW (in: hFindFile=0x4fca30, lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0132.545] GetProcessHeap () returned 0x4e0000 [0132.545] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2c) returned 0x4fcd10 [0132.545] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*.*", lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522e98 [0132.546] GetProcessHeap () returned 0x4e0000 [0132.546] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0132.546] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.546] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0132.546] GetProcessHeap () returned 0x4e0000 [0132.546] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x22e) returned 0x521750 [0132.546] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0132.547] GetLastError () returned 0x5 [0132.547] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0132.547] FindClose (in: hFindFile=0x522e98 | out: hFindFile=0x522e98) returned 1 [0132.547] GetProcessHeap () returned 0x4e0000 [0132.547] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x521750 | out: hHeap=0x4e0000) returned 1 [0132.547] FindNextFileW (in: hFindFile=0x4fca30, lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0132.547] GetProcessHeap () returned 0x4e0000 [0132.547] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2c) returned 0x4fcd10 [0132.547] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*.*", lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522e98 [0132.547] GetProcessHeap () returned 0x4e0000 [0132.547] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0132.547] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.547] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0132.547] GetProcessHeap () returned 0x4e0000 [0132.547] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x22e) returned 0x521750 [0132.548] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0132.548] GetLastError () returned 0x5 [0132.548] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0132.548] FindClose (in: hFindFile=0x522e98 | out: hFindFile=0x522e98) returned 1 [0132.548] GetProcessHeap () returned 0x4e0000 [0132.548] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x521750 | out: hHeap=0x4e0000) returned 1 [0132.548] FindNextFileW (in: hFindFile=0x4fca30, lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0132.548] GetProcessHeap () returned 0x4e0000 [0132.548] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2c) returned 0x4fcd10 [0132.548] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*.*", lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522e98 [0132.548] GetProcessHeap () returned 0x4e0000 [0132.548] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0132.548] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.548] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0132.548] GetProcessHeap () returned 0x4e0000 [0132.548] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x22e) returned 0x521750 [0132.548] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0132.549] GetLastError () returned 0x5 [0132.549] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0132.549] FindClose (in: hFindFile=0x522e98 | out: hFindFile=0x522e98) returned 1 [0132.549] GetProcessHeap () returned 0x4e0000 [0132.549] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x521750 | out: hHeap=0x4e0000) returned 1 [0132.549] FindNextFileW (in: hFindFile=0x4fca30, lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0132.549] GetProcessHeap () returned 0x4e0000 [0132.549] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2c) returned 0x4fcd10 [0132.549] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*.*", lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522e98 [0132.550] GetProcessHeap () returned 0x4e0000 [0132.550] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0132.550] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.550] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0132.550] GetProcessHeap () returned 0x4e0000 [0132.550] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x22e) returned 0x521750 [0132.550] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0132.550] GetLastError () returned 0x5 [0132.550] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0132.550] FindClose (in: hFindFile=0x522e98 | out: hFindFile=0x522e98) returned 1 [0132.550] GetProcessHeap () returned 0x4e0000 [0132.550] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x521750 | out: hHeap=0x4e0000) returned 1 [0132.550] FindNextFileW (in: hFindFile=0x4fca30, lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0132.550] GetProcessHeap () returned 0x4e0000 [0132.550] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2c) returned 0x4fcd10 [0132.550] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*.*", lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522e98 [0132.550] GetProcessHeap () returned 0x4e0000 [0132.550] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0132.551] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.551] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0132.551] GetProcessHeap () returned 0x4e0000 [0132.551] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x22e) returned 0x521750 [0132.551] CreateFileW (lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0132.551] GetLastError () returned 0x5 [0132.551] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0132.552] FindClose (in: hFindFile=0x522e98 | out: hFindFile=0x522e98) returned 1 [0132.552] GetProcessHeap () returned 0x4e0000 [0132.552] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x521750 | out: hHeap=0x4e0000) returned 1 [0132.552] FindNextFileW (in: hFindFile=0x4fca30, lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0132.552] GetProcessHeap () returned 0x4e0000 [0132.552] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2c) returned 0x4fcd10 [0132.552] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*.*", lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522e98 [0132.552] GetProcessHeap () returned 0x4e0000 [0132.552] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0132.552] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.552] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0132.552] GetProcessHeap () returned 0x4e0000 [0132.552] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x22e) returned 0x521750 [0132.552] CreateFileW (lpFileName="C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0132.553] GetLastError () returned 0x5 [0132.553] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0132.553] FindClose (in: hFindFile=0x522e98 | out: hFindFile=0x522e98) returned 1 [0132.553] GetProcessHeap () returned 0x4e0000 [0132.553] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x521750 | out: hHeap=0x4e0000) returned 1 [0132.553] FindNextFileW (in: hFindFile=0x4fca30, lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0132.553] GetProcessHeap () returned 0x4e0000 [0132.553] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2c) returned 0x4fcd10 [0132.553] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*.*", lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522e98 [0132.553] GetProcessHeap () returned 0x4e0000 [0132.553] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0132.553] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.553] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0132.553] GetProcessHeap () returned 0x4e0000 [0132.553] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x22e) returned 0x521750 [0132.554] CreateFileW (lpFileName="C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0132.554] GetLastError () returned 0x5 [0132.554] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0132.554] FindClose (in: hFindFile=0x522e98 | out: hFindFile=0x522e98) returned 1 [0132.554] GetProcessHeap () returned 0x4e0000 [0132.554] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x521750 | out: hHeap=0x4e0000) returned 1 [0132.554] FindNextFileW (in: hFindFile=0x4fca30, lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0132.554] GetProcessHeap () returned 0x4e0000 [0132.554] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2c) returned 0x4fcd10 [0132.554] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*.*", lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522e98 [0132.555] GetProcessHeap () returned 0x4e0000 [0132.555] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0132.555] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.555] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0132.555] GetProcessHeap () returned 0x4e0000 [0132.555] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x22e) returned 0x521750 [0132.555] CreateFileW (lpFileName="C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0132.555] GetLastError () returned 0x5 [0132.555] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0132.555] FindClose (in: hFindFile=0x522e98 | out: hFindFile=0x522e98) returned 1 [0132.555] GetProcessHeap () returned 0x4e0000 [0132.555] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x521750 | out: hHeap=0x4e0000) returned 1 [0132.555] FindNextFileW (in: hFindFile=0x4fca30, lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0132.555] GetProcessHeap () returned 0x4e0000 [0132.555] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2c) returned 0x4fcd10 [0132.555] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*.*", lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522e98 [0132.556] GetProcessHeap () returned 0x4e0000 [0132.556] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0132.556] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.556] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0132.556] GetProcessHeap () returned 0x4e0000 [0132.556] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x22e) returned 0x521750 [0132.556] CreateFileW (lpFileName="C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0132.556] GetLastError () returned 0x5 [0132.556] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0132.556] FindClose (in: hFindFile=0x522e98 | out: hFindFile=0x522e98) returned 1 [0132.556] GetProcessHeap () returned 0x4e0000 [0132.556] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x521750 | out: hHeap=0x4e0000) returned 1 [0132.556] FindNextFileW (in: hFindFile=0x4fca30, lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0132.556] FindClose (in: hFindFile=0x4fca30 | out: hFindFile=0x4fca30) returned 1 [0132.556] GetProcessHeap () returned 0x4e0000 [0132.556] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x521520 | out: hHeap=0x4e0000) returned 1 [0132.556] FindNextFileW (in: hFindFile=0x4f9820, lpFindFileData=0x24dfd20 | out: lpFindFileData=0x24dfd20*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0xffff, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0132.556] FindNextFileW (in: hFindFile=0x4f9820, lpFindFileData=0x24dfd20 | out: lpFindFileData=0x24dfd20*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac54a060, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac54a060, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac54a060, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0xffff, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0132.556] FindNextFileW (in: hFindFile=0x4f9820, lpFindFileData=0x24dfd20 | out: lpFindFileData=0x24dfd20*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xffff, cFileName="Config.Msi", cAlternateFileName="")) returned 1 [0132.556] GetProcessHeap () returned 0x4e0000 [0132.556] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2c) returned 0x4fcd10 [0132.556] FindFirstFileW (in: lpFileName="C:\\Config.Msi\\*.*", lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x522e98 [0132.557] GetProcessHeap () returned 0x4e0000 [0132.557] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0132.557] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0132.557] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 0 [0132.557] FindClose (in: hFindFile=0x522e98 | out: hFindFile=0x522e98) returned 1 [0132.557] GetProcessHeap () returned 0x4e0000 [0132.557] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4e0000) returned 1 [0132.557] FindNextFileW (in: hFindFile=0x4f9820, lpFindFileData=0x24dfd20 | out: lpFindFileData=0x24dfd20*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xffff, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0132.557] GetProcessHeap () returned 0x4e0000 [0132.557] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x44) returned 0x4fca30 [0132.557] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*.*", lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 0xffffffff [0132.557] GetProcessHeap () returned 0x4e0000 [0132.557] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fca30 | out: hHeap=0x4e0000) returned 1 [0132.557] GetLastError () returned 0x5 [0132.558] FindNextFileW (in: hFindFile=0x4f9820, lpFindFileData=0x24dfd20 | out: lpFindFileData=0x24dfd20*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0xae99ef60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0xffff, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0132.558] FindNextFileW (in: hFindFile=0x4f9820, lpFindFileData=0x24dfd20 | out: lpFindFileData=0x24dfd20*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xffff, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0132.558] GetProcessHeap () returned 0x4e0000 [0132.558] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x28) returned 0x4fe470 [0132.558] FindFirstFileW (in: lpFileName="C:\\MSOCache\\*.*", lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x522e98 [0132.558] GetProcessHeap () returned 0x4e0000 [0132.558] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fe470 | out: hHeap=0x4e0000) returned 1 [0132.558] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0132.558] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0132.558] GetProcessHeap () returned 0x4e0000 [0132.558] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x22a) returned 0x520518 [0132.558] GetProcessHeap () returned 0x4e0000 [0132.558] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x3c) returned 0x4f53d8 [0132.558] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\*.*", lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522ed8 [0132.560] GetProcessHeap () returned 0x4e0000 [0132.560] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0132.560] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0132.561] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{90140000-0016-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~3")) returned 1 [0132.561] GetProcessHeap () returned 0x4e0000 [0132.561] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x23e) returned 0x521758 [0132.561] GetProcessHeap () returned 0x4e0000 [0132.561] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8e) returned 0x4fc578 [0132.561] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f18 [0132.562] GetProcessHeap () returned 0x4e0000 [0132.562] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fc578 | out: hHeap=0x4e0000) returned 1 [0132.562] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0132.562] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x393df700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x393df700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xed035930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x102fcbb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ExcelLR.cab", cAlternateFileName="")) returned 1 [0132.562] GetProcessHeap () returned 0x4e0000 [0132.562] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x290) returned 0x5229a8 [0132.562] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0132.563] GetFileSizeEx (in: hFile=0x110, lpFileSize=0x24df4f0 | out: lpFileSize=0x24df4f0*=16972987) returned 1 [0132.563] GetProcessHeap () returned 0x4e0000 [0132.563] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0132.563] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0132.563] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.563] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4dc*=0x5, lpOverlapped=0x0) returned 1 [0132.565] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0132.565] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0132.565] GetProcessHeap () returned 0x4e0000 [0132.565] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0132.566] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c0*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c0*=0x40) returned 1 [0132.566] CryptDestroyKey (hKey=0x522f58) returned 1 [0132.566] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4dc*=0x40, lpOverlapped=0x0) returned 1 [0132.566] WriteFile (in: hFile=0x110, lpBuffer=0x24df4e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4e4*, lpNumberOfBytesWritten=0x24df4dc*=0x4, lpOverlapped=0x0) returned 1 [0132.566] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4dc*=0x10, lpOverlapped=0x0) returned 1 [0132.566] WriteFile (in: hFile=0x110, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df4dc*=0x80, lpOverlapped=0x0) returned 1 [0132.566] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df508 | out: lpNewFilePointer=0x0) returned 1 [0132.566] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4f8*, lpNumberOfBytesWritten=0x24df4dc*=0x8, lpOverlapped=0x0) returned 1 [0132.566] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0132.566] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0132.566] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0132.566] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0132.572] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0132.576] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.576] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0132.577] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x102fd94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.577] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0132.577] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0132.577] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0132.581] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0132.583] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.584] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0132.584] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x102fd94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.584] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0132.585] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xfefcc0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0132.585] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0132.588] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0132.590] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xfefcc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.590] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0132.591] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x102fd94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.591] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0132.591] CryptDestroyKey (hKey=0x522f58) returned 1 [0132.591] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x102fd94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.591] SetEndOfFile (hFile=0x110) returned 1 [0132.594] GetProcessHeap () returned 0x4e0000 [0132.594] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0132.594] GetProcessHeap () returned 0x4e0000 [0132.594] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0132.594] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0132.597] CloseHandle (hObject=0x110) returned 1 [0133.283] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xece1ee80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263e00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ExcelMUI.msi", cAlternateFileName="")) returned 1 [0133.283] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0133.285] GetFileSizeEx (in: hFile=0x110, lpFileSize=0x24df4f0 | out: lpFileSize=0x24df4f0*=2506240) returned 1 [0133.285] GetProcessHeap () returned 0x4e0000 [0133.285] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0133.285] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0133.285] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.285] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0133.285] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0133.285] GetProcessHeap () returned 0x4e0000 [0133.285] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0133.285] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c0*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c0*=0x40) returned 1 [0133.285] CryptDestroyKey (hKey=0x522f58) returned 1 [0133.285] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4dc*=0x40, lpOverlapped=0x0) returned 1 [0133.295] WriteFile (in: hFile=0x110, lpBuffer=0x24df4e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4e4*, lpNumberOfBytesWritten=0x24df4dc*=0x4, lpOverlapped=0x0) returned 1 [0133.295] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4dc*=0x10, lpOverlapped=0x0) returned 1 [0133.295] WriteFile (in: hFile=0x110, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df4dc*=0x80, lpOverlapped=0x0) returned 1 [0133.295] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df508 | out: lpNewFilePointer=0x0) returned 1 [0133.295] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4f8*, lpNumberOfBytesWritten=0x24df4dc*=0x8, lpOverlapped=0x0) returned 1 [0133.295] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0133.295] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0133.295] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0133.295] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0133.305] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0133.309] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.309] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0133.310] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x263ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.310] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0133.310] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0133.310] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0133.382] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0133.384] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.384] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0133.386] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x263ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.386] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0133.386] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0133.386] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0133.392] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0133.395] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.395] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0133.396] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x263ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.396] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0133.396] CryptDestroyKey (hKey=0x522f58) returned 1 [0133.396] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x263ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.396] SetEndOfFile (hFile=0x110) returned 1 [0133.399] GetProcessHeap () returned 0x4e0000 [0133.399] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0133.399] GetProcessHeap () returned 0x4e0000 [0133.399] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0133.399] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0133.476] CloseHandle (hObject=0x110) returned 1 [0133.476] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ExcelMUI.xml", cAlternateFileName="")) returned 1 [0133.476] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0133.477] GetProcessHeap () returned 0x4e0000 [0133.477] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0133.477] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0133.477] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0133.477] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0x3, lpOverlapped=0x0) returned 1 [0133.505] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0133.505] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0133.506] GetProcessHeap () returned 0x4e0000 [0133.506] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0133.506] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40) returned 1 [0133.506] CryptDestroyKey (hKey=0x522f58) returned 1 [0133.506] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4e8*=0x40, lpOverlapped=0x0) returned 1 [0133.506] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0133.506] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0133.506] WriteFile (in: hFile=0x110, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0133.506] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0133.506] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0133.506] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0133.506] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0133.506] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.506] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x61d, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0x61d, lpOverlapped=0x0) returned 1 [0133.506] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x620, dwBufLen=0x620 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x620) returned 1 [0133.506] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.506] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0x620, lpOverlapped=0x0) returned 1 [0133.507] CryptDestroyKey (hKey=0x522f58) returned 1 [0133.507] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x6f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.507] SetEndOfFile (hFile=0x110) returned 1 [0133.509] GetProcessHeap () returned 0x4e0000 [0133.509] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0133.509] GetProcessHeap () returned 0x4e0000 [0133.509] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0133.509] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0133.509] CloseHandle (hObject=0x110) returned 1 [0133.511] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0133.511] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0133.521] GetProcessHeap () returned 0x4e0000 [0133.521] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0133.521] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0133.521] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0133.521] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0133.528] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0133.528] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0133.528] GetProcessHeap () returned 0x4e0000 [0133.528] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0133.528] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df4c8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df4c8*=0x30) returned 1 [0133.528] CryptDestroyKey (hKey=0x522f58) returned 1 [0133.529] WriteFile (in: hFile=0x110, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df4e8*=0x30, lpOverlapped=0x0) returned 1 [0133.529] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0133.529] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0133.529] WriteFile (in: hFile=0x110, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0133.529] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0133.529] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0133.529] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0133.529] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0133.529] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.529] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x8f8, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0x8f8, lpOverlapped=0x0) returned 1 [0133.529] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x900, dwBufLen=0x900 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x900) returned 1 [0133.529] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.529] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0x900, lpOverlapped=0x0) returned 1 [0133.529] CryptDestroyKey (hKey=0x522f58) returned 1 [0133.529] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x9c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.529] SetEndOfFile (hFile=0x110) returned 1 [0133.532] GetProcessHeap () returned 0x4e0000 [0133.532] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0133.532] GetProcessHeap () returned 0x4e0000 [0133.532] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0133.532] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0133.532] CloseHandle (hObject=0x110) returned 1 [0133.532] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0133.532] GetProcessHeap () returned 0x4e0000 [0133.532] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0133.532] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df4d8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f58) returned 1 [0133.532] CryptDecrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df540 | out: pbData=0x4f53d8, pdwDataLen=0x24df540) returned 1 [0133.533] CryptDestroyKey (hKey=0x522f58) returned 1 [0133.533] GetProcessHeap () returned 0x4e0000 [0133.533] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0133.533] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df4d8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f58) returned 1 [0133.533] CryptDecrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df540 | out: pbData=0x4f5420, pdwDataLen=0x24df540) returned 1 [0133.533] CryptDestroyKey (hKey=0x522f58) returned 1 [0133.533] GetProcessHeap () returned 0x4e0000 [0133.533] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x524e88 [0133.533] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df4d8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f58) returned 1 [0133.533] CryptDecrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x524e88, pdwDataLen=0x24df540 | out: pbData=0x524e88, pdwDataLen=0x24df540) returned 1 [0133.533] CryptDestroyKey (hKey=0x522f58) returned 1 [0133.533] wsprintfW (in: param_1=0x24de51c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\readme-warning.txt") returned 81 [0133.533] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0133.534] WriteFile (in: hFile=0x110, lpBuffer=0x524e88*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24de518, lpOverlapped=0x0 | out: lpBuffer=0x524e88*, lpNumberOfBytesWritten=0x24de518*=0x6c3, lpOverlapped=0x0) returned 1 [0133.535] CloseHandle (hObject=0x110) returned 1 [0133.535] GetProcessHeap () returned 0x4e0000 [0133.535] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x524e88 | out: hHeap=0x4e0000) returned 1 [0133.535] GetProcessHeap () returned 0x4e0000 [0133.535] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0133.535] GetProcessHeap () returned 0x4e0000 [0133.535] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0133.535] FindClose (in: hFindFile=0x522f18 | out: hFindFile=0x522f18) returned 1 [0133.535] GetProcessHeap () returned 0x4e0000 [0133.535] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5229a8 | out: hHeap=0x4e0000) returned 1 [0133.535] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{90140000-0018-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~2")) returned 1 [0133.535] GetProcessHeap () returned 0x4e0000 [0133.535] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8e) returned 0x4fa058 [0133.535] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f18 [0133.539] GetProcessHeap () returned 0x4e0000 [0133.539] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0133.539] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0133.539] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe874f770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PowerPointMUI.msi", cAlternateFileName="POWERP~1.MSI")) returned 1 [0133.539] GetProcessHeap () returned 0x4e0000 [0133.539] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x290) returned 0x5219a0 [0133.539] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0133.539] GetFileSizeEx (in: hFile=0x110, lpFileSize=0x24df4f0 | out: lpFileSize=0x24df4f0*=2503680) returned 1 [0133.539] GetProcessHeap () returned 0x4e0000 [0133.539] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0133.539] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0133.539] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.539] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0133.539] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0133.539] GetProcessHeap () returned 0x4e0000 [0133.539] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0133.539] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c0*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c0*=0x40) returned 1 [0133.539] CryptDestroyKey (hKey=0x522f58) returned 1 [0133.539] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4dc*=0x40, lpOverlapped=0x0) returned 1 [0133.552] WriteFile (in: hFile=0x110, lpBuffer=0x24df4e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4e4*, lpNumberOfBytesWritten=0x24df4dc*=0x4, lpOverlapped=0x0) returned 1 [0133.552] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4dc*=0x10, lpOverlapped=0x0) returned 1 [0133.553] WriteFile (in: hFile=0x110, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df4dc*=0x80, lpOverlapped=0x0) returned 1 [0133.553] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df508 | out: lpNewFilePointer=0x0) returned 1 [0133.553] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4f8*, lpNumberOfBytesWritten=0x24df4dc*=0x8, lpOverlapped=0x0) returned 1 [0133.553] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0133.553] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0133.553] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0133.553] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0133.558] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0133.562] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.562] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0133.563] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x2634d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.563] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0133.563] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0133.563] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0133.574] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0133.576] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.576] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0133.578] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x2634d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.578] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0133.578] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0133.578] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0133.592] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0133.594] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.594] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0133.595] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x2634d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.595] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0133.595] CryptDestroyKey (hKey=0x522f58) returned 1 [0133.595] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x2634d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.595] SetEndOfFile (hFile=0x110) returned 1 [0133.599] GetProcessHeap () returned 0x4e0000 [0133.599] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0133.599] GetProcessHeap () returned 0x4e0000 [0133.599] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0133.599] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0133.658] CloseHandle (hObject=0x110) returned 1 [0133.658] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PowerPointMUI.xml", cAlternateFileName="POWERP~1.XML")) returned 1 [0133.658] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0133.659] GetProcessHeap () returned 0x4e0000 [0133.659] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0133.659] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0133.659] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0133.659] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0x6, lpOverlapped=0x0) returned 1 [0133.661] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0133.661] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0133.661] GetProcessHeap () returned 0x4e0000 [0133.661] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0133.661] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40) returned 1 [0133.661] CryptDestroyKey (hKey=0x522f58) returned 1 [0133.661] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4e8*=0x40, lpOverlapped=0x0) returned 1 [0133.662] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0133.662] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0133.662] WriteFile (in: hFile=0x110, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0133.662] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0133.662] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0133.662] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0133.662] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0133.662] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.662] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5aa, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0x5aa, lpOverlapped=0x0) returned 1 [0133.662] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x5b0) returned 1 [0133.662] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.662] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0x5b0, lpOverlapped=0x0) returned 1 [0133.662] CryptDestroyKey (hKey=0x522f58) returned 1 [0133.662] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.662] SetEndOfFile (hFile=0x110) returned 1 [0133.664] GetProcessHeap () returned 0x4e0000 [0133.664] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0133.664] GetProcessHeap () returned 0x4e0000 [0133.664] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0133.665] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0133.666] CloseHandle (hObject=0x110) returned 1 [0133.666] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d523500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2d523500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8b079d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x431a290, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PptLR.cab", cAlternateFileName="")) returned 1 [0133.667] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0133.668] GetFileSizeEx (in: hFile=0x110, lpFileSize=0x24df4f0 | out: lpFileSize=0x24df4f0*=70361744) returned 1 [0133.668] GetProcessHeap () returned 0x4e0000 [0133.668] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0133.668] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0133.668] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.668] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0133.668] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0133.668] GetProcessHeap () returned 0x4e0000 [0133.668] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0133.668] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df4c0*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df4c0*=0x30) returned 1 [0133.668] CryptDestroyKey (hKey=0x522f58) returned 1 [0133.668] WriteFile (in: hFile=0x110, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df4dc*=0x30, lpOverlapped=0x0) returned 1 [0133.680] WriteFile (in: hFile=0x110, lpBuffer=0x24df4e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4e4*, lpNumberOfBytesWritten=0x24df4dc*=0x4, lpOverlapped=0x0) returned 1 [0133.681] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4dc*=0x10, lpOverlapped=0x0) returned 1 [0133.681] WriteFile (in: hFile=0x110, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df4dc*=0x80, lpOverlapped=0x0) returned 1 [0133.681] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df508 | out: lpNewFilePointer=0x0) returned 1 [0133.681] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4f8*, lpNumberOfBytesWritten=0x24df4dc*=0x8, lpOverlapped=0x0) returned 1 [0133.681] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0133.681] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0133.681] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0133.681] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0133.686] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0133.690] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.690] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0133.691] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x431a354, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.691] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0133.691] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0133.691] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0133.698] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0133.700] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.700] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0133.701] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x431a354, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.701] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0133.701] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0133.701] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0133.705] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0133.707] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.708] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0133.708] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x431a354, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.708] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0133.708] CryptDestroyKey (hKey=0x522f58) returned 1 [0133.708] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x431a354, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.709] SetEndOfFile (hFile=0x110) returned 1 [0133.711] GetProcessHeap () returned 0x4e0000 [0133.711] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0133.711] GetProcessHeap () returned 0x4e0000 [0133.711] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0133.711] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0133.712] CloseHandle (hObject=0x110) returned 1 [0133.712] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0133.712] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0133.712] GetProcessHeap () returned 0x4e0000 [0133.712] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0133.713] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0133.713] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0133.713] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0x2, lpOverlapped=0x0) returned 1 [0133.716] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0133.716] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0133.716] GetProcessHeap () returned 0x4e0000 [0133.716] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0133.716] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df4c8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df4c8*=0x30) returned 1 [0133.716] CryptDestroyKey (hKey=0x522f58) returned 1 [0133.716] WriteFile (in: hFile=0x110, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df4e8*=0x30, lpOverlapped=0x0) returned 1 [0133.716] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0133.716] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0133.716] WriteFile (in: hFile=0x110, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0133.717] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0133.717] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0133.717] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0133.717] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0133.717] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.717] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x75e, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0x75e, lpOverlapped=0x0) returned 1 [0133.717] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x760, dwBufLen=0x760 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x760) returned 1 [0133.717] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.717] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0x760, lpOverlapped=0x0) returned 1 [0133.717] CryptDestroyKey (hKey=0x522f58) returned 1 [0133.717] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x824, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.717] SetEndOfFile (hFile=0x110) returned 1 [0133.719] GetProcessHeap () returned 0x4e0000 [0133.719] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0133.719] GetProcessHeap () returned 0x4e0000 [0133.719] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0133.719] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0133.720] CloseHandle (hObject=0x110) returned 1 [0133.720] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0133.720] GetProcessHeap () returned 0x4e0000 [0133.720] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0133.720] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df4d8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f58) returned 1 [0133.720] CryptDecrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df540 | out: pbData=0x4f53d8, pdwDataLen=0x24df540) returned 1 [0133.720] CryptDestroyKey (hKey=0x522f58) returned 1 [0133.720] GetProcessHeap () returned 0x4e0000 [0133.720] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0133.720] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df4d8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f58) returned 1 [0133.720] CryptDecrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df540 | out: pbData=0x4f5420, pdwDataLen=0x24df540) returned 1 [0133.720] CryptDestroyKey (hKey=0x522f58) returned 1 [0133.720] GetProcessHeap () returned 0x4e0000 [0133.720] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x521c38 [0133.720] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df4d8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f58) returned 1 [0133.720] CryptDecrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x521c38, pdwDataLen=0x24df540 | out: pbData=0x521c38, pdwDataLen=0x24df540) returned 1 [0133.720] CryptDestroyKey (hKey=0x522f58) returned 1 [0133.720] wsprintfW (in: param_1=0x24de51c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\readme-warning.txt") returned 81 [0133.720] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0133.721] WriteFile (in: hFile=0x110, lpBuffer=0x521c38*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24de518, lpOverlapped=0x0 | out: lpBuffer=0x521c38*, lpNumberOfBytesWritten=0x24de518*=0x6c3, lpOverlapped=0x0) returned 1 [0133.722] CloseHandle (hObject=0x110) returned 1 [0133.722] GetProcessHeap () returned 0x4e0000 [0133.722] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x521c38 | out: hHeap=0x4e0000) returned 1 [0133.722] GetProcessHeap () returned 0x4e0000 [0133.722] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0133.722] GetProcessHeap () returned 0x4e0000 [0133.722] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0133.722] FindClose (in: hFindFile=0x522f18 | out: hFindFile=0x522f18) returned 1 [0133.722] GetProcessHeap () returned 0x4e0000 [0133.722] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5219a0 | out: hHeap=0x4e0000) returned 1 [0133.722] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{90140000-0019-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9877A~1")) returned 1 [0133.722] GetProcessHeap () returned 0x4e0000 [0133.722] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8e) returned 0x4fa058 [0133.722] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f18 [0133.725] GetProcessHeap () returned 0x4e0000 [0133.725] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0133.725] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0133.725] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc40b730, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x265c00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PublisherMUI.msi", cAlternateFileName="PUBLIS~1.MSI")) returned 1 [0133.725] GetProcessHeap () returned 0x4e0000 [0133.725] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x290) returned 0x5219a0 [0133.725] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0133.726] GetFileSizeEx (in: hFile=0x110, lpFileSize=0x24df4f0 | out: lpFileSize=0x24df4f0*=2513920) returned 1 [0133.726] GetProcessHeap () returned 0x4e0000 [0133.726] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0133.726] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0133.726] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.726] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0133.726] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0133.726] GetProcessHeap () returned 0x4e0000 [0133.726] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0133.726] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c0*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c0*=0x40) returned 1 [0133.726] CryptDestroyKey (hKey=0x522f58) returned 1 [0133.726] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4dc*=0x40, lpOverlapped=0x0) returned 1 [0133.728] WriteFile (in: hFile=0x110, lpBuffer=0x24df4e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4e4*, lpNumberOfBytesWritten=0x24df4dc*=0x4, lpOverlapped=0x0) returned 1 [0133.728] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4dc*=0x10, lpOverlapped=0x0) returned 1 [0133.728] WriteFile (in: hFile=0x110, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df4dc*=0x80, lpOverlapped=0x0) returned 1 [0133.729] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df508 | out: lpNewFilePointer=0x0) returned 1 [0133.729] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4f8*, lpNumberOfBytesWritten=0x24df4dc*=0x8, lpOverlapped=0x0) returned 1 [0133.729] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0133.729] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0133.729] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0133.729] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0133.734] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0133.738] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.738] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0133.739] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x265cd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.739] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0133.740] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0133.740] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0133.762] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0133.765] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.765] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0133.767] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x265cd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.767] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0133.768] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0133.768] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0133.777] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0133.780] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.780] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0133.782] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x265cd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.782] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0133.782] CryptDestroyKey (hKey=0x522f58) returned 1 [0133.782] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x265cd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.782] SetEndOfFile (hFile=0x110) returned 1 [0133.786] GetProcessHeap () returned 0x4e0000 [0133.786] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0133.787] GetProcessHeap () returned 0x4e0000 [0133.787] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0133.787] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0133.850] CloseHandle (hObject=0x110) returned 1 [0133.850] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PublisherMUI.xml", cAlternateFileName="PUBLIS~1.XML")) returned 1 [0133.850] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0133.850] GetProcessHeap () returned 0x4e0000 [0133.850] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0133.850] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0133.851] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0133.851] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0x6, lpOverlapped=0x0) returned 1 [0133.854] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0133.855] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0133.855] GetProcessHeap () returned 0x4e0000 [0133.855] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0133.855] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40) returned 1 [0133.855] CryptDestroyKey (hKey=0x522f58) returned 1 [0133.855] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4e8*=0x40, lpOverlapped=0x0) returned 1 [0133.855] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0133.855] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0133.855] WriteFile (in: hFile=0x110, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0133.855] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0133.855] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0133.855] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0133.855] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0133.855] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.855] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5aa, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0x5aa, lpOverlapped=0x0) returned 1 [0133.855] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x5b0) returned 1 [0133.855] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.856] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0x5b0, lpOverlapped=0x0) returned 1 [0133.856] CryptDestroyKey (hKey=0x522f58) returned 1 [0133.856] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.856] SetEndOfFile (hFile=0x110) returned 1 [0133.858] GetProcessHeap () returned 0x4e0000 [0133.858] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0133.858] GetProcessHeap () returned 0x4e0000 [0133.858] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0133.858] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0133.860] CloseHandle (hObject=0x110) returned 1 [0133.860] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc47e320, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x97f3f4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PubLR.cab", cAlternateFileName="")) returned 1 [0133.860] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0133.860] GetFileSizeEx (in: hFile=0x110, lpFileSize=0x24df4f0 | out: lpFileSize=0x24df4f0*=9958388) returned 1 [0133.860] GetProcessHeap () returned 0x4e0000 [0133.860] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0133.861] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0133.861] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.861] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4dc*=0xc, lpOverlapped=0x0) returned 1 [0133.864] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0133.864] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0133.864] GetProcessHeap () returned 0x4e0000 [0133.864] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0133.864] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df4c0*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df4c0*=0x30) returned 1 [0133.864] CryptDestroyKey (hKey=0x522f58) returned 1 [0133.864] WriteFile (in: hFile=0x110, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df4dc*=0x30, lpOverlapped=0x0) returned 1 [0133.864] WriteFile (in: hFile=0x110, lpBuffer=0x24df4e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4e4*, lpNumberOfBytesWritten=0x24df4dc*=0x4, lpOverlapped=0x0) returned 1 [0133.864] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4dc*=0x10, lpOverlapped=0x0) returned 1 [0133.864] WriteFile (in: hFile=0x110, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df4dc*=0x80, lpOverlapped=0x0) returned 1 [0133.864] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df508 | out: lpNewFilePointer=0x0) returned 1 [0133.864] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4f8*, lpNumberOfBytesWritten=0x24df4dc*=0x8, lpOverlapped=0x0) returned 1 [0133.865] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0133.865] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0133.865] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0133.865] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0133.869] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0133.873] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.873] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0133.874] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x97f4c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.874] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0133.874] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0133.874] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0133.892] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0133.894] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.894] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0133.895] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x97f4c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.895] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0133.895] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x93f400, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0133.895] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0133.901] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0133.903] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x93f400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.903] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0133.904] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x97f4c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.904] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0133.904] CryptDestroyKey (hKey=0x522f58) returned 1 [0133.904] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x97f4c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.904] SetEndOfFile (hFile=0x110) returned 1 [0133.907] GetProcessHeap () returned 0x4e0000 [0133.907] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0133.907] GetProcessHeap () returned 0x4e0000 [0133.907] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0133.907] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0133.908] CloseHandle (hObject=0x110) returned 1 [0133.908] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0133.908] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0133.908] GetProcessHeap () returned 0x4e0000 [0133.908] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0133.908] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0133.908] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0133.908] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0133.917] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0133.917] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0133.917] GetProcessHeap () returned 0x4e0000 [0133.917] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0133.917] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df4c8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df4c8*=0x30) returned 1 [0133.917] CryptDestroyKey (hKey=0x522f58) returned 1 [0133.917] WriteFile (in: hFile=0x110, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df4e8*=0x30, lpOverlapped=0x0) returned 1 [0133.917] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0133.917] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0133.917] WriteFile (in: hFile=0x110, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0133.917] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0133.917] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0133.918] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0133.918] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0133.918] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.918] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x648, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0x648, lpOverlapped=0x0) returned 1 [0133.918] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x650, dwBufLen=0x650 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x650) returned 1 [0133.918] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.918] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0x650, lpOverlapped=0x0) returned 1 [0133.918] CryptDestroyKey (hKey=0x522f58) returned 1 [0133.918] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.918] SetEndOfFile (hFile=0x110) returned 1 [0133.920] GetProcessHeap () returned 0x4e0000 [0133.920] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0133.920] GetProcessHeap () returned 0x4e0000 [0133.920] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0133.920] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0133.921] CloseHandle (hObject=0x110) returned 1 [0133.921] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0133.921] GetProcessHeap () returned 0x4e0000 [0133.921] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0133.921] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df4d8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f58) returned 1 [0133.921] CryptDecrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df540 | out: pbData=0x4f53d8, pdwDataLen=0x24df540) returned 1 [0133.921] CryptDestroyKey (hKey=0x522f58) returned 1 [0133.921] GetProcessHeap () returned 0x4e0000 [0133.921] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0133.921] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df4d8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f58) returned 1 [0133.921] CryptDecrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df540 | out: pbData=0x4f5420, pdwDataLen=0x24df540) returned 1 [0133.921] CryptDestroyKey (hKey=0x522f58) returned 1 [0133.921] GetProcessHeap () returned 0x4e0000 [0133.921] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x521c38 [0133.921] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df4d8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f58) returned 1 [0133.922] CryptDecrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x521c38, pdwDataLen=0x24df540 | out: pbData=0x521c38, pdwDataLen=0x24df540) returned 1 [0133.922] CryptDestroyKey (hKey=0x522f58) returned 1 [0133.922] wsprintfW (in: param_1=0x24de51c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\readme-warning.txt") returned 81 [0133.922] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0133.922] WriteFile (in: hFile=0x110, lpBuffer=0x521c38*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24de518, lpOverlapped=0x0 | out: lpBuffer=0x521c38*, lpNumberOfBytesWritten=0x24de518*=0x6c3, lpOverlapped=0x0) returned 1 [0133.923] CloseHandle (hObject=0x110) returned 1 [0133.923] GetProcessHeap () returned 0x4e0000 [0133.923] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x521c38 | out: hHeap=0x4e0000) returned 1 [0133.924] GetProcessHeap () returned 0x4e0000 [0133.924] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0133.924] GetProcessHeap () returned 0x4e0000 [0133.924] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0133.924] FindClose (in: hFindFile=0x522f18 | out: hFindFile=0x522f18) returned 1 [0133.924] GetProcessHeap () returned 0x4e0000 [0133.924] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5219a0 | out: hHeap=0x4e0000) returned 1 [0133.924] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{90140000-001A-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9765F~1")) returned 1 [0133.924] GetProcessHeap () returned 0x4e0000 [0133.924] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8e) returned 0x4fa058 [0133.924] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f18 [0133.936] GetProcessHeap () returned 0x4e0000 [0133.936] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0133.936] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0133.936] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a6f2400, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3a6f2400, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xeebe0180, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe21fcc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OutlkLR.cab", cAlternateFileName="")) returned 1 [0133.936] GetProcessHeap () returned 0x4e0000 [0133.936] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x290) returned 0x5219a0 [0133.936] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0133.936] GetFileSizeEx (in: hFile=0x110, lpFileSize=0x24df4f0 | out: lpFileSize=0x24df4f0*=14819276) returned 1 [0133.936] GetProcessHeap () returned 0x4e0000 [0133.936] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0133.936] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0133.936] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.936] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4dc*=0x4, lpOverlapped=0x0) returned 1 [0133.974] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0133.974] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0133.974] GetProcessHeap () returned 0x4e0000 [0133.974] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0133.974] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c0*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c0*=0x40) returned 1 [0133.974] CryptDestroyKey (hKey=0x522f58) returned 1 [0133.974] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4dc*=0x40, lpOverlapped=0x0) returned 1 [0133.974] WriteFile (in: hFile=0x110, lpBuffer=0x24df4e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4e4*, lpNumberOfBytesWritten=0x24df4dc*=0x4, lpOverlapped=0x0) returned 1 [0133.974] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4dc*=0x10, lpOverlapped=0x0) returned 1 [0133.974] WriteFile (in: hFile=0x110, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df4dc*=0x80, lpOverlapped=0x0) returned 1 [0133.975] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df508 | out: lpNewFilePointer=0x0) returned 1 [0133.975] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4f8*, lpNumberOfBytesWritten=0x24df4dc*=0x8, lpOverlapped=0x0) returned 1 [0133.975] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0133.975] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0133.975] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0133.975] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0133.979] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0133.981] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.981] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0133.984] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xe220a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.984] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0133.984] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0133.984] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0133.988] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0133.991] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.991] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0133.991] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xe220a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.992] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0133.992] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xde1fd0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0133.992] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0133.995] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0133.998] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xde1fd0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.998] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0133.999] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xe220a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.999] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0133.999] CryptDestroyKey (hKey=0x522f58) returned 1 [0133.999] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xe220a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.999] SetEndOfFile (hFile=0x110) returned 1 [0134.002] GetProcessHeap () returned 0x4e0000 [0134.002] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0134.002] GetProcessHeap () returned 0x4e0000 [0134.002] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0134.002] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0134.447] CloseHandle (hObject=0x110) returned 1 [0134.447] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2bba00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OutlookMUI.msi", cAlternateFileName="OUTLOO~1.MSI")) returned 1 [0134.447] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0134.447] GetFileSizeEx (in: hFile=0x110, lpFileSize=0x24df4f0 | out: lpFileSize=0x24df4f0*=2865664) returned 1 [0134.447] GetProcessHeap () returned 0x4e0000 [0134.447] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0134.447] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0134.447] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.448] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0134.448] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0134.448] GetProcessHeap () returned 0x4e0000 [0134.448] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0134.448] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c0*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c0*=0x40) returned 1 [0134.448] CryptDestroyKey (hKey=0x522f58) returned 1 [0134.448] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4dc*=0x40, lpOverlapped=0x0) returned 1 [0134.451] WriteFile (in: hFile=0x110, lpBuffer=0x24df4e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4e4*, lpNumberOfBytesWritten=0x24df4dc*=0x4, lpOverlapped=0x0) returned 1 [0134.451] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4dc*=0x10, lpOverlapped=0x0) returned 1 [0134.451] WriteFile (in: hFile=0x110, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df4dc*=0x80, lpOverlapped=0x0) returned 1 [0134.451] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df508 | out: lpNewFilePointer=0x0) returned 1 [0134.451] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4f8*, lpNumberOfBytesWritten=0x24df4dc*=0x8, lpOverlapped=0x0) returned 1 [0134.451] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0134.451] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0134.451] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0134.451] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0134.455] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0134.460] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.460] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0134.461] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x2bbad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.461] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0134.461] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0134.461] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0134.477] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0134.479] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.479] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0134.480] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x2bbad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.481] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0134.481] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0134.481] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0134.484] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0134.487] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.487] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0134.488] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x2bbad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.488] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0134.488] CryptDestroyKey (hKey=0x522f58) returned 1 [0134.488] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x2bbad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.488] SetEndOfFile (hFile=0x110) returned 1 [0134.491] GetProcessHeap () returned 0x4e0000 [0134.491] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0134.491] GetProcessHeap () returned 0x4e0000 [0134.492] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0134.492] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0134.553] CloseHandle (hObject=0x110) returned 1 [0134.553] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OutlookMUI.xml", cAlternateFileName="OUTLOO~1.XML")) returned 1 [0134.554] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0134.554] GetProcessHeap () returned 0x4e0000 [0134.554] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0134.554] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0134.554] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0134.554] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0xe, lpOverlapped=0x0) returned 1 [0134.558] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0134.558] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0134.558] GetProcessHeap () returned 0x4e0000 [0134.558] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0134.558] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40) returned 1 [0134.558] CryptDestroyKey (hKey=0x522f58) returned 1 [0134.558] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4e8*=0x40, lpOverlapped=0x0) returned 1 [0134.558] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0134.558] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0134.558] WriteFile (in: hFile=0x110, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0134.558] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0134.558] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0134.558] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0134.558] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0134.558] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.558] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xc72, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0xc72, lpOverlapped=0x0) returned 1 [0134.558] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0xc80, dwBufLen=0xc80 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0xc80) returned 1 [0134.559] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.559] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0xc80, lpOverlapped=0x0) returned 1 [0134.559] CryptDestroyKey (hKey=0x522f58) returned 1 [0134.559] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xd54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.559] SetEndOfFile (hFile=0x110) returned 1 [0134.561] GetProcessHeap () returned 0x4e0000 [0134.561] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0134.561] GetProcessHeap () returned 0x4e0000 [0134.561] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0134.561] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0134.563] CloseHandle (hObject=0x110) returned 1 [0134.563] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0134.563] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0134.582] GetProcessHeap () returned 0x4e0000 [0134.582] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0134.582] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0134.582] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0134.582] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0x1, lpOverlapped=0x0) returned 1 [0134.584] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0134.584] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0134.584] GetProcessHeap () returned 0x4e0000 [0134.585] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0134.585] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df4c8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df4c8*=0x30) returned 1 [0134.585] CryptDestroyKey (hKey=0x522f58) returned 1 [0134.585] WriteFile (in: hFile=0x110, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df4e8*=0x30, lpOverlapped=0x0) returned 1 [0134.585] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0134.585] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0134.585] WriteFile (in: hFile=0x110, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0134.585] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0134.585] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0134.585] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0134.585] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0134.585] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.585] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x106f, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0x106f, lpOverlapped=0x0) returned 1 [0134.610] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x1070, dwBufLen=0x1070 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x1070) returned 1 [0134.611] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.611] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0x1070, lpOverlapped=0x0) returned 1 [0134.611] CryptDestroyKey (hKey=0x522f58) returned 1 [0134.611] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x1134, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.611] SetEndOfFile (hFile=0x110) returned 1 [0134.613] GetProcessHeap () returned 0x4e0000 [0134.613] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0134.613] GetProcessHeap () returned 0x4e0000 [0134.613] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0134.613] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0134.614] CloseHandle (hObject=0x110) returned 1 [0134.614] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0134.614] GetProcessHeap () returned 0x4e0000 [0134.614] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0134.614] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df4d8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f58) returned 1 [0134.614] CryptDecrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df540 | out: pbData=0x4f53d8, pdwDataLen=0x24df540) returned 1 [0134.614] CryptDestroyKey (hKey=0x522f58) returned 1 [0134.614] GetProcessHeap () returned 0x4e0000 [0134.614] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0134.614] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df4d8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f58) returned 1 [0134.614] CryptDecrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df540 | out: pbData=0x4f5420, pdwDataLen=0x24df540) returned 1 [0134.614] CryptDestroyKey (hKey=0x522f58) returned 1 [0134.614] GetProcessHeap () returned 0x4e0000 [0134.614] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x521c38 [0134.615] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df4d8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f58) returned 1 [0134.615] CryptDecrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x521c38, pdwDataLen=0x24df540 | out: pbData=0x521c38, pdwDataLen=0x24df540) returned 1 [0134.615] CryptDestroyKey (hKey=0x522f58) returned 1 [0134.615] wsprintfW (in: param_1=0x24de51c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\readme-warning.txt") returned 81 [0134.615] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0134.615] WriteFile (in: hFile=0x110, lpBuffer=0x521c38*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24de518, lpOverlapped=0x0 | out: lpBuffer=0x521c38*, lpNumberOfBytesWritten=0x24de518*=0x6c3, lpOverlapped=0x0) returned 1 [0134.616] CloseHandle (hObject=0x110) returned 1 [0134.616] GetProcessHeap () returned 0x4e0000 [0134.616] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x521c38 | out: hHeap=0x4e0000) returned 1 [0134.616] GetProcessHeap () returned 0x4e0000 [0134.617] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0134.617] GetProcessHeap () returned 0x4e0000 [0134.617] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0134.617] FindClose (in: hFindFile=0x522f18 | out: hFindFile=0x522f18) returned 1 [0134.617] GetProcessHeap () returned 0x4e0000 [0134.617] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5219a0 | out: hHeap=0x4e0000) returned 1 [0134.617] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{90140000-001B-0409-1000-0000000FF1CE}-C", cAlternateFileName="{94E50~1")) returned 1 [0134.617] GetProcessHeap () returned 0x4e0000 [0134.617] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8e) returned 0x4fa058 [0134.617] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f18 [0134.618] GetProcessHeap () returned 0x4e0000 [0134.618] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0134.618] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0134.618] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0134.618] GetProcessHeap () returned 0x4e0000 [0134.619] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x290) returned 0x5219a0 [0134.619] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0134.619] GetProcessHeap () returned 0x4e0000 [0134.619] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0134.619] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0134.619] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0134.619] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0134.621] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0134.621] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0134.621] GetProcessHeap () returned 0x4e0000 [0134.621] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0134.621] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df4c8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df4c8*=0x30) returned 1 [0134.621] CryptDestroyKey (hKey=0x522f58) returned 1 [0134.621] WriteFile (in: hFile=0x110, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df4e8*=0x30, lpOverlapped=0x0) returned 1 [0134.622] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0134.622] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0134.622] WriteFile (in: hFile=0x110, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0134.622] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0134.622] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0134.622] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0134.622] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0134.622] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.622] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x978, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0x978, lpOverlapped=0x0) returned 1 [0134.622] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x980, dwBufLen=0x980 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x980) returned 1 [0134.622] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.622] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0x980, lpOverlapped=0x0) returned 1 [0134.622] CryptDestroyKey (hKey=0x522f58) returned 1 [0134.622] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xa44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.622] SetEndOfFile (hFile=0x110) returned 1 [0134.624] GetProcessHeap () returned 0x4e0000 [0134.624] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0134.625] GetProcessHeap () returned 0x4e0000 [0134.625] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0134.625] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0134.627] CloseHandle (hObject=0x110) returned 1 [0134.627] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2fb48f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2fb48f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc967850, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x29c6dbd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WordLR.cab", cAlternateFileName="")) returned 1 [0134.627] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0134.627] GetFileSizeEx (in: hFile=0x110, lpFileSize=0x24df4f0 | out: lpFileSize=0x24df4f0*=43806141) returned 1 [0134.627] GetProcessHeap () returned 0x4e0000 [0134.627] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0134.627] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0134.627] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.627] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4dc*=0x3, lpOverlapped=0x0) returned 1 [0134.633] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0134.633] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0134.633] GetProcessHeap () returned 0x4e0000 [0134.633] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0134.633] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df4c0*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df4c0*=0x30) returned 1 [0134.633] CryptDestroyKey (hKey=0x522f58) returned 1 [0134.633] WriteFile (in: hFile=0x110, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df4dc*=0x30, lpOverlapped=0x0) returned 1 [0134.633] WriteFile (in: hFile=0x110, lpBuffer=0x24df4e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4e4*, lpNumberOfBytesWritten=0x24df4dc*=0x4, lpOverlapped=0x0) returned 1 [0134.633] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4dc*=0x10, lpOverlapped=0x0) returned 1 [0134.633] WriteFile (in: hFile=0x110, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df4dc*=0x80, lpOverlapped=0x0) returned 1 [0134.634] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df508 | out: lpNewFilePointer=0x0) returned 1 [0134.634] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4f8*, lpNumberOfBytesWritten=0x24df4dc*=0x8, lpOverlapped=0x0) returned 1 [0134.634] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0134.634] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0134.634] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0134.634] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0134.640] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0134.644] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.644] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0134.645] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x29c6e84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.645] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0134.645] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xdecf3f, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0134.645] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0134.652] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0134.655] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xdecf3f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.655] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0134.657] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x29c6e84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.657] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0134.657] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x2986dc0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0134.657] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0134.662] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0134.665] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x2986dc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.665] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0134.666] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x29c6e84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.666] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0134.666] CryptDestroyKey (hKey=0x522f58) returned 1 [0134.666] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x29c6e84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.666] SetEndOfFile (hFile=0x110) returned 1 [0134.669] GetProcessHeap () returned 0x4e0000 [0134.669] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0134.669] GetProcessHeap () returned 0x4e0000 [0134.669] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0134.669] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0134.670] CloseHandle (hObject=0x110) returned 1 [0134.670] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x267e00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WordMUI.msi", cAlternateFileName="")) returned 1 [0134.670] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0134.670] GetFileSizeEx (in: hFile=0x110, lpFileSize=0x24df4f0 | out: lpFileSize=0x24df4f0*=2522624) returned 1 [0134.671] GetProcessHeap () returned 0x4e0000 [0134.671] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0134.671] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0134.671] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.671] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0134.671] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0134.671] GetProcessHeap () returned 0x4e0000 [0134.671] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0134.671] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c0*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c0*=0x40) returned 1 [0134.671] CryptDestroyKey (hKey=0x522f58) returned 1 [0134.671] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4dc*=0x40, lpOverlapped=0x0) returned 1 [0134.674] WriteFile (in: hFile=0x110, lpBuffer=0x24df4e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4e4*, lpNumberOfBytesWritten=0x24df4dc*=0x4, lpOverlapped=0x0) returned 1 [0134.674] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4dc*=0x10, lpOverlapped=0x0) returned 1 [0134.674] WriteFile (in: hFile=0x110, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df4dc*=0x80, lpOverlapped=0x0) returned 1 [0134.675] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df508 | out: lpNewFilePointer=0x0) returned 1 [0134.675] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4f8*, lpNumberOfBytesWritten=0x24df4dc*=0x8, lpOverlapped=0x0) returned 1 [0134.675] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0134.675] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0134.675] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0134.675] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0134.680] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0134.686] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.686] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0134.687] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x267ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.687] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0134.687] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0134.687] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0134.704] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0134.707] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.707] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0134.709] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x267ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.709] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0134.709] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0134.710] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0134.717] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0134.720] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.720] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0134.721] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x267ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.722] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0134.722] CryptDestroyKey (hKey=0x522f58) returned 1 [0134.722] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x267ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.722] SetEndOfFile (hFile=0x110) returned 1 [0134.726] GetProcessHeap () returned 0x4e0000 [0134.726] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0134.726] GetProcessHeap () returned 0x4e0000 [0134.726] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0134.726] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0134.798] CloseHandle (hObject=0x110) returned 1 [0134.799] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WordMUI.xml", cAlternateFileName="")) returned 1 [0134.799] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0134.799] GetProcessHeap () returned 0x4e0000 [0134.799] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0134.799] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0134.799] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0134.799] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0134.802] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0134.802] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0134.802] GetProcessHeap () returned 0x4e0000 [0134.802] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0134.802] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40) returned 1 [0134.803] CryptDestroyKey (hKey=0x522f58) returned 1 [0134.803] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4e8*=0x40, lpOverlapped=0x0) returned 1 [0134.803] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0134.803] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0134.803] WriteFile (in: hFile=0x110, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0134.803] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0134.803] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0134.803] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0134.803] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0134.803] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.803] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x708, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0x708, lpOverlapped=0x0) returned 1 [0134.803] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x710, dwBufLen=0x710 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x710) returned 1 [0134.803] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.804] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0x710, lpOverlapped=0x0) returned 1 [0134.805] CryptDestroyKey (hKey=0x522f58) returned 1 [0134.805] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x7e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.805] SetEndOfFile (hFile=0x110) returned 1 [0134.807] GetProcessHeap () returned 0x4e0000 [0134.808] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0134.808] GetProcessHeap () returned 0x4e0000 [0134.808] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0134.808] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0134.810] CloseHandle (hObject=0x110) returned 1 [0134.810] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WordMUI.xml", cAlternateFileName="")) returned 0 [0134.810] GetProcessHeap () returned 0x4e0000 [0134.810] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0134.810] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df4d8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f58) returned 1 [0134.810] CryptDecrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df540 | out: pbData=0x4f53d8, pdwDataLen=0x24df540) returned 1 [0134.810] CryptDestroyKey (hKey=0x522f58) returned 1 [0134.810] GetProcessHeap () returned 0x4e0000 [0134.810] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0134.811] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df4d8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f58) returned 1 [0134.811] CryptDecrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df540 | out: pbData=0x4f5420, pdwDataLen=0x24df540) returned 1 [0134.811] CryptDestroyKey (hKey=0x522f58) returned 1 [0134.811] GetProcessHeap () returned 0x4e0000 [0134.811] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x521c38 [0134.811] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df4d8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f58) returned 1 [0134.811] CryptDecrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x521c38, pdwDataLen=0x24df540 | out: pbData=0x521c38, pdwDataLen=0x24df540) returned 1 [0134.811] CryptDestroyKey (hKey=0x522f58) returned 1 [0134.811] wsprintfW (in: param_1=0x24de51c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\readme-warning.txt") returned 81 [0134.811] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0134.811] WriteFile (in: hFile=0x110, lpBuffer=0x521c38*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24de518, lpOverlapped=0x0 | out: lpBuffer=0x521c38*, lpNumberOfBytesWritten=0x24de518*=0x6c3, lpOverlapped=0x0) returned 1 [0134.813] CloseHandle (hObject=0x110) returned 1 [0134.813] GetProcessHeap () returned 0x4e0000 [0134.813] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x521c38 | out: hHeap=0x4e0000) returned 1 [0134.813] GetProcessHeap () returned 0x4e0000 [0134.813] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0134.813] GetProcessHeap () returned 0x4e0000 [0134.813] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0134.813] FindClose (in: hFindFile=0x522f18 | out: hFindFile=0x522f18) returned 1 [0134.813] GetProcessHeap () returned 0x4e0000 [0134.813] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5219a0 | out: hHeap=0x4e0000) returned 1 [0134.813] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{90140000-002C-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92787~1")) returned 1 [0134.813] GetProcessHeap () returned 0x4e0000 [0134.813] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8e) returned 0x4fa058 [0134.813] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f18 [0134.817] GetProcessHeap () returned 0x4e0000 [0134.817] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0134.817] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0134.817] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0134.817] GetProcessHeap () returned 0x4e0000 [0134.817] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x290) returned 0x5219a0 [0134.817] GetProcessHeap () returned 0x4e0000 [0134.817] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa0) returned 0x525e90 [0134.817] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\*.*", lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f58 [0134.818] GetProcessHeap () returned 0x4e0000 [0134.818] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x525e90 | out: hHeap=0x4e0000) returned 1 [0134.818] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0134.818] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x219b4a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x219b4a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf07b1ad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xaf35ed, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0134.818] GetProcessHeap () returned 0x4e0000 [0134.818] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2a2) returned 0x525e90 [0134.818] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0134.823] GetFileSizeEx (in: hFile=0xdc, lpFileSize=0x24df260 | out: lpFileSize=0x24df260*=11482605) returned 1 [0134.823] GetProcessHeap () returned 0x4e0000 [0134.823] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0134.823] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0134.823] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.823] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x24df24c, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df24c*=0x3, lpOverlapped=0x0) returned 1 [0134.828] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df250 | out: phKey=0x24df250*=0x522f98) returned 1 [0134.828] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0134.828] GetProcessHeap () returned 0x4e0000 [0134.828] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0134.828] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df230*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df230*=0x30) returned 1 [0134.828] CryptDestroyKey (hKey=0x522f98) returned 1 [0134.828] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df24c, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df24c*=0x30, lpOverlapped=0x0) returned 1 [0134.829] WriteFile (in: hFile=0xdc, lpBuffer=0x24df254*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df24c, lpOverlapped=0x0 | out: lpBuffer=0x24df254*, lpNumberOfBytesWritten=0x24df24c*=0x4, lpOverlapped=0x0) returned 1 [0134.829] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df24c, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df24c*=0x10, lpOverlapped=0x0) returned 1 [0134.829] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df24c, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df24c*=0x80, lpOverlapped=0x0) returned 1 [0134.829] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df278 | out: lpNewFilePointer=0x0) returned 1 [0134.829] WriteFile (in: hFile=0xdc, lpBuffer=0x24df268*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df24c, lpOverlapped=0x0 | out: lpBuffer=0x24df268*, lpNumberOfBytesWritten=0x24df24c*=0x8, lpOverlapped=0x0) returned 1 [0134.829] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df250 | out: phKey=0x24df250*=0x522f98) returned 1 [0134.829] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0134.829] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df220 | out: lpNewFilePointer=0x0) returned 1 [0134.829] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df214*=0x40000, lpOverlapped=0x0) returned 1 [0134.834] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df21c*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df21c*=0x40000) returned 1 [0134.839] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.839] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df218, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df218*=0x40000, lpOverlapped=0x0) returned 1 [0134.841] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xaf36b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.841] WriteFile (in: hFile=0xdc, lpBuffer=0x24df220*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df218, lpOverlapped=0x0 | out: lpBuffer=0x24df220*, lpNumberOfBytesWritten=0x24df218*=0x8, lpOverlapped=0x0) returned 1 [0134.841] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3a674f, lpNewFilePointer=0x0, dwMoveMethod=0x24df220 | out: lpNewFilePointer=0x0) returned 1 [0134.841] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df214*=0x40000, lpOverlapped=0x0) returned 1 [0134.901] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df21c*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df21c*=0x40000) returned 1 [0134.904] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3a674f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.904] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df218, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df218*=0x40000, lpOverlapped=0x0) returned 1 [0134.905] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xaf36b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.905] WriteFile (in: hFile=0xdc, lpBuffer=0x24df220*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df218, lpOverlapped=0x0 | out: lpBuffer=0x24df220*, lpNumberOfBytesWritten=0x24df218*=0x8, lpOverlapped=0x0) returned 1 [0134.905] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xab35f0, lpNewFilePointer=0x0, dwMoveMethod=0x24df220 | out: lpNewFilePointer=0x0) returned 1 [0134.905] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df214*=0x40000, lpOverlapped=0x0) returned 1 [0134.920] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df21c*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df21c*=0x40000) returned 1 [0134.923] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xab35f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.924] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df218, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df218*=0x40000, lpOverlapped=0x0) returned 1 [0134.925] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xaf36b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.925] WriteFile (in: hFile=0xdc, lpBuffer=0x24df220*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df218, lpOverlapped=0x0 | out: lpBuffer=0x24df220*, lpNumberOfBytesWritten=0x24df218*=0x8, lpOverlapped=0x0) returned 1 [0134.925] CryptDestroyKey (hKey=0x522f98) returned 1 [0134.925] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xaf36b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.925] SetEndOfFile (hFile=0xdc) returned 1 [0134.929] GetProcessHeap () returned 0x4e0000 [0134.929] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0134.929] GetProcessHeap () returned 0x4e0000 [0134.930] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0134.930] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0135.349] CloseHandle (hObject=0xdc) returned 1 [0135.349] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4db6cb00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x4db6cb00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf020c5d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5c00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0135.350] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0135.350] GetProcessHeap () returned 0x4e0000 [0135.350] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0135.350] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0135.350] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0135.350] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0135.350] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0135.350] GetProcessHeap () returned 0x4e0000 [0135.350] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0135.350] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0135.350] CryptDestroyKey (hKey=0x522f98) returned 1 [0135.350] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0135.392] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0135.392] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0135.392] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0135.392] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0135.395] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0135.396] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0135.396] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0135.396] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.396] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xd5c00, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xd5c00, lpOverlapped=0x0) returned 1 [0135.414] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xd5c00, dwBufLen=0xd5c00 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xd5c00) returned 1 [0135.424] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.424] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xd5c00, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xd5c00, lpOverlapped=0x0) returned 1 [0135.427] CryptDestroyKey (hKey=0x522f98) returned 1 [0135.427] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xd5cc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.427] SetEndOfFile (hFile=0xdc) returned 1 [0135.431] GetProcessHeap () returned 0x4e0000 [0135.431] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0135.431] GetProcessHeap () returned 0x4e0000 [0135.431] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0135.431] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0135.447] CloseHandle (hObject=0xdc) returned 1 [0135.447] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0135.448] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0135.448] GetProcessHeap () returned 0x4e0000 [0135.448] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0135.448] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0135.448] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0135.448] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xd, lpOverlapped=0x0) returned 1 [0135.451] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0135.452] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0135.452] GetProcessHeap () returned 0x4e0000 [0135.452] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0135.452] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0135.452] CryptDestroyKey (hKey=0x522f98) returned 1 [0135.452] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0135.452] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0135.452] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0135.452] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0135.452] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0135.452] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0135.453] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0135.453] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0135.453] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.453] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x543, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x543, lpOverlapped=0x0) returned 1 [0135.453] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x550, dwBufLen=0x550 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x550) returned 1 [0135.453] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.453] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x550, lpOverlapped=0x0) returned 1 [0135.453] CryptDestroyKey (hKey=0x522f98) returned 1 [0135.453] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.453] SetEndOfFile (hFile=0xdc) returned 1 [0135.456] GetProcessHeap () returned 0x4e0000 [0135.456] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0135.456] GetProcessHeap () returned 0x4e0000 [0135.457] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0135.457] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0135.459] CloseHandle (hObject=0xdc) returned 1 [0135.460] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0135.460] GetProcessHeap () returned 0x4e0000 [0135.460] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0135.460] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df248, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f98) returned 1 [0135.460] CryptDecrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df2b0 | out: pbData=0x4f53d8, pdwDataLen=0x24df2b0) returned 1 [0135.460] CryptDestroyKey (hKey=0x522f98) returned 1 [0135.460] GetProcessHeap () returned 0x4e0000 [0135.460] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0135.460] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df248, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f98) returned 1 [0135.460] CryptDecrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df2b0 | out: pbData=0x4f5420, pdwDataLen=0x24df2b0) returned 1 [0135.460] CryptDestroyKey (hKey=0x522f98) returned 1 [0135.460] GetProcessHeap () returned 0x4e0000 [0135.460] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x526140 [0135.460] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df248, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f98) returned 1 [0135.460] CryptDecrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x526140, pdwDataLen=0x24df2b0 | out: pbData=0x526140, pdwDataLen=0x24df2b0) returned 1 [0135.461] CryptDestroyKey (hKey=0x522f98) returned 1 [0135.461] wsprintfW (in: param_1=0x24de28c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\readme-warning.txt") returned 90 [0135.461] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0135.461] WriteFile (in: hFile=0xdc, lpBuffer=0x526140*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24de288, lpOverlapped=0x0 | out: lpBuffer=0x526140*, lpNumberOfBytesWritten=0x24de288*=0x6c3, lpOverlapped=0x0) returned 1 [0135.462] CloseHandle (hObject=0xdc) returned 1 [0135.463] GetProcessHeap () returned 0x4e0000 [0135.463] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x526140 | out: hHeap=0x4e0000) returned 1 [0135.463] GetProcessHeap () returned 0x4e0000 [0135.463] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0135.463] GetProcessHeap () returned 0x4e0000 [0135.463] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0135.463] FindClose (in: hFindFile=0x522f58 | out: hFindFile=0x522f58) returned 1 [0135.463] GetProcessHeap () returned 0x4e0000 [0135.463] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x525e90 | out: hHeap=0x4e0000) returned 1 [0135.463] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0135.463] GetProcessHeap () returned 0x4e0000 [0135.463] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa0) returned 0x4fa058 [0135.463] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\*.*", lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f58 [0135.464] GetProcessHeap () returned 0x4e0000 [0135.464] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0135.464] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0135.464] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd02aea, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0135.464] GetProcessHeap () returned 0x4e0000 [0135.464] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2a2) returned 0x521c38 [0135.464] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0135.473] GetFileSizeEx (in: hFile=0xdc, lpFileSize=0x24df260 | out: lpFileSize=0x24df260*=13642474) returned 1 [0135.474] GetProcessHeap () returned 0x4e0000 [0135.474] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0135.474] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0135.474] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.474] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df24c, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df24c*=0x6, lpOverlapped=0x0) returned 1 [0135.476] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df250 | out: phKey=0x24df250*=0x522f98) returned 1 [0135.476] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0135.477] GetProcessHeap () returned 0x4e0000 [0135.477] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0135.477] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df230*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df230*=0x30) returned 1 [0135.477] CryptDestroyKey (hKey=0x522f98) returned 1 [0135.477] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df24c, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df24c*=0x30, lpOverlapped=0x0) returned 1 [0135.477] WriteFile (in: hFile=0xdc, lpBuffer=0x24df254*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df24c, lpOverlapped=0x0 | out: lpBuffer=0x24df254*, lpNumberOfBytesWritten=0x24df24c*=0x4, lpOverlapped=0x0) returned 1 [0135.477] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df24c, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df24c*=0x10, lpOverlapped=0x0) returned 1 [0135.477] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df24c, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df24c*=0x80, lpOverlapped=0x0) returned 1 [0135.477] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df278 | out: lpNewFilePointer=0x0) returned 1 [0135.477] WriteFile (in: hFile=0xdc, lpBuffer=0x24df268*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df24c, lpOverlapped=0x0 | out: lpBuffer=0x24df268*, lpNumberOfBytesWritten=0x24df24c*=0x8, lpOverlapped=0x0) returned 1 [0135.477] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df250 | out: phKey=0x24df250*=0x522f98) returned 1 [0135.477] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0135.477] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df220 | out: lpNewFilePointer=0x0) returned 1 [0135.477] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df214*=0x40000, lpOverlapped=0x0) returned 1 [0135.486] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df21c*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df21c*=0x40000) returned 1 [0135.489] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.490] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df218, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df218*=0x40000, lpOverlapped=0x0) returned 1 [0135.491] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xd02bb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.491] WriteFile (in: hFile=0xdc, lpBuffer=0x24df220*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df218, lpOverlapped=0x0 | out: lpBuffer=0x24df220*, lpNumberOfBytesWritten=0x24df218*=0x8, lpOverlapped=0x0) returned 1 [0135.491] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4563a3, lpNewFilePointer=0x0, dwMoveMethod=0x24df220 | out: lpNewFilePointer=0x0) returned 1 [0135.491] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df214*=0x40000, lpOverlapped=0x0) returned 1 [0135.496] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df21c*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df21c*=0x40000) returned 1 [0135.499] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4563a3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.499] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df218, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df218*=0x40000, lpOverlapped=0x0) returned 1 [0135.500] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xd02bb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.500] WriteFile (in: hFile=0xdc, lpBuffer=0x24df220*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df218, lpOverlapped=0x0 | out: lpBuffer=0x24df220*, lpNumberOfBytesWritten=0x24df218*=0x8, lpOverlapped=0x0) returned 1 [0135.500] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xcc2af0, lpNewFilePointer=0x0, dwMoveMethod=0x24df220 | out: lpNewFilePointer=0x0) returned 1 [0135.500] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df214*=0x40000, lpOverlapped=0x0) returned 1 [0135.511] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df21c*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df21c*=0x40000) returned 1 [0135.513] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xcc2af0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.514] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df218, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df218*=0x40000, lpOverlapped=0x0) returned 1 [0135.515] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xd02bb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.515] WriteFile (in: hFile=0xdc, lpBuffer=0x24df220*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df218, lpOverlapped=0x0 | out: lpBuffer=0x24df220*, lpNumberOfBytesWritten=0x24df218*=0x8, lpOverlapped=0x0) returned 1 [0135.515] CryptDestroyKey (hKey=0x522f98) returned 1 [0135.515] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xd02bb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.515] SetEndOfFile (hFile=0xdc) returned 1 [0135.519] GetProcessHeap () returned 0x4e0000 [0135.519] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0135.519] GetProcessHeap () returned 0x4e0000 [0135.519] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0135.519] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0135.799] CloseHandle (hObject=0xdc) returned 1 [0135.799] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e5c7f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd7200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0135.799] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0135.800] GetProcessHeap () returned 0x4e0000 [0135.800] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0135.800] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0135.800] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0135.800] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0135.800] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0135.800] GetProcessHeap () returned 0x4e0000 [0135.800] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0135.800] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0135.800] CryptDestroyKey (hKey=0x522f98) returned 1 [0135.800] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0135.810] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0135.810] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0135.810] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0135.810] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0135.810] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0135.810] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0135.810] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0135.810] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.810] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xd7200, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xd7200, lpOverlapped=0x0) returned 1 [0135.821] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xd7200, dwBufLen=0xd7200 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xd7200) returned 1 [0135.832] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.832] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xd7200, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xd7200, lpOverlapped=0x0) returned 1 [0135.835] CryptDestroyKey (hKey=0x522f98) returned 1 [0135.835] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xd72c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.835] SetEndOfFile (hFile=0xdc) returned 1 [0135.839] GetProcessHeap () returned 0x4e0000 [0135.839] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0135.839] GetProcessHeap () returned 0x4e0000 [0135.839] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0135.839] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0135.852] CloseHandle (hObject=0xdc) returned 1 [0135.852] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0135.852] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0135.853] GetProcessHeap () returned 0x4e0000 [0135.853] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0135.853] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0135.853] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0135.853] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xf, lpOverlapped=0x0) returned 1 [0135.856] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0135.856] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0135.856] GetProcessHeap () returned 0x4e0000 [0135.856] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0135.856] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0135.856] CryptDestroyKey (hKey=0x522f98) returned 1 [0135.856] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0135.857] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0135.857] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0135.857] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0135.857] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0135.857] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0135.857] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0135.857] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0135.857] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.857] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5b1, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x5b1, lpOverlapped=0x0) returned 1 [0135.857] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5c0, dwBufLen=0x5c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5c0) returned 1 [0135.857] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.857] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5c0, lpOverlapped=0x0) returned 1 [0135.857] CryptDestroyKey (hKey=0x522f98) returned 1 [0135.857] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.857] SetEndOfFile (hFile=0xdc) returned 1 [0135.859] GetProcessHeap () returned 0x4e0000 [0135.859] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0135.859] GetProcessHeap () returned 0x4e0000 [0135.859] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0135.860] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0135.862] CloseHandle (hObject=0xdc) returned 1 [0135.863] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0135.863] GetProcessHeap () returned 0x4e0000 [0135.863] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0135.863] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df248, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f98) returned 1 [0135.863] CryptDecrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df2b0 | out: pbData=0x4f53d8, pdwDataLen=0x24df2b0) returned 1 [0135.863] CryptDestroyKey (hKey=0x522f98) returned 1 [0135.863] GetProcessHeap () returned 0x4e0000 [0135.863] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0135.863] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df248, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f98) returned 1 [0135.863] CryptDecrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df2b0 | out: pbData=0x4f5420, pdwDataLen=0x24df2b0) returned 1 [0135.863] CryptDestroyKey (hKey=0x522f98) returned 1 [0135.863] GetProcessHeap () returned 0x4e0000 [0135.863] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x521ee8 [0135.863] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df248, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f98) returned 1 [0135.863] CryptDecrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x521ee8, pdwDataLen=0x24df2b0 | out: pbData=0x521ee8, pdwDataLen=0x24df2b0) returned 1 [0135.863] CryptDestroyKey (hKey=0x522f98) returned 1 [0135.863] wsprintfW (in: param_1=0x24de28c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\readme-warning.txt") returned 90 [0135.863] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0135.864] WriteFile (in: hFile=0xdc, lpBuffer=0x521ee8*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24de288, lpOverlapped=0x0 | out: lpBuffer=0x521ee8*, lpNumberOfBytesWritten=0x24de288*=0x6c3, lpOverlapped=0x0) returned 1 [0135.865] CloseHandle (hObject=0xdc) returned 1 [0135.865] GetProcessHeap () returned 0x4e0000 [0135.865] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x521ee8 | out: hHeap=0x4e0000) returned 1 [0135.865] GetProcessHeap () returned 0x4e0000 [0135.865] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0135.865] GetProcessHeap () returned 0x4e0000 [0135.865] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0135.865] FindClose (in: hFindFile=0x522f58 | out: hFindFile=0x522f58) returned 1 [0135.865] GetProcessHeap () returned 0x4e0000 [0135.865] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x521c38 | out: hHeap=0x4e0000) returned 1 [0135.865] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0135.865] GetProcessHeap () returned 0x4e0000 [0135.865] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa0) returned 0x4fa058 [0135.865] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\*.*", lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f58 [0135.865] GetProcessHeap () returned 0x4e0000 [0135.865] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0135.865] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0135.865] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x35aa7000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x35aa7000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf3076b00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1416b54, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0135.866] GetProcessHeap () returned 0x4e0000 [0135.866] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2a2) returned 0x521c38 [0135.866] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0135.866] GetFileSizeEx (in: hFile=0xdc, lpFileSize=0x24df260 | out: lpFileSize=0x24df260*=21064532) returned 1 [0135.866] GetProcessHeap () returned 0x4e0000 [0135.866] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0135.866] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0135.866] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.866] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df24c, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df24c*=0xc, lpOverlapped=0x0) returned 1 [0135.873] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df250 | out: phKey=0x24df250*=0x522f98) returned 1 [0135.873] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0135.873] GetProcessHeap () returned 0x4e0000 [0135.873] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0135.873] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df230*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df230*=0x30) returned 1 [0135.873] CryptDestroyKey (hKey=0x522f98) returned 1 [0135.873] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df24c, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df24c*=0x30, lpOverlapped=0x0) returned 1 [0135.874] WriteFile (in: hFile=0xdc, lpBuffer=0x24df254*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df24c, lpOverlapped=0x0 | out: lpBuffer=0x24df254*, lpNumberOfBytesWritten=0x24df24c*=0x4, lpOverlapped=0x0) returned 1 [0135.874] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df24c, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df24c*=0x10, lpOverlapped=0x0) returned 1 [0135.874] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df24c, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df24c*=0x80, lpOverlapped=0x0) returned 1 [0135.874] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df278 | out: lpNewFilePointer=0x0) returned 1 [0135.874] WriteFile (in: hFile=0xdc, lpBuffer=0x24df268*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df24c, lpOverlapped=0x0 | out: lpBuffer=0x24df268*, lpNumberOfBytesWritten=0x24df24c*=0x8, lpOverlapped=0x0) returned 1 [0135.874] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df250 | out: phKey=0x24df250*=0x522f98) returned 1 [0135.874] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0135.874] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df220 | out: lpNewFilePointer=0x0) returned 1 [0135.874] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df214*=0x40000, lpOverlapped=0x0) returned 1 [0135.878] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df21c*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df21c*=0x40000) returned 1 [0135.882] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.882] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df218, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df218*=0x40000, lpOverlapped=0x0) returned 1 [0135.883] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1416c24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.883] WriteFile (in: hFile=0xdc, lpBuffer=0x24df220*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df218, lpOverlapped=0x0 | out: lpBuffer=0x24df220*, lpNumberOfBytesWritten=0x24df218*=0x8, lpOverlapped=0x0) returned 1 [0135.883] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6b23c6, lpNewFilePointer=0x0, dwMoveMethod=0x24df220 | out: lpNewFilePointer=0x0) returned 1 [0135.883] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df214*=0x40000, lpOverlapped=0x0) returned 1 [0135.891] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df21c*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df21c*=0x40000) returned 1 [0135.893] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6b23c6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.893] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df218, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df218*=0x40000, lpOverlapped=0x0) returned 1 [0135.894] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1416c24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.894] WriteFile (in: hFile=0xdc, lpBuffer=0x24df220*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df218, lpOverlapped=0x0 | out: lpBuffer=0x24df220*, lpNumberOfBytesWritten=0x24df218*=0x8, lpOverlapped=0x0) returned 1 [0135.894] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x13d6b60, lpNewFilePointer=0x0, dwMoveMethod=0x24df220 | out: lpNewFilePointer=0x0) returned 1 [0135.894] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df214*=0x40000, lpOverlapped=0x0) returned 1 [0135.898] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df21c*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df21c*=0x40000) returned 1 [0135.900] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x13d6b60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.901] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df218, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df218*=0x40000, lpOverlapped=0x0) returned 1 [0135.901] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1416c24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.901] WriteFile (in: hFile=0xdc, lpBuffer=0x24df220*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df218, lpOverlapped=0x0 | out: lpBuffer=0x24df220*, lpNumberOfBytesWritten=0x24df218*=0x8, lpOverlapped=0x0) returned 1 [0135.901] CryptDestroyKey (hKey=0x522f98) returned 1 [0135.901] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1416c24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.902] SetEndOfFile (hFile=0xdc) returned 1 [0135.904] GetProcessHeap () returned 0x4e0000 [0135.904] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0135.904] GetProcessHeap () returned 0x4e0000 [0135.904] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0135.904] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0136.196] CloseHandle (hObject=0xdc) returned 1 [0136.196] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2e3b660, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd8400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0136.196] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0136.197] GetProcessHeap () returned 0x4e0000 [0136.197] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0136.197] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0136.197] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0136.197] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0136.198] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0136.198] GetProcessHeap () returned 0x4e0000 [0136.198] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0136.198] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0136.198] CryptDestroyKey (hKey=0x522f98) returned 1 [0136.198] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0136.199] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0136.199] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0136.199] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0136.200] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0136.200] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0136.200] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0136.200] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0136.200] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.200] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xd8400, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xd8400, lpOverlapped=0x0) returned 1 [0136.208] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xd8400, dwBufLen=0xd8400 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xd8400) returned 1 [0136.215] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.215] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xd8400, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xd8400, lpOverlapped=0x0) returned 1 [0136.218] CryptDestroyKey (hKey=0x522f98) returned 1 [0136.218] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xd84c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.218] SetEndOfFile (hFile=0xdc) returned 1 [0136.221] GetProcessHeap () returned 0x4e0000 [0136.221] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0136.221] GetProcessHeap () returned 0x4e0000 [0136.221] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0136.221] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0136.229] CloseHandle (hObject=0xdc) returned 1 [0136.229] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0136.229] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0136.230] GetProcessHeap () returned 0x4e0000 [0136.230] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0136.230] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0136.230] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0136.230] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0136.280] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0136.280] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0136.280] GetProcessHeap () returned 0x4e0000 [0136.280] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0136.280] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0136.280] CryptDestroyKey (hKey=0x522f98) returned 1 [0136.280] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0136.281] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0136.281] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0136.281] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0136.281] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0136.281] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0136.281] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0136.281] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0136.281] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.281] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5b2, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x5b2, lpOverlapped=0x0) returned 1 [0136.281] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5c0, dwBufLen=0x5c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5c0) returned 1 [0136.296] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.296] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5c0, lpOverlapped=0x0) returned 1 [0136.296] CryptDestroyKey (hKey=0x522f98) returned 1 [0136.296] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.296] SetEndOfFile (hFile=0xdc) returned 1 [0136.299] GetProcessHeap () returned 0x4e0000 [0136.299] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0136.299] GetProcessHeap () returned 0x4e0000 [0136.299] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0136.299] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0136.302] CloseHandle (hObject=0xdc) returned 1 [0136.302] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0136.302] GetProcessHeap () returned 0x4e0000 [0136.302] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0136.302] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df248, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f98) returned 1 [0136.302] CryptDecrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df2b0 | out: pbData=0x4f53d8, pdwDataLen=0x24df2b0) returned 1 [0136.302] CryptDestroyKey (hKey=0x522f98) returned 1 [0136.302] GetProcessHeap () returned 0x4e0000 [0136.302] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0136.302] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df248, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f98) returned 1 [0136.302] CryptDecrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df2b0 | out: pbData=0x4f5420, pdwDataLen=0x24df2b0) returned 1 [0136.302] CryptDestroyKey (hKey=0x522f98) returned 1 [0136.302] GetProcessHeap () returned 0x4e0000 [0136.302] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x521ee8 [0136.302] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df248, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f98) returned 1 [0136.302] CryptDecrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x521ee8, pdwDataLen=0x24df2b0 | out: pbData=0x521ee8, pdwDataLen=0x24df2b0) returned 1 [0136.303] CryptDestroyKey (hKey=0x522f98) returned 1 [0136.303] wsprintfW (in: param_1=0x24de28c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\readme-warning.txt") returned 90 [0136.303] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0136.306] WriteFile (in: hFile=0xdc, lpBuffer=0x521ee8*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24de288, lpOverlapped=0x0 | out: lpBuffer=0x521ee8*, lpNumberOfBytesWritten=0x24de288*=0x6c3, lpOverlapped=0x0) returned 1 [0136.307] CloseHandle (hObject=0xdc) returned 1 [0136.308] GetProcessHeap () returned 0x4e0000 [0136.308] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x521ee8 | out: hHeap=0x4e0000) returned 1 [0136.308] GetProcessHeap () returned 0x4e0000 [0136.308] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0136.308] GetProcessHeap () returned 0x4e0000 [0136.308] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0136.308] FindClose (in: hFindFile=0x522f58 | out: hFindFile=0x522f58) returned 1 [0136.308] GetProcessHeap () returned 0x4e0000 [0136.308] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x521c38 | out: hHeap=0x4e0000) returned 1 [0136.308] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x40650500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x40650500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf0126df0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Proofing.msi", cAlternateFileName="")) returned 1 [0136.308] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0136.308] GetProcessHeap () returned 0x4e0000 [0136.308] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0136.308] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0136.308] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0136.309] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0136.309] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0136.309] GetProcessHeap () returned 0x4e0000 [0136.309] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0136.309] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40) returned 1 [0136.309] CryptDestroyKey (hKey=0x522f58) returned 1 [0136.309] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4e8*=0x40, lpOverlapped=0x0) returned 1 [0136.367] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0136.368] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0136.368] WriteFile (in: hFile=0x110, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0136.368] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0136.368] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0136.368] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0136.368] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0136.368] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.368] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xd4200, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0xd4200, lpOverlapped=0x0) returned 1 [0136.385] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0xd4200, dwBufLen=0xd4200 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0xd4200) returned 1 [0136.395] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.395] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xd4200, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0xd4200, lpOverlapped=0x0) returned 1 [0136.398] CryptDestroyKey (hKey=0x522f58) returned 1 [0136.398] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xd42d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.398] SetEndOfFile (hFile=0x110) returned 1 [0136.401] GetProcessHeap () returned 0x4e0000 [0136.401] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0136.401] GetProcessHeap () returned 0x4e0000 [0136.401] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0136.401] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0136.422] CloseHandle (hObject=0x110) returned 1 [0136.422] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Proofing.xml", cAlternateFileName="")) returned 1 [0136.422] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0136.423] GetProcessHeap () returned 0x4e0000 [0136.423] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0136.423] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0136.423] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0136.423] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0x5, lpOverlapped=0x0) returned 1 [0136.432] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0136.432] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0136.432] GetProcessHeap () returned 0x4e0000 [0136.433] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0136.433] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40) returned 1 [0136.433] CryptDestroyKey (hKey=0x522f58) returned 1 [0136.433] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4e8*=0x40, lpOverlapped=0x0) returned 1 [0136.433] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0136.433] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0136.433] WriteFile (in: hFile=0x110, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0136.433] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0136.433] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0136.433] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0136.433] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0136.433] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.433] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x32b, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0x32b, lpOverlapped=0x0) returned 1 [0136.434] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x330, dwBufLen=0x330 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x330) returned 1 [0136.434] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.434] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0x330, lpOverlapped=0x0) returned 1 [0136.434] CryptDestroyKey (hKey=0x522f58) returned 1 [0136.434] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x404, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.434] SetEndOfFile (hFile=0x110) returned 1 [0136.437] GetProcessHeap () returned 0x4e0000 [0136.437] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0136.437] GetProcessHeap () returned 0x4e0000 [0136.437] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0136.437] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0136.439] CloseHandle (hObject=0x110) returned 1 [0136.440] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0136.440] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0136.440] GetProcessHeap () returned 0x4e0000 [0136.440] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0136.440] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0136.440] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0136.440] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0136.443] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0136.443] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0136.443] GetProcessHeap () returned 0x4e0000 [0136.443] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0136.443] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df4c8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df4c8*=0x30) returned 1 [0136.443] CryptDestroyKey (hKey=0x522f58) returned 1 [0136.443] WriteFile (in: hFile=0x110, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df4e8*=0x30, lpOverlapped=0x0) returned 1 [0136.443] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0136.443] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0136.443] WriteFile (in: hFile=0x110, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0136.443] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0136.443] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0136.443] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0136.444] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0136.444] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.444] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x16fc, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0x16fc, lpOverlapped=0x0) returned 1 [0136.445] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x1700, dwBufLen=0x1700 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x1700) returned 1 [0136.445] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.445] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0x1700, lpOverlapped=0x0) returned 1 [0136.445] CryptDestroyKey (hKey=0x522f58) returned 1 [0136.445] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x17c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.445] SetEndOfFile (hFile=0x110) returned 1 [0136.448] GetProcessHeap () returned 0x4e0000 [0136.448] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0136.448] GetProcessHeap () returned 0x4e0000 [0136.448] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0136.448] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0136.449] CloseHandle (hObject=0x110) returned 1 [0136.449] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0136.449] GetProcessHeap () returned 0x4e0000 [0136.449] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0136.449] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df4d8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f58) returned 1 [0136.449] CryptDecrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df540 | out: pbData=0x4f53d8, pdwDataLen=0x24df540) returned 1 [0136.449] CryptDestroyKey (hKey=0x522f58) returned 1 [0136.449] GetProcessHeap () returned 0x4e0000 [0136.449] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0136.449] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df4d8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f58) returned 1 [0136.450] CryptDecrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df540 | out: pbData=0x4f5420, pdwDataLen=0x24df540) returned 1 [0136.450] CryptDestroyKey (hKey=0x522f58) returned 1 [0136.450] GetProcessHeap () returned 0x4e0000 [0136.450] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x525e90 [0136.450] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df4d8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f58) returned 1 [0136.450] CryptDecrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x525e90, pdwDataLen=0x24df540 | out: pbData=0x525e90, pdwDataLen=0x24df540) returned 1 [0136.450] CryptDestroyKey (hKey=0x522f58) returned 1 [0136.450] wsprintfW (in: param_1=0x24de51c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\readme-warning.txt") returned 81 [0136.450] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0136.450] WriteFile (in: hFile=0x110, lpBuffer=0x525e90*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24de518, lpOverlapped=0x0 | out: lpBuffer=0x525e90*, lpNumberOfBytesWritten=0x24de518*=0x6c3, lpOverlapped=0x0) returned 1 [0136.452] CloseHandle (hObject=0x110) returned 1 [0136.452] GetProcessHeap () returned 0x4e0000 [0136.452] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x525e90 | out: hHeap=0x4e0000) returned 1 [0136.452] GetProcessHeap () returned 0x4e0000 [0136.452] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0136.452] GetProcessHeap () returned 0x4e0000 [0136.452] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0136.452] FindClose (in: hFindFile=0x522f18 | out: hFindFile=0x522f18) returned 1 [0136.452] GetProcessHeap () returned 0x4e0000 [0136.452] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5219a0 | out: hHeap=0x4e0000) returned 1 [0136.452] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{90140000-0043-0409-1000-0000000FF1CE}-C", cAlternateFileName="{95310~1")) returned 1 [0136.452] GetProcessHeap () returned 0x4e0000 [0136.452] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8e) returned 0x4fa058 [0136.452] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f18 [0136.458] GetProcessHeap () returned 0x4e0000 [0136.458] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0136.458] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0136.459] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office32MUI.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0136.459] GetProcessHeap () returned 0x4e0000 [0136.459] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x290) returned 0x5229a8 [0136.459] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0136.459] GetProcessHeap () returned 0x4e0000 [0136.459] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0136.459] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0136.459] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0136.459] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0136.459] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0136.459] GetProcessHeap () returned 0x4e0000 [0136.459] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0136.459] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40) returned 1 [0136.460] CryptDestroyKey (hKey=0x522f58) returned 1 [0136.460] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4e8*=0x40, lpOverlapped=0x0) returned 1 [0136.462] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0136.462] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0136.462] WriteFile (in: hFile=0x110, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0136.462] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0136.462] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0136.462] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0136.462] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0136.462] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.462] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xd5600, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0xd5600, lpOverlapped=0x0) returned 1 [0136.485] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0xd5600, dwBufLen=0xd5600 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0xd5600) returned 1 [0136.495] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.495] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xd5600, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0xd5600, lpOverlapped=0x0) returned 1 [0136.498] CryptDestroyKey (hKey=0x522f58) returned 1 [0136.498] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xd56d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.498] SetEndOfFile (hFile=0x110) returned 1 [0136.501] GetProcessHeap () returned 0x4e0000 [0136.501] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0136.501] GetProcessHeap () returned 0x4e0000 [0136.501] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0136.501] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0136.511] CloseHandle (hObject=0x110) returned 1 [0136.511] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office32MUI.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0136.511] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0136.512] GetProcessHeap () returned 0x4e0000 [0136.512] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0136.512] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0136.512] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0136.512] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0x9, lpOverlapped=0x0) returned 1 [0136.514] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0136.514] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0136.514] GetProcessHeap () returned 0x4e0000 [0136.514] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0136.514] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40) returned 1 [0136.514] CryptDestroyKey (hKey=0x522f58) returned 1 [0136.515] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4e8*=0x40, lpOverlapped=0x0) returned 1 [0136.515] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0136.515] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0136.515] WriteFile (in: hFile=0x110, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0136.515] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0136.515] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0136.515] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0136.515] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0136.515] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.515] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x567, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0x567, lpOverlapped=0x0) returned 1 [0136.515] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x570, dwBufLen=0x570 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x570) returned 1 [0136.515] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.515] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0x570, lpOverlapped=0x0) returned 1 [0136.516] CryptDestroyKey (hKey=0x522f58) returned 1 [0136.516] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x644, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.516] SetEndOfFile (hFile=0x110) returned 1 [0136.518] GetProcessHeap () returned 0x4e0000 [0136.518] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0136.519] GetProcessHeap () returned 0x4e0000 [0136.519] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0136.519] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0136.521] CloseHandle (hObject=0x110) returned 1 [0136.521] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc301560, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2cb13b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OWOW32LR.cab", cAlternateFileName="")) returned 1 [0136.522] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0136.522] GetFileSizeEx (in: hFile=0x110, lpFileSize=0x24df4f0 | out: lpFileSize=0x24df4f0*=2928955) returned 1 [0136.522] GetProcessHeap () returned 0x4e0000 [0136.522] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0136.522] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0136.522] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.522] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4dc*=0x5, lpOverlapped=0x0) returned 1 [0136.524] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0136.525] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0136.525] GetProcessHeap () returned 0x4e0000 [0136.525] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0136.525] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c0*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c0*=0x40) returned 1 [0136.525] CryptDestroyKey (hKey=0x522f58) returned 1 [0136.525] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4dc*=0x40, lpOverlapped=0x0) returned 1 [0136.525] WriteFile (in: hFile=0x110, lpBuffer=0x24df4e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4e4*, lpNumberOfBytesWritten=0x24df4dc*=0x4, lpOverlapped=0x0) returned 1 [0136.526] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4dc*=0x10, lpOverlapped=0x0) returned 1 [0136.526] WriteFile (in: hFile=0x110, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df4dc*=0x80, lpOverlapped=0x0) returned 1 [0136.526] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df508 | out: lpNewFilePointer=0x0) returned 1 [0136.526] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4f8*, lpNumberOfBytesWritten=0x24df4dc*=0x8, lpOverlapped=0x0) returned 1 [0136.526] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0136.526] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0136.527] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0136.527] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0136.531] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0136.536] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.536] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0136.538] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x2cb214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.538] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0136.538] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xee5be, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0136.538] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0136.551] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0136.554] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xee5be, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.554] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0136.556] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x2cb214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.556] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0136.556] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x28b140, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0136.556] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0136.561] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0136.565] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x28b140, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.565] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0136.566] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x2cb214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.566] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0136.566] CryptDestroyKey (hKey=0x522f58) returned 1 [0136.566] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x2cb214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.566] SetEndOfFile (hFile=0x110) returned 1 [0136.569] GetProcessHeap () returned 0x4e0000 [0136.569] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0136.569] GetProcessHeap () returned 0x4e0000 [0136.569] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0136.569] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0136.570] CloseHandle (hObject=0x110) returned 1 [0136.570] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0136.570] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0136.571] GetProcessHeap () returned 0x4e0000 [0136.571] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0136.571] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0136.571] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0136.571] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0x6, lpOverlapped=0x0) returned 1 [0136.573] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0136.573] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0136.573] GetProcessHeap () returned 0x4e0000 [0136.573] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0136.573] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df4c8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df4c8*=0x30) returned 1 [0136.573] CryptDestroyKey (hKey=0x522f58) returned 1 [0136.573] WriteFile (in: hFile=0x110, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df4e8*=0x30, lpOverlapped=0x0) returned 1 [0136.573] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0136.573] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0136.573] WriteFile (in: hFile=0x110, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0136.573] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0136.574] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0136.574] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0136.574] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0136.574] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.574] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x93a, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0x93a, lpOverlapped=0x0) returned 1 [0136.574] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x940, dwBufLen=0x940 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x940) returned 1 [0136.574] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.574] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0x940, lpOverlapped=0x0) returned 1 [0136.574] CryptDestroyKey (hKey=0x522f58) returned 1 [0136.574] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xa04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.574] SetEndOfFile (hFile=0x110) returned 1 [0136.576] GetProcessHeap () returned 0x4e0000 [0136.576] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0136.576] GetProcessHeap () returned 0x4e0000 [0136.576] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0136.576] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0136.577] CloseHandle (hObject=0x110) returned 1 [0136.577] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0136.577] GetProcessHeap () returned 0x4e0000 [0136.577] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0136.577] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df4d8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f58) returned 1 [0136.577] CryptDecrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df540 | out: pbData=0x4f53d8, pdwDataLen=0x24df540) returned 1 [0136.577] CryptDestroyKey (hKey=0x522f58) returned 1 [0136.577] GetProcessHeap () returned 0x4e0000 [0136.577] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0136.577] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df4d8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f58) returned 1 [0136.577] CryptDecrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df540 | out: pbData=0x4f5420, pdwDataLen=0x24df540) returned 1 [0136.577] CryptDestroyKey (hKey=0x522f58) returned 1 [0136.577] GetProcessHeap () returned 0x4e0000 [0136.577] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x524e88 [0136.577] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df4d8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f58) returned 1 [0136.577] CryptDecrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x524e88, pdwDataLen=0x24df540 | out: pbData=0x524e88, pdwDataLen=0x24df540) returned 1 [0136.577] CryptDestroyKey (hKey=0x522f58) returned 1 [0136.577] wsprintfW (in: param_1=0x24de51c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\readme-warning.txt") returned 81 [0136.578] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0136.578] WriteFile (in: hFile=0x110, lpBuffer=0x524e88*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24de518, lpOverlapped=0x0 | out: lpBuffer=0x524e88*, lpNumberOfBytesWritten=0x24de518*=0x6c3, lpOverlapped=0x0) returned 1 [0136.579] CloseHandle (hObject=0x110) returned 1 [0136.579] GetProcessHeap () returned 0x4e0000 [0136.579] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x524e88 | out: hHeap=0x4e0000) returned 1 [0136.579] GetProcessHeap () returned 0x4e0000 [0136.579] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0136.579] GetProcessHeap () returned 0x4e0000 [0136.579] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0136.579] FindClose (in: hFindFile=0x522f18 | out: hFindFile=0x522f18) returned 1 [0136.579] GetProcessHeap () returned 0x4e0000 [0136.579] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5229a8 | out: hHeap=0x4e0000) returned 1 [0136.579] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{90140000-0044-0409-1000-0000000FF1CE}-C", cAlternateFileName="{91454~1")) returned 1 [0136.579] GetProcessHeap () returned 0x4e0000 [0136.579] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8e) returned 0x4fa058 [0136.580] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f18 [0136.596] GetProcessHeap () returned 0x4e0000 [0136.596] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0136.596] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0136.596] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf79111d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1200204, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="InfLR.cab", cAlternateFileName="")) returned 1 [0136.596] GetProcessHeap () returned 0x4e0000 [0136.596] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x290) returned 0x5229a8 [0136.597] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0136.598] GetFileSizeEx (in: hFile=0x110, lpFileSize=0x24df4f0 | out: lpFileSize=0x24df4f0*=18874884) returned 1 [0136.598] GetProcessHeap () returned 0x4e0000 [0136.598] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0136.599] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0136.599] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.599] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4dc*=0xc, lpOverlapped=0x0) returned 1 [0136.601] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0136.601] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0136.601] GetProcessHeap () returned 0x4e0000 [0136.601] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0136.602] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df4c0*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df4c0*=0x30) returned 1 [0136.602] CryptDestroyKey (hKey=0x522f58) returned 1 [0136.602] WriteFile (in: hFile=0x110, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df4dc*=0x30, lpOverlapped=0x0) returned 1 [0136.602] WriteFile (in: hFile=0x110, lpBuffer=0x24df4e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4e4*, lpNumberOfBytesWritten=0x24df4dc*=0x4, lpOverlapped=0x0) returned 1 [0136.602] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4dc*=0x10, lpOverlapped=0x0) returned 1 [0136.602] WriteFile (in: hFile=0x110, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df4dc*=0x80, lpOverlapped=0x0) returned 1 [0136.602] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df508 | out: lpNewFilePointer=0x0) returned 1 [0136.602] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4f8*, lpNumberOfBytesWritten=0x24df4dc*=0x8, lpOverlapped=0x0) returned 1 [0136.602] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0136.602] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0136.602] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0136.602] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0136.606] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0136.610] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.610] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0136.611] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x12002d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.611] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0136.611] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x6000ac, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0136.611] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0136.623] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0136.625] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x6000ac, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.625] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0136.626] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x12002d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.626] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0136.626] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x11c0210, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0136.626] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0136.630] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0136.632] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x11c0210, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.632] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0136.633] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x12002d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.633] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0136.633] CryptDestroyKey (hKey=0x522f58) returned 1 [0136.633] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x12002d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.633] SetEndOfFile (hFile=0x110) returned 1 [0136.635] GetProcessHeap () returned 0x4e0000 [0136.635] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0136.635] GetProcessHeap () returned 0x4e0000 [0136.635] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0136.635] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0136.636] CloseHandle (hObject=0x110) returned 1 [0136.636] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e58f90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2fac00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="InfoPathMUI.msi", cAlternateFileName="INFOPA~1.MSI")) returned 1 [0136.636] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0136.636] GetFileSizeEx (in: hFile=0x110, lpFileSize=0x24df4f0 | out: lpFileSize=0x24df4f0*=3124224) returned 1 [0136.636] GetProcessHeap () returned 0x4e0000 [0136.636] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0136.636] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0136.636] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.636] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0136.636] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0136.636] GetProcessHeap () returned 0x4e0000 [0136.637] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0136.637] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c0*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c0*=0x40) returned 1 [0136.637] CryptDestroyKey (hKey=0x522f58) returned 1 [0136.637] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4dc*=0x40, lpOverlapped=0x0) returned 1 [0136.638] WriteFile (in: hFile=0x110, lpBuffer=0x24df4e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4e4*, lpNumberOfBytesWritten=0x24df4dc*=0x4, lpOverlapped=0x0) returned 1 [0136.638] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4dc*=0x10, lpOverlapped=0x0) returned 1 [0136.638] WriteFile (in: hFile=0x110, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df4dc*=0x80, lpOverlapped=0x0) returned 1 [0136.639] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df508 | out: lpNewFilePointer=0x0) returned 1 [0136.639] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4f8*, lpNumberOfBytesWritten=0x24df4dc*=0x8, lpOverlapped=0x0) returned 1 [0136.639] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0136.639] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0136.639] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0136.639] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0136.642] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0136.646] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.647] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0136.647] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x2facd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.647] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0136.648] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xfe400, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0136.648] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0136.659] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0136.661] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xfe400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.661] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0136.663] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x2facd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.663] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0136.663] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x2bac00, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0136.663] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0136.667] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0136.669] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x2bac00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.669] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0136.670] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x2facd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.670] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0136.670] CryptDestroyKey (hKey=0x522f58) returned 1 [0136.670] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x2facd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.670] SetEndOfFile (hFile=0x110) returned 1 [0136.673] GetProcessHeap () returned 0x4e0000 [0136.673] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0136.673] GetProcessHeap () returned 0x4e0000 [0136.673] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0136.674] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0136.731] CloseHandle (hObject=0x110) returned 1 [0136.731] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="InfoPathMUI.xml", cAlternateFileName="INFOPA~1.XML")) returned 1 [0136.732] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0136.732] GetProcessHeap () returned 0x4e0000 [0136.732] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0136.732] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0136.732] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0136.732] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0x1, lpOverlapped=0x0) returned 1 [0136.734] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0136.734] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0136.734] GetProcessHeap () returned 0x4e0000 [0136.734] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0136.734] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40) returned 1 [0136.734] CryptDestroyKey (hKey=0x522f58) returned 1 [0136.734] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4e8*=0x40, lpOverlapped=0x0) returned 1 [0136.734] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0136.734] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0136.734] WriteFile (in: hFile=0x110, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0136.735] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0136.735] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0136.735] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0136.735] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0136.735] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.735] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4cf, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0x4cf, lpOverlapped=0x0) returned 1 [0136.735] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x4d0, dwBufLen=0x4d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x4d0) returned 1 [0136.735] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.735] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0x4d0, lpOverlapped=0x0) returned 1 [0136.735] CryptDestroyKey (hKey=0x522f58) returned 1 [0136.735] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x5a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.735] SetEndOfFile (hFile=0x110) returned 1 [0136.737] GetProcessHeap () returned 0x4e0000 [0136.737] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0136.737] GetProcessHeap () returned 0x4e0000 [0136.737] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0136.737] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0136.739] CloseHandle (hObject=0x110) returned 1 [0136.739] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0136.739] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0136.740] GetProcessHeap () returned 0x4e0000 [0136.740] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0136.740] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0136.740] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0136.740] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0136.742] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0136.742] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0136.742] GetProcessHeap () returned 0x4e0000 [0136.742] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0136.742] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df4c8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df4c8*=0x30) returned 1 [0136.742] CryptDestroyKey (hKey=0x522f58) returned 1 [0136.742] WriteFile (in: hFile=0x110, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df4e8*=0x30, lpOverlapped=0x0) returned 1 [0136.742] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0136.742] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0136.742] WriteFile (in: hFile=0x110, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0136.742] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0136.742] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0136.743] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0136.743] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0136.743] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.743] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x73c, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0x73c, lpOverlapped=0x0) returned 1 [0136.743] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x740, dwBufLen=0x740 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x740) returned 1 [0136.743] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.743] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0x740, lpOverlapped=0x0) returned 1 [0136.743] CryptDestroyKey (hKey=0x522f58) returned 1 [0136.743] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x804, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.743] SetEndOfFile (hFile=0x110) returned 1 [0136.745] GetProcessHeap () returned 0x4e0000 [0136.745] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0136.745] GetProcessHeap () returned 0x4e0000 [0136.745] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0136.745] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0136.746] CloseHandle (hObject=0x110) returned 1 [0136.746] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0136.746] GetProcessHeap () returned 0x4e0000 [0136.746] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0136.746] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df4d8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f58) returned 1 [0136.746] CryptDecrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df540 | out: pbData=0x4f53d8, pdwDataLen=0x24df540) returned 1 [0136.746] CryptDestroyKey (hKey=0x522f58) returned 1 [0136.746] GetProcessHeap () returned 0x4e0000 [0136.746] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0136.746] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df4d8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f58) returned 1 [0136.746] CryptDecrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df540 | out: pbData=0x4f5420, pdwDataLen=0x24df540) returned 1 [0136.746] CryptDestroyKey (hKey=0x522f58) returned 1 [0136.746] GetProcessHeap () returned 0x4e0000 [0136.746] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x524e88 [0136.746] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df4d8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f58) returned 1 [0136.746] CryptDecrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x524e88, pdwDataLen=0x24df540 | out: pbData=0x524e88, pdwDataLen=0x24df540) returned 1 [0136.747] CryptDestroyKey (hKey=0x522f58) returned 1 [0136.747] wsprintfW (in: param_1=0x24de51c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\readme-warning.txt") returned 81 [0136.747] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0136.747] WriteFile (in: hFile=0x110, lpBuffer=0x524e88*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24de518, lpOverlapped=0x0 | out: lpBuffer=0x524e88*, lpNumberOfBytesWritten=0x24de518*=0x6c3, lpOverlapped=0x0) returned 1 [0136.748] CloseHandle (hObject=0x110) returned 1 [0136.748] GetProcessHeap () returned 0x4e0000 [0136.748] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x524e88 | out: hHeap=0x4e0000) returned 1 [0136.748] GetProcessHeap () returned 0x4e0000 [0136.748] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0136.748] GetProcessHeap () returned 0x4e0000 [0136.748] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0136.748] FindClose (in: hFindFile=0x522f18 | out: hFindFile=0x522f18) returned 1 [0136.748] GetProcessHeap () returned 0x4e0000 [0136.748] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5229a8 | out: hHeap=0x4e0000) returned 1 [0136.748] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{90140000-0054-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9EA85~1")) returned 1 [0136.748] GetProcessHeap () returned 0x4e0000 [0136.748] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8e) returned 0x4fa058 [0136.749] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f18 [0136.749] GetProcessHeap () returned 0x4e0000 [0136.749] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0136.749] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0136.749] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f356eb0, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f356eb0, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0136.749] GetProcessHeap () returned 0x4e0000 [0136.749] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x290) returned 0x5229a8 [0136.749] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0136.750] GetProcessHeap () returned 0x4e0000 [0136.750] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0136.750] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0136.750] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0136.750] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0xf, lpOverlapped=0x0) returned 1 [0136.752] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0136.752] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0136.752] GetProcessHeap () returned 0x4e0000 [0136.752] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0136.752] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df4c8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df4c8*=0x30) returned 1 [0136.752] CryptDestroyKey (hKey=0x522f58) returned 1 [0136.752] WriteFile (in: hFile=0x110, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df4e8*=0x30, lpOverlapped=0x0) returned 1 [0136.752] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0136.753] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0136.753] WriteFile (in: hFile=0x110, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0136.753] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0136.753] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0136.753] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0136.753] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0136.753] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.753] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1861, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0x1861, lpOverlapped=0x0) returned 1 [0136.754] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x1870, dwBufLen=0x1870 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x1870) returned 1 [0136.754] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.754] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0x1870, lpOverlapped=0x0) returned 1 [0136.754] CryptDestroyKey (hKey=0x522f58) returned 1 [0136.754] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x1934, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.754] SetEndOfFile (hFile=0x110) returned 1 [0136.756] GetProcessHeap () returned 0x4e0000 [0136.756] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0136.756] GetProcessHeap () returned 0x4e0000 [0136.756] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0136.756] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0136.758] CloseHandle (hObject=0x110) returned 1 [0136.758] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7fb9f9e0, ftCreationTime.dwHighDateTime=0x1cbe575, ftLastAccessTime.dwLowDateTime=0x7fb9f9e0, ftLastAccessTime.dwHighDateTime=0x1cbe575, ftLastWriteTime.dwLowDateTime=0x437179c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x30780dd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VisioLR.cab", cAlternateFileName="")) returned 1 [0136.758] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0136.758] GetFileSizeEx (in: hFile=0x110, lpFileSize=0x24df4f0 | out: lpFileSize=0x24df4f0*=50823389) returned 1 [0136.758] GetProcessHeap () returned 0x4e0000 [0136.759] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0136.759] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0136.759] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.759] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4dc*=0x3, lpOverlapped=0x0) returned 1 [0136.761] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0136.761] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0136.761] GetProcessHeap () returned 0x4e0000 [0136.761] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0136.762] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c0*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c0*=0x40) returned 1 [0136.762] CryptDestroyKey (hKey=0x522f58) returned 1 [0136.762] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4dc*=0x40, lpOverlapped=0x0) returned 1 [0136.762] WriteFile (in: hFile=0x110, lpBuffer=0x24df4e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4e4*, lpNumberOfBytesWritten=0x24df4dc*=0x4, lpOverlapped=0x0) returned 1 [0136.762] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4dc*=0x10, lpOverlapped=0x0) returned 1 [0136.762] WriteFile (in: hFile=0x110, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df4dc*=0x80, lpOverlapped=0x0) returned 1 [0136.762] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df508 | out: lpNewFilePointer=0x0) returned 1 [0136.762] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4f8*, lpNumberOfBytesWritten=0x24df4dc*=0x8, lpOverlapped=0x0) returned 1 [0136.762] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0136.762] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0136.762] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0136.762] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0136.767] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0136.771] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.771] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0136.772] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x30781b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.772] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0136.772] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x1028049, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0136.772] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0136.776] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0136.778] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x1028049, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.778] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0136.779] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x30781b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.779] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0136.779] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x30380e0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0136.779] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0136.783] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0136.785] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x30380e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.785] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0136.786] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x30781b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.786] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0136.786] CryptDestroyKey (hKey=0x522f58) returned 1 [0136.786] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x30781b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.786] SetEndOfFile (hFile=0x110) returned 1 [0136.789] GetProcessHeap () returned 0x4e0000 [0136.789] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0136.790] GetProcessHeap () returned 0x4e0000 [0136.790] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0136.790] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0136.790] CloseHandle (hObject=0x110) returned 1 [0136.790] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x272b1e70, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x272b1e70, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x435c1d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2ab000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VisioMUI.msi", cAlternateFileName="")) returned 1 [0136.790] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0136.791] GetFileSizeEx (in: hFile=0x110, lpFileSize=0x24df4f0 | out: lpFileSize=0x24df4f0*=2797568) returned 1 [0136.791] GetProcessHeap () returned 0x4e0000 [0136.791] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0136.791] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0136.791] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.791] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0136.791] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0136.791] GetProcessHeap () returned 0x4e0000 [0136.791] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0136.791] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c0*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c0*=0x40) returned 1 [0136.791] CryptDestroyKey (hKey=0x522f58) returned 1 [0136.791] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4dc*=0x40, lpOverlapped=0x0) returned 1 [0136.792] WriteFile (in: hFile=0x110, lpBuffer=0x24df4e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4e4*, lpNumberOfBytesWritten=0x24df4dc*=0x4, lpOverlapped=0x0) returned 1 [0136.792] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4dc*=0x10, lpOverlapped=0x0) returned 1 [0136.792] WriteFile (in: hFile=0x110, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df4dc*=0x80, lpOverlapped=0x0) returned 1 [0136.793] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df508 | out: lpNewFilePointer=0x0) returned 1 [0136.793] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4f8*, lpNumberOfBytesWritten=0x24df4dc*=0x8, lpOverlapped=0x0) returned 1 [0136.793] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0136.793] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0136.793] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0136.793] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0136.797] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0136.801] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.801] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0136.802] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x2ab0d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.802] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0136.802] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xe3aaa, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0136.802] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0136.811] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0136.814] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xe3aaa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.814] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0136.815] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x2ab0d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.815] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0136.815] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x26b000, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0136.815] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0136.819] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0136.821] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x26b000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.821] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0136.822] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x2ab0d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.822] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0136.822] CryptDestroyKey (hKey=0x522f58) returned 1 [0136.822] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x2ab0d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.822] SetEndOfFile (hFile=0x110) returned 1 [0136.825] GetProcessHeap () returned 0x4e0000 [0136.825] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0136.825] GetProcessHeap () returned 0x4e0000 [0136.825] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0136.825] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0136.826] CloseHandle (hObject=0x110) returned 1 [0136.826] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VisioMUI.xml", cAlternateFileName="")) returned 1 [0136.826] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0136.826] GetProcessHeap () returned 0x4e0000 [0136.826] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0136.826] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0136.826] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0136.826] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0x1, lpOverlapped=0x0) returned 1 [0136.828] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0136.828] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0136.828] GetProcessHeap () returned 0x4e0000 [0136.828] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0136.828] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40) returned 1 [0136.828] CryptDestroyKey (hKey=0x522f58) returned 1 [0136.828] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4e8*=0x40, lpOverlapped=0x0) returned 1 [0136.828] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0136.829] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0136.829] WriteFile (in: hFile=0x110, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0136.829] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0136.829] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0136.829] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0136.829] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0136.829] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.829] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x251f, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0x251f, lpOverlapped=0x0) returned 1 [0136.830] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x2520, dwBufLen=0x2520 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x2520) returned 1 [0136.830] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.830] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0x2520, lpOverlapped=0x0) returned 1 [0136.830] CryptDestroyKey (hKey=0x522f58) returned 1 [0136.830] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x25f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.830] SetEndOfFile (hFile=0x110) returned 1 [0136.832] GetProcessHeap () returned 0x4e0000 [0136.832] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0136.832] GetProcessHeap () returned 0x4e0000 [0136.832] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0136.832] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0136.835] CloseHandle (hObject=0x110) returned 1 [0136.835] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VisioMUI.xml", cAlternateFileName="")) returned 0 [0136.835] GetProcessHeap () returned 0x4e0000 [0136.835] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0136.835] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df4d8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f58) returned 1 [0136.835] CryptDecrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df540 | out: pbData=0x4f53d8, pdwDataLen=0x24df540) returned 1 [0136.835] CryptDestroyKey (hKey=0x522f58) returned 1 [0136.835] GetProcessHeap () returned 0x4e0000 [0136.835] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0136.836] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df4d8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f58) returned 1 [0136.836] CryptDecrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df540 | out: pbData=0x4f5420, pdwDataLen=0x24df540) returned 1 [0136.836] CryptDestroyKey (hKey=0x522f58) returned 1 [0136.836] GetProcessHeap () returned 0x4e0000 [0136.836] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x524e88 [0136.836] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df4d8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f58) returned 1 [0136.836] CryptDecrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x524e88, pdwDataLen=0x24df540 | out: pbData=0x524e88, pdwDataLen=0x24df540) returned 1 [0136.836] CryptDestroyKey (hKey=0x522f58) returned 1 [0136.836] wsprintfW (in: param_1=0x24de51c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\readme-warning.txt") returned 81 [0136.836] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0136.836] WriteFile (in: hFile=0x110, lpBuffer=0x524e88*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24de518, lpOverlapped=0x0 | out: lpBuffer=0x524e88*, lpNumberOfBytesWritten=0x24de518*=0x6c3, lpOverlapped=0x0) returned 1 [0136.837] CloseHandle (hObject=0x110) returned 1 [0136.838] GetProcessHeap () returned 0x4e0000 [0136.838] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x524e88 | out: hHeap=0x4e0000) returned 1 [0136.838] GetProcessHeap () returned 0x4e0000 [0136.838] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0136.838] GetProcessHeap () returned 0x4e0000 [0136.838] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0136.838] FindClose (in: hFindFile=0x522f18 | out: hFindFile=0x522f18) returned 1 [0136.838] GetProcessHeap () returned 0x4e0000 [0136.838] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5229a8 | out: hHeap=0x4e0000) returned 1 [0136.838] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{90140000-00A1-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92572~1")) returned 1 [0136.838] GetProcessHeap () returned 0x4e0000 [0136.838] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8e) returned 0x4fa058 [0136.838] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f18 [0136.841] GetProcessHeap () returned 0x4e0000 [0136.841] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0136.841] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0136.841] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5914a30, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OneNoteMUI.msi", cAlternateFileName="ONENOT~1.MSI")) returned 1 [0136.841] GetProcessHeap () returned 0x4e0000 [0136.841] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x290) returned 0x5229a8 [0136.842] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0136.842] GetFileSizeEx (in: hFile=0x110, lpFileSize=0x24df4f0 | out: lpFileSize=0x24df4f0*=2503680) returned 1 [0136.842] GetProcessHeap () returned 0x4e0000 [0136.842] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0136.842] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0136.842] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.842] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0136.842] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0136.842] GetProcessHeap () returned 0x4e0000 [0136.842] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0136.842] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c0*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c0*=0x40) returned 1 [0136.842] CryptDestroyKey (hKey=0x522f58) returned 1 [0136.842] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4dc*=0x40, lpOverlapped=0x0) returned 1 [0136.847] WriteFile (in: hFile=0x110, lpBuffer=0x24df4e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4e4*, lpNumberOfBytesWritten=0x24df4dc*=0x4, lpOverlapped=0x0) returned 1 [0136.847] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4dc*=0x10, lpOverlapped=0x0) returned 1 [0136.847] WriteFile (in: hFile=0x110, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df4dc*=0x80, lpOverlapped=0x0) returned 1 [0136.847] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df508 | out: lpNewFilePointer=0x0) returned 1 [0136.847] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4f8*, lpNumberOfBytesWritten=0x24df4dc*=0x8, lpOverlapped=0x0) returned 1 [0136.847] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0136.847] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0136.847] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0136.847] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0136.851] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0136.856] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.856] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0136.857] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x2634d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.857] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0136.857] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0136.857] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0136.868] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0136.870] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.870] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0136.872] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x2634d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.872] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0136.872] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0136.872] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0136.878] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0136.880] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.880] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0136.881] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x2634d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.881] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0136.881] CryptDestroyKey (hKey=0x522f58) returned 1 [0136.881] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x2634d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.881] SetEndOfFile (hFile=0x110) returned 1 [0136.884] GetProcessHeap () returned 0x4e0000 [0136.884] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0136.884] GetProcessHeap () returned 0x4e0000 [0136.884] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0136.884] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0136.945] CloseHandle (hObject=0x110) returned 1 [0136.945] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OneNoteMUI.xml", cAlternateFileName="ONENOT~1.XML")) returned 1 [0136.945] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0136.945] GetProcessHeap () returned 0x4e0000 [0136.946] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0136.946] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0136.946] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0136.946] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0xa, lpOverlapped=0x0) returned 1 [0136.948] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0136.948] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0136.948] GetProcessHeap () returned 0x4e0000 [0136.948] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0136.949] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40) returned 1 [0136.949] CryptDestroyKey (hKey=0x522f58) returned 1 [0136.949] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4e8*=0x40, lpOverlapped=0x0) returned 1 [0136.949] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0136.949] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0136.949] WriteFile (in: hFile=0x110, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0136.949] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0136.949] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0136.949] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0136.949] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0136.949] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.949] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x646, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0x646, lpOverlapped=0x0) returned 1 [0136.950] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x650, dwBufLen=0x650 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x650) returned 1 [0136.950] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.950] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0x650, lpOverlapped=0x0) returned 1 [0136.950] CryptDestroyKey (hKey=0x522f58) returned 1 [0136.950] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x724, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.950] SetEndOfFile (hFile=0x110) returned 1 [0136.953] GetProcessHeap () returned 0x4e0000 [0136.953] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0136.953] GetProcessHeap () returned 0x4e0000 [0136.953] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0136.953] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0136.956] CloseHandle (hObject=0x110) returned 1 [0136.956] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36db9d00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x36db9d00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5e95540, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10a5df8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OnoteLR.cab", cAlternateFileName="")) returned 1 [0136.956] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0136.957] GetFileSizeEx (in: hFile=0x110, lpFileSize=0x24df4f0 | out: lpFileSize=0x24df4f0*=17456632) returned 1 [0136.957] GetProcessHeap () returned 0x4e0000 [0136.958] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0136.958] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0136.958] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.958] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4dc*=0x8, lpOverlapped=0x0) returned 1 [0136.961] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0136.961] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0136.961] GetProcessHeap () returned 0x4e0000 [0136.961] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0136.961] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c0*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c0*=0x40) returned 1 [0136.961] CryptDestroyKey (hKey=0x522f58) returned 1 [0136.961] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4dc*=0x40, lpOverlapped=0x0) returned 1 [0136.961] WriteFile (in: hFile=0x110, lpBuffer=0x24df4e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4e4*, lpNumberOfBytesWritten=0x24df4dc*=0x4, lpOverlapped=0x0) returned 1 [0136.961] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4dc*=0x10, lpOverlapped=0x0) returned 1 [0136.961] WriteFile (in: hFile=0x110, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df4dc*=0x80, lpOverlapped=0x0) returned 1 [0136.961] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df508 | out: lpNewFilePointer=0x0) returned 1 [0136.961] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4f8*, lpNumberOfBytesWritten=0x24df4dc*=0x8, lpOverlapped=0x0) returned 1 [0136.962] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0136.962] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0136.962] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0136.962] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0136.967] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0136.973] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.973] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0136.974] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x10a5ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.974] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0136.974] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x58c9fd, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0136.974] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0136.982] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0136.985] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x58c9fd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.985] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0136.986] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x10a5ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.986] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0136.986] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x1065e00, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0136.987] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0136.991] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0136.994] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x1065e00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.994] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0136.995] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x10a5ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.995] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0136.995] CryptDestroyKey (hKey=0x522f58) returned 1 [0136.995] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x10a5ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.995] SetEndOfFile (hFile=0x110) returned 1 [0137.000] GetProcessHeap () returned 0x4e0000 [0137.000] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0137.000] GetProcessHeap () returned 0x4e0000 [0137.000] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0137.000] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0137.001] CloseHandle (hObject=0x110) returned 1 [0137.001] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0137.001] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0137.001] GetProcessHeap () returned 0x4e0000 [0137.001] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0137.001] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0137.001] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0137.001] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0xc, lpOverlapped=0x0) returned 1 [0137.004] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0137.004] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0137.004] GetProcessHeap () returned 0x4e0000 [0137.004] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0137.004] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df4c8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df4c8*=0x30) returned 1 [0137.004] CryptDestroyKey (hKey=0x522f58) returned 1 [0137.004] WriteFile (in: hFile=0x110, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df4e8*=0x30, lpOverlapped=0x0) returned 1 [0137.004] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0137.004] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0137.004] WriteFile (in: hFile=0x110, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0137.004] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0137.004] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0137.005] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0137.005] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0137.005] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.005] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7c4, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0x7c4, lpOverlapped=0x0) returned 1 [0137.005] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x7d0, dwBufLen=0x7d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x7d0) returned 1 [0137.005] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.005] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0x7d0, lpOverlapped=0x0) returned 1 [0137.005] CryptDestroyKey (hKey=0x522f58) returned 1 [0137.005] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x894, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.005] SetEndOfFile (hFile=0x110) returned 1 [0137.008] GetProcessHeap () returned 0x4e0000 [0137.008] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0137.008] GetProcessHeap () returned 0x4e0000 [0137.008] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0137.008] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0137.009] CloseHandle (hObject=0x110) returned 1 [0137.009] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0137.009] GetProcessHeap () returned 0x4e0000 [0137.009] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0137.009] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df4d8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f58) returned 1 [0137.009] CryptDecrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df540 | out: pbData=0x4f53d8, pdwDataLen=0x24df540) returned 1 [0137.009] CryptDestroyKey (hKey=0x522f58) returned 1 [0137.009] GetProcessHeap () returned 0x4e0000 [0137.009] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0137.009] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df4d8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f58) returned 1 [0137.009] CryptDecrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df540 | out: pbData=0x4f5420, pdwDataLen=0x24df540) returned 1 [0137.009] CryptDestroyKey (hKey=0x522f58) returned 1 [0137.009] GetProcessHeap () returned 0x4e0000 [0137.009] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x524e88 [0137.010] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df4d8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f58) returned 1 [0137.010] CryptDecrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x524e88, pdwDataLen=0x24df540 | out: pbData=0x524e88, pdwDataLen=0x24df540) returned 1 [0137.010] CryptDestroyKey (hKey=0x522f58) returned 1 [0137.010] wsprintfW (in: param_1=0x24de51c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\readme-warning.txt") returned 81 [0137.010] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0137.010] WriteFile (in: hFile=0x110, lpBuffer=0x524e88*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24de518, lpOverlapped=0x0 | out: lpBuffer=0x524e88*, lpNumberOfBytesWritten=0x24de518*=0x6c3, lpOverlapped=0x0) returned 1 [0137.012] CloseHandle (hObject=0x110) returned 1 [0137.012] GetProcessHeap () returned 0x4e0000 [0137.012] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x524e88 | out: hHeap=0x4e0000) returned 1 [0137.012] GetProcessHeap () returned 0x4e0000 [0137.012] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0137.012] GetProcessHeap () returned 0x4e0000 [0137.012] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0137.012] FindClose (in: hFindFile=0x522f18 | out: hFindFile=0x522f18) returned 1 [0137.012] GetProcessHeap () returned 0x4e0000 [0137.012] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5229a8 | out: hHeap=0x4e0000) returned 1 [0137.012] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{90140000-00B4-0409-1000-0000000FF1CE}-C", cAlternateFileName="{912E0~1")) returned 1 [0137.012] GetProcessHeap () returned 0x4e0000 [0137.012] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8e) returned 0x4fa058 [0137.012] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f18 [0137.023] GetProcessHeap () returned 0x4e0000 [0137.023] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0137.023] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0137.023] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x308ae9f0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x308ae9f0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b55ce0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x265400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ProjectMUI.msi", cAlternateFileName="PROJEC~1.MSI")) returned 1 [0137.023] GetProcessHeap () returned 0x4e0000 [0137.023] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x290) returned 0x5229a8 [0137.023] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0137.024] GetFileSizeEx (in: hFile=0x110, lpFileSize=0x24df4f0 | out: lpFileSize=0x24df4f0*=2511872) returned 1 [0137.024] GetProcessHeap () returned 0x4e0000 [0137.024] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0137.024] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0137.024] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.024] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0137.024] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0137.024] GetProcessHeap () returned 0x4e0000 [0137.024] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0137.024] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c0*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c0*=0x40) returned 1 [0137.024] CryptDestroyKey (hKey=0x522f58) returned 1 [0137.025] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4dc*=0x40, lpOverlapped=0x0) returned 1 [0137.027] WriteFile (in: hFile=0x110, lpBuffer=0x24df4e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4e4*, lpNumberOfBytesWritten=0x24df4dc*=0x4, lpOverlapped=0x0) returned 1 [0137.027] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4dc*=0x10, lpOverlapped=0x0) returned 1 [0137.027] WriteFile (in: hFile=0x110, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df4dc*=0x80, lpOverlapped=0x0) returned 1 [0137.027] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df508 | out: lpNewFilePointer=0x0) returned 1 [0137.027] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4f8*, lpNumberOfBytesWritten=0x24df4dc*=0x8, lpOverlapped=0x0) returned 1 [0137.027] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0137.027] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0137.027] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0137.027] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0137.032] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0137.038] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.038] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0137.039] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x2654d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.040] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0137.040] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xcc6aa, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0137.040] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0137.056] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0137.059] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xcc6aa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.059] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0137.061] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x2654d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.061] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0137.062] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x225400, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0137.062] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0137.070] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0137.073] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x225400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.073] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0137.074] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x2654d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.074] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0137.074] CryptDestroyKey (hKey=0x522f58) returned 1 [0137.074] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x2654d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.074] SetEndOfFile (hFile=0x110) returned 1 [0137.078] GetProcessHeap () returned 0x4e0000 [0137.079] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0137.079] GetProcessHeap () returned 0x4e0000 [0137.079] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0137.079] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0137.156] CloseHandle (hObject=0x110) returned 1 [0137.156] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30a2b7b0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30a2b7b0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ProjectMUI.xml", cAlternateFileName="PROJEC~1.XML")) returned 1 [0137.156] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0137.157] GetProcessHeap () returned 0x4e0000 [0137.157] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0137.157] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0137.157] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0137.157] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0137.160] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0137.160] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0137.160] GetProcessHeap () returned 0x4e0000 [0137.160] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0137.160] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40) returned 1 [0137.160] CryptDestroyKey (hKey=0x522f58) returned 1 [0137.160] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4e8*=0x40, lpOverlapped=0x0) returned 1 [0137.160] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0137.160] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0137.160] WriteFile (in: hFile=0x110, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0137.160] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0137.161] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0137.161] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0137.161] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0137.161] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.161] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5ac, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0x5ac, lpOverlapped=0x0) returned 1 [0137.161] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x5b0) returned 1 [0137.161] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.161] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0x5b0, lpOverlapped=0x0) returned 1 [0137.161] CryptDestroyKey (hKey=0x522f58) returned 1 [0137.161] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.161] SetEndOfFile (hFile=0x110) returned 1 [0137.164] GetProcessHeap () returned 0x4e0000 [0137.164] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0137.164] GetProcessHeap () returned 0x4e0000 [0137.164] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0137.164] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0137.166] CloseHandle (hObject=0x110) returned 1 [0137.166] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30306de0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30306de0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b7cde0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x7e1dcd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ProjLR.cab", cAlternateFileName="")) returned 1 [0137.166] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0137.167] GetFileSizeEx (in: hFile=0x110, lpFileSize=0x24df4f0 | out: lpFileSize=0x24df4f0*=8265165) returned 1 [0137.167] GetProcessHeap () returned 0x4e0000 [0137.167] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0137.168] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0137.168] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.168] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4dc*=0x3, lpOverlapped=0x0) returned 1 [0137.169] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0137.169] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0137.169] GetProcessHeap () returned 0x4e0000 [0137.169] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0137.170] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df4c0*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df4c0*=0x30) returned 1 [0137.170] CryptDestroyKey (hKey=0x522f58) returned 1 [0137.170] WriteFile (in: hFile=0x110, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df4dc*=0x30, lpOverlapped=0x0) returned 1 [0137.170] WriteFile (in: hFile=0x110, lpBuffer=0x24df4e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4e4*, lpNumberOfBytesWritten=0x24df4dc*=0x4, lpOverlapped=0x0) returned 1 [0137.170] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4dc*=0x10, lpOverlapped=0x0) returned 1 [0137.170] WriteFile (in: hFile=0x110, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df4dc*=0x80, lpOverlapped=0x0) returned 1 [0137.170] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df508 | out: lpNewFilePointer=0x0) returned 1 [0137.170] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4f8*, lpNumberOfBytesWritten=0x24df4dc*=0x8, lpOverlapped=0x0) returned 1 [0137.170] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0137.170] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0137.170] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0137.170] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0137.176] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0137.181] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.181] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0137.181] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x7e1e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.182] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0137.182] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x2a09ef, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0137.182] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0137.186] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0137.188] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x2a09ef, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.188] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0137.189] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x7e1e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.189] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0137.189] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x7a1dd0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0137.189] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0137.192] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0137.195] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x7a1dd0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.195] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0137.195] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x7e1e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.196] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0137.196] CryptDestroyKey (hKey=0x522f58) returned 1 [0137.196] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x7e1e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.196] SetEndOfFile (hFile=0x110) returned 1 [0137.199] GetProcessHeap () returned 0x4e0000 [0137.199] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0137.199] GetProcessHeap () returned 0x4e0000 [0137.199] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0137.199] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0137.199] CloseHandle (hObject=0x110) returned 1 [0137.199] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0137.199] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0137.201] GetProcessHeap () returned 0x4e0000 [0137.201] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0137.201] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0137.201] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0137.201] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0137.201] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0137.201] GetProcessHeap () returned 0x4e0000 [0137.201] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0137.201] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df4c8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df4c8*=0x30) returned 1 [0137.201] CryptDestroyKey (hKey=0x522f58) returned 1 [0137.201] WriteFile (in: hFile=0x110, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df4e8*=0x30, lpOverlapped=0x0) returned 1 [0137.203] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0137.203] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0137.203] WriteFile (in: hFile=0x110, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0137.203] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0137.203] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0137.203] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0137.203] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0137.203] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.203] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x750, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0x750, lpOverlapped=0x0) returned 1 [0137.203] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x750, dwBufLen=0x750 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x750) returned 1 [0137.203] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.204] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x750, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0x750, lpOverlapped=0x0) returned 1 [0137.204] CryptDestroyKey (hKey=0x522f58) returned 1 [0137.204] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.204] SetEndOfFile (hFile=0x110) returned 1 [0137.206] GetProcessHeap () returned 0x4e0000 [0137.206] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0137.206] GetProcessHeap () returned 0x4e0000 [0137.206] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0137.206] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0137.206] CloseHandle (hObject=0x110) returned 1 [0137.206] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0137.206] GetProcessHeap () returned 0x4e0000 [0137.206] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0137.207] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df4d8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f58) returned 1 [0137.207] CryptDecrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df540 | out: pbData=0x4f53d8, pdwDataLen=0x24df540) returned 1 [0137.207] CryptDestroyKey (hKey=0x522f58) returned 1 [0137.207] GetProcessHeap () returned 0x4e0000 [0137.207] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0137.207] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df4d8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f58) returned 1 [0137.207] CryptDecrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df540 | out: pbData=0x4f5420, pdwDataLen=0x24df540) returned 1 [0137.207] CryptDestroyKey (hKey=0x522f58) returned 1 [0137.207] GetProcessHeap () returned 0x4e0000 [0137.207] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x524e88 [0137.207] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df4d8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f58) returned 1 [0137.207] CryptDecrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x524e88, pdwDataLen=0x24df540 | out: pbData=0x524e88, pdwDataLen=0x24df540) returned 1 [0137.207] CryptDestroyKey (hKey=0x522f58) returned 1 [0137.207] wsprintfW (in: param_1=0x24de51c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\readme-warning.txt") returned 81 [0137.207] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0137.207] WriteFile (in: hFile=0x110, lpBuffer=0x524e88*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24de518, lpOverlapped=0x0 | out: lpBuffer=0x524e88*, lpNumberOfBytesWritten=0x24de518*=0x6c3, lpOverlapped=0x0) returned 1 [0137.208] CloseHandle (hObject=0x110) returned 1 [0137.209] GetProcessHeap () returned 0x4e0000 [0137.209] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x524e88 | out: hHeap=0x4e0000) returned 1 [0137.209] GetProcessHeap () returned 0x4e0000 [0137.209] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0137.209] GetProcessHeap () returned 0x4e0000 [0137.209] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0137.209] FindClose (in: hFindFile=0x522f18 | out: hFindFile=0x522f18) returned 1 [0137.209] GetProcessHeap () returned 0x4e0000 [0137.209] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5229a8 | out: hHeap=0x4e0000) returned 1 [0137.209] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{90140000-00BA-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~4")) returned 1 [0137.209] GetProcessHeap () returned 0x4e0000 [0137.209] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8e) returned 0x4fa058 [0137.209] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f18 [0137.211] GetProcessHeap () returned 0x4e0000 [0137.211] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0137.211] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0137.211] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee4bb7b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x3e7e1f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="GrooveLR.cab", cAlternateFileName="")) returned 1 [0137.211] GetProcessHeap () returned 0x4e0000 [0137.211] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x290) returned 0x5229a8 [0137.211] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0137.212] GetFileSizeEx (in: hFile=0x110, lpFileSize=0x24df4f0 | out: lpFileSize=0x24df4f0*=4095519) returned 1 [0137.212] GetProcessHeap () returned 0x4e0000 [0137.212] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0137.212] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0137.212] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.212] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4dc*=0x1, lpOverlapped=0x0) returned 1 [0137.214] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0137.214] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0137.214] GetProcessHeap () returned 0x4e0000 [0137.214] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0137.214] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c0*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c0*=0x40) returned 1 [0137.214] CryptDestroyKey (hKey=0x522f58) returned 1 [0137.214] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4dc*=0x40, lpOverlapped=0x0) returned 1 [0137.214] WriteFile (in: hFile=0x110, lpBuffer=0x24df4e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4e4*, lpNumberOfBytesWritten=0x24df4dc*=0x4, lpOverlapped=0x0) returned 1 [0137.214] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4dc*=0x10, lpOverlapped=0x0) returned 1 [0137.214] WriteFile (in: hFile=0x110, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df4dc*=0x80, lpOverlapped=0x0) returned 1 [0137.214] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df508 | out: lpNewFilePointer=0x0) returned 1 [0137.214] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4f8*, lpNumberOfBytesWritten=0x24df4dc*=0x8, lpOverlapped=0x0) returned 1 [0137.214] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0137.214] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0137.214] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0137.214] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0137.218] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0137.222] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.222] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0137.223] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x3e7ef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.223] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0137.223] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x14d4b5, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0137.223] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0137.228] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0137.230] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x14d4b5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.230] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0137.231] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x3e7ef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.231] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0137.231] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x3a7e20, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0137.231] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0137.234] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0137.236] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x3a7e20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.236] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0137.237] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x3e7ef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.237] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0137.237] CryptDestroyKey (hKey=0x522f58) returned 1 [0137.237] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x3e7ef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.237] SetEndOfFile (hFile=0x110) returned 1 [0137.240] GetProcessHeap () returned 0x4e0000 [0137.240] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0137.240] GetProcessHeap () returned 0x4e0000 [0137.240] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0137.240] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0137.241] CloseHandle (hObject=0x110) returned 1 [0137.241] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee3b15e0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x264400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="GrooveMUI.msi", cAlternateFileName="GROOVE~1.MSI")) returned 1 [0137.241] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0137.241] GetFileSizeEx (in: hFile=0x110, lpFileSize=0x24df4f0 | out: lpFileSize=0x24df4f0*=2507776) returned 1 [0137.241] GetProcessHeap () returned 0x4e0000 [0137.241] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0137.241] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0137.241] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.242] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0137.242] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0137.242] GetProcessHeap () returned 0x4e0000 [0137.242] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0137.242] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c0*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c0*=0x40) returned 1 [0137.242] CryptDestroyKey (hKey=0x522f58) returned 1 [0137.242] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4dc*=0x40, lpOverlapped=0x0) returned 1 [0137.244] WriteFile (in: hFile=0x110, lpBuffer=0x24df4e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4e4*, lpNumberOfBytesWritten=0x24df4dc*=0x4, lpOverlapped=0x0) returned 1 [0137.244] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4dc*=0x10, lpOverlapped=0x0) returned 1 [0137.244] WriteFile (in: hFile=0x110, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df4dc*=0x80, lpOverlapped=0x0) returned 1 [0137.244] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df508 | out: lpNewFilePointer=0x0) returned 1 [0137.244] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4f8*, lpNumberOfBytesWritten=0x24df4dc*=0x8, lpOverlapped=0x0) returned 1 [0137.244] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0137.244] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0137.244] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0137.244] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0137.248] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0137.252] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.252] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0137.252] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x2644d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.252] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0137.253] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xcc155, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0137.253] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0137.263] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0137.265] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xcc155, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.265] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0137.267] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x2644d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.267] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0137.267] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x224400, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0137.267] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0137.273] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0137.275] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x224400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.275] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0137.276] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x2644d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.276] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0137.276] CryptDestroyKey (hKey=0x522f58) returned 1 [0137.276] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x2644d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.276] SetEndOfFile (hFile=0x110) returned 1 [0137.279] GetProcessHeap () returned 0x4e0000 [0137.279] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0137.279] GetProcessHeap () returned 0x4e0000 [0137.279] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0137.279] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0137.280] CloseHandle (hObject=0x110) returned 1 [0137.280] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="GrooveMUI.xml", cAlternateFileName="GROOVE~1.XML")) returned 1 [0137.280] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0137.290] GetProcessHeap () returned 0x4e0000 [0137.290] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0137.291] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0137.291] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0137.291] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0xf, lpOverlapped=0x0) returned 1 [0137.293] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0137.293] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0137.293] GetProcessHeap () returned 0x4e0000 [0137.293] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0137.293] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40) returned 1 [0137.293] CryptDestroyKey (hKey=0x522f58) returned 1 [0137.293] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4e8*=0x40, lpOverlapped=0x0) returned 1 [0137.293] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0137.293] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0137.294] WriteFile (in: hFile=0x110, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0137.294] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0137.294] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0137.294] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0137.294] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0137.294] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.294] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x391, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0x391, lpOverlapped=0x0) returned 1 [0137.294] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x3a0, dwBufLen=0x3a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x3a0) returned 1 [0137.294] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.294] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0x3a0, lpOverlapped=0x0) returned 1 [0137.294] CryptDestroyKey (hKey=0x522f58) returned 1 [0137.294] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.294] SetEndOfFile (hFile=0x110) returned 1 [0137.296] GetProcessHeap () returned 0x4e0000 [0137.297] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0137.297] GetProcessHeap () returned 0x4e0000 [0137.297] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0137.297] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0137.299] CloseHandle (hObject=0x110) returned 1 [0137.299] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0137.299] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0137.299] GetProcessHeap () returned 0x4e0000 [0137.299] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0137.299] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0137.299] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0137.299] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0137.301] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0137.301] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0137.301] GetProcessHeap () returned 0x4e0000 [0137.301] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0137.301] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df4c8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df4c8*=0x30) returned 1 [0137.301] CryptDestroyKey (hKey=0x522f58) returned 1 [0137.301] WriteFile (in: hFile=0x110, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df4e8*=0x30, lpOverlapped=0x0) returned 1 [0137.302] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0137.302] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0137.302] WriteFile (in: hFile=0x110, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0137.302] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0137.302] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0137.302] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0137.302] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0137.302] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.302] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5ac, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0x5ac, lpOverlapped=0x0) returned 1 [0137.302] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x5b0) returned 1 [0137.302] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.302] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0x5b0, lpOverlapped=0x0) returned 1 [0137.304] CryptDestroyKey (hKey=0x522f58) returned 1 [0137.304] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x674, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.304] SetEndOfFile (hFile=0x110) returned 1 [0137.306] GetProcessHeap () returned 0x4e0000 [0137.306] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0137.306] GetProcessHeap () returned 0x4e0000 [0137.306] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0137.306] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0137.307] CloseHandle (hObject=0x110) returned 1 [0137.307] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0137.307] GetProcessHeap () returned 0x4e0000 [0137.307] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0137.307] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df4d8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f58) returned 1 [0137.307] CryptDecrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df540 | out: pbData=0x4f53d8, pdwDataLen=0x24df540) returned 1 [0137.307] CryptDestroyKey (hKey=0x522f58) returned 1 [0137.307] GetProcessHeap () returned 0x4e0000 [0137.307] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0137.307] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df4d8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f58) returned 1 [0137.307] CryptDecrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df540 | out: pbData=0x4f5420, pdwDataLen=0x24df540) returned 1 [0137.307] CryptDestroyKey (hKey=0x522f58) returned 1 [0137.307] GetProcessHeap () returned 0x4e0000 [0137.307] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x524e88 [0137.307] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df4d8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f58) returned 1 [0137.307] CryptDecrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x524e88, pdwDataLen=0x24df540 | out: pbData=0x524e88, pdwDataLen=0x24df540) returned 1 [0137.307] CryptDestroyKey (hKey=0x522f58) returned 1 [0137.308] wsprintfW (in: param_1=0x24de51c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\readme-warning.txt") returned 81 [0137.308] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0137.308] WriteFile (in: hFile=0x110, lpBuffer=0x524e88*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24de518, lpOverlapped=0x0 | out: lpBuffer=0x524e88*, lpNumberOfBytesWritten=0x24de518*=0x6c3, lpOverlapped=0x0) returned 1 [0137.309] CloseHandle (hObject=0x110) returned 1 [0137.309] GetProcessHeap () returned 0x4e0000 [0137.309] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x524e88 | out: hHeap=0x4e0000) returned 1 [0137.309] GetProcessHeap () returned 0x4e0000 [0137.309] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0137.309] GetProcessHeap () returned 0x4e0000 [0137.309] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0137.309] FindClose (in: hFindFile=0x522f18 | out: hFindFile=0x522f18) returned 1 [0137.309] GetProcessHeap () returned 0x4e0000 [0137.309] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5229a8 | out: hHeap=0x4e0000) returned 1 [0137.309] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{90140000-0115-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~1")) returned 1 [0137.309] GetProcessHeap () returned 0x4e0000 [0137.309] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8e) returned 0x4fa058 [0137.309] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f18 [0137.311] GetProcessHeap () returned 0x4e0000 [0137.311] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0137.311] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0137.311] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 1 [0137.312] GetProcessHeap () returned 0x4e0000 [0137.312] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x290) returned 0x5229a8 [0137.312] GetProcessHeap () returned 0x4e0000 [0137.312] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x98) returned 0x4fa058 [0137.312] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\*.*", lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f58 [0137.312] GetProcessHeap () returned 0x4e0000 [0137.312] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0137.312] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0137.313] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dwintl20.dll", cAlternateFileName="")) returned 1 [0137.313] GetProcessHeap () returned 0x4e0000 [0137.313] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x29a) returned 0x525e90 [0137.313] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dwintl20.dll", cAlternateFileName="")) returned 0 [0137.313] FindClose (in: hFindFile=0x522f58 | out: hFindFile=0x522f58) returned 1 [0137.313] GetProcessHeap () returned 0x4e0000 [0137.313] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x525e90 | out: hHeap=0x4e0000) returned 1 [0137.313] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0137.313] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0137.314] GetProcessHeap () returned 0x4e0000 [0137.314] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0137.314] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0137.314] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0137.314] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0xb, lpOverlapped=0x0) returned 1 [0137.315] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0137.315] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0137.315] GetProcessHeap () returned 0x4e0000 [0137.315] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0137.315] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40) returned 1 [0137.315] CryptDestroyKey (hKey=0x522f58) returned 1 [0137.316] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4e8*=0x40, lpOverlapped=0x0) returned 1 [0137.316] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0137.316] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0137.316] WriteFile (in: hFile=0x110, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0137.316] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0137.316] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0137.316] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0137.316] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0137.316] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.316] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x91975, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0x91975, lpOverlapped=0x0) returned 1 [0137.323] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x91980, dwBufLen=0x91980 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x91980) returned 1 [0137.328] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.328] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0x91980, lpOverlapped=0x0) returned 1 [0137.330] CryptDestroyKey (hKey=0x522f58) returned 1 [0137.330] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x91a54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.330] SetEndOfFile (hFile=0x110) returned 1 [0137.335] GetProcessHeap () returned 0x4e0000 [0137.335] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0137.335] GetProcessHeap () returned 0x4e0000 [0137.335] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0137.335] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0137.335] CloseHandle (hObject=0x110) returned 1 [0137.336] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa26c9d00, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xa26c9d00, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85142d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xccb88, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0137.336] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85ab8b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x80760, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dwdcw20.dll", cAlternateFileName="")) returned 1 [0137.336] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85f73a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7eda0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dwtrig20.exe", cAlternateFileName="")) returned 1 [0137.336] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8d646800, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8d646800, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x741, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.VC90.CRT.manifest", cAlternateFileName="MICROS~1.MAN")) returned 1 [0137.336] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0137.337] GetProcessHeap () returned 0x4e0000 [0137.337] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0137.337] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0137.337] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0137.337] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0xf, lpOverlapped=0x0) returned 1 [0137.338] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0137.338] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0137.338] GetProcessHeap () returned 0x4e0000 [0137.338] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x60) returned 0x4fca30 [0137.338] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fca30*, pdwDataLen=0x24df4c8*=0x60, dwBufLen=0x60 | out: pbData=0x4fca30*, pdwDataLen=0x24df4c8*=0x60) returned 1 [0137.339] CryptDestroyKey (hKey=0x522f58) returned 1 [0137.339] WriteFile (in: hFile=0x110, lpBuffer=0x4fca30*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fca30*, lpNumberOfBytesWritten=0x24df4e8*=0x60, lpOverlapped=0x0) returned 1 [0137.339] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0137.339] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0137.339] WriteFile (in: hFile=0x110, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0137.339] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0137.339] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0137.339] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0137.339] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0137.339] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.339] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x741, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0x741, lpOverlapped=0x0) returned 1 [0137.339] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x750, dwBufLen=0x750 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x750) returned 1 [0137.339] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.339] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x750, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0x750, lpOverlapped=0x0) returned 1 [0137.339] CryptDestroyKey (hKey=0x522f58) returned 1 [0137.339] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x844, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.339] SetEndOfFile (hFile=0x110) returned 1 [0137.341] GetProcessHeap () returned 0x4e0000 [0137.341] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fca30 | out: hHeap=0x4e0000) returned 1 [0137.341] GetProcessHeap () returned 0x4e0000 [0137.341] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0137.342] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0137.346] CloseHandle (hObject=0x110) returned 1 [0137.346] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8c333b00, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8c333b00, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe86b5a80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa0200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msvcr90.dll", cAlternateFileName="")) returned 1 [0137.346] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7e3b3f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd79282, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OfficeLR.cab", cAlternateFileName="")) returned 1 [0137.346] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0137.346] GetFileSizeEx (in: hFile=0x110, lpFileSize=0x24df4f0 | out: lpFileSize=0x24df4f0*=14127746) returned 1 [0137.346] GetProcessHeap () returned 0x4e0000 [0137.346] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0137.346] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0137.346] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.346] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4dc*=0xe, lpOverlapped=0x0) returned 1 [0137.349] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0137.349] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0137.349] GetProcessHeap () returned 0x4e0000 [0137.349] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0137.349] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c0*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c0*=0x40) returned 1 [0137.349] CryptDestroyKey (hKey=0x522f58) returned 1 [0137.349] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4dc*=0x40, lpOverlapped=0x0) returned 1 [0137.349] WriteFile (in: hFile=0x110, lpBuffer=0x24df4e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4e4*, lpNumberOfBytesWritten=0x24df4dc*=0x4, lpOverlapped=0x0) returned 1 [0137.349] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4dc*=0x10, lpOverlapped=0x0) returned 1 [0137.349] WriteFile (in: hFile=0x110, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df4dc*=0x80, lpOverlapped=0x0) returned 1 [0137.349] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df508 | out: lpNewFilePointer=0x0) returned 1 [0137.349] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4f8*, lpNumberOfBytesWritten=0x24df4dc*=0x8, lpOverlapped=0x0) returned 1 [0137.349] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0137.349] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0137.349] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0137.349] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0137.369] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0137.373] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.373] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0137.374] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xd79364, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.374] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0137.374] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x47db80, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0137.375] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0137.379] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0137.381] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x47db80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.381] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0137.382] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xd79364, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.382] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0137.382] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xd39290, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0137.382] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0137.385] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0137.387] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xd39290, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.387] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0137.388] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xd79364, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.388] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0137.388] CryptDestroyKey (hKey=0x522f58) returned 1 [0137.388] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xd79364, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.388] SetEndOfFile (hFile=0x110) returned 1 [0137.391] GetProcessHeap () returned 0x4e0000 [0137.392] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0137.392] GetProcessHeap () returned 0x4e0000 [0137.392] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0137.392] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0137.709] CloseHandle (hObject=0x110) returned 1 [0137.709] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c4ba40, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x387e00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OfficeMUI.msi", cAlternateFileName="OFFICE~2.MSI")) returned 1 [0137.709] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0137.710] GetFileSizeEx (in: hFile=0x110, lpFileSize=0x24df4f0 | out: lpFileSize=0x24df4f0*=3702272) returned 1 [0137.710] GetProcessHeap () returned 0x4e0000 [0137.710] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0137.710] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0137.710] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.710] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0137.710] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0137.710] GetProcessHeap () returned 0x4e0000 [0137.710] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0137.710] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c0*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c0*=0x40) returned 1 [0137.710] CryptDestroyKey (hKey=0x522f58) returned 1 [0137.710] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4dc*=0x40, lpOverlapped=0x0) returned 1 [0137.719] WriteFile (in: hFile=0x110, lpBuffer=0x24df4e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4e4*, lpNumberOfBytesWritten=0x24df4dc*=0x4, lpOverlapped=0x0) returned 1 [0137.719] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4dc*=0x10, lpOverlapped=0x0) returned 1 [0137.719] WriteFile (in: hFile=0x110, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df4dc*=0x80, lpOverlapped=0x0) returned 1 [0137.719] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df508 | out: lpNewFilePointer=0x0) returned 1 [0137.719] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4f8*, lpNumberOfBytesWritten=0x24df4dc*=0x8, lpOverlapped=0x0) returned 1 [0137.719] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0137.720] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0137.720] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0137.720] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0137.723] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0137.727] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.727] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0137.728] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x387ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.728] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0137.728] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x12d4aa, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0137.728] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0137.736] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0137.739] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x12d4aa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.739] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0137.740] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x387ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.740] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0137.740] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x347e00, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0137.740] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0137.743] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0137.745] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x347e00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.745] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0137.746] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x387ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.746] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0137.746] CryptDestroyKey (hKey=0x522f58) returned 1 [0137.746] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x387ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.746] SetEndOfFile (hFile=0x110) returned 1 [0137.748] GetProcessHeap () returned 0x4e0000 [0137.748] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0137.748] GetProcessHeap () returned 0x4e0000 [0137.748] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0137.749] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0137.749] CloseHandle (hObject=0x110) returned 1 [0137.749] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c27050, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15b5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OfficeMUI.xml", cAlternateFileName="OFFICE~2.XML")) returned 1 [0137.749] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0137.750] GetProcessHeap () returned 0x4e0000 [0137.750] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0137.750] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0137.750] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0137.750] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0xb, lpOverlapped=0x0) returned 1 [0137.752] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0137.752] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0137.752] GetProcessHeap () returned 0x4e0000 [0137.752] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0137.752] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40) returned 1 [0137.752] CryptDestroyKey (hKey=0x522f58) returned 1 [0137.752] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4e8*=0x40, lpOverlapped=0x0) returned 1 [0137.752] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0137.752] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0137.752] WriteFile (in: hFile=0x110, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0137.752] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0137.752] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0137.753] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0137.753] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0137.753] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.753] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x15b5, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0x15b5, lpOverlapped=0x0) returned 1 [0137.753] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x15c0, dwBufLen=0x15c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x15c0) returned 1 [0137.753] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.754] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0x15c0, lpOverlapped=0x0) returned 1 [0137.754] CryptDestroyKey (hKey=0x522f58) returned 1 [0137.754] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x1694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.754] SetEndOfFile (hFile=0x110) returned 1 [0137.756] GetProcessHeap () returned 0x4e0000 [0137.756] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0137.756] GetProcessHeap () returned 0x4e0000 [0137.756] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0137.756] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0137.758] CloseHandle (hObject=0x110) returned 1 [0137.758] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OfficeMUISet.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0137.758] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0137.759] GetProcessHeap () returned 0x4e0000 [0137.759] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0137.759] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0137.759] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0137.759] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0137.759] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0137.759] GetProcessHeap () returned 0x4e0000 [0137.759] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0137.759] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40) returned 1 [0137.759] CryptDestroyKey (hKey=0x522f58) returned 1 [0137.759] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4e8*=0x40, lpOverlapped=0x0) returned 1 [0137.761] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0137.761] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0137.761] WriteFile (in: hFile=0x110, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0137.761] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0137.761] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0137.761] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0137.761] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0137.761] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.761] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xd4200, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0xd4200, lpOverlapped=0x0) returned 1 [0137.770] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0xd4200, dwBufLen=0xd4200 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0xd4200) returned 1 [0137.777] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.777] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xd4200, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0xd4200, lpOverlapped=0x0) returned 1 [0137.780] CryptDestroyKey (hKey=0x522f58) returned 1 [0137.780] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xd42d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.780] SetEndOfFile (hFile=0x110) returned 1 [0137.782] GetProcessHeap () returned 0x4e0000 [0137.782] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0137.782] GetProcessHeap () returned 0x4e0000 [0137.782] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0137.782] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0137.792] CloseHandle (hObject=0x110) returned 1 [0137.792] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OfficeMUISet.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0137.792] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0137.792] GetProcessHeap () returned 0x4e0000 [0137.793] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0137.793] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0137.793] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0137.793] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0xd, lpOverlapped=0x0) returned 1 [0137.795] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0137.795] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0137.795] GetProcessHeap () returned 0x4e0000 [0137.795] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0137.795] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40) returned 1 [0137.795] CryptDestroyKey (hKey=0x522f58) returned 1 [0137.795] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4e8*=0x40, lpOverlapped=0x0) returned 1 [0137.795] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0137.795] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0137.795] WriteFile (in: hFile=0x110, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0137.795] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0137.796] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0137.796] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0137.796] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0137.796] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.796] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x333, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0x333, lpOverlapped=0x0) returned 1 [0137.796] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x340, dwBufLen=0x340 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x340) returned 1 [0137.796] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.796] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0x340, lpOverlapped=0x0) returned 1 [0137.796] CryptDestroyKey (hKey=0x522f58) returned 1 [0137.796] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x414, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.796] SetEndOfFile (hFile=0x110) returned 1 [0137.798] GetProcessHeap () returned 0x4e0000 [0137.798] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0137.798] GetProcessHeap () returned 0x4e0000 [0137.798] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0137.799] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0137.801] CloseHandle (hObject=0x110) returned 1 [0137.802] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc8b16200, ftCreationTime.dwHighDateTime=0x1cac190, ftLastAccessTime.dwLowDateTime=0xc8b16200, ftLastAccessTime.dwHighDateTime=0x1cac190, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2ed80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="osetupui.dll", cAlternateFileName="")) returned 1 [0137.802] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x77cbb000, ftCreationTime.dwHighDateTime=0x1cac57a, ftLastAccessTime.dwLowDateTime=0x77cbb000, ftLastAccessTime.dwHighDateTime=0x1cac57a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x6a3b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pss10r.chm", cAlternateFileName="")) returned 1 [0137.802] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0137.802] GetProcessHeap () returned 0x4e0000 [0137.802] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0137.802] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0137.802] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0137.802] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0x5, lpOverlapped=0x0) returned 1 [0137.804] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0137.804] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0137.804] GetProcessHeap () returned 0x4e0000 [0137.804] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0137.805] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df4c8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df4c8*=0x30) returned 1 [0137.805] CryptDestroyKey (hKey=0x522f58) returned 1 [0137.805] WriteFile (in: hFile=0x110, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df4e8*=0x30, lpOverlapped=0x0) returned 1 [0137.805] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0137.805] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0137.805] WriteFile (in: hFile=0x110, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0137.805] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0137.805] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0137.805] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0137.805] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0137.805] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.805] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x6a3b, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0x6a3b, lpOverlapped=0x0) returned 1 [0137.806] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x6a40, dwBufLen=0x6a40 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x6a40) returned 1 [0137.806] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.806] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0x6a40, lpOverlapped=0x0) returned 1 [0137.807] CryptDestroyKey (hKey=0x522f58) returned 1 [0137.807] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x6b04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.807] SetEndOfFile (hFile=0x110) returned 1 [0137.809] GetProcessHeap () returned 0x4e0000 [0137.809] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0137.809] GetProcessHeap () returned 0x4e0000 [0137.809] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0137.809] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0137.810] CloseHandle (hObject=0x110) returned 1 [0137.810] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cab9f00, ftCreationTime.dwHighDateTime=0x1cac8ad, ftLastAccessTime.dwLowDateTime=0x7cab9f00, ftLastAccessTime.dwHighDateTime=0x1cac8ad, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10676, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="setup.chm", cAlternateFileName="")) returned 1 [0137.810] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0137.810] GetProcessHeap () returned 0x4e0000 [0137.810] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0137.810] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0137.810] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0137.810] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0xa, lpOverlapped=0x0) returned 1 [0137.813] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0137.813] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0137.813] GetProcessHeap () returned 0x4e0000 [0137.813] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0137.813] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df4c8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df4c8*=0x30) returned 1 [0137.813] CryptDestroyKey (hKey=0x522f58) returned 1 [0137.813] WriteFile (in: hFile=0x110, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df4e8*=0x30, lpOverlapped=0x0) returned 1 [0137.813] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0137.813] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0137.813] WriteFile (in: hFile=0x110, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0137.813] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0137.813] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0137.813] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0137.814] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0137.814] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.814] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x10676, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0x10676, lpOverlapped=0x0) returned 1 [0137.817] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x10680, dwBufLen=0x10680 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x10680) returned 1 [0137.818] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.818] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0x10680, lpOverlapped=0x0) returned 1 [0137.818] CryptDestroyKey (hKey=0x522f58) returned 1 [0137.818] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x10744, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.819] SetEndOfFile (hFile=0x110) returned 1 [0137.821] GetProcessHeap () returned 0x4e0000 [0137.821] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0137.821] GetProcessHeap () returned 0x4e0000 [0137.821] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0137.821] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0137.822] CloseHandle (hObject=0x110) returned 1 [0137.822] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0137.822] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0137.822] GetProcessHeap () returned 0x4e0000 [0137.822] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0137.822] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0137.822] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0137.822] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0137.825] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0137.825] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0137.825] GetProcessHeap () returned 0x4e0000 [0137.825] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0137.825] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df4c8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df4c8*=0x30) returned 1 [0137.825] CryptDestroyKey (hKey=0x522f58) returned 1 [0137.825] WriteFile (in: hFile=0x110, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df4e8*=0x30, lpOverlapped=0x0) returned 1 [0137.825] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0137.825] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0137.825] WriteFile (in: hFile=0x110, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0137.826] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0137.826] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0137.826] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0137.826] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0137.826] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.826] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2488, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0x2488, lpOverlapped=0x0) returned 1 [0137.827] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x2490, dwBufLen=0x2490 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x2490) returned 1 [0137.827] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.827] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0x2490, lpOverlapped=0x0) returned 1 [0137.827] CryptDestroyKey (hKey=0x522f58) returned 1 [0137.827] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x2554, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.827] SetEndOfFile (hFile=0x110) returned 1 [0137.829] GetProcessHeap () returned 0x4e0000 [0137.829] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0137.829] GetProcessHeap () returned 0x4e0000 [0137.829] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0137.829] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0137.831] CloseHandle (hObject=0x110) returned 1 [0137.831] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x131a1c00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x131a1c00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ShellUI.MST", cAlternateFileName="")) returned 1 [0137.831] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0137.832] GetProcessHeap () returned 0x4e0000 [0137.832] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0137.832] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0137.832] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0137.832] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0137.832] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0137.832] GetProcessHeap () returned 0x4e0000 [0137.832] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0137.832] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40) returned 1 [0137.833] CryptDestroyKey (hKey=0x522f58) returned 1 [0137.833] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4e8*=0x40, lpOverlapped=0x0) returned 1 [0137.834] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0137.834] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0137.834] WriteFile (in: hFile=0x110, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0137.834] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0137.835] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0137.835] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0137.835] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0137.835] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.835] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0xe00, lpOverlapped=0x0) returned 1 [0137.835] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0xe00, dwBufLen=0xe00 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0xe00) returned 1 [0137.835] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.835] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0xe00, lpOverlapped=0x0) returned 1 [0137.835] CryptDestroyKey (hKey=0x522f58) returned 1 [0137.835] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.835] SetEndOfFile (hFile=0x110) returned 1 [0137.837] GetProcessHeap () returned 0x4e0000 [0137.837] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0137.837] GetProcessHeap () returned 0x4e0000 [0137.837] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0137.837] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0137.839] CloseHandle (hObject=0x110) returned 1 [0137.839] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x131a1c00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x131a1c00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ShellUI.MST", cAlternateFileName="")) returned 0 [0137.839] GetProcessHeap () returned 0x4e0000 [0137.839] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0137.839] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df4d8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f58) returned 1 [0137.839] CryptDecrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df540 | out: pbData=0x4f53d8, pdwDataLen=0x24df540) returned 1 [0137.839] CryptDestroyKey (hKey=0x522f58) returned 1 [0137.839] GetProcessHeap () returned 0x4e0000 [0137.839] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0137.839] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df4d8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f58) returned 1 [0137.839] CryptDecrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df540 | out: pbData=0x4f5420, pdwDataLen=0x24df540) returned 1 [0137.839] CryptDestroyKey (hKey=0x522f58) returned 1 [0137.839] GetProcessHeap () returned 0x4e0000 [0137.839] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x524e88 [0137.839] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df4d8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f58) returned 1 [0137.839] CryptDecrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x524e88, pdwDataLen=0x24df540 | out: pbData=0x524e88, pdwDataLen=0x24df540) returned 1 [0137.839] CryptDestroyKey (hKey=0x522f58) returned 1 [0137.839] wsprintfW (in: param_1=0x24de51c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\readme-warning.txt") returned 81 [0137.839] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0137.840] WriteFile (in: hFile=0x110, lpBuffer=0x524e88*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24de518, lpOverlapped=0x0 | out: lpBuffer=0x524e88*, lpNumberOfBytesWritten=0x24de518*=0x6c3, lpOverlapped=0x0) returned 1 [0137.841] CloseHandle (hObject=0x110) returned 1 [0137.841] GetProcessHeap () returned 0x4e0000 [0137.841] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x524e88 | out: hHeap=0x4e0000) returned 1 [0137.841] GetProcessHeap () returned 0x4e0000 [0137.841] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0137.841] GetProcessHeap () returned 0x4e0000 [0137.841] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0137.841] FindClose (in: hFindFile=0x522f18 | out: hFindFile=0x522f18) returned 1 [0137.841] GetProcessHeap () returned 0x4e0000 [0137.841] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5229a8 | out: hHeap=0x4e0000) returned 1 [0137.841] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{90140000-0117-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9AFC7~1")) returned 1 [0137.841] GetProcessHeap () returned 0x4e0000 [0137.841] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8e) returned 0x4fa058 [0137.841] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f18 [0137.844] GetProcessHeap () returned 0x4e0000 [0137.844] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0137.844] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0137.844] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Access.en-us", cAlternateFileName="ACCESS~1.EN-")) returned 1 [0137.844] GetProcessHeap () returned 0x4e0000 [0137.844] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x290) returned 0x5229a8 [0137.844] GetProcessHeap () returned 0x4e0000 [0137.844] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa8) returned 0x4fa058 [0137.844] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\*.*", lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f58 [0137.846] GetProcessHeap () returned 0x4e0000 [0137.846] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0137.846] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0137.846] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa623330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x266a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AccessMUI.msi", cAlternateFileName="ACCESS~1.MSI")) returned 1 [0137.846] GetProcessHeap () returned 0x4e0000 [0137.846] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2aa) returned 0x525e90 [0137.846] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0137.847] GetFileSizeEx (in: hFile=0xdc, lpFileSize=0x24df260 | out: lpFileSize=0x24df260*=2517504) returned 1 [0137.847] GetProcessHeap () returned 0x4e0000 [0137.847] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0137.847] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0137.847] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.847] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df250 | out: phKey=0x24df250*=0x522f98) returned 1 [0137.847] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0137.847] GetProcessHeap () returned 0x4e0000 [0137.847] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0137.847] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df230*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df230*=0x40) returned 1 [0137.847] CryptDestroyKey (hKey=0x522f98) returned 1 [0137.847] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df24c, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df24c*=0x40, lpOverlapped=0x0) returned 1 [0137.849] WriteFile (in: hFile=0xdc, lpBuffer=0x24df254*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df24c, lpOverlapped=0x0 | out: lpBuffer=0x24df254*, lpNumberOfBytesWritten=0x24df24c*=0x4, lpOverlapped=0x0) returned 1 [0137.849] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df24c, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df24c*=0x10, lpOverlapped=0x0) returned 1 [0137.849] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df24c, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df24c*=0x80, lpOverlapped=0x0) returned 1 [0137.849] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df278 | out: lpNewFilePointer=0x0) returned 1 [0137.849] WriteFile (in: hFile=0xdc, lpBuffer=0x24df268*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df24c, lpOverlapped=0x0 | out: lpBuffer=0x24df268*, lpNumberOfBytesWritten=0x24df24c*=0x8, lpOverlapped=0x0) returned 1 [0137.849] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df250 | out: phKey=0x24df250*=0x522f98) returned 1 [0137.850] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0137.850] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df220 | out: lpNewFilePointer=0x0) returned 1 [0137.850] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df214*=0x40000, lpOverlapped=0x0) returned 1 [0137.853] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df21c*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df21c*=0x40000) returned 1 [0137.857] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.857] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df218, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df218*=0x40000, lpOverlapped=0x0) returned 1 [0137.858] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x266ad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.858] WriteFile (in: hFile=0xdc, lpBuffer=0x24df220*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df218, lpOverlapped=0x0 | out: lpBuffer=0x24df220*, lpNumberOfBytesWritten=0x24df218*=0x8, lpOverlapped=0x0) returned 1 [0137.858] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xcce00, lpNewFilePointer=0x0, dwMoveMethod=0x24df220 | out: lpNewFilePointer=0x0) returned 1 [0137.858] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df214*=0x40000, lpOverlapped=0x0) returned 1 [0137.869] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df21c*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df21c*=0x40000) returned 1 [0137.871] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xcce00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.871] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df218, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df218*=0x40000, lpOverlapped=0x0) returned 1 [0137.872] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x266ad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.873] WriteFile (in: hFile=0xdc, lpBuffer=0x24df220*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df218, lpOverlapped=0x0 | out: lpBuffer=0x24df220*, lpNumberOfBytesWritten=0x24df218*=0x8, lpOverlapped=0x0) returned 1 [0137.873] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x226a00, lpNewFilePointer=0x0, dwMoveMethod=0x24df220 | out: lpNewFilePointer=0x0) returned 1 [0137.873] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df214*=0x40000, lpOverlapped=0x0) returned 1 [0137.879] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df21c*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df21c*=0x40000) returned 1 [0137.881] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x226a00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.881] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df218, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df218*=0x40000, lpOverlapped=0x0) returned 1 [0137.882] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x266ad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.882] WriteFile (in: hFile=0xdc, lpBuffer=0x24df220*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df218, lpOverlapped=0x0 | out: lpBuffer=0x24df220*, lpNumberOfBytesWritten=0x24df218*=0x8, lpOverlapped=0x0) returned 1 [0137.882] CryptDestroyKey (hKey=0x522f98) returned 1 [0137.882] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x266ad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.882] SetEndOfFile (hFile=0xdc) returned 1 [0137.885] GetProcessHeap () returned 0x4e0000 [0137.885] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0137.885] GetProcessHeap () returned 0x4e0000 [0137.885] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0137.885] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0137.937] CloseHandle (hObject=0xdc) returned 1 [0137.937] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa5fe940, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x545, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AccessMUI.xml", cAlternateFileName="ACCESS~1.XML")) returned 1 [0137.937] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0137.938] GetProcessHeap () returned 0x4e0000 [0137.938] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0137.938] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0137.938] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0137.938] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xb, lpOverlapped=0x0) returned 1 [0137.940] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0137.940] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0137.940] GetProcessHeap () returned 0x4e0000 [0137.940] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0137.940] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0137.940] CryptDestroyKey (hKey=0x522f98) returned 1 [0137.940] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0137.940] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0137.941] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0137.941] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0137.941] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0137.941] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0137.941] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0137.941] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0137.941] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.941] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x545, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x545, lpOverlapped=0x0) returned 1 [0137.941] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x550, dwBufLen=0x550 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x550) returned 1 [0137.941] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.941] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x550, lpOverlapped=0x0) returned 1 [0137.942] CryptDestroyKey (hKey=0x522f98) returned 1 [0137.942] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x624, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.942] SetEndOfFile (hFile=0xdc) returned 1 [0137.944] GetProcessHeap () returned 0x4e0000 [0137.945] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0137.945] GetProcessHeap () returned 0x4e0000 [0137.945] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0137.945] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0137.947] CloseHandle (hObject=0xdc) returned 1 [0137.948] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3216e900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3216e900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa64a430, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1ab7e94, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AccLR.cab", cAlternateFileName="")) returned 1 [0137.948] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0137.949] GetFileSizeEx (in: hFile=0xdc, lpFileSize=0x24df260 | out: lpFileSize=0x24df260*=28016276) returned 1 [0137.949] GetProcessHeap () returned 0x4e0000 [0137.949] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0137.949] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0137.949] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.949] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df24c, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df24c*=0xc, lpOverlapped=0x0) returned 1 [0137.956] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df250 | out: phKey=0x24df250*=0x522f98) returned 1 [0137.956] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0137.956] GetProcessHeap () returned 0x4e0000 [0137.956] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0137.956] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df230*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df230*=0x30) returned 1 [0137.956] CryptDestroyKey (hKey=0x522f98) returned 1 [0137.956] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df24c, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df24c*=0x30, lpOverlapped=0x0) returned 1 [0137.956] WriteFile (in: hFile=0xdc, lpBuffer=0x24df254*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df24c, lpOverlapped=0x0 | out: lpBuffer=0x24df254*, lpNumberOfBytesWritten=0x24df24c*=0x4, lpOverlapped=0x0) returned 1 [0137.956] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df24c, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df24c*=0x10, lpOverlapped=0x0) returned 1 [0137.956] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df24c, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df24c*=0x80, lpOverlapped=0x0) returned 1 [0137.956] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df278 | out: lpNewFilePointer=0x0) returned 1 [0137.956] WriteFile (in: hFile=0xdc, lpBuffer=0x24df268*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df24c, lpOverlapped=0x0 | out: lpBuffer=0x24df268*, lpNumberOfBytesWritten=0x24df24c*=0x8, lpOverlapped=0x0) returned 1 [0137.957] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df250 | out: phKey=0x24df250*=0x522f98) returned 1 [0137.957] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0137.957] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df220 | out: lpNewFilePointer=0x0) returned 1 [0137.957] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df214*=0x40000, lpOverlapped=0x0) returned 1 [0137.961] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df21c*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df21c*=0x40000) returned 1 [0137.967] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.967] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df218, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df218*=0x40000, lpOverlapped=0x0) returned 1 [0137.968] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1ab7f64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.968] WriteFile (in: hFile=0xdc, lpBuffer=0x24df220*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df218, lpOverlapped=0x0 | out: lpBuffer=0x24df220*, lpNumberOfBytesWritten=0x24df218*=0x8, lpOverlapped=0x0) returned 1 [0137.968] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x8e7f86, lpNewFilePointer=0x0, dwMoveMethod=0x24df220 | out: lpNewFilePointer=0x0) returned 1 [0137.968] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df214*=0x40000, lpOverlapped=0x0) returned 1 [0137.974] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df21c*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df21c*=0x40000) returned 1 [0137.977] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x8e7f86, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.977] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df218, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df218*=0x40000, lpOverlapped=0x0) returned 1 [0137.979] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1ab7f64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.979] WriteFile (in: hFile=0xdc, lpBuffer=0x24df220*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df218, lpOverlapped=0x0 | out: lpBuffer=0x24df220*, lpNumberOfBytesWritten=0x24df218*=0x8, lpOverlapped=0x0) returned 1 [0137.980] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1a77ea0, lpNewFilePointer=0x0, dwMoveMethod=0x24df220 | out: lpNewFilePointer=0x0) returned 1 [0137.980] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df214*=0x40000, lpOverlapped=0x0) returned 1 [0137.984] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df21c*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df21c*=0x40000) returned 1 [0137.987] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1a77ea0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.987] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df218, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df218*=0x40000, lpOverlapped=0x0) returned 1 [0137.988] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1ab7f64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.988] WriteFile (in: hFile=0xdc, lpBuffer=0x24df220*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df218, lpOverlapped=0x0 | out: lpBuffer=0x24df220*, lpNumberOfBytesWritten=0x24df218*=0x8, lpOverlapped=0x0) returned 1 [0137.988] CryptDestroyKey (hKey=0x522f98) returned 1 [0137.988] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1ab7f64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.988] SetEndOfFile (hFile=0xdc) returned 1 [0137.993] GetProcessHeap () returned 0x4e0000 [0137.993] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0137.993] GetProcessHeap () returned 0x4e0000 [0137.993] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0137.993] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0138.453] CloseHandle (hObject=0xdc) returned 1 [0138.453] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xfc0c60c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0138.453] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0138.454] GetProcessHeap () returned 0x4e0000 [0138.454] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0138.454] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0138.454] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0138.455] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xb, lpOverlapped=0x0) returned 1 [0138.457] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0138.457] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0138.457] GetProcessHeap () returned 0x4e0000 [0138.457] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0138.457] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0138.457] CryptDestroyKey (hKey=0x522f98) returned 1 [0138.457] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0138.457] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0138.457] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0138.457] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0138.458] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0138.458] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0138.458] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0138.458] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0138.458] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.458] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x91975, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x91975, lpOverlapped=0x0) returned 1 [0138.465] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x91980, dwBufLen=0x91980 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x91980) returned 1 [0138.472] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.472] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x91980, lpOverlapped=0x0) returned 1 [0138.475] CryptDestroyKey (hKey=0x522f98) returned 1 [0138.475] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x91a54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.475] SetEndOfFile (hFile=0xdc) returned 1 [0138.478] GetProcessHeap () returned 0x4e0000 [0138.478] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0138.478] GetProcessHeap () returned 0x4e0000 [0138.478] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0138.478] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0138.485] CloseHandle (hObject=0xdc) returned 1 [0138.486] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xfc0c60c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="branding.xml", cAlternateFileName="")) returned 0 [0138.486] GetProcessHeap () returned 0x4e0000 [0138.486] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0138.486] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df248, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f98) returned 1 [0138.486] CryptDecrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df2b0 | out: pbData=0x4f53d8, pdwDataLen=0x24df2b0) returned 1 [0138.486] CryptDestroyKey (hKey=0x522f98) returned 1 [0138.486] GetProcessHeap () returned 0x4e0000 [0138.486] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0138.486] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df248, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f98) returned 1 [0138.486] CryptDecrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df2b0 | out: pbData=0x4f5420, pdwDataLen=0x24df2b0) returned 1 [0138.486] CryptDestroyKey (hKey=0x522f98) returned 1 [0138.486] GetProcessHeap () returned 0x4e0000 [0138.486] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x526148 [0138.486] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df248, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f98) returned 1 [0138.486] CryptDecrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x526148, pdwDataLen=0x24df2b0 | out: pbData=0x526148, pdwDataLen=0x24df2b0) returned 1 [0138.486] CryptDestroyKey (hKey=0x522f98) returned 1 [0138.486] wsprintfW (in: param_1=0x24de28c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\readme-warning.txt") returned 94 [0138.487] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0138.487] WriteFile (in: hFile=0xdc, lpBuffer=0x526148*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24de288, lpOverlapped=0x0 | out: lpBuffer=0x526148*, lpNumberOfBytesWritten=0x24de288*=0x6c3, lpOverlapped=0x0) returned 1 [0138.488] CloseHandle (hObject=0xdc) returned 1 [0138.489] GetProcessHeap () returned 0x4e0000 [0138.489] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x526148 | out: hHeap=0x4e0000) returned 1 [0138.489] GetProcessHeap () returned 0x4e0000 [0138.489] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0138.489] GetProcessHeap () returned 0x4e0000 [0138.489] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0138.489] FindClose (in: hFindFile=0x522f58 | out: hFindFile=0x522f58) returned 1 [0138.489] GetProcessHeap () returned 0x4e0000 [0138.489] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x525e90 | out: hHeap=0x4e0000) returned 1 [0138.489] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa160f00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AccessMUISet.msi", cAlternateFileName="ACCESS~1.MSI")) returned 1 [0138.489] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0138.489] GetProcessHeap () returned 0x4e0000 [0138.489] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0138.489] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0138.489] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0138.490] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0138.490] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0138.490] GetProcessHeap () returned 0x4e0000 [0138.490] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0138.490] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40) returned 1 [0138.490] CryptDestroyKey (hKey=0x522f58) returned 1 [0138.490] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4e8*=0x40, lpOverlapped=0x0) returned 1 [0138.492] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0138.492] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0138.492] WriteFile (in: hFile=0x110, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0138.492] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0138.492] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0138.492] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0138.492] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0138.492] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.493] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xd4200, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0xd4200, lpOverlapped=0x0) returned 1 [0138.503] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0xd4200, dwBufLen=0xd4200 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0xd4200) returned 1 [0138.514] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.514] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xd4200, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0xd4200, lpOverlapped=0x0) returned 1 [0138.517] CryptDestroyKey (hKey=0x522f58) returned 1 [0138.517] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xd42d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.517] SetEndOfFile (hFile=0x110) returned 1 [0138.520] GetProcessHeap () returned 0x4e0000 [0138.520] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0138.520] GetProcessHeap () returned 0x4e0000 [0138.520] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0138.520] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0138.523] CloseHandle (hObject=0x110) returned 1 [0138.523] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AccessMUISet.xml", cAlternateFileName="ACCESS~1.XML")) returned 1 [0138.523] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0138.523] GetProcessHeap () returned 0x4e0000 [0138.523] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0138.523] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0138.523] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0138.523] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0xd, lpOverlapped=0x0) returned 1 [0138.528] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0138.528] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0138.528] GetProcessHeap () returned 0x4e0000 [0138.528] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0138.528] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40) returned 1 [0138.528] CryptDestroyKey (hKey=0x522f58) returned 1 [0138.528] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4e8*=0x40, lpOverlapped=0x0) returned 1 [0138.528] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0138.528] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0138.528] WriteFile (in: hFile=0x110, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0138.528] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0138.528] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0138.529] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0138.529] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0138.529] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.529] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x333, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0x333, lpOverlapped=0x0) returned 1 [0138.529] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x340, dwBufLen=0x340 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x340) returned 1 [0138.529] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.529] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0x340, lpOverlapped=0x0) returned 1 [0138.529] CryptDestroyKey (hKey=0x522f58) returned 1 [0138.529] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x414, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.529] SetEndOfFile (hFile=0x110) returned 1 [0138.531] GetProcessHeap () returned 0x4e0000 [0138.531] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0138.531] GetProcessHeap () returned 0x4e0000 [0138.531] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0138.531] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0138.532] CloseHandle (hObject=0x110) returned 1 [0138.532] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0138.532] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0138.533] GetProcessHeap () returned 0x4e0000 [0138.533] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0138.533] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0138.533] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0138.533] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0138.533] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0138.533] GetProcessHeap () returned 0x4e0000 [0138.533] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0138.533] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df4c8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df4c8*=0x30) returned 1 [0138.533] CryptDestroyKey (hKey=0x522f58) returned 1 [0138.533] WriteFile (in: hFile=0x110, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df4e8*=0x30, lpOverlapped=0x0) returned 1 [0138.535] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0138.535] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0138.535] WriteFile (in: hFile=0x110, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0138.535] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0138.535] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0138.535] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0138.535] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0138.535] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.535] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xa40, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0xa40, lpOverlapped=0x0) returned 1 [0138.535] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0xa40, dwBufLen=0xa40 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0xa40) returned 1 [0138.535] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.535] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0xa40, lpOverlapped=0x0) returned 1 [0138.535] CryptDestroyKey (hKey=0x522f58) returned 1 [0138.535] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xb04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.535] SetEndOfFile (hFile=0x110) returned 1 [0138.537] GetProcessHeap () returned 0x4e0000 [0138.537] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0138.538] GetProcessHeap () returned 0x4e0000 [0138.538] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0138.538] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0138.538] CloseHandle (hObject=0x110) returned 1 [0138.538] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0138.538] GetProcessHeap () returned 0x4e0000 [0138.538] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0138.538] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df4d8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f58) returned 1 [0138.538] CryptDecrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df540 | out: pbData=0x4f53d8, pdwDataLen=0x24df540) returned 1 [0138.538] CryptDestroyKey (hKey=0x522f58) returned 1 [0138.538] GetProcessHeap () returned 0x4e0000 [0138.538] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0138.538] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df4d8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f58) returned 1 [0138.539] CryptDecrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df540 | out: pbData=0x4f5420, pdwDataLen=0x24df540) returned 1 [0138.539] CryptDestroyKey (hKey=0x522f58) returned 1 [0138.539] GetProcessHeap () returned 0x4e0000 [0138.539] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x524e88 [0138.539] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df4d8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f58) returned 1 [0138.539] CryptDecrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x524e88, pdwDataLen=0x24df540 | out: pbData=0x524e88, pdwDataLen=0x24df540) returned 1 [0138.539] CryptDestroyKey (hKey=0x522f58) returned 1 [0138.539] wsprintfW (in: param_1=0x24de51c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\readme-warning.txt") returned 81 [0138.539] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0138.539] WriteFile (in: hFile=0x110, lpBuffer=0x524e88*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24de518, lpOverlapped=0x0 | out: lpBuffer=0x524e88*, lpNumberOfBytesWritten=0x24de518*=0x6c3, lpOverlapped=0x0) returned 1 [0138.540] CloseHandle (hObject=0x110) returned 1 [0138.540] GetProcessHeap () returned 0x4e0000 [0138.540] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x524e88 | out: hHeap=0x4e0000) returned 1 [0138.540] GetProcessHeap () returned 0x4e0000 [0138.541] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0138.541] GetProcessHeap () returned 0x4e0000 [0138.541] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0138.541] FindClose (in: hFindFile=0x522f18 | out: hFindFile=0x522f18) returned 1 [0138.541] GetProcessHeap () returned 0x4e0000 [0138.541] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5229a8 | out: hHeap=0x4e0000) returned 1 [0138.541] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{91140000-0011-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~1")) returned 1 [0138.541] GetProcessHeap () returned 0x4e0000 [0138.541] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8e) returned 0x4fa058 [0138.541] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f18 [0138.543] GetProcessHeap () returned 0x4e0000 [0138.543] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0138.543] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0138.543] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34ae1a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x34ae1a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe0c2860, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0138.543] GetProcessHeap () returned 0x4e0000 [0138.543] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x290) returned 0x5229a8 [0138.543] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0138.544] GetFileSizeEx (in: hFile=0x110, lpFileSize=0x24df4f0 | out: lpFileSize=0x24df4f0*=1992192) returned 1 [0138.544] GetProcessHeap () returned 0x4e0000 [0138.544] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0138.544] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0138.544] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.544] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0138.544] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0138.544] GetProcessHeap () returned 0x4e0000 [0138.544] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0138.544] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c0*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c0*=0x40) returned 1 [0138.544] CryptDestroyKey (hKey=0x522f58) returned 1 [0138.544] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4dc*=0x40, lpOverlapped=0x0) returned 1 [0138.546] WriteFile (in: hFile=0x110, lpBuffer=0x24df4e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4e4*, lpNumberOfBytesWritten=0x24df4dc*=0x4, lpOverlapped=0x0) returned 1 [0138.547] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4dc*=0x10, lpOverlapped=0x0) returned 1 [0138.547] WriteFile (in: hFile=0x110, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df4dc*=0x80, lpOverlapped=0x0) returned 1 [0138.547] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df508 | out: lpNewFilePointer=0x0) returned 1 [0138.547] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4f8*, lpNumberOfBytesWritten=0x24df4dc*=0x8, lpOverlapped=0x0) returned 1 [0138.547] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0138.547] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0138.547] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0138.547] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0138.552] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0138.555] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.555] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0138.556] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x1e66d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.556] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0138.556] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0138.556] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0138.560] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0138.563] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.563] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0138.564] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x1e66d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.564] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0138.564] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0138.564] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0138.567] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0138.569] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.569] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0138.570] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x1e66d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.570] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0138.570] CryptDestroyKey (hKey=0x522f58) returned 1 [0138.570] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x1e66d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.570] SetEndOfFile (hFile=0x110) returned 1 [0138.573] GetProcessHeap () returned 0x4e0000 [0138.573] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0138.573] GetProcessHeap () returned 0x4e0000 [0138.573] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0138.573] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0138.574] CloseHandle (hObject=0x110) returned 1 [0138.574] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x940c2a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x940c2a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0138.574] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0138.574] GetProcessHeap () returned 0x4e0000 [0138.574] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0138.574] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0138.574] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0138.574] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0xe, lpOverlapped=0x0) returned 1 [0138.576] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0138.576] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0138.576] GetProcessHeap () returned 0x4e0000 [0138.576] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0138.577] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40) returned 1 [0138.577] CryptDestroyKey (hKey=0x522f58) returned 1 [0138.577] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4e8*=0x40, lpOverlapped=0x0) returned 1 [0138.577] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0138.577] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0138.577] WriteFile (in: hFile=0x110, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0138.577] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0138.577] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0138.577] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0138.577] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0138.577] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.577] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x10b2, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0x10b2, lpOverlapped=0x0) returned 1 [0138.578] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x10c0, dwBufLen=0x10c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x10c0) returned 1 [0138.578] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.578] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0x10c0, lpOverlapped=0x0) returned 1 [0138.578] CryptDestroyKey (hKey=0x522f58) returned 1 [0138.578] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x1194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.578] SetEndOfFile (hFile=0x110) returned 1 [0138.580] GetProcessHeap () returned 0x4e0000 [0138.580] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0138.580] GetProcessHeap () returned 0x4e0000 [0138.580] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0138.580] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0138.581] CloseHandle (hObject=0x110) returned 1 [0138.581] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf885a000, ftCreationTime.dwHighDateTime=0x1cac4d7, ftLastAccessTime.dwLowDateTime=0xf885a000, ftLastAccessTime.dwHighDateTime=0x1cac4d7, ftLastWriteTime.dwLowDateTime=0x17c42c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0138.581] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd900f00, ftCreationTime.dwHighDateTime=0x1cac15b, ftLastAccessTime.dwLowDateTime=0xbd900f00, ftLastAccessTime.dwHighDateTime=0x1cac15b, ftLastWriteTime.dwLowDateTime=0x16854390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0138.581] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x147e5b00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x147e5b00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xff654fc0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0138.581] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0138.582] GetFileSizeEx (in: hFile=0x110, lpFileSize=0x24df4f0 | out: lpFileSize=0x24df4f0*=36233052) returned 1 [0138.582] GetProcessHeap () returned 0x4e0000 [0138.582] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0138.582] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0138.582] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.582] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4dc*=0x4, lpOverlapped=0x0) returned 1 [0138.585] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0138.585] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0138.585] GetProcessHeap () returned 0x4e0000 [0138.585] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0138.585] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c0*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c0*=0x40) returned 1 [0138.585] CryptDestroyKey (hKey=0x522f58) returned 1 [0138.585] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4dc*=0x40, lpOverlapped=0x0) returned 1 [0138.585] WriteFile (in: hFile=0x110, lpBuffer=0x24df4e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4e4*, lpNumberOfBytesWritten=0x24df4dc*=0x4, lpOverlapped=0x0) returned 1 [0138.585] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4dc*=0x10, lpOverlapped=0x0) returned 1 [0138.585] WriteFile (in: hFile=0x110, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df4dc*=0x80, lpOverlapped=0x0) returned 1 [0138.585] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df508 | out: lpNewFilePointer=0x0) returned 1 [0138.586] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4f8*, lpNumberOfBytesWritten=0x24df4dc*=0x8, lpOverlapped=0x0) returned 1 [0138.586] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0138.586] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0138.586] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0138.586] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0138.589] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0138.593] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.593] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0138.594] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x228e034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.594] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0138.594] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0138.594] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0138.598] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0138.600] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.601] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0138.601] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x228e034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.601] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0138.601] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x224df60, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0138.602] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0138.604] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0138.608] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x224df60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.608] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0138.609] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x228e034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.609] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0138.609] CryptDestroyKey (hKey=0x522f58) returned 1 [0138.609] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x228e034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.609] SetEndOfFile (hFile=0x110) returned 1 [0138.611] GetProcessHeap () returned 0x4e0000 [0138.611] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0138.611] GetProcessHeap () returned 0x4e0000 [0138.611] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0138.611] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0138.612] CloseHandle (hObject=0x110) returned 1 [0138.612] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3a02e00, ftCreationTime.dwHighDateTime=0x1cac5f7, ftLastAccessTime.dwLowDateTime=0xe3a02e00, ftLastAccessTime.dwHighDateTime=0x1cac5f7, ftLastWriteTime.dwLowDateTime=0x17e0dbf0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0138.612] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe06a9500, ftCreationTime.dwHighDateTime=0x1cac7e5, ftLastAccessTime.dwLowDateTime=0xe06a9500, ftLastAccessTime.dwHighDateTime=0x1cac7e5, ftLastWriteTime.dwLowDateTime=0x17c42c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0138.612] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0138.612] GetProcessHeap () returned 0x4e0000 [0138.613] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0138.613] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0138.613] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0138.613] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0x6, lpOverlapped=0x0) returned 1 [0138.614] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0138.614] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0138.614] GetProcessHeap () returned 0x4e0000 [0138.615] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x50) returned 0x4fd470 [0138.615] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fd470*, pdwDataLen=0x24df4c8*=0x50, dwBufLen=0x50 | out: pbData=0x4fd470*, pdwDataLen=0x24df4c8*=0x50) returned 1 [0138.615] CryptDestroyKey (hKey=0x522f58) returned 1 [0138.615] WriteFile (in: hFile=0x110, lpBuffer=0x4fd470*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fd470*, lpNumberOfBytesWritten=0x24df4e8*=0x50, lpOverlapped=0x0) returned 1 [0138.615] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0138.615] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0138.615] WriteFile (in: hFile=0x110, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0138.615] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0138.615] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0138.615] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0138.615] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0138.615] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.615] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xaec3a, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0xaec3a, lpOverlapped=0x0) returned 1 [0138.621] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0xaec40, dwBufLen=0xaec40 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0xaec40) returned 1 [0138.628] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.628] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0xaec40, lpOverlapped=0x0) returned 1 [0138.630] CryptDestroyKey (hKey=0x522f58) returned 1 [0138.630] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xaed24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.630] SetEndOfFile (hFile=0x110) returned 1 [0138.633] GetProcessHeap () returned 0x4e0000 [0138.633] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fd470 | out: hHeap=0x4e0000) returned 1 [0138.633] GetProcessHeap () returned 0x4e0000 [0138.633] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0138.633] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0138.634] CloseHandle (hObject=0x110) returned 1 [0138.634] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbb2e2000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbb2e2000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x1a41c00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ProPlusrWW.msi", cAlternateFileName="PROPLU~1.MSI")) returned 1 [0138.634] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0138.647] GetFileSizeEx (in: hFile=0x110, lpFileSize=0x24df4f0 | out: lpFileSize=0x24df4f0*=27532288) returned 1 [0138.647] GetProcessHeap () returned 0x4e0000 [0138.647] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0138.647] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0138.647] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.647] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0138.648] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0138.648] GetProcessHeap () returned 0x4e0000 [0138.648] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0138.648] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c0*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c0*=0x40) returned 1 [0138.648] CryptDestroyKey (hKey=0x522f58) returned 1 [0138.648] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4dc*=0x40, lpOverlapped=0x0) returned 1 [0138.650] WriteFile (in: hFile=0x110, lpBuffer=0x24df4e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4e4*, lpNumberOfBytesWritten=0x24df4dc*=0x4, lpOverlapped=0x0) returned 1 [0138.650] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4dc*=0x10, lpOverlapped=0x0) returned 1 [0138.650] WriteFile (in: hFile=0x110, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df4dc*=0x80, lpOverlapped=0x0) returned 1 [0138.650] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df508 | out: lpNewFilePointer=0x0) returned 1 [0138.650] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4f8*, lpNumberOfBytesWritten=0x24df4dc*=0x8, lpOverlapped=0x0) returned 1 [0138.650] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0138.650] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0138.650] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0138.650] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0138.654] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0138.659] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.659] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0138.660] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x1a41cd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.660] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0138.660] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x8c0955, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0138.660] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0138.665] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0138.667] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x8c0955, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.668] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0138.669] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x1a41cd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.669] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0138.670] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x1a01c00, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0138.670] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0138.673] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0138.676] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x1a01c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.676] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0138.677] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x1a41cd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.677] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0138.677] CryptDestroyKey (hKey=0x522f58) returned 1 [0138.677] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x1a41cd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.677] SetEndOfFile (hFile=0x110) returned 1 [0138.679] GetProcessHeap () returned 0x4e0000 [0138.679] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0138.680] GetProcessHeap () returned 0x4e0000 [0138.680] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0138.680] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0138.682] CloseHandle (hObject=0x110) returned 1 [0138.682] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x41d4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ProPlusrWW.xml", cAlternateFileName="PROPLU~1.XML")) returned 1 [0138.682] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0138.682] GetProcessHeap () returned 0x4e0000 [0138.682] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0138.682] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0138.682] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0138.682] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0xc, lpOverlapped=0x0) returned 1 [0138.685] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0138.685] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0138.685] GetProcessHeap () returned 0x4e0000 [0138.685] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0138.685] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40) returned 1 [0138.685] CryptDestroyKey (hKey=0x522f58) returned 1 [0138.685] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4e8*=0x40, lpOverlapped=0x0) returned 1 [0138.685] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0138.685] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0138.685] WriteFile (in: hFile=0x110, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0138.686] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0138.686] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0138.686] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0138.686] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0138.686] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.686] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x41d4, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0x41d4, lpOverlapped=0x0) returned 1 [0138.687] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x41e0, dwBufLen=0x41e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x41e0) returned 1 [0138.687] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.687] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0x41e0, lpOverlapped=0x0) returned 1 [0138.687] CryptDestroyKey (hKey=0x522f58) returned 1 [0138.687] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x42b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.687] SetEndOfFile (hFile=0x110) returned 1 [0138.690] GetProcessHeap () returned 0x4e0000 [0138.690] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0138.691] GetProcessHeap () returned 0x4e0000 [0138.691] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0138.691] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0138.691] CloseHandle (hObject=0x110) returned 1 [0138.692] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x262b2700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x262b2700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x1ffd0c0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xa97cbdb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ProPrWW.cab", cAlternateFileName="")) returned 1 [0138.692] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0138.693] GetFileSizeEx (in: hFile=0x110, lpFileSize=0x24df4f0 | out: lpFileSize=0x24df4f0*=177720283) returned 1 [0138.693] GetProcessHeap () returned 0x4e0000 [0138.693] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0138.693] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0138.693] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.693] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4dc*=0x5, lpOverlapped=0x0) returned 1 [0138.696] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0138.696] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0138.696] GetProcessHeap () returned 0x4e0000 [0138.696] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0138.696] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c0*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c0*=0x40) returned 1 [0138.696] CryptDestroyKey (hKey=0x522f58) returned 1 [0138.696] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4dc*=0x40, lpOverlapped=0x0) returned 1 [0138.696] WriteFile (in: hFile=0x110, lpBuffer=0x24df4e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4e4*, lpNumberOfBytesWritten=0x24df4dc*=0x4, lpOverlapped=0x0) returned 1 [0138.696] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4dc*=0x10, lpOverlapped=0x0) returned 1 [0138.696] WriteFile (in: hFile=0x110, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df4dc*=0x80, lpOverlapped=0x0) returned 1 [0138.696] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df508 | out: lpNewFilePointer=0x0) returned 1 [0138.696] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4f8*, lpNumberOfBytesWritten=0x24df4dc*=0x8, lpOverlapped=0x0) returned 1 [0138.696] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0138.697] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0138.697] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0138.697] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0138.701] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0138.706] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.706] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0138.707] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xa97ccb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.708] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0138.708] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x387ee9e, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0138.708] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0138.712] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0138.715] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x387ee9e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.715] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0138.716] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xa97ccb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.716] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0138.716] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xa93cbe0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0138.716] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0138.719] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0138.722] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xa93cbe0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.722] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0138.723] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xa97ccb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.723] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0138.723] CryptDestroyKey (hKey=0x522f58) returned 1 [0138.724] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xa97ccb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.724] SetEndOfFile (hFile=0x110) returned 1 [0138.728] GetProcessHeap () returned 0x4e0000 [0138.728] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0138.728] GetProcessHeap () returned 0x4e0000 [0138.728] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0138.728] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0138.729] CloseHandle (hObject=0x110) returned 1 [0138.729] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf14900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbf14900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xc96ff40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xd49ee31, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ProPrWW2.cab", cAlternateFileName="")) returned 1 [0138.729] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0138.730] GetFileSizeEx (in: hFile=0x110, lpFileSize=0x24df4f0 | out: lpFileSize=0x24df4f0*=222948913) returned 1 [0138.730] GetProcessHeap () returned 0x4e0000 [0138.730] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0138.730] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0138.730] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.730] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4dc*=0xf, lpOverlapped=0x0) returned 1 [0138.733] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0138.733] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0138.733] GetProcessHeap () returned 0x4e0000 [0138.733] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0138.733] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c0*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c0*=0x40) returned 1 [0138.733] CryptDestroyKey (hKey=0x522f58) returned 1 [0138.733] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4dc*=0x40, lpOverlapped=0x0) returned 1 [0138.734] WriteFile (in: hFile=0x110, lpBuffer=0x24df4e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4e4*, lpNumberOfBytesWritten=0x24df4dc*=0x4, lpOverlapped=0x0) returned 1 [0138.734] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4dc*=0x10, lpOverlapped=0x0) returned 1 [0138.734] WriteFile (in: hFile=0x110, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df4dc*=0x80, lpOverlapped=0x0) returned 1 [0138.734] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df508 | out: lpNewFilePointer=0x0) returned 1 [0138.734] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4f8*, lpNumberOfBytesWritten=0x24df4dc*=0x8, lpOverlapped=0x0) returned 1 [0138.734] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0138.734] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0138.734] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0138.734] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0138.738] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0138.743] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.743] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0138.744] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xd49ef14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.744] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0138.744] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x46dfa10, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0138.745] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0138.750] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0138.752] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x46dfa10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.752] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0138.753] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xd49ef14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.753] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0138.754] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xd45ee40, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0138.754] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0138.757] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0138.759] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xd45ee40, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.759] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0138.760] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xd49ef14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.760] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0138.760] CryptDestroyKey (hKey=0x522f58) returned 1 [0138.760] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xd49ef14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.760] SetEndOfFile (hFile=0x110) returned 1 [0138.763] GetProcessHeap () returned 0x4e0000 [0138.763] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0138.763] GetProcessHeap () returned 0x4e0000 [0138.763] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0138.763] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0138.764] CloseHandle (hObject=0x110) returned 1 [0138.764] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec13c00, ftCreationTime.dwHighDateTime=0x1cac15b, ftLastAccessTime.dwLowDateTime=0xbec13c00, ftLastAccessTime.dwHighDateTime=0x1cac15b, ftLastWriteTime.dwLowDateTime=0x1682d290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0138.764] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0138.764] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0138.765] GetProcessHeap () returned 0x4e0000 [0138.765] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0138.765] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0138.765] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0138.765] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0xa, lpOverlapped=0x0) returned 1 [0138.767] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0138.767] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0138.767] GetProcessHeap () returned 0x4e0000 [0138.767] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0138.767] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df4c8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df4c8*=0x30) returned 1 [0138.767] CryptDestroyKey (hKey=0x522f58) returned 1 [0138.767] WriteFile (in: hFile=0x110, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df4e8*=0x30, lpOverlapped=0x0) returned 1 [0138.767] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0138.767] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0138.767] WriteFile (in: hFile=0x110, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0138.767] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0138.767] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0138.768] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0138.768] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0138.768] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.768] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7976, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0x7976, lpOverlapped=0x0) returned 1 [0138.769] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x7980, dwBufLen=0x7980 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x7980) returned 1 [0138.769] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.769] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0x7980, lpOverlapped=0x0) returned 1 [0138.769] CryptDestroyKey (hKey=0x522f58) returned 1 [0138.769] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x7a44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.769] SetEndOfFile (hFile=0x110) returned 1 [0138.772] GetProcessHeap () returned 0x4e0000 [0138.772] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0138.772] GetProcessHeap () returned 0x4e0000 [0138.772] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0138.772] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0138.772] CloseHandle (hObject=0x110) returned 1 [0138.772] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0138.773] GetProcessHeap () returned 0x4e0000 [0138.773] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0138.773] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df4d8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f58) returned 1 [0138.773] CryptDecrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df540 | out: pbData=0x4f53d8, pdwDataLen=0x24df540) returned 1 [0138.773] CryptDestroyKey (hKey=0x522f58) returned 1 [0138.773] GetProcessHeap () returned 0x4e0000 [0138.773] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0138.773] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df4d8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f58) returned 1 [0138.773] CryptDecrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df540 | out: pbData=0x4f5420, pdwDataLen=0x24df540) returned 1 [0138.773] CryptDestroyKey (hKey=0x522f58) returned 1 [0138.773] GetProcessHeap () returned 0x4e0000 [0138.773] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x524e88 [0138.773] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df4d8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f58) returned 1 [0138.773] CryptDecrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x524e88, pdwDataLen=0x24df540 | out: pbData=0x524e88, pdwDataLen=0x24df540) returned 1 [0138.773] CryptDestroyKey (hKey=0x522f58) returned 1 [0138.773] wsprintfW (in: param_1=0x24de51c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\readme-warning.txt") returned 81 [0138.773] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0138.774] WriteFile (in: hFile=0x110, lpBuffer=0x524e88*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24de518, lpOverlapped=0x0 | out: lpBuffer=0x524e88*, lpNumberOfBytesWritten=0x24de518*=0x6c3, lpOverlapped=0x0) returned 1 [0138.774] CloseHandle (hObject=0x110) returned 1 [0138.775] GetProcessHeap () returned 0x4e0000 [0138.775] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x524e88 | out: hHeap=0x4e0000) returned 1 [0138.775] GetProcessHeap () returned 0x4e0000 [0138.775] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0138.775] GetProcessHeap () returned 0x4e0000 [0138.775] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0138.775] FindClose (in: hFindFile=0x522f18 | out: hFindFile=0x522f18) returned 1 [0138.775] GetProcessHeap () returned 0x4e0000 [0138.775] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5229a8 | out: hHeap=0x4e0000) returned 1 [0138.775] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{91140000-003B-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~3")) returned 1 [0138.775] GetProcessHeap () returned 0x4e0000 [0138.775] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8e) returned 0x4fa058 [0138.775] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f18 [0138.777] GetProcessHeap () returned 0x4e0000 [0138.777] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0138.777] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0138.777] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87078450, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87078450, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5d1e590, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0138.777] GetProcessHeap () returned 0x4e0000 [0138.777] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x290) returned 0x5229a8 [0138.777] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0138.778] GetFileSizeEx (in: hFile=0x110, lpFileSize=0x24df4f0 | out: lpFileSize=0x24df4f0*=1992192) returned 1 [0138.778] GetProcessHeap () returned 0x4e0000 [0138.778] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0138.778] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0138.778] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.778] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0138.778] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0138.778] GetProcessHeap () returned 0x4e0000 [0138.778] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0138.778] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c0*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c0*=0x40) returned 1 [0138.778] CryptDestroyKey (hKey=0x522f58) returned 1 [0138.778] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4dc*=0x40, lpOverlapped=0x0) returned 1 [0138.780] WriteFile (in: hFile=0x110, lpBuffer=0x24df4e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4e4*, lpNumberOfBytesWritten=0x24df4dc*=0x4, lpOverlapped=0x0) returned 1 [0138.780] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4dc*=0x10, lpOverlapped=0x0) returned 1 [0138.780] WriteFile (in: hFile=0x110, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df4dc*=0x80, lpOverlapped=0x0) returned 1 [0138.780] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df508 | out: lpNewFilePointer=0x0) returned 1 [0138.780] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4f8*, lpNumberOfBytesWritten=0x24df4dc*=0x8, lpOverlapped=0x0) returned 1 [0138.780] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0138.780] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0138.780] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0138.780] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0138.784] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0138.788] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.788] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0138.789] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x1e66d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.789] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0138.789] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0138.789] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0138.794] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0138.796] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.796] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0138.797] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x1e66d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.797] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0138.797] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0138.797] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0138.800] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0138.803] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.803] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0138.804] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x1e66d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.804] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0138.804] CryptDestroyKey (hKey=0x522f58) returned 1 [0138.805] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x1e66d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.805] SetEndOfFile (hFile=0x110) returned 1 [0138.816] GetProcessHeap () returned 0x4e0000 [0138.816] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0138.816] GetProcessHeap () returned 0x4e0000 [0138.816] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0138.816] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0138.817] CloseHandle (hObject=0x110) returned 1 [0138.817] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87abdaa0, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87abdaa0, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5cd2aa0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0138.817] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0138.817] GetProcessHeap () returned 0x4e0000 [0138.817] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0138.817] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0138.817] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0138.818] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0xe, lpOverlapped=0x0) returned 1 [0138.819] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0138.819] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0138.819] GetProcessHeap () returned 0x4e0000 [0138.819] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0138.819] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40) returned 1 [0138.819] CryptDestroyKey (hKey=0x522f58) returned 1 [0138.819] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4e8*=0x40, lpOverlapped=0x0) returned 1 [0138.820] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0138.820] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0138.820] WriteFile (in: hFile=0x110, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0138.820] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0138.820] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0138.820] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0138.820] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0138.820] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.820] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x10b2, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0x10b2, lpOverlapped=0x0) returned 1 [0138.821] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x10c0, dwBufLen=0x10c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x10c0) returned 1 [0138.821] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.821] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0x10c0, lpOverlapped=0x0) returned 1 [0138.821] CryptDestroyKey (hKey=0x522f58) returned 1 [0138.821] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x1194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.821] SetEndOfFile (hFile=0x110) returned 1 [0138.823] GetProcessHeap () returned 0x4e0000 [0138.823] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0138.823] GetProcessHeap () returned 0x4e0000 [0138.823] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0138.823] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0138.824] CloseHandle (hObject=0x110) returned 1 [0138.824] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfe57f8e0, ftCreationTime.dwHighDateTime=0x1cbe1cb, ftLastAccessTime.dwLowDateTime=0xfe57f8e0, ftLastAccessTime.dwHighDateTime=0x1cbe1cb, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0138.824] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6644b620, ftCreationTime.dwHighDateTime=0x1cb04b2, ftLastAccessTime.dwLowDateTime=0x6644b620, ftLastAccessTime.dwHighDateTime=0x1cb04b2, ftLastWriteTime.dwLowDateTime=0xa81b8770, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0138.824] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8238e540, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x8238e540, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5ddcc70, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0138.824] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0138.826] GetFileSizeEx (in: hFile=0x110, lpFileSize=0x24df4f0 | out: lpFileSize=0x24df4f0*=36233052) returned 1 [0138.826] GetProcessHeap () returned 0x4e0000 [0138.827] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0138.827] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0138.827] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.827] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4dc*=0x4, lpOverlapped=0x0) returned 1 [0138.829] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0138.829] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0138.829] GetProcessHeap () returned 0x4e0000 [0138.829] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0138.829] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c0*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c0*=0x40) returned 1 [0138.829] CryptDestroyKey (hKey=0x522f58) returned 1 [0138.829] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4dc*=0x40, lpOverlapped=0x0) returned 1 [0138.829] WriteFile (in: hFile=0x110, lpBuffer=0x24df4e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4e4*, lpNumberOfBytesWritten=0x24df4dc*=0x4, lpOverlapped=0x0) returned 1 [0138.829] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4dc*=0x10, lpOverlapped=0x0) returned 1 [0138.829] WriteFile (in: hFile=0x110, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df4dc*=0x80, lpOverlapped=0x0) returned 1 [0138.829] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df508 | out: lpNewFilePointer=0x0) returned 1 [0138.829] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4f8*, lpNumberOfBytesWritten=0x24df4dc*=0x8, lpOverlapped=0x0) returned 1 [0138.830] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0138.830] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0138.830] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0138.830] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0138.833] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0138.838] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.838] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0138.839] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x228e034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.839] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0138.839] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0138.839] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0138.842] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0138.845] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.845] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0138.845] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x228e034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.846] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0138.846] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x224df60, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0138.846] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0138.849] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0138.851] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x224df60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.851] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0138.852] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x228e034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.852] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0138.852] CryptDestroyKey (hKey=0x522f58) returned 1 [0138.852] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x228e034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.852] SetEndOfFile (hFile=0x110) returned 1 [0138.854] GetProcessHeap () returned 0x4e0000 [0138.854] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0138.854] GetProcessHeap () returned 0x4e0000 [0138.854] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0138.855] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0138.855] CloseHandle (hObject=0x110) returned 1 [0138.855] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7bd91af0, ftCreationTime.dwHighDateTime=0x1cb07b2, ftLastAccessTime.dwLowDateTime=0x7bd91af0, ftLastAccessTime.dwHighDateTime=0x1cb07b2, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0138.855] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2a2397e0, ftCreationTime.dwHighDateTime=0x1cbe19a, ftLastAccessTime.dwLowDateTime=0x2a2397e0, ftLastAccessTime.dwHighDateTime=0x1cbe19a, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0138.855] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0138.856] GetProcessHeap () returned 0x4e0000 [0138.856] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0138.856] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0138.857] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0138.857] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0x6, lpOverlapped=0x0) returned 1 [0138.858] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0138.858] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0138.858] GetProcessHeap () returned 0x4e0000 [0138.858] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x50) returned 0x4fd470 [0138.858] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fd470*, pdwDataLen=0x24df4c8*=0x50, dwBufLen=0x50 | out: pbData=0x4fd470*, pdwDataLen=0x24df4c8*=0x50) returned 1 [0138.858] CryptDestroyKey (hKey=0x522f58) returned 1 [0138.858] WriteFile (in: hFile=0x110, lpBuffer=0x4fd470*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fd470*, lpNumberOfBytesWritten=0x24df4e8*=0x50, lpOverlapped=0x0) returned 1 [0138.859] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0138.859] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0138.859] WriteFile (in: hFile=0x110, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0138.859] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0138.859] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0138.859] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0138.859] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0138.859] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.859] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xaec3a, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0xaec3a, lpOverlapped=0x0) returned 1 [0138.867] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0xaec40, dwBufLen=0xaec40 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0xaec40) returned 1 [0138.875] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.875] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0xaec40, lpOverlapped=0x0) returned 1 [0138.877] CryptDestroyKey (hKey=0x522f58) returned 1 [0138.877] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xaed24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.878] SetEndOfFile (hFile=0x110) returned 1 [0138.881] GetProcessHeap () returned 0x4e0000 [0138.881] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fd470 | out: hHeap=0x4e0000) returned 1 [0138.881] GetProcessHeap () returned 0x4e0000 [0138.881] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0138.881] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0138.882] CloseHandle (hObject=0x110) returned 1 [0138.882] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c1614f0, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7c1614f0, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xa4c400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PrjProrWW.msi", cAlternateFileName="PRJPRO~1.MSI")) returned 1 [0138.882] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0138.883] GetFileSizeEx (in: hFile=0x110, lpFileSize=0x24df4f0 | out: lpFileSize=0x24df4f0*=10798080) returned 1 [0138.883] GetProcessHeap () returned 0x4e0000 [0138.883] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0138.883] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0138.883] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.883] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0138.883] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0138.883] GetProcessHeap () returned 0x4e0000 [0138.883] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0138.883] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c0*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c0*=0x40) returned 1 [0138.883] CryptDestroyKey (hKey=0x522f58) returned 1 [0138.883] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4dc*=0x40, lpOverlapped=0x0) returned 1 [0138.885] WriteFile (in: hFile=0x110, lpBuffer=0x24df4e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4e4*, lpNumberOfBytesWritten=0x24df4dc*=0x4, lpOverlapped=0x0) returned 1 [0138.885] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4dc*=0x10, lpOverlapped=0x0) returned 1 [0138.886] WriteFile (in: hFile=0x110, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df4dc*=0x80, lpOverlapped=0x0) returned 1 [0138.886] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df508 | out: lpNewFilePointer=0x0) returned 1 [0138.886] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4f8*, lpNumberOfBytesWritten=0x24df4dc*=0x8, lpOverlapped=0x0) returned 1 [0138.886] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0138.886] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0138.886] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0138.886] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0138.891] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0138.893] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.893] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0138.894] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xa4c4d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.894] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0138.894] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x36ec00, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0138.894] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0138.903] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0138.905] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x36ec00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.905] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0138.906] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xa4c4d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.906] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0138.906] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xa0c400, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0138.906] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0138.913] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0138.915] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xa0c400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.915] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0138.916] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xa4c4d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.916] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0138.916] CryptDestroyKey (hKey=0x522f58) returned 1 [0138.916] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xa4c4d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.916] SetEndOfFile (hFile=0x110) returned 1 [0138.919] GetProcessHeap () returned 0x4e0000 [0138.919] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0138.919] GetProcessHeap () returned 0x4e0000 [0138.919] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0138.919] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0138.920] CloseHandle (hObject=0x110) returned 1 [0138.920] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cabec50, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7cabec50, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1915, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PrjProrWW.xml", cAlternateFileName="PRJPRO~1.XML")) returned 1 [0138.920] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0138.921] GetProcessHeap () returned 0x4e0000 [0138.921] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0138.921] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0138.921] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0138.921] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0xb, lpOverlapped=0x0) returned 1 [0138.923] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0138.923] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0138.923] GetProcessHeap () returned 0x4e0000 [0138.923] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0138.923] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40) returned 1 [0138.923] CryptDestroyKey (hKey=0x522f58) returned 1 [0138.923] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4e8*=0x40, lpOverlapped=0x0) returned 1 [0138.923] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0138.923] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0138.923] WriteFile (in: hFile=0x110, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0138.923] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0138.924] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0138.924] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0138.924] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0138.924] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.924] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1915, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0x1915, lpOverlapped=0x0) returned 1 [0138.925] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x1920, dwBufLen=0x1920 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x1920) returned 1 [0138.925] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.925] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0x1920, lpOverlapped=0x0) returned 1 [0138.925] CryptDestroyKey (hKey=0x522f58) returned 1 [0138.925] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x19f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.925] SetEndOfFile (hFile=0x110) returned 1 [0138.927] GetProcessHeap () returned 0x4e0000 [0138.927] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0138.927] GetProcessHeap () returned 0x4e0000 [0138.927] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0138.927] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0138.928] CloseHandle (hObject=0x110) returned 1 [0138.928] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6c87b0c0, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x6c87b0c0, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa6b67930, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x9b6ba9f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PrjPrrWW.cab", cAlternateFileName="")) returned 1 [0138.928] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0138.928] GetFileSizeEx (in: hFile=0x110, lpFileSize=0x24df4f0 | out: lpFileSize=0x24df4f0*=162970271) returned 1 [0138.928] GetProcessHeap () returned 0x4e0000 [0138.928] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0138.928] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0138.928] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.928] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4dc*=0x1, lpOverlapped=0x0) returned 1 [0138.932] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0138.932] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0138.932] GetProcessHeap () returned 0x4e0000 [0138.932] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0138.933] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c0*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c0*=0x40) returned 1 [0138.933] CryptDestroyKey (hKey=0x522f58) returned 1 [0138.933] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4dc*=0x40, lpOverlapped=0x0) returned 1 [0138.933] WriteFile (in: hFile=0x110, lpBuffer=0x24df4e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4e4*, lpNumberOfBytesWritten=0x24df4dc*=0x4, lpOverlapped=0x0) returned 1 [0138.933] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4dc*=0x10, lpOverlapped=0x0) returned 1 [0138.933] WriteFile (in: hFile=0x110, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df4dc*=0x80, lpOverlapped=0x0) returned 1 [0138.933] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df508 | out: lpNewFilePointer=0x0) returned 1 [0138.933] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4f8*, lpNumberOfBytesWritten=0x24df4dc*=0x8, lpOverlapped=0x0) returned 1 [0138.933] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0138.933] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0138.933] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0138.933] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0138.939] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0138.944] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.944] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0138.945] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x9b6bb74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.945] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0138.945] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x33ce8df, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0138.945] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0138.952] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0138.955] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x33ce8df, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.955] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0138.956] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x9b6bb74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.956] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0138.956] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x9b2baa0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0138.956] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0138.960] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0138.962] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x9b2baa0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.962] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0138.963] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x9b6bb74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.963] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0138.963] CryptDestroyKey (hKey=0x522f58) returned 1 [0138.963] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x9b6bb74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.963] SetEndOfFile (hFile=0x110) returned 1 [0138.966] GetProcessHeap () returned 0x4e0000 [0138.967] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0138.967] GetProcessHeap () returned 0x4e0000 [0138.967] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0138.967] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0138.968] CloseHandle (hObject=0x110) returned 1 [0138.968] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x69dde270, ftCreationTime.dwHighDateTime=0x1cb04b2, ftLastAccessTime.dwLowDateTime=0x69dde270, ftLastAccessTime.dwHighDateTime=0x1cb04b2, ftLastWriteTime.dwLowDateTime=0xa8191670, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0138.968] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7ca00570, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7ca00570, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0138.968] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0138.968] GetProcessHeap () returned 0x4e0000 [0138.968] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0138.968] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0138.968] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0138.968] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0x5, lpOverlapped=0x0) returned 1 [0138.970] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0138.970] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0138.970] GetProcessHeap () returned 0x4e0000 [0138.970] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0138.970] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df4c8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df4c8*=0x30) returned 1 [0138.970] CryptDestroyKey (hKey=0x522f58) returned 1 [0138.970] WriteFile (in: hFile=0x110, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df4e8*=0x30, lpOverlapped=0x0) returned 1 [0138.970] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0138.971] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0138.971] WriteFile (in: hFile=0x110, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0138.971] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0138.971] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0138.971] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0138.971] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0138.971] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.971] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x412b, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0x412b, lpOverlapped=0x0) returned 1 [0138.972] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x4130, dwBufLen=0x4130 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x4130) returned 1 [0138.972] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.972] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0x4130, lpOverlapped=0x0) returned 1 [0138.973] CryptDestroyKey (hKey=0x522f58) returned 1 [0138.973] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x41f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.973] SetEndOfFile (hFile=0x110) returned 1 [0138.975] GetProcessHeap () returned 0x4e0000 [0138.975] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0138.975] GetProcessHeap () returned 0x4e0000 [0138.975] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0138.975] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0138.976] CloseHandle (hObject=0x110) returned 1 [0138.976] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7ca00570, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7ca00570, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0138.976] GetProcessHeap () returned 0x4e0000 [0138.976] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0138.976] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df4d8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f58) returned 1 [0138.977] CryptDecrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df540 | out: pbData=0x4f53d8, pdwDataLen=0x24df540) returned 1 [0138.977] CryptDestroyKey (hKey=0x522f58) returned 1 [0138.977] GetProcessHeap () returned 0x4e0000 [0138.977] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0138.977] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df4d8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f58) returned 1 [0138.977] CryptDecrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df540 | out: pbData=0x4f5420, pdwDataLen=0x24df540) returned 1 [0138.977] CryptDestroyKey (hKey=0x522f58) returned 1 [0138.977] GetProcessHeap () returned 0x4e0000 [0138.977] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x524e88 [0138.977] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df4d8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f58) returned 1 [0138.977] CryptDecrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x524e88, pdwDataLen=0x24df540 | out: pbData=0x524e88, pdwDataLen=0x24df540) returned 1 [0138.977] CryptDestroyKey (hKey=0x522f58) returned 1 [0138.977] wsprintfW (in: param_1=0x24de51c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\readme-warning.txt") returned 81 [0138.977] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0138.978] WriteFile (in: hFile=0x110, lpBuffer=0x524e88*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24de518, lpOverlapped=0x0 | out: lpBuffer=0x524e88*, lpNumberOfBytesWritten=0x24de518*=0x6c3, lpOverlapped=0x0) returned 1 [0138.979] CloseHandle (hObject=0x110) returned 1 [0138.979] GetProcessHeap () returned 0x4e0000 [0138.979] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x524e88 | out: hHeap=0x4e0000) returned 1 [0138.979] GetProcessHeap () returned 0x4e0000 [0138.979] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0138.979] GetProcessHeap () returned 0x4e0000 [0138.979] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0138.979] FindClose (in: hFindFile=0x522f18 | out: hFindFile=0x522f18) returned 1 [0138.979] GetProcessHeap () returned 0x4e0000 [0138.979] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5229a8 | out: hHeap=0x4e0000) returned 1 [0138.979] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{91140000-0057-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~2")) returned 1 [0138.979] GetProcessHeap () returned 0x4e0000 [0138.979] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8e) returned 0x4fa058 [0138.980] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f18 [0138.984] GetProcessHeap () returned 0x4e0000 [0138.984] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0138.984] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0138.984] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe5ed9630, ftCreationTime.dwHighDateTime=0x1cb12b3, ftLastAccessTime.dwLowDateTime=0xe5ed9630, ftLastAccessTime.dwHighDateTime=0x1cb12b3, ftLastWriteTime.dwLowDateTime=0x4655d500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0138.984] GetProcessHeap () returned 0x4e0000 [0138.984] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x290) returned 0x5229a8 [0138.984] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0138.984] GetFileSizeEx (in: hFile=0x110, lpFileSize=0x24df4f0 | out: lpFileSize=0x24df4f0*=1992192) returned 1 [0138.984] GetProcessHeap () returned 0x4e0000 [0138.984] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0138.984] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0138.985] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.985] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0138.985] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0138.985] GetProcessHeap () returned 0x4e0000 [0138.985] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0138.985] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c0*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c0*=0x40) returned 1 [0138.985] CryptDestroyKey (hKey=0x522f58) returned 1 [0138.985] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4dc*=0x40, lpOverlapped=0x0) returned 1 [0138.987] WriteFile (in: hFile=0x110, lpBuffer=0x24df4e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4e4*, lpNumberOfBytesWritten=0x24df4dc*=0x4, lpOverlapped=0x0) returned 1 [0138.989] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4dc*=0x10, lpOverlapped=0x0) returned 1 [0138.989] WriteFile (in: hFile=0x110, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df4dc*=0x80, lpOverlapped=0x0) returned 1 [0138.989] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df508 | out: lpNewFilePointer=0x0) returned 1 [0138.990] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4f8*, lpNumberOfBytesWritten=0x24df4dc*=0x8, lpOverlapped=0x0) returned 1 [0138.990] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0138.990] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0138.990] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0138.990] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0138.994] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0138.998] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.998] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0138.999] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x1e66d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.999] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0138.999] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0138.999] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0139.004] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0139.006] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.006] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0139.007] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x1e66d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.007] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0139.007] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0139.007] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0139.011] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0139.013] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.013] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0139.014] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x1e66d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.014] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0139.014] CryptDestroyKey (hKey=0x522f58) returned 1 [0139.014] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x1e66d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.014] SetEndOfFile (hFile=0x110) returned 1 [0139.017] GetProcessHeap () returned 0x4e0000 [0139.017] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0139.017] GetProcessHeap () returned 0x4e0000 [0139.017] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0139.017] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0139.018] CloseHandle (hObject=0x110) returned 1 [0139.018] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x16771fb0, ftCreationTime.dwHighDateTime=0x1cb12b4, ftLastAccessTime.dwLowDateTime=0x16771fb0, ftLastAccessTime.dwHighDateTime=0x1cb12b4, ftLastWriteTime.dwLowDateTime=0x46536400, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0139.018] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0139.019] GetProcessHeap () returned 0x4e0000 [0139.019] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0139.019] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0139.019] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0139.019] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0xe, lpOverlapped=0x0) returned 1 [0139.021] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0139.021] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0139.021] GetProcessHeap () returned 0x4e0000 [0139.021] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0139.021] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40) returned 1 [0139.021] CryptDestroyKey (hKey=0x522f58) returned 1 [0139.021] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4e8*=0x40, lpOverlapped=0x0) returned 1 [0139.021] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0139.021] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0139.021] WriteFile (in: hFile=0x110, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0139.021] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0139.021] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0139.021] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0139.021] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0139.021] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.021] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x10b2, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0x10b2, lpOverlapped=0x0) returned 1 [0139.022] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x10c0, dwBufLen=0x10c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x10c0) returned 1 [0139.022] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.022] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0x10c0, lpOverlapped=0x0) returned 1 [0139.022] CryptDestroyKey (hKey=0x522f58) returned 1 [0139.023] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x1194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.023] SetEndOfFile (hFile=0x110) returned 1 [0139.025] GetProcessHeap () returned 0x4e0000 [0139.025] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0139.025] GetProcessHeap () returned 0x4e0000 [0139.025] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0139.025] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0139.025] CloseHandle (hObject=0x110) returned 1 [0139.026] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec54b6b0, ftCreationTime.dwHighDateTime=0x1cb04a9, ftLastAccessTime.dwLowDateTime=0xec54b6b0, ftLastAccessTime.dwHighDateTime=0x1cb04a9, ftLastWriteTime.dwLowDateTime=0x4a687710, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0139.026] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xde72fbf0, ftCreationTime.dwHighDateTime=0x1cb0d0b, ftLastAccessTime.dwLowDateTime=0xde72fbf0, ftLastAccessTime.dwHighDateTime=0x1cb0d0b, ftLastWriteTime.dwLowDateTime=0x49c902c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0139.026] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc9c380f0, ftCreationTime.dwHighDateTime=0x1cb12b3, ftLastAccessTime.dwLowDateTime=0xc9c380f0, ftLastAccessTime.dwHighDateTime=0x1cb12b3, ftLastWriteTime.dwLowDateTime=0x465d00f0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0139.026] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0139.026] GetFileSizeEx (in: hFile=0x110, lpFileSize=0x24df4f0 | out: lpFileSize=0x24df4f0*=36233052) returned 1 [0139.026] GetProcessHeap () returned 0x4e0000 [0139.026] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0139.026] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0139.026] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.026] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4dc*=0x4, lpOverlapped=0x0) returned 1 [0139.028] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0139.028] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0139.028] GetProcessHeap () returned 0x4e0000 [0139.028] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0139.028] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c0*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c0*=0x40) returned 1 [0139.028] CryptDestroyKey (hKey=0x522f58) returned 1 [0139.028] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4dc*=0x40, lpOverlapped=0x0) returned 1 [0139.029] WriteFile (in: hFile=0x110, lpBuffer=0x24df4e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4e4*, lpNumberOfBytesWritten=0x24df4dc*=0x4, lpOverlapped=0x0) returned 1 [0139.029] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4dc*=0x10, lpOverlapped=0x0) returned 1 [0139.029] WriteFile (in: hFile=0x110, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df4dc*=0x80, lpOverlapped=0x0) returned 1 [0139.029] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df508 | out: lpNewFilePointer=0x0) returned 1 [0139.029] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4f8*, lpNumberOfBytesWritten=0x24df4dc*=0x8, lpOverlapped=0x0) returned 1 [0139.029] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0139.029] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0139.029] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0139.029] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0139.036] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0139.040] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.040] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0139.041] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x228e034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.041] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0139.041] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0139.041] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0139.046] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0139.049] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.049] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0139.050] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x228e034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.050] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0139.051] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x224df60, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0139.051] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0139.055] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0139.059] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x224df60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.059] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0139.060] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x228e034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.060] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0139.060] CryptDestroyKey (hKey=0x522f58) returned 1 [0139.060] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x228e034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.060] SetEndOfFile (hFile=0x110) returned 1 [0139.063] GetProcessHeap () returned 0x4e0000 [0139.063] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0139.063] GetProcessHeap () returned 0x4e0000 [0139.063] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0139.063] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0139.064] CloseHandle (hObject=0x110) returned 1 [0139.064] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe7c66670, ftCreationTime.dwHighDateTime=0x1cb0ee5, ftLastAccessTime.dwLowDateTime=0xe7c66670, ftLastAccessTime.dwHighDateTime=0x1cb0ee5, ftLastWriteTime.dwLowDateTime=0x4a6ac100, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0139.064] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x95261510, ftCreationTime.dwHighDateTime=0x1cb048a, ftLastAccessTime.dwLowDateTime=0x95261510, ftLastAccessTime.dwHighDateTime=0x1cb048a, ftLastWriteTime.dwLowDateTime=0x4a6ac100, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0139.064] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0139.065] GetProcessHeap () returned 0x4e0000 [0139.065] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0139.065] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0139.065] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0139.065] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0x6, lpOverlapped=0x0) returned 1 [0139.068] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0139.068] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0139.068] GetProcessHeap () returned 0x4e0000 [0139.068] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x50) returned 0x4fd470 [0139.068] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fd470*, pdwDataLen=0x24df4c8*=0x50, dwBufLen=0x50 | out: pbData=0x4fd470*, pdwDataLen=0x24df4c8*=0x50) returned 1 [0139.068] CryptDestroyKey (hKey=0x522f58) returned 1 [0139.068] WriteFile (in: hFile=0x110, lpBuffer=0x4fd470*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fd470*, lpNumberOfBytesWritten=0x24df4e8*=0x50, lpOverlapped=0x0) returned 1 [0139.068] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0139.068] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0139.068] WriteFile (in: hFile=0x110, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0139.069] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0139.069] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0139.069] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0139.069] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0139.069] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.069] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xaec3a, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0xaec3a, lpOverlapped=0x0) returned 1 [0139.079] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0xaec40, dwBufLen=0xaec40 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0xaec40) returned 1 [0139.088] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.088] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0xaec40, lpOverlapped=0x0) returned 1 [0139.092] CryptDestroyKey (hKey=0x522f58) returned 1 [0139.092] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xaed24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.092] SetEndOfFile (hFile=0x110) returned 1 [0139.096] GetProcessHeap () returned 0x4e0000 [0139.096] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fd470 | out: hHeap=0x4e0000) returned 1 [0139.096] GetProcessHeap () returned 0x4e0000 [0139.096] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0139.096] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0139.097] CloseHandle (hObject=0x110) returned 1 [0139.097] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeb7e7af0, ftCreationTime.dwHighDateTime=0x1cb04a9, ftLastAccessTime.dwLowDateTime=0xeb7e7af0, ftLastAccessTime.dwHighDateTime=0x1cb04a9, ftLastWriteTime.dwLowDateTime=0x49c691c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0139.097] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80aa51d0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80aa51d0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x4a6d3200, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x5061, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0139.097] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0139.097] GetProcessHeap () returned 0x4e0000 [0139.097] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0139.097] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0139.097] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0139.097] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0xf, lpOverlapped=0x0) returned 1 [0139.099] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0139.099] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0139.099] GetProcessHeap () returned 0x4e0000 [0139.099] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0139.099] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df4c8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df4c8*=0x30) returned 1 [0139.099] CryptDestroyKey (hKey=0x522f58) returned 1 [0139.099] WriteFile (in: hFile=0x110, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df4e8*=0x30, lpOverlapped=0x0) returned 1 [0139.099] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0139.099] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0139.099] WriteFile (in: hFile=0x110, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0139.099] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0139.100] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0139.100] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0139.100] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0139.100] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.100] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5061, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0x5061, lpOverlapped=0x0) returned 1 [0139.101] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x5070, dwBufLen=0x5070 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x5070) returned 1 [0139.101] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.101] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0x5070, lpOverlapped=0x0) returned 1 [0139.101] CryptDestroyKey (hKey=0x522f58) returned 1 [0139.101] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x5134, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.101] SetEndOfFile (hFile=0x110) returned 1 [0139.104] GetProcessHeap () returned 0x4e0000 [0139.104] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0139.104] GetProcessHeap () returned 0x4e0000 [0139.104] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0139.104] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0139.104] CloseHandle (hObject=0x110) returned 1 [0139.104] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x749b0240, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x749b0240, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x46a46a30, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xb9fa2f7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VisiorWW.cab", cAlternateFileName="")) returned 1 [0139.104] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0139.106] GetFileSizeEx (in: hFile=0x110, lpFileSize=0x24df4f0 | out: lpFileSize=0x24df4f0*=195011319) returned 1 [0139.106] GetProcessHeap () returned 0x4e0000 [0139.106] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0139.106] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0139.106] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.106] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4dc*=0x9, lpOverlapped=0x0) returned 1 [0139.110] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0139.110] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0139.110] GetProcessHeap () returned 0x4e0000 [0139.110] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0139.110] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c0*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c0*=0x40) returned 1 [0139.110] CryptDestroyKey (hKey=0x522f58) returned 1 [0139.110] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4dc*=0x40, lpOverlapped=0x0) returned 1 [0139.110] WriteFile (in: hFile=0x110, lpBuffer=0x24df4e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4e4*, lpNumberOfBytesWritten=0x24df4dc*=0x4, lpOverlapped=0x0) returned 1 [0139.110] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4dc*=0x10, lpOverlapped=0x0) returned 1 [0139.111] WriteFile (in: hFile=0x110, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df4dc*=0x80, lpOverlapped=0x0) returned 1 [0139.111] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df508 | out: lpNewFilePointer=0x0) returned 1 [0139.111] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4f8*, lpNumberOfBytesWritten=0x24df4dc*=0x8, lpOverlapped=0x0) returned 1 [0139.111] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0139.111] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0139.111] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0139.111] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0139.115] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0139.120] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.120] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0139.121] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xb9fa3d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.121] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0139.121] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x3dfe0fd, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0139.121] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0139.129] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0139.132] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x3dfe0fd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.132] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0139.134] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xb9fa3d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.134] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0139.134] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xb9ba300, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0139.134] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0139.139] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0139.142] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xb9ba300, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.142] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0139.143] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xb9fa3d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.143] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0139.144] CryptDestroyKey (hKey=0x522f58) returned 1 [0139.144] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xb9fa3d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.144] SetEndOfFile (hFile=0x110) returned 1 [0139.148] GetProcessHeap () returned 0x4e0000 [0139.148] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0139.148] GetProcessHeap () returned 0x4e0000 [0139.148] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0139.148] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0139.149] CloseHandle (hObject=0x110) returned 1 [0139.150] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80711960, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80711960, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468ee660, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xb80800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VisiorWW.msi", cAlternateFileName="")) returned 1 [0139.150] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0139.150] GetFileSizeEx (in: hFile=0x110, lpFileSize=0x24df4f0 | out: lpFileSize=0x24df4f0*=12060672) returned 1 [0139.150] GetProcessHeap () returned 0x4e0000 [0139.150] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0139.150] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0139.150] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.151] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0139.151] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0139.151] GetProcessHeap () returned 0x4e0000 [0139.151] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0139.151] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c0*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c0*=0x40) returned 1 [0139.151] CryptDestroyKey (hKey=0x522f58) returned 1 [0139.151] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4dc*=0x40, lpOverlapped=0x0) returned 1 [0139.158] WriteFile (in: hFile=0x110, lpBuffer=0x24df4e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4e4*, lpNumberOfBytesWritten=0x24df4dc*=0x4, lpOverlapped=0x0) returned 1 [0139.158] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4dc*=0x10, lpOverlapped=0x0) returned 1 [0139.158] WriteFile (in: hFile=0x110, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df4dc*=0x80, lpOverlapped=0x0) returned 1 [0139.158] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df508 | out: lpNewFilePointer=0x0) returned 1 [0139.158] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4f8*, lpNumberOfBytesWritten=0x24df4dc*=0x8, lpOverlapped=0x0) returned 1 [0139.158] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0139.158] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0139.158] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0139.158] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0139.164] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0139.170] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.170] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0139.172] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xb808d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.172] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0139.172] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x3d5800, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0139.172] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0139.185] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0139.188] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x3d5800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.188] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0139.190] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xb808d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.190] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0139.190] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xb40800, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0139.190] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0139.195] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0139.197] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xb40800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.197] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0139.198] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xb808d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.198] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0139.198] CryptDestroyKey (hKey=0x522f58) returned 1 [0139.198] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xb808d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.198] SetEndOfFile (hFile=0x110) returned 1 [0139.201] GetProcessHeap () returned 0x4e0000 [0139.201] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0139.201] GetProcessHeap () returned 0x4e0000 [0139.201] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0139.201] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0139.202] CloseHandle (hObject=0x110) returned 1 [0139.202] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80b17dc0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80b17dc0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VisiorWW.xml", cAlternateFileName="")) returned 1 [0139.202] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0139.202] GetProcessHeap () returned 0x4e0000 [0139.202] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0139.202] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0139.202] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0139.202] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0xd, lpOverlapped=0x0) returned 1 [0139.204] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0139.204] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0139.204] GetProcessHeap () returned 0x4e0000 [0139.204] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0139.204] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40) returned 1 [0139.204] CryptDestroyKey (hKey=0x522f58) returned 1 [0139.204] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4e8*=0x40, lpOverlapped=0x0) returned 1 [0139.204] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0139.205] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0139.205] WriteFile (in: hFile=0x110, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0139.205] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0139.205] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0139.205] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0139.205] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0139.205] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.205] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2213, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0x2213, lpOverlapped=0x0) returned 1 [0139.206] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x2220, dwBufLen=0x2220 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x2220) returned 1 [0139.206] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.206] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0x2220, lpOverlapped=0x0) returned 1 [0139.207] CryptDestroyKey (hKey=0x522f58) returned 1 [0139.207] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x22f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.207] SetEndOfFile (hFile=0x110) returned 1 [0139.209] GetProcessHeap () returned 0x4e0000 [0139.209] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0139.209] GetProcessHeap () returned 0x4e0000 [0139.209] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0139.209] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0139.210] CloseHandle (hObject=0x110) returned 1 [0139.210] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80b17dc0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80b17dc0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VisiorWW.xml", cAlternateFileName="")) returned 0 [0139.210] GetProcessHeap () returned 0x4e0000 [0139.210] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0139.210] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df4d8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f58) returned 1 [0139.210] CryptDecrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df540 | out: pbData=0x4f53d8, pdwDataLen=0x24df540) returned 1 [0139.210] CryptDestroyKey (hKey=0x522f58) returned 1 [0139.210] GetProcessHeap () returned 0x4e0000 [0139.210] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0139.210] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df4d8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f58) returned 1 [0139.210] CryptDecrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df540 | out: pbData=0x4f5420, pdwDataLen=0x24df540) returned 1 [0139.210] CryptDestroyKey (hKey=0x522f58) returned 1 [0139.210] GetProcessHeap () returned 0x4e0000 [0139.210] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x524e88 [0139.210] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df4d8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f58) returned 1 [0139.211] CryptDecrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x524e88, pdwDataLen=0x24df540 | out: pbData=0x524e88, pdwDataLen=0x24df540) returned 1 [0139.211] CryptDestroyKey (hKey=0x522f58) returned 1 [0139.211] wsprintfW (in: param_1=0x24de51c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\readme-warning.txt") returned 81 [0139.211] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0139.211] WriteFile (in: hFile=0x110, lpBuffer=0x524e88*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24de518, lpOverlapped=0x0 | out: lpBuffer=0x524e88*, lpNumberOfBytesWritten=0x24de518*=0x6c3, lpOverlapped=0x0) returned 1 [0139.212] CloseHandle (hObject=0x110) returned 1 [0139.212] GetProcessHeap () returned 0x4e0000 [0139.212] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x524e88 | out: hHeap=0x4e0000) returned 1 [0139.212] GetProcessHeap () returned 0x4e0000 [0139.212] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0139.212] GetProcessHeap () returned 0x4e0000 [0139.212] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0139.212] FindClose (in: hFindFile=0x522f18 | out: hFindFile=0x522f18) returned 1 [0139.212] GetProcessHeap () returned 0x4e0000 [0139.212] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5229a8 | out: hHeap=0x4e0000) returned 1 [0139.212] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{91140000-0057-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~2")) returned 0 [0139.212] FindClose (in: hFindFile=0x522ed8 | out: hFindFile=0x522ed8) returned 1 [0139.213] GetProcessHeap () returned 0x4e0000 [0139.213] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x521758 | out: hHeap=0x4e0000) returned 1 [0139.213] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 0 [0139.213] FindClose (in: hFindFile=0x522e98 | out: hFindFile=0x522e98) returned 1 [0139.213] GetProcessHeap () returned 0x4e0000 [0139.213] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x520518 | out: hHeap=0x4e0000) returned 1 [0139.213] FindNextFileW (in: hFindFile=0x4f9820, lpFindFileData=0x24dfd20 | out: lpFindFileData=0x24dfd20*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x563d4b80, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x563d4b80, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0xaece4da0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0xa0000003, dwReserved1=0xffff, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0139.213] FindNextFileW (in: hFindFile=0x4f9820, lpFindFileData=0x24dfd20 | out: lpFindFileData=0x24dfd20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xffff, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0139.213] GetProcessHeap () returned 0x4e0000 [0139.213] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x28) returned 0x4fe470 [0139.213] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\*.*", lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x522e98 [0139.213] GetProcessHeap () returned 0x4e0000 [0139.213] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fe470 | out: hHeap=0x4e0000) returned 1 [0139.213] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0139.214] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Admin", cAlternateFileName="")) returned 1 [0139.214] GetProcessHeap () returned 0x4e0000 [0139.214] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x22a) returned 0x521520 [0139.214] GetProcessHeap () returned 0x4e0000 [0139.214] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x34) returned 0x522ed8 [0139.214] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\Admin\\*.*", lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f18 [0139.214] GetProcessHeap () returned 0x4e0000 [0139.214] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x522ed8 | out: hHeap=0x4e0000) returned 1 [0139.214] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0139.214] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0 [0139.214] FindClose (in: hFindFile=0x522f18 | out: hFindFile=0x522f18) returned 1 [0139.214] GetProcessHeap () returned 0x4e0000 [0139.214] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4e0000) returned 1 [0139.214] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Admin", cAlternateFileName="")) returned 0 [0139.214] FindClose (in: hFindFile=0x522e98 | out: hFindFile=0x522e98) returned 1 [0139.214] GetProcessHeap () returned 0x4e0000 [0139.214] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x521520 | out: hHeap=0x4e0000) returned 1 [0139.215] FindNextFileW (in: hFindFile=0x4f9820, lpFindFileData=0x24dfd20 | out: lpFindFileData=0x24dfd20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe312db80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe312db80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xffff, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0139.215] GetProcessHeap () returned 0x4e0000 [0139.215] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x32) returned 0x522e98 [0139.215] FindFirstFileW (in: lpFileName="C:\\Program Files\\*.*", lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe312db80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe312db80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x522f18 [0139.215] GetProcessHeap () returned 0x4e0000 [0139.215] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x522e98 | out: hHeap=0x4e0000) returned 1 [0139.215] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe312db80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe312db80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0139.215] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xddbc8640, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xddbc8640, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0139.215] GetProcessHeap () returned 0x4e0000 [0139.215] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x234) returned 0x521520 [0139.215] GetProcessHeap () returned 0x4e0000 [0139.215] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x4c) returned 0x4fd470 [0139.215] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\*.*", lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xddbc8640, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xddbc8640, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522e98 [0139.215] GetProcessHeap () returned 0x4e0000 [0139.215] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fd470 | out: hHeap=0x4e0000) returned 1 [0139.215] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xddbc8640, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xddbc8640, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0139.215] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DESIGNER", cAlternateFileName="")) returned 1 [0139.215] GetProcessHeap () returned 0x4e0000 [0139.215] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x24e) returned 0x522768 [0139.215] GetProcessHeap () returned 0x4e0000 [0139.215] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x5e) returned 0x4fca30 [0139.215] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\*.*", lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522ed8 [0139.216] GetProcessHeap () returned 0x4e0000 [0139.216] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fca30 | out: hHeap=0x4e0000) returned 1 [0139.216] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0139.216] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 1 [0139.216] GetProcessHeap () returned 0x4e0000 [0139.216] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x260) returned 0x5229c0 [0139.216] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 0 [0139.216] FindClose (in: hFindFile=0x522ed8 | out: hFindFile=0x522ed8) returned 1 [0139.216] GetProcessHeap () returned 0x4e0000 [0139.216] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5229c0 | out: hHeap=0x4e0000) returned 1 [0139.216] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25d81140, ftCreationTime.dwHighDateTime=0x1d5a5f7, ftLastAccessTime.dwLowDateTime=0x7980a690, ftLastAccessTime.dwHighDateTime=0x1d5a5ac, ftLastWriteTime.dwLowDateTime=0x7980a690, ftLastWriteTime.dwHighDateTime=0x1d5a5ac, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="influence-yr-pizza.exe", cAlternateFileName="INFLUE~1.EXE")) returned 1 [0139.216] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft Shared", cAlternateFileName="MICROS~1")) returned 1 [0139.216] GetProcessHeap () returned 0x4e0000 [0139.216] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e) returned 0x4fa058 [0139.216] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522ed8 [0139.216] GetProcessHeap () returned 0x4e0000 [0139.217] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0139.217] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0139.217] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DW", cAlternateFileName="")) returned 1 [0139.217] GetProcessHeap () returned 0x4e0000 [0139.217] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x270) returned 0x5229c0 [0139.217] GetProcessHeap () returned 0x4e0000 [0139.217] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x74) returned 0x4f1b18 [0139.217] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\*.*", lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f58 [0139.220] GetProcessHeap () returned 0x4e0000 [0139.220] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1b18 | out: hHeap=0x4e0000) returned 1 [0139.220] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0139.220] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a0ba500, ftCreationTime.dwHighDateTime=0x1c982ad, ftLastAccessTime.dwLowDateTime=0x6086b2d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4a0ba500, ftLastWriteTime.dwHighDateTime=0x1c982ad, nFileSizeHigh=0x0, nFileSizeLow=0x14e760, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DBGHELP.DLL", cAlternateFileName="")) returned 1 [0139.220] GetProcessHeap () returned 0x4e0000 [0139.220] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x276) returned 0x525e90 [0139.220] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f8f7000, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdb9ec040, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2f8f7000, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0xf2b88, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0139.220] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5e4300, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdbe62980, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2e5e4300, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0x99ba0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DWTRIG20.EXE", cAlternateFileName="")) returned 1 [0139.220] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5e4300, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdbe62980, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2e5e4300, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0x99ba0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DWTRIG20.EXE", cAlternateFileName="")) returned 0 [0139.221] FindClose (in: hFindFile=0x522f58 | out: hFindFile=0x522f58) returned 1 [0139.221] GetProcessHeap () returned 0x4e0000 [0139.221] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x525e90 | out: hHeap=0x4e0000) returned 1 [0139.221] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EQUATION", cAlternateFileName="")) returned 1 [0139.221] GetProcessHeap () returned 0x4e0000 [0139.221] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x80) returned 0x4fa058 [0139.221] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*.*", lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f58 [0139.221] GetProcessHeap () returned 0x4e0000 [0139.221] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0139.221] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0139.221] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 1 [0139.221] GetProcessHeap () returned 0x4e0000 [0139.221] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x282) returned 0x525e90 [0139.221] GetProcessHeap () returned 0x4e0000 [0139.221] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8a) returned 0x4fa058 [0139.221] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0139.222] GetProcessHeap () returned 0x4e0000 [0139.222] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0139.223] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0139.223] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723f8e00, ftCreationTime.dwHighDateTime=0x1c2e156, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x723f8e00, ftLastWriteTime.dwHighDateTime=0x1c2e156, nFileSizeHigh=0x0, nFileSizeLow=0xfa60, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EEINTL.DLL", cAlternateFileName="")) returned 1 [0139.223] GetProcessHeap () returned 0x4e0000 [0139.223] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x28c) returned 0x527128 [0139.223] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723f8e00, ftCreationTime.dwHighDateTime=0x1c2e156, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x723f8e00, ftLastWriteTime.dwHighDateTime=0x1c2e156, nFileSizeHigh=0x0, nFileSizeLow=0xfa60, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EEINTL.DLL", cAlternateFileName="")) returned 0 [0139.223] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0139.223] GetProcessHeap () returned 0x4e0000 [0139.223] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527128 | out: hHeap=0x4e0000) returned 1 [0139.223] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d107e00, ftCreationTime.dwHighDateTime=0x1bb541c, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5d107e00, ftLastWriteTime.dwHighDateTime=0x1bb541c, nFileSizeHigh=0x0, nFileSizeLow=0x9fd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EQNEDT32.CNT", cAlternateFileName="")) returned 1 [0139.223] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0139.224] GetProcessHeap () returned 0x4e0000 [0139.224] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0139.224] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0139.224] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0139.224] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x3, lpOverlapped=0x0) returned 1 [0139.226] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0139.226] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0139.226] GetProcessHeap () returned 0x4e0000 [0139.226] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0139.226] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0139.226] CryptDestroyKey (hKey=0x522f98) returned 1 [0139.226] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0139.226] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0139.226] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0139.227] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0139.227] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0139.227] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0139.227] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0139.227] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0139.227] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.227] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x9fd, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x9fd, lpOverlapped=0x0) returned 1 [0139.227] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa00, dwBufLen=0xa00 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa00) returned 1 [0139.227] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.227] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xa00, lpOverlapped=0x0) returned 1 [0139.227] CryptDestroyKey (hKey=0x522f98) returned 1 [0139.227] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.227] SetEndOfFile (hFile=0xdc) returned 1 [0139.229] GetProcessHeap () returned 0x4e0000 [0139.229] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0139.229] GetProcessHeap () returned 0x4e0000 [0139.229] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0139.230] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0139.231] CloseHandle (hObject=0xdc) returned 1 [0139.231] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28305200, ftCreationTime.dwHighDateTime=0x1c2f1c2, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x28305200, ftLastWriteTime.dwHighDateTime=0x1c2f1c2, nFileSizeHigh=0x0, nFileSizeLow=0x84a48, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EQNEDT32.EXE", cAlternateFileName="")) returned 1 [0139.231] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3acd3b00, ftCreationTime.dwHighDateTime=0x1c6cca0, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3acd3b00, ftLastWriteTime.dwHighDateTime=0x1c6cca0, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eqnedt32.exe.manifest", cAlternateFileName="EQNEDT~1.MAN")) returned 1 [0139.231] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0139.277] GetProcessHeap () returned 0x4e0000 [0139.277] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0139.277] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0139.278] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0139.278] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0139.279] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0139.279] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0139.279] GetProcessHeap () returned 0x4e0000 [0139.279] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x50) returned 0x4fd470 [0139.279] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fd470*, pdwDataLen=0x24df238*=0x50, dwBufLen=0x50 | out: pbData=0x4fd470*, pdwDataLen=0x24df238*=0x50) returned 1 [0139.279] CryptDestroyKey (hKey=0x522f98) returned 1 [0139.279] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd470*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd470*, lpNumberOfBytesWritten=0x24df258*=0x50, lpOverlapped=0x0) returned 1 [0139.279] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0139.279] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0139.279] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0139.280] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0139.280] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0139.280] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0139.280] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0139.280] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.280] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x236, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x236, lpOverlapped=0x0) returned 1 [0139.280] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x240, dwBufLen=0x240 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x240) returned 1 [0139.280] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.280] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x240, lpOverlapped=0x0) returned 1 [0139.280] CryptDestroyKey (hKey=0x522f98) returned 1 [0139.280] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x324, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.280] SetEndOfFile (hFile=0xdc) returned 1 [0139.282] GetProcessHeap () returned 0x4e0000 [0139.282] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fd470 | out: hHeap=0x4e0000) returned 1 [0139.282] GetProcessHeap () returned 0x4e0000 [0139.282] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0139.282] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0139.283] CloseHandle (hObject=0xdc) returned 1 [0139.283] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bd0200, ftCreationTime.dwHighDateTime=0x1be1298, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3bd0200, ftLastWriteTime.dwHighDateTime=0x1be1298, nFileSizeHigh=0x0, nFileSizeLow=0x2b0b7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EQNEDT32.HLP", cAlternateFileName="")) returned 1 [0139.283] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0139.284] GetProcessHeap () returned 0x4e0000 [0139.284] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0139.284] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0139.284] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0139.284] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x9, lpOverlapped=0x0) returned 1 [0139.324] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0139.324] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0139.324] GetProcessHeap () returned 0x4e0000 [0139.324] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0139.324] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0139.324] CryptDestroyKey (hKey=0x522f98) returned 1 [0139.324] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0139.324] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0139.325] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0139.325] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0139.325] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0139.325] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0139.325] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0139.325] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0139.325] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.325] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2b0b7, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2b0b7, lpOverlapped=0x0) returned 1 [0139.327] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2b0c0, dwBufLen=0x2b0c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2b0c0) returned 1 [0139.328] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.328] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2b0c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2b0c0, lpOverlapped=0x0) returned 1 [0139.329] CryptDestroyKey (hKey=0x522f98) returned 1 [0139.329] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2b194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.329] SetEndOfFile (hFile=0xdc) returned 1 [0139.332] GetProcessHeap () returned 0x4e0000 [0139.332] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0139.332] GetProcessHeap () returned 0x4e0000 [0139.332] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0139.332] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0139.333] CloseHandle (hObject=0xdc) returned 1 [0139.333] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fd7600, ftCreationTime.dwHighDateTime=0x1bc9dc7, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x95fd7600, ftLastWriteTime.dwHighDateTime=0x1bc9dc7, nFileSizeHigh=0x0, nFileSizeLow=0x1de8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MTEXTRA.TTF", cAlternateFileName="")) returned 1 [0139.333] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0139.334] GetProcessHeap () returned 0x4e0000 [0139.334] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0139.334] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0139.334] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0139.334] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0139.335] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0139.335] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0139.335] GetProcessHeap () returned 0x4e0000 [0139.336] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0139.336] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0139.336] CryptDestroyKey (hKey=0x522f98) returned 1 [0139.336] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0139.336] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0139.336] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0139.336] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0139.336] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0139.336] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0139.336] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0139.336] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0139.336] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.336] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1de8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1de8, lpOverlapped=0x0) returned 1 [0139.337] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1df0, dwBufLen=0x1df0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1df0) returned 1 [0139.337] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.337] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1df0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1df0, lpOverlapped=0x0) returned 1 [0139.337] CryptDestroyKey (hKey=0x522f98) returned 1 [0139.337] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1ec4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.337] SetEndOfFile (hFile=0xdc) returned 1 [0139.339] GetProcessHeap () returned 0x4e0000 [0139.339] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0139.340] GetProcessHeap () returned 0x4e0000 [0139.340] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0139.340] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0139.340] CloseHandle (hObject=0xdc) returned 1 [0139.340] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fd7600, ftCreationTime.dwHighDateTime=0x1bc9dc7, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x95fd7600, ftLastWriteTime.dwHighDateTime=0x1bc9dc7, nFileSizeHigh=0x0, nFileSizeLow=0x1de8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MTEXTRA.TTF", cAlternateFileName="")) returned 0 [0139.340] GetProcessHeap () returned 0x4e0000 [0139.340] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0139.340] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df248, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f98) returned 1 [0139.341] CryptDecrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df2b0 | out: pbData=0x4f53d8, pdwDataLen=0x24df2b0) returned 1 [0139.341] CryptDestroyKey (hKey=0x522f98) returned 1 [0139.341] GetProcessHeap () returned 0x4e0000 [0139.341] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0139.341] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df248, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f98) returned 1 [0139.341] CryptDecrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df2b0 | out: pbData=0x4f5420, pdwDataLen=0x24df2b0) returned 1 [0139.341] CryptDestroyKey (hKey=0x522f98) returned 1 [0139.341] GetProcessHeap () returned 0x4e0000 [0139.341] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x526120 [0139.341] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df248, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f98) returned 1 [0139.341] CryptDecrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x526120, pdwDataLen=0x24df2b0 | out: pbData=0x526120, pdwDataLen=0x24df2b0) returned 1 [0139.341] CryptDestroyKey (hKey=0x522f98) returned 1 [0139.341] wsprintfW (in: param_1=0x24de28c, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\readme-warning.txt") returned 74 [0139.341] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0139.342] WriteFile (in: hFile=0xdc, lpBuffer=0x526120*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24de288, lpOverlapped=0x0 | out: lpBuffer=0x526120*, lpNumberOfBytesWritten=0x24de288*=0x6c3, lpOverlapped=0x0) returned 1 [0139.343] CloseHandle (hObject=0xdc) returned 1 [0139.343] GetProcessHeap () returned 0x4e0000 [0139.343] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x526120 | out: hHeap=0x4e0000) returned 1 [0139.343] GetProcessHeap () returned 0x4e0000 [0139.343] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0139.343] GetProcessHeap () returned 0x4e0000 [0139.343] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0139.343] FindClose (in: hFindFile=0x522f58 | out: hFindFile=0x522f58) returned 1 [0139.343] GetProcessHeap () returned 0x4e0000 [0139.343] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x525e90 | out: hHeap=0x4e0000) returned 1 [0139.343] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EURO", cAlternateFileName="")) returned 1 [0139.343] GetProcessHeap () returned 0x4e0000 [0139.343] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x78) returned 0x4f1b18 [0139.343] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\*.*", lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f58 [0139.347] GetProcessHeap () returned 0x4e0000 [0139.347] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1b18 | out: hHeap=0x4e0000) returned 1 [0139.347] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0139.347] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x7980, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSOEURO.DLL", cAlternateFileName="")) returned 1 [0139.347] GetProcessHeap () returned 0x4e0000 [0139.347] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x27a) returned 0x525e90 [0139.347] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x7980, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSOEURO.DLL", cAlternateFileName="")) returned 0 [0139.347] FindClose (in: hFindFile=0x522f58 | out: hFindFile=0x522f58) returned 1 [0139.347] GetProcessHeap () returned 0x4e0000 [0139.347] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x525e90 | out: hHeap=0x4e0000) returned 1 [0139.347] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Filters", cAlternateFileName="")) returned 1 [0139.347] GetProcessHeap () returned 0x4e0000 [0139.347] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x7e) returned 0x4fa058 [0139.347] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\*.*", lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f58 [0139.348] GetProcessHeap () returned 0x4e0000 [0139.348] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0139.348] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0139.348] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x9770, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msgfilt.dll", cAlternateFileName="")) returned 1 [0139.348] GetProcessHeap () returned 0x4e0000 [0139.349] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x280) returned 0x525e90 [0139.349] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x6b29d7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x140790, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="odffilt.dll", cAlternateFileName="")) returned 1 [0139.349] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x16af90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="offfiltx.dll", cAlternateFileName="")) returned 1 [0139.349] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46d35b00, ftCreationTime.dwHighDateTime=0x1cba077, ftLastAccessTime.dwLowDateTime=0xd9e40080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x46d35b00, ftLastWriteTime.dwHighDateTime=0x1cba077, nFileSizeHigh=0x0, nFileSizeLow=0x206b78, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VISFILT.DLL", cAlternateFileName="")) returned 1 [0139.349] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46d35b00, ftCreationTime.dwHighDateTime=0x1cba077, ftLastAccessTime.dwLowDateTime=0xd9e40080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x46d35b00, ftLastWriteTime.dwHighDateTime=0x1cba077, nFileSizeHigh=0x0, nFileSizeLow=0x206b78, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VISFILT.DLL", cAlternateFileName="")) returned 0 [0139.349] FindClose (in: hFindFile=0x522f58 | out: hFindFile=0x522f58) returned 1 [0139.349] GetProcessHeap () returned 0x4e0000 [0139.349] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x525e90 | out: hHeap=0x4e0000) returned 1 [0139.349] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="GRPHFLT", cAlternateFileName="")) returned 1 [0139.349] GetProcessHeap () returned 0x4e0000 [0139.349] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x7e) returned 0x4fa058 [0139.349] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*.*", lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f58 [0139.351] GetProcessHeap () returned 0x4e0000 [0139.351] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0139.351] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0139.351] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x1a9b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CGMIMP32.CFG", cAlternateFileName="")) returned 1 [0139.351] GetProcessHeap () returned 0x4e0000 [0139.352] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x280) returned 0x525e90 [0139.352] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0139.352] GetProcessHeap () returned 0x4e0000 [0139.352] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0139.352] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0139.352] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0139.352] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x5, lpOverlapped=0x0) returned 1 [0139.354] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0139.354] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0139.354] GetProcessHeap () returned 0x4e0000 [0139.354] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0139.354] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0139.354] CryptDestroyKey (hKey=0x522f98) returned 1 [0139.354] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0139.354] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0139.354] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0139.354] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0139.354] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0139.354] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0139.354] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0139.354] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0139.355] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.355] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1a9b, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1a9b, lpOverlapped=0x0) returned 1 [0139.356] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1aa0, dwBufLen=0x1aa0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1aa0) returned 1 [0139.356] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.356] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1aa0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1aa0, lpOverlapped=0x0) returned 1 [0139.356] CryptDestroyKey (hKey=0x522f98) returned 1 [0139.356] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1b74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.356] SetEndOfFile (hFile=0xdc) returned 1 [0139.358] GetProcessHeap () returned 0x4e0000 [0139.358] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0139.358] GetProcessHeap () returned 0x4e0000 [0139.358] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0139.358] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0139.359] CloseHandle (hObject=0xdc) returned 1 [0139.359] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfda4ec00, ftCreationTime.dwHighDateTime=0x1cba021, ftLastAccessTime.dwLowDateTime=0xc22488c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xfda4ec00, ftLastWriteTime.dwHighDateTime=0x1cba021, nFileSizeHigh=0x0, nFileSizeLow=0x4f160, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CGMIMP32.FLT", cAlternateFileName="")) returned 1 [0139.359] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0139.360] GetProcessHeap () returned 0x4e0000 [0139.360] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0139.360] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0139.360] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0139.360] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0139.360] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0139.360] GetProcessHeap () returned 0x4e0000 [0139.360] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0139.360] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0139.360] CryptDestroyKey (hKey=0x522f98) returned 1 [0139.360] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0139.362] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0139.362] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0139.362] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0139.362] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0139.362] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0139.362] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0139.362] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0139.362] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.362] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4f160, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4f160, lpOverlapped=0x0) returned 1 [0139.419] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4f160, dwBufLen=0x4f160 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4f160) returned 1 [0139.422] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.422] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4f160, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4f160, lpOverlapped=0x0) returned 1 [0139.423] CryptDestroyKey (hKey=0x522f98) returned 1 [0139.423] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4f234, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.423] SetEndOfFile (hFile=0xdc) returned 1 [0139.425] GetProcessHeap () returned 0x4e0000 [0139.425] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0139.425] GetProcessHeap () returned 0x4e0000 [0139.425] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0139.425] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0139.426] CloseHandle (hObject=0xdc) returned 1 [0139.426] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x93f6e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CGMIMP32.FNT", cAlternateFileName="")) returned 1 [0139.426] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0139.458] GetProcessHeap () returned 0x4e0000 [0139.458] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0139.459] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0139.459] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0139.459] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0139.460] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0139.460] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0139.460] GetProcessHeap () returned 0x4e0000 [0139.460] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0139.461] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0139.461] CryptDestroyKey (hKey=0x522f98) returned 1 [0139.461] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0139.461] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0139.461] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0139.461] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0139.461] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0139.461] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0139.461] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0139.461] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0139.461] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.461] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x93f6e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x93f6e, lpOverlapped=0x0) returned 1 [0139.467] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x93f70, dwBufLen=0x93f70 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x93f70) returned 1 [0139.472] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.472] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x93f70, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x93f70, lpOverlapped=0x0) returned 1 [0139.474] CryptDestroyKey (hKey=0x522f98) returned 1 [0139.474] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x94044, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.474] SetEndOfFile (hFile=0xdc) returned 1 [0139.476] GetProcessHeap () returned 0x4e0000 [0139.476] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0139.476] GetProcessHeap () returned 0x4e0000 [0139.476] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0139.477] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0139.477] CloseHandle (hObject=0xdc) returned 1 [0139.477] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0xadf90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EPSIMP32.FLT", cAlternateFileName="")) returned 1 [0139.477] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0139.477] GetProcessHeap () returned 0x4e0000 [0139.478] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0139.478] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0139.478] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0139.478] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0139.478] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0139.478] GetProcessHeap () returned 0x4e0000 [0139.478] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0139.478] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0139.478] CryptDestroyKey (hKey=0x522f98) returned 1 [0139.478] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0139.480] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0139.480] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0139.480] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0139.480] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0139.480] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0139.480] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0139.480] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0139.480] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.480] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xadf90, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xadf90, lpOverlapped=0x0) returned 1 [0139.487] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xadf90, dwBufLen=0xadf90 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xadf90) returned 1 [0139.493] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.493] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xadf90, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xadf90, lpOverlapped=0x0) returned 1 [0139.495] CryptDestroyKey (hKey=0x522f98) returned 1 [0139.495] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xae064, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.495] SetEndOfFile (hFile=0xdc) returned 1 [0139.498] GetProcessHeap () returned 0x4e0000 [0139.498] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0139.498] GetProcessHeap () returned 0x4e0000 [0139.498] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0139.498] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0139.499] CloseHandle (hObject=0xdc) returned 1 [0139.499] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x4e380, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="GIFIMP32.FLT", cAlternateFileName="")) returned 1 [0139.499] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0139.500] GetProcessHeap () returned 0x4e0000 [0139.500] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0139.500] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0139.500] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0139.500] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0139.500] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0139.500] GetProcessHeap () returned 0x4e0000 [0139.500] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0139.500] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0139.500] CryptDestroyKey (hKey=0x522f98) returned 1 [0139.500] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0139.502] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0139.502] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0139.502] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0139.502] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0139.502] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0139.503] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0139.503] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0139.503] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.503] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4e380, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4e380, lpOverlapped=0x0) returned 1 [0139.507] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4e380, dwBufLen=0x4e380 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4e380) returned 1 [0139.509] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.510] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4e380, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4e380, lpOverlapped=0x0) returned 1 [0139.510] CryptDestroyKey (hKey=0x522f98) returned 1 [0139.511] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4e454, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.511] SetEndOfFile (hFile=0xdc) returned 1 [0139.513] GetProcessHeap () returned 0x4e0000 [0139.513] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0139.513] GetProcessHeap () returned 0x4e0000 [0139.513] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0139.513] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0139.514] CloseHandle (hObject=0xdc) returned 1 [0139.514] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x3ad80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="JPEGIM32.FLT", cAlternateFileName="")) returned 1 [0139.514] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0139.515] GetProcessHeap () returned 0x4e0000 [0139.515] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0139.515] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0139.515] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0139.515] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0139.515] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0139.515] GetProcessHeap () returned 0x4e0000 [0139.515] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0139.515] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0139.515] CryptDestroyKey (hKey=0x522f98) returned 1 [0139.515] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0139.517] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0139.517] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0139.517] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0139.517] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0139.517] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0139.517] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0139.517] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0139.517] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.517] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3ad80, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3ad80, lpOverlapped=0x0) returned 1 [0139.519] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3ad80, dwBufLen=0x3ad80 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3ad80) returned 1 [0139.521] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.521] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3ad80, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3ad80, lpOverlapped=0x0) returned 1 [0139.522] CryptDestroyKey (hKey=0x522f98) returned 1 [0139.522] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3ae54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.522] SetEndOfFile (hFile=0xdc) returned 1 [0139.526] GetProcessHeap () returned 0x4e0000 [0139.526] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0139.526] GetProcessHeap () returned 0x4e0000 [0139.526] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0139.526] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0139.527] CloseHandle (hObject=0xdc) returned 1 [0139.527] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x774, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MS.CGM", cAlternateFileName="")) returned 1 [0139.527] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0139.530] GetProcessHeap () returned 0x4e0000 [0139.530] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0139.530] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0139.530] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0139.530] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0139.532] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0139.532] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0139.532] GetProcessHeap () returned 0x4e0000 [0139.532] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0139.532] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0139.532] CryptDestroyKey (hKey=0x522f98) returned 1 [0139.532] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0139.532] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0139.532] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0139.532] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0139.532] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0139.532] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0139.532] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0139.532] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0139.533] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.533] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x774, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x774, lpOverlapped=0x0) returned 1 [0139.533] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x780, dwBufLen=0x780 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x780) returned 1 [0139.533] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.533] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x780, lpOverlapped=0x0) returned 1 [0139.533] CryptDestroyKey (hKey=0x522f98) returned 1 [0139.533] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x844, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.533] SetEndOfFile (hFile=0xdc) returned 1 [0139.535] GetProcessHeap () returned 0x4e0000 [0139.535] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0139.535] GetProcessHeap () returned 0x4e0000 [0139.535] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0139.535] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0139.536] CloseHandle (hObject=0xdc) returned 1 [0139.536] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x3adb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MS.EPS", cAlternateFileName="")) returned 1 [0139.536] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0139.536] GetProcessHeap () returned 0x4e0000 [0139.536] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0139.536] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0139.536] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0139.536] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x5, lpOverlapped=0x0) returned 1 [0139.538] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0139.538] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0139.538] GetProcessHeap () returned 0x4e0000 [0139.538] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0139.538] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0139.538] CryptDestroyKey (hKey=0x522f98) returned 1 [0139.538] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0139.538] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0139.538] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0139.538] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0139.538] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0139.538] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0139.539] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0139.539] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0139.539] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.539] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3adb, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3adb, lpOverlapped=0x0) returned 1 [0139.540] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3ae0, dwBufLen=0x3ae0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3ae0) returned 1 [0139.540] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.540] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3ae0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3ae0, lpOverlapped=0x0) returned 1 [0139.540] CryptDestroyKey (hKey=0x522f98) returned 1 [0139.540] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3ba4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.540] SetEndOfFile (hFile=0xdc) returned 1 [0139.543] GetProcessHeap () returned 0x4e0000 [0139.543] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0139.543] GetProcessHeap () returned 0x4e0000 [0139.543] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0139.543] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0139.544] CloseHandle (hObject=0xdc) returned 1 [0139.544] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x42d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MS.GIF", cAlternateFileName="")) returned 1 [0139.544] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0139.544] GetProcessHeap () returned 0x4e0000 [0139.544] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0139.544] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0139.544] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0139.544] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x3, lpOverlapped=0x0) returned 1 [0139.546] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0139.546] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0139.546] GetProcessHeap () returned 0x4e0000 [0139.546] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0139.546] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0139.546] CryptDestroyKey (hKey=0x522f98) returned 1 [0139.546] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0139.546] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0139.546] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0139.546] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0139.546] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0139.546] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0139.547] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0139.547] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0139.547] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.547] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x42d, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x42d, lpOverlapped=0x0) returned 1 [0139.547] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x430, dwBufLen=0x430 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x430) returned 1 [0139.547] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.547] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x430, lpOverlapped=0x0) returned 1 [0139.547] CryptDestroyKey (hKey=0x522f98) returned 1 [0139.547] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.547] SetEndOfFile (hFile=0xdc) returned 1 [0139.549] GetProcessHeap () returned 0x4e0000 [0139.549] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0139.549] GetProcessHeap () returned 0x4e0000 [0139.549] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0139.549] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0139.550] CloseHandle (hObject=0xdc) returned 1 [0139.550] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x425, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MS.JPG", cAlternateFileName="")) returned 1 [0139.550] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0139.551] GetProcessHeap () returned 0x4e0000 [0139.551] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0139.551] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0139.551] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0139.551] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xb, lpOverlapped=0x0) returned 1 [0139.553] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0139.553] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0139.553] GetProcessHeap () returned 0x4e0000 [0139.553] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0139.553] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0139.553] CryptDestroyKey (hKey=0x522f98) returned 1 [0139.553] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0139.553] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0139.553] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0139.553] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0139.553] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0139.553] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0139.553] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0139.553] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0139.553] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.553] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x425, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x425, lpOverlapped=0x0) returned 1 [0139.553] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x430, dwBufLen=0x430 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x430) returned 1 [0139.553] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.554] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x430, lpOverlapped=0x0) returned 1 [0139.554] CryptDestroyKey (hKey=0x522f98) returned 1 [0139.554] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.554] SetEndOfFile (hFile=0xdc) returned 1 [0139.556] GetProcessHeap () returned 0x4e0000 [0139.556] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0139.556] GetProcessHeap () returned 0x4e0000 [0139.556] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0139.556] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0139.556] CloseHandle (hObject=0xdc) returned 1 [0139.556] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x692, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MS.PNG", cAlternateFileName="")) returned 1 [0139.557] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0139.557] GetProcessHeap () returned 0x4e0000 [0139.557] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0139.557] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0139.557] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0139.557] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0139.559] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0139.559] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0139.559] GetProcessHeap () returned 0x4e0000 [0139.559] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0139.559] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0139.559] CryptDestroyKey (hKey=0x522f98) returned 1 [0139.559] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0139.559] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0139.559] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0139.559] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0139.559] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0139.559] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0139.559] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0139.560] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0139.560] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.560] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x692, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x692, lpOverlapped=0x0) returned 1 [0139.560] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6a0, dwBufLen=0x6a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6a0) returned 1 [0139.560] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.560] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x6a0, lpOverlapped=0x0) returned 1 [0139.560] CryptDestroyKey (hKey=0x522f98) returned 1 [0139.560] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x764, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.560] SetEndOfFile (hFile=0xdc) returned 1 [0139.562] GetProcessHeap () returned 0x4e0000 [0139.562] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0139.562] GetProcessHeap () returned 0x4e0000 [0139.562] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0139.562] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0139.563] CloseHandle (hObject=0xdc) returned 1 [0139.563] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MS.WPG", cAlternateFileName="")) returned 1 [0139.563] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0139.563] GetProcessHeap () returned 0x4e0000 [0139.563] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0139.563] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0139.563] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0139.563] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0139.565] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0139.565] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0139.565] GetProcessHeap () returned 0x4e0000 [0139.565] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0139.565] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0139.565] CryptDestroyKey (hKey=0x522f98) returned 1 [0139.565] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0139.565] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0139.565] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0139.566] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0139.566] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0139.566] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0139.566] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0139.566] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0139.566] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.566] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x566, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x566, lpOverlapped=0x0) returned 1 [0139.566] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x570, dwBufLen=0x570 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x570) returned 1 [0139.566] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.566] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x570, lpOverlapped=0x0) returned 1 [0139.566] CryptDestroyKey (hKey=0x522f98) returned 1 [0139.566] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x634, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.566] SetEndOfFile (hFile=0xdc) returned 1 [0139.568] GetProcessHeap () returned 0x4e0000 [0139.568] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0139.568] GetProcessHeap () returned 0x4e0000 [0139.568] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0139.568] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0139.573] CloseHandle (hObject=0xdc) returned 1 [0139.573] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x11d78, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PICTIM32.FLT", cAlternateFileName="")) returned 1 [0139.573] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0139.585] GetProcessHeap () returned 0x4e0000 [0139.585] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0139.585] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0139.585] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0139.585] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0139.587] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0139.587] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0139.587] GetProcessHeap () returned 0x4e0000 [0139.587] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0139.587] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0139.587] CryptDestroyKey (hKey=0x522f98) returned 1 [0139.587] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0139.587] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0139.587] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0139.588] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0139.588] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0139.588] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0139.588] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0139.588] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0139.588] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.588] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x11d78, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x11d78, lpOverlapped=0x0) returned 1 [0139.589] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x11d80, dwBufLen=0x11d80 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x11d80) returned 1 [0139.590] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.590] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x11d80, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x11d80, lpOverlapped=0x0) returned 1 [0139.590] CryptDestroyKey (hKey=0x522f98) returned 1 [0139.590] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x11e54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.590] SetEndOfFile (hFile=0xdc) returned 1 [0139.593] GetProcessHeap () returned 0x4e0000 [0139.593] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0139.593] GetProcessHeap () returned 0x4e0000 [0139.593] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0139.593] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0139.594] CloseHandle (hObject=0xdc) returned 1 [0139.594] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x49f80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PNG32.FLT", cAlternateFileName="")) returned 1 [0139.594] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0139.594] GetProcessHeap () returned 0x4e0000 [0139.594] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0139.594] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0139.594] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0139.595] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0139.595] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0139.595] GetProcessHeap () returned 0x4e0000 [0139.595] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0139.595] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0139.595] CryptDestroyKey (hKey=0x522f98) returned 1 [0139.595] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0139.597] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0139.597] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0139.597] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0139.597] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0139.597] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0139.597] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0139.597] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0139.597] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.597] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x49f80, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x49f80, lpOverlapped=0x0) returned 1 [0139.601] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x49f80, dwBufLen=0x49f80 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x49f80) returned 1 [0139.603] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.603] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x49f80, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x49f80, lpOverlapped=0x0) returned 1 [0139.604] CryptDestroyKey (hKey=0x522f98) returned 1 [0139.604] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4a044, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.604] SetEndOfFile (hFile=0xdc) returned 1 [0139.607] GetProcessHeap () returned 0x4e0000 [0139.607] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0139.607] GetProcessHeap () returned 0x4e0000 [0139.607] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0139.607] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0139.607] CloseHandle (hObject=0xdc) returned 1 [0139.608] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53d4900, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd53d4900, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x44780, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WPGIMP32.FLT", cAlternateFileName="")) returned 1 [0139.608] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0139.609] GetProcessHeap () returned 0x4e0000 [0139.609] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0139.609] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0139.609] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0139.609] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0139.609] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0139.609] GetProcessHeap () returned 0x4e0000 [0139.609] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0139.610] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0139.610] CryptDestroyKey (hKey=0x522f98) returned 1 [0139.610] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0139.611] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0139.611] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0139.611] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0139.611] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0139.611] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0139.612] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0139.612] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0139.612] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.612] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x44780, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x44780, lpOverlapped=0x0) returned 1 [0139.615] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x44780, dwBufLen=0x44780 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x44780) returned 1 [0139.617] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.617] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x44780, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x44780, lpOverlapped=0x0) returned 1 [0139.618] CryptDestroyKey (hKey=0x522f98) returned 1 [0139.618] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x44854, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.618] SetEndOfFile (hFile=0xdc) returned 1 [0139.621] GetProcessHeap () returned 0x4e0000 [0139.621] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0139.621] GetProcessHeap () returned 0x4e0000 [0139.621] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0139.621] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0139.621] CloseHandle (hObject=0xdc) returned 1 [0139.621] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53d4900, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd53d4900, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x44780, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WPGIMP32.FLT", cAlternateFileName="")) returned 0 [0139.622] GetProcessHeap () returned 0x4e0000 [0139.622] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0139.622] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df248, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f98) returned 1 [0139.622] CryptDecrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df2b0 | out: pbData=0x4f53d8, pdwDataLen=0x24df2b0) returned 1 [0139.622] CryptDestroyKey (hKey=0x522f98) returned 1 [0139.622] GetProcessHeap () returned 0x4e0000 [0139.622] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0139.622] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df248, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f98) returned 1 [0139.622] CryptDecrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df2b0 | out: pbData=0x4f5420, pdwDataLen=0x24df2b0) returned 1 [0139.622] CryptDestroyKey (hKey=0x522f98) returned 1 [0139.622] GetProcessHeap () returned 0x4e0000 [0139.622] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x526118 [0139.622] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df248, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f98) returned 1 [0139.622] CryptDecrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x526118, pdwDataLen=0x24df2b0 | out: pbData=0x526118, pdwDataLen=0x24df2b0) returned 1 [0139.622] CryptDestroyKey (hKey=0x522f98) returned 1 [0139.622] wsprintfW (in: param_1=0x24de28c, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\readme-warning.txt") returned 73 [0139.622] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0139.623] WriteFile (in: hFile=0xdc, lpBuffer=0x526118*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24de288, lpOverlapped=0x0 | out: lpBuffer=0x526118*, lpNumberOfBytesWritten=0x24de288*=0x6c3, lpOverlapped=0x0) returned 1 [0139.624] CloseHandle (hObject=0xdc) returned 1 [0139.624] GetProcessHeap () returned 0x4e0000 [0139.624] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x526118 | out: hHeap=0x4e0000) returned 1 [0139.624] GetProcessHeap () returned 0x4e0000 [0139.624] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0139.624] GetProcessHeap () returned 0x4e0000 [0139.624] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0139.624] FindClose (in: hFindFile=0x522f58 | out: hFindFile=0x522f58) returned 1 [0139.624] GetProcessHeap () returned 0x4e0000 [0139.624] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x525e90 | out: hHeap=0x4e0000) returned 1 [0139.624] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Help", cAlternateFileName="")) returned 1 [0139.624] GetProcessHeap () returned 0x4e0000 [0139.624] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x78) returned 0x4f1b18 [0139.624] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\*.*", lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f58 [0139.625] GetProcessHeap () returned 0x4e0000 [0139.625] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1b18 | out: hHeap=0x4e0000) returned 1 [0139.625] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0139.625] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x60d54030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x133200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hxds.dll", cAlternateFileName="")) returned 1 [0139.625] GetProcessHeap () returned 0x4e0000 [0139.625] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x27a) returned 0x525e90 [0139.625] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3e47200, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x522dc930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe3e47200, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x1bf200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ITIRCL55.DLL", cAlternateFileName="")) returned 1 [0139.625] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x616b36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x69000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msitss55.dll", cAlternateFileName="")) returned 1 [0139.625] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x616b36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x69000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msitss55.dll", cAlternateFileName="")) returned 0 [0139.625] FindClose (in: hFindFile=0x522f58 | out: hFindFile=0x522f58) returned 1 [0139.628] GetProcessHeap () returned 0x4e0000 [0139.628] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x525e90 | out: hHeap=0x4e0000) returned 1 [0139.628] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ink", cAlternateFileName="")) returned 1 [0139.628] GetProcessHeap () returned 0x4e0000 [0139.628] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x76) returned 0x4f1b18 [0139.628] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f58 [0139.629] GetProcessHeap () returned 0x4e0000 [0139.629] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1b18 | out: hHeap=0x4e0000) returned 1 [0139.629] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0139.629] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2bbccc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c2bbccc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc1486, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Alphabet.xml", cAlternateFileName="")) returned 1 [0139.629] GetProcessHeap () returned 0x4e0000 [0139.629] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x278) returned 0x525e90 [0139.629] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.630] GetLastError () returned 0x5 [0139.630] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ar-SA", cAlternateFileName="")) returned 1 [0139.630] GetProcessHeap () returned 0x4e0000 [0139.630] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x82) returned 0x4fa058 [0139.630] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0139.631] GetProcessHeap () returned 0x4e0000 [0139.631] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0139.631] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.631] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846a08f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe86330eb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8659248, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0139.631] GetProcessHeap () returned 0x4e0000 [0139.631] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x284) returned 0x527118 [0139.631] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.632] GetLastError () returned 0x5 [0139.632] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846a08f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe86330eb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8659248, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0139.632] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0139.632] GetProcessHeap () returned 0x4e0000 [0139.632] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0139.632] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0139.632] GetProcessHeap () returned 0x4e0000 [0139.632] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x82) returned 0x4fa058 [0139.632] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0139.633] GetProcessHeap () returned 0x4e0000 [0139.633] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0139.633] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.633] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1207ac, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea335ac2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea35bc1f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0139.633] GetProcessHeap () returned 0x4e0000 [0139.633] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x284) returned 0x527118 [0139.633] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.633] GetLastError () returned 0x5 [0139.633] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1207ac, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea335ac2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea35bc1f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0139.633] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0139.633] GetProcessHeap () returned 0x4e0000 [0139.633] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0139.633] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90daefa5, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x90daefa5, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Content.xml", cAlternateFileName="")) returned 1 [0139.633] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.634] GetLastError () returned 0x5 [0139.634] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c92176b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c92176b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xdd6ec0f0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2f200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ConvertInkStore.exe", cAlternateFileName="")) returned 1 [0139.634] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0139.634] GetProcessHeap () returned 0x4e0000 [0139.634] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x82) returned 0x4fa058 [0139.634] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0139.634] GetProcessHeap () returned 0x4e0000 [0139.634] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0139.634] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.634] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ce8929, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6f23d9c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6f23d9c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0139.634] GetProcessHeap () returned 0x4e0000 [0139.634] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x284) returned 0x527118 [0139.634] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.634] GetLastError () returned 0x5 [0139.634] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ce8929, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6f23d9c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6f23d9c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0139.634] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0139.635] GetProcessHeap () returned 0x4e0000 [0139.635] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0139.635] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="da-DK", cAlternateFileName="")) returned 1 [0139.635] GetProcessHeap () returned 0x4e0000 [0139.635] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x82) returned 0x4fa058 [0139.635] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0139.635] GetProcessHeap () returned 0x4e0000 [0139.635] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0139.635] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.635] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6fbc310, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe71ab4c9, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe71d1626, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0139.635] GetProcessHeap () returned 0x4e0000 [0139.635] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x284) returned 0x527118 [0139.635] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.635] GetLastError () returned 0x5 [0139.635] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6fbc310, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe71ab4c9, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe71d1626, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0139.636] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0139.636] GetProcessHeap () returned 0x4e0000 [0139.636] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0139.636] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="de-DE", cAlternateFileName="")) returned 1 [0139.636] GetProcessHeap () returned 0x4e0000 [0139.636] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x82) returned 0x4fa058 [0139.636] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0139.637] GetProcessHeap () returned 0x4e0000 [0139.637] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0139.637] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.637] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe728fcf7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe74cb16a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe74cb16a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0139.637] GetProcessHeap () returned 0x4e0000 [0139.637] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x284) returned 0x527118 [0139.637] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.640] GetLastError () returned 0x5 [0139.640] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe728fcf7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe74cb16a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe74cb16a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0139.641] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0139.641] GetProcessHeap () returned 0x4e0000 [0139.641] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0139.641] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="el-GR", cAlternateFileName="")) returned 1 [0139.641] GetProcessHeap () returned 0x4e0000 [0139.641] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x82) returned 0x4fa058 [0139.641] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0139.641] GetProcessHeap () returned 0x4e0000 [0139.641] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0139.641] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.641] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31667d9, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe337baef, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe337baef, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0139.641] GetProcessHeap () returned 0x4e0000 [0139.641] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x284) returned 0x527118 [0139.641] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.642] GetLastError () returned 0x5 [0139.642] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31667d9, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe337baef, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe337baef, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0139.642] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0139.642] GetProcessHeap () returned 0x4e0000 [0139.642] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0139.642] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-US", cAlternateFileName="")) returned 1 [0139.642] GetProcessHeap () returned 0x4e0000 [0139.642] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x82) returned 0x4fa058 [0139.642] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0139.643] GetProcessHeap () returned 0x4e0000 [0139.643] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0139.644] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.644] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a407849, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9a407849, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x9a407849, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x15e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-correct.avi", cAlternateFileName="")) returned 1 [0139.644] GetProcessHeap () returned 0x4e0000 [0139.644] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x284) returned 0x527118 [0139.644] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.644] GetLastError () returned 0x5 [0139.644] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23b3de0, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23b3de0, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a49fdc1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-delete.avi", cAlternateFileName="")) returned 1 [0139.644] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.645] GetLastError () returned 0x5 [0139.645] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23d9f3d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23d9f3d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a4c5f1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x8200, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-join.avi", cAlternateFileName="")) returned 1 [0139.645] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.645] GetLastError () returned 0x5 [0139.645] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24261f7, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24261f7, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a538339, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf600, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-split.avi", cAlternateFileName="")) returned 1 [0139.645] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.645] GetLastError () returned 0x5 [0139.645] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x244c354, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x244c354, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a55e497, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x30200, dwReserved0=0x0, dwReserved1=0x0, cFileName="correct.avi", cAlternateFileName="")) returned 1 [0139.646] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.646] GetLastError () returned 0x5 [0139.646] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24be76b, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24be76b, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5845f5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="delete.avi", cAlternateFileName="")) returned 1 [0139.646] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.646] GetLastError () returned 0x5 [0139.646] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe.mui", cAlternateFileName="")) returned 1 [0139.646] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.647] GetLastError () returned 0x5 [0139.647] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc8723b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdc8723b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll.mui", cAlternateFileName="")) returned 1 [0139.647] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.647] GetLastError () returned 0x5 [0139.647] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkWatson.exe.mui", cAlternateFileName="")) returned 1 [0139.647] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.648] GetLastError () returned 0x5 [0139.648] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization.exe.mui", cAlternateFileName="")) returned 1 [0139.648] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.649] GetLastError () returned 0x5 [0139.649] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x5800, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll.mui", cAlternateFileName="")) returned 1 [0139.649] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.649] GetLastError () returned 0x5 [0139.649] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll.mui", cAlternateFileName="")) returned 1 [0139.649] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.649] GetLastError () returned 0x5 [0139.649] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x250aa25, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x250aa25, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5aa753, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36400, dwReserved0=0x0, dwReserved1=0x0, cFileName="join.avi", cAlternateFileName="")) returned 1 [0139.649] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.649] GetLastError () returned 0x5 [0139.649] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll.mui", cAlternateFileName="")) returned 1 [0139.650] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.650] GetLastError () returned 0x5 [0139.650] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe.mui", cAlternateFileName="")) returned 1 [0139.650] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.650] GetLastError () returned 0x5 [0139.650] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll.mui", cAlternateFileName="")) returned 1 [0139.650] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.651] GetLastError () returned 0x5 [0139.651] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeca1847, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf901a42, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xeca1847, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll.mui", cAlternateFileName="")) returned 1 [0139.651] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.651] GetLastError () returned 0x5 [0139.651] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe.mui", cAlternateFileName="")) returned 1 [0139.651] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.652] GetLastError () returned 0x5 [0139.652] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25c90f6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x25c90f6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5d08b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2f600, dwReserved0=0x0, dwReserved1=0x0, cFileName="split.avi", cAlternateFileName="")) returned 1 [0139.652] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.652] GetLastError () returned 0x5 [0139.652] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa23a9ac, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xa5a884b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xa23a9ac, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tabskb.dll.mui", cAlternateFileName="")) returned 1 [0139.652] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.653] GetLastError () returned 0x5 [0139.653] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipBand.dll.mui", cAlternateFileName="")) returned 1 [0139.653] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipband.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.653] GetLastError () returned 0x5 [0139.653] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll.mui", cAlternateFileName="")) returned 1 [0139.653] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.653] GetLastError () returned 0x5 [0139.653] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5cd75ed, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5f38bbd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5f38bbd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0139.653] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.654] GetLastError () returned 0x5 [0139.654] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 1 [0139.654] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.654] GetLastError () returned 0x5 [0139.654] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 0 [0139.654] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0139.655] GetProcessHeap () returned 0x4e0000 [0139.655] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0139.655] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="es-ES", cAlternateFileName="")) returned 1 [0139.655] GetProcessHeap () returned 0x4e0000 [0139.655] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x82) returned 0x4fa058 [0139.655] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0139.655] GetProcessHeap () returned 0x4e0000 [0139.655] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0139.655] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.655] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe41519b8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe41519b8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0139.655] GetProcessHeap () returned 0x4e0000 [0139.655] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x284) returned 0x527118 [0139.655] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.656] GetLastError () returned 0x5 [0139.656] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe41519b8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe41519b8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0139.656] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0139.656] GetProcessHeap () returned 0x4e0000 [0139.656] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0139.656] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="et-EE", cAlternateFileName="")) returned 1 [0139.656] GetProcessHeap () returned 0x4e0000 [0139.656] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x82) returned 0x4fa058 [0139.656] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0139.657] GetProcessHeap () returned 0x4e0000 [0139.657] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0139.657] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.657] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb4e9cfd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeb74b2cd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeb74b2cd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0139.657] GetProcessHeap () returned 0x4e0000 [0139.657] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x284) returned 0x527118 [0139.657] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.657] GetLastError () returned 0x5 [0139.657] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb4e9cfd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeb74b2cd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeb74b2cd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0139.657] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0139.658] GetProcessHeap () returned 0x4e0000 [0139.658] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0139.658] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0139.658] GetProcessHeap () returned 0x4e0000 [0139.658] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x82) returned 0x4fa058 [0139.658] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0139.658] GetProcessHeap () returned 0x4e0000 [0139.658] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0139.658] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.658] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe47dd5b4, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4a64ce1, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4a64ce1, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0139.658] GetProcessHeap () returned 0x4e0000 [0139.658] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x284) returned 0x527118 [0139.658] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.659] GetLastError () returned 0x5 [0139.659] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe47dd5b4, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4a64ce1, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4a64ce1, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0139.659] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0139.659] GetProcessHeap () returned 0x4e0000 [0139.659] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0139.659] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f4e4a1, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x92f4e4a1, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x92f9a75d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1 [0139.660] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.660] GetLastError () returned 0x5 [0139.660] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c53a9c4, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5c53a9c4, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe29c9700, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xe2800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FlickLearningWizard.exe", cAlternateFileName="")) returned 1 [0139.660] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0139.660] GetProcessHeap () returned 0x4e0000 [0139.660] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x82) returned 0x4fa058 [0139.660] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0139.660] GetProcessHeap () returned 0x4e0000 [0139.660] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0139.660] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.660] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8311729d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8311729d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8311729d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0139.660] GetProcessHeap () returned 0x4e0000 [0139.660] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x284) returned 0x527118 [0139.660] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.661] GetLastError () returned 0x5 [0139.661] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8311729d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8311729d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8311729d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0139.661] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0139.661] GetProcessHeap () returned 0x4e0000 [0139.661] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0139.661] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fsdefinitions", cAlternateFileName="FSDEFI~1")) returned 1 [0139.661] GetProcessHeap () returned 0x4e0000 [0139.661] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x92) returned 0x4fa058 [0139.661] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0139.662] GetProcessHeap () returned 0x4e0000 [0139.662] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0139.662] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.663] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad", cAlternateFileName="")) returned 1 [0139.663] GetProcessHeap () returned 0x4e0000 [0139.663] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x294) returned 0x527118 [0139.663] GetProcessHeap () returned 0x4e0000 [0139.663] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa0) returned 0x4fa058 [0139.663] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\*.*", lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522fd8 [0139.663] GetProcessHeap () returned 0x4e0000 [0139.663] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0139.664] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0139.664] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2d7bf7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2d7bf7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2d7bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="auxbase.xml", cAlternateFileName="")) returned 1 [0139.664] GetProcessHeap () returned 0x4e0000 [0139.664] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2a2) returned 0x5283c0 [0139.664] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.665] GetLastError () returned 0x5 [0139.665] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2d7bf7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2d7bf7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2d7bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="auxbase.xml", cAlternateFileName="")) returned 0 [0139.665] FindClose (in: hFindFile=0x522fd8 | out: hFindFile=0x522fd8) returned 1 [0139.665] GetProcessHeap () returned 0x4e0000 [0139.665] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5283c0 | out: hHeap=0x4e0000) returned 1 [0139.665] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2b1a99, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2b1a99, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2b1a99, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad.xml", cAlternateFileName="")) returned 1 [0139.665] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.665] GetLastError () returned 0x5 [0139.665] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad", cAlternateFileName="")) returned 1 [0139.665] GetProcessHeap () returned 0x4e0000 [0139.665] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa0) returned 0x4fa058 [0139.665] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\*.*", lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522fd8 [0139.665] GetProcessHeap () returned 0x4e0000 [0139.666] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0139.666] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.666] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f4a0c5f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f4a0c5f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea.xml", cAlternateFileName="")) returned 1 [0139.666] GetProcessHeap () returned 0x4e0000 [0139.666] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2a2) returned 0x5283c0 [0139.666] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.666] GetLastError () returned 0x5 [0139.666] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c8fc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1c8fc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x45e, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypadbase.xml", cAlternateFileName="")) returned 1 [0139.666] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.667] GetLastError () returned 0x5 [0139.667] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4ecf1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 1 [0139.667] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.667] GetLastError () returned 0x5 [0139.667] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4ecf1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 0 [0139.667] FindClose (in: hFindFile=0x522fd8 | out: hFindFile=0x522fd8) returned 1 [0139.667] GetProcessHeap () returned 0x4e0000 [0139.667] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5283c0 | out: hHeap=0x4e0000) returned 1 [0139.667] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f47ab01, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f47ab01, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f47ab01, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad.xml", cAlternateFileName="")) returned 1 [0139.667] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.668] GetLastError () returned 0x5 [0139.668] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="main", cAlternateFileName="")) returned 1 [0139.668] GetProcessHeap () returned 0x4e0000 [0139.668] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x9c) returned 0x4fa058 [0139.668] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*.*", lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522fd8 [0139.670] GetProcessHeap () returned 0x4e0000 [0139.670] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0139.670] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.670] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f643b69, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f643b69, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f643b69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="base.xml", cAlternateFileName="")) returned 1 [0139.670] GetProcessHeap () returned 0x4e0000 [0139.670] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x29e) returned 0x5283c0 [0139.670] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.671] GetLastError () returned 0x5 [0139.671] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e7ee29, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e7ee29, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6b5f83, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf7, dwReserved0=0x0, dwReserved1=0x0, cFileName="baseAltGr_rtl.xml", cAlternateFileName="")) returned 1 [0139.671] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.671] GetLastError () returned 0x5 [0139.671] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c8fc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1c8fc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f643b69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc59, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_altgr.xml", cAlternateFileName="")) returned 1 [0139.671] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.672] GetLastError () returned 0x5 [0139.672] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f669cc7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_ca.xml", cAlternateFileName="")) returned 1 [0139.672] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.672] GetLastError () returned 0x5 [0139.672] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cdbf2a, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cdbf2a, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_heb.xml", cAlternateFileName="")) returned 1 [0139.672] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.673] GetLastError () returned 0x5 [0139.673] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d02087, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d02087, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_jpn.xml", cAlternateFileName="")) returned 1 [0139.673] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.673] GetLastError () returned 0x5 [0139.673] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d02087, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d02087, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_kor.xml", cAlternateFileName="")) returned 1 [0139.673] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.674] GetLastError () returned 0x5 [0139.674] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d281e4, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d281e4, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6b5f83, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_rtl.xml", cAlternateFileName="")) returned 1 [0139.674] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.674] GetLastError () returned 0x5 [0139.674] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d4e341, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d4e341, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6dc0e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x40e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp.xml", cAlternateFileName="")) returned 1 [0139.674] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.675] GetLastError () returned 0x5 [0139.675] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d7449e, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d7449e, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f70223f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3af9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr.xml", cAlternateFileName="")) returned 1 [0139.675] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.675] GetLastError () returned 0x5 [0139.675] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d9a5fb, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d9a5fb, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f774659, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x264b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-changjei.xml", cAlternateFileName="")) returned 1 [0139.675] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.676] GetLastError () returned 0x5 [0139.676] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e7ee29, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e7ee29, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2b3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-dayi.xml", cAlternateFileName="")) returned 1 [0139.676] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.676] GetLastError () returned 0x5 [0139.676] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e32b6f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e32b6f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 1 [0139.676] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.677] GetLastError () returned 0x5 [0139.677] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e32b6f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e32b6f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 0 [0139.677] FindClose (in: hFindFile=0x522fd8 | out: hFindFile=0x522fd8) returned 1 [0139.677] GetProcessHeap () returned 0x4e0000 [0139.678] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5283c0 | out: hHeap=0x4e0000) returned 1 [0139.678] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f513079, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f513079, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f513079, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x9655, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.xml", cAlternateFileName="")) returned 1 [0139.678] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.678] GetLastError () returned 0x5 [0139.678] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbers", cAlternateFileName="")) returned 1 [0139.678] GetProcessHeap () returned 0x4e0000 [0139.678] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa2) returned 0x4fa058 [0139.678] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\*.*", lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522fd8 [0139.678] GetProcessHeap () returned 0x4e0000 [0139.678] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0139.678] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.678] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7e6a73, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f7e6a73, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7e6a73, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbase.xml", cAlternateFileName="")) returned 1 [0139.678] GetProcessHeap () returned 0x4e0000 [0139.678] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2a4) returned 0x5283c0 [0139.678] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.678] GetLastError () returned 0x5 [0139.678] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7e6a73, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f7e6a73, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7e6a73, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbase.xml", cAlternateFileName="")) returned 0 [0139.679] FindClose (in: hFindFile=0x522fd8 | out: hFindFile=0x522fd8) returned 1 [0139.679] GetProcessHeap () returned 0x4e0000 [0139.679] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5283c0 | out: hHeap=0x4e0000) returned 1 [0139.679] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f79a7b7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f79a7b7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7c0915, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbers.xml", cAlternateFileName="")) returned 1 [0139.679] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.679] GetLastError () returned 0x5 [0139.679] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenu", cAlternateFileName="")) returned 1 [0139.679] GetProcessHeap () returned 0x4e0000 [0139.679] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa2) returned 0x4fa058 [0139.680] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\*.*", lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522fd8 [0139.680] GetProcessHeap () returned 0x4e0000 [0139.680] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0139.680] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.680] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f832d2f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f832d2f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f858e8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 1 [0139.680] GetProcessHeap () returned 0x4e0000 [0139.680] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2a4) returned 0x5283c0 [0139.680] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.681] GetLastError () returned 0x5 [0139.681] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f832d2f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f832d2f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f858e8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 0 [0139.681] FindClose (in: hFindFile=0x522fd8 | out: hFindFile=0x522fd8) returned 1 [0139.681] GetProcessHeap () returned 0x4e0000 [0139.681] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5283c0 | out: hHeap=0x4e0000) returned 1 [0139.681] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f80cbd1, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f80cbd1, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f832d2f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenu.xml", cAlternateFileName="")) returned 1 [0139.681] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.682] GetLastError () returned 0x5 [0139.682] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpad", cAlternateFileName="OSKNUM~1")) returned 1 [0139.682] GetProcessHeap () returned 0x4e0000 [0139.682] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa6) returned 0x4fa058 [0139.682] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\*.*", lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522fd8 [0139.682] GetProcessHeap () returned 0x4e0000 [0139.682] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0139.682] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.682] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdda123, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdda123, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdda123, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 1 [0139.682] GetProcessHeap () returned 0x4e0000 [0139.682] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2a8) returned 0x5283c0 [0139.682] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.682] GetLastError () returned 0x5 [0139.682] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdda123, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdda123, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdda123, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 0 [0139.682] FindClose (in: hFindFile=0x522fd8 | out: hFindFile=0x522fd8) returned 1 [0139.682] GetProcessHeap () returned 0x4e0000 [0139.682] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5283c0 | out: hHeap=0x4e0000) returned 1 [0139.683] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdb3fc5, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdb3fc5, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdb3fc5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpad.xml", cAlternateFileName="")) returned 1 [0139.683] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.683] GetLastError () returned 0x5 [0139.683] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpred", cAlternateFileName="")) returned 1 [0139.683] GetProcessHeap () returned 0x4e0000 [0139.683] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa2) returned 0x4fa058 [0139.683] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\*.*", lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522fd8 [0139.684] GetProcessHeap () returned 0x4e0000 [0139.684] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0139.684] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.684] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe263df, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe263df, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe263df, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 1 [0139.684] GetProcessHeap () returned 0x4e0000 [0139.684] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2a4) returned 0x5283c0 [0139.684] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.684] GetLastError () returned 0x5 [0139.685] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe263df, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe263df, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe263df, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 0 [0139.685] FindClose (in: hFindFile=0x522fd8 | out: hFindFile=0x522fd8) returned 1 [0139.685] GetProcessHeap () returned 0x4e0000 [0139.685] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5283c0 | out: hHeap=0x4e0000) returned 1 [0139.685] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe00281, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe00281, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe00281, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpred.xml", cAlternateFileName="")) returned 1 [0139.685] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.685] GetLastError () returned 0x5 [0139.685] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbols", cAlternateFileName="")) returned 1 [0139.685] GetProcessHeap () returned 0x4e0000 [0139.685] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa2) returned 0x4fa058 [0139.685] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\*.*", lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522fd8 [0139.685] GetProcessHeap () returned 0x4e0000 [0139.685] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0139.685] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.685] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dc0758, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1dc0758, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x900155a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea-sym.xml", cAlternateFileName="")) returned 1 [0139.685] GetProcessHeap () returned 0x4e0000 [0139.685] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2a4) returned 0x5283c0 [0139.685] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.686] GetLastError () returned 0x5 [0139.686] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d9a5fb, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d9a5fb, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x900155a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp-sym.xml", cAlternateFileName="")) returned 1 [0139.686] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.686] GetLastError () returned 0x5 [0139.686] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9003b703, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9003b703, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xacc, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbase.xml", cAlternateFileName="")) returned 1 [0139.686] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.687] GetLastError () returned 0x5 [0139.687] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9003b703, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9003b703, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xacc, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbase.xml", cAlternateFileName="")) returned 0 [0139.687] FindClose (in: hFindFile=0x522fd8 | out: hFindFile=0x522fd8) returned 1 [0139.687] GetProcessHeap () returned 0x4e0000 [0139.687] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5283c0 | out: hHeap=0x4e0000) returned 1 [0139.687] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe7269b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe7269b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe7269b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbols.xml", cAlternateFileName="")) returned 1 [0139.687] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.687] GetLastError () returned 0x5 [0139.688] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="web", cAlternateFileName="")) returned 1 [0139.688] GetProcessHeap () returned 0x4e0000 [0139.688] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x9a) returned 0x4fa058 [0139.688] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\*.*", lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522fd8 [0139.688] GetProcessHeap () returned 0x4e0000 [0139.688] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0139.688] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.688] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900d3c7b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x900d3c7b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x900f9dd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x48e, dwReserved0=0x0, dwReserved1=0x0, cFileName="webbase.xml", cAlternateFileName="")) returned 1 [0139.689] GetProcessHeap () returned 0x4e0000 [0139.689] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x29c) returned 0x5283c0 [0139.689] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.689] GetLastError () returned 0x5 [0139.689] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900d3c7b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x900d3c7b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x900f9dd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x48e, dwReserved0=0x0, dwReserved1=0x0, cFileName="webbase.xml", cAlternateFileName="")) returned 0 [0139.689] FindClose (in: hFindFile=0x522fd8 | out: hFindFile=0x522fd8) returned 1 [0139.689] GetProcessHeap () returned 0x4e0000 [0139.689] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5283c0 | out: hHeap=0x4e0000) returned 1 [0139.690] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90061861, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x90061861, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="web.xml", cAlternateFileName="")) returned 1 [0139.690] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.690] GetLastError () returned 0x5 [0139.690] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90061861, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x90061861, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="web.xml", cAlternateFileName="")) returned 0 [0139.690] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0139.690] GetProcessHeap () returned 0x4e0000 [0139.690] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0139.690] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="he-IL", cAlternateFileName="")) returned 1 [0139.690] GetProcessHeap () returned 0x4e0000 [0139.690] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x82) returned 0x4fa058 [0139.690] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0139.690] GetProcessHeap () returned 0x4e0000 [0139.690] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0139.690] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.690] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bbf40b, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2dd4721, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2dd4721, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0139.691] GetProcessHeap () returned 0x4e0000 [0139.691] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x284) returned 0x527118 [0139.691] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.691] GetLastError () returned 0x5 [0139.691] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bbf40b, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2dd4721, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2dd4721, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0139.691] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0139.691] GetProcessHeap () returned 0x4e0000 [0139.691] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0139.691] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0139.691] GetProcessHeap () returned 0x4e0000 [0139.691] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x82) returned 0x4fa058 [0139.691] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0139.691] GetProcessHeap () returned 0x4e0000 [0139.691] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0139.691] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.691] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50f08dd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe539e167, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe539e167, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0139.692] GetProcessHeap () returned 0x4e0000 [0139.692] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x284) returned 0x527118 [0139.692] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.692] GetLastError () returned 0x5 [0139.692] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50f08dd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe539e167, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe539e167, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0139.692] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0139.692] GetProcessHeap () returned 0x4e0000 [0139.692] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0139.692] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0139.692] GetProcessHeap () returned 0x4e0000 [0139.692] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x82) returned 0x4fa058 [0139.692] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0139.692] GetProcessHeap () returned 0x4e0000 [0139.692] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0139.692] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.693] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e3ba89, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe9004ae5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe9004ae5, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0139.693] GetProcessHeap () returned 0x4e0000 [0139.693] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x284) returned 0x527118 [0139.693] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.693] GetLastError () returned 0x5 [0139.693] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e3ba89, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe9004ae5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe9004ae5, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0139.693] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0139.694] GetProcessHeap () returned 0x4e0000 [0139.694] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0139.694] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ece8572, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x2ece8572, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x2ea60e45, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xb620, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hwrcommonlm.dat", cAlternateFileName="")) returned 1 [0139.694] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.694] GetLastError () returned 0x5 [0139.694] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HWRCustomization", cAlternateFileName="HWRCUS~1")) returned 1 [0139.694] GetProcessHeap () returned 0x4e0000 [0139.694] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x98) returned 0x4fa058 [0139.694] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0139.695] GetProcessHeap () returned 0x4e0000 [0139.695] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0139.695] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.695] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0139.695] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0139.695] GetProcessHeap () returned 0x4e0000 [0139.695] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4e0000) returned 1 [0139.695] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7eaa54, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x2f7eaa54, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x2f301d57, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xb6710, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hwrenalm.dat", cAlternateFileName="")) returned 1 [0139.695] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.698] GetLastError () returned 0x5 [0139.699] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33535c00, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x33535c00, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x332fa78d, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xc7240, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hwrenclm.dat", cAlternateFileName="")) returned 1 [0139.699] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.699] GetLastError () returned 0x5 [0139.699] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32bd661d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x32bd661d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x32a7f9d8, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x10ca50, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hwrlatinlm.dat", cAlternateFileName="")) returned 1 [0139.699] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.699] GetLastError () returned 0x5 [0139.699] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d94dbb3, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3d94dbb3, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3c28ab1e, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x2e99a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hwruklm.dat", cAlternateFileName="")) returned 1 [0139.699] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.700] GetLastError () returned 0x5 [0139.700] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da5853e, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3da5853e, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3d7f6f6e, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x21ff00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hwruksh.dat", cAlternateFileName="")) returned 1 [0139.700] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.700] GetLastError () returned 0x5 [0139.700] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db89026, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3db89026, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3d3cc942, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x30c330, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hwrusalm.dat", cAlternateFileName="")) returned 1 [0139.700] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.700] GetLastError () returned 0x5 [0139.700] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dbfb43d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3dbfb43d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3da7e69b, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x3ee0d0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hwrusash.dat", cAlternateFileName="")) returned 1 [0139.700] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.700] GetLastError () returned 0x5 [0139.700] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c4bfb78, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x4c4bfb78, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x298e8420, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x56400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="InkDiv.dll", cAlternateFileName="")) returned 1 [0139.700] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c412911, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c412911, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x29a8c2e0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x201800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="InkObj.dll", cAlternateFileName="")) returned 1 [0139.700] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eab8150, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5eab8150, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe4490e80, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x61000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="InkWatson.exe", cAlternateFileName="")) returned 1 [0139.701] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7700d105, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x7700d105, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe45c2150, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x5da00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="InputPersonalization.exe", cAlternateFileName="")) returned 1 [0139.701] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91865215, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x91865215, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa20, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipscat.xml", cAlternateFileName="")) returned 1 [0139.701] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.701] GetLastError () returned 0x5 [0139.701] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27bfdab7, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27bfdab7, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x99e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipschs.xml", cAlternateFileName="")) returned 1 [0139.701] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.701] GetLastError () returned 0x5 [0139.701] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c23c14, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c23c14, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipscht.xml", cAlternateFileName="")) returned 1 [0139.701] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.702] GetLastError () returned 0x5 [0139.702] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c23c14, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c23c14, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipscsy.xml", cAlternateFileName="")) returned 1 [0139.702] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.702] GetLastError () returned 0x5 [0139.702] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c49d71, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c49d71, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9d2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipsdan.xml", cAlternateFileName="")) returned 1 [0139.702] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.702] GetLastError () returned 0x5 [0139.702] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c49d71, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c49d71, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipsdeu.xml", cAlternateFileName="")) returned 1 [0139.702] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.702] GetLastError () returned 0x5 [0139.702] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c6fece, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c6fece, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa12, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipsen.xml", cAlternateFileName="")) returned 1 [0139.702] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.703] GetLastError () returned 0x5 [0139.703] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27cbc188, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27cbc188, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbd0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipsesp.xml", cAlternateFileName="")) returned 1 [0139.703] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.703] GetLastError () returned 0x5 [0139.703] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58cd8515, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x58cd8515, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x5ca35e50, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IPSEventLogMsg.dll", cAlternateFileName="")) returned 1 [0139.703] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c9602b, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c9602b, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa62, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipsfin.xml", cAlternateFileName="")) returned 1 [0139.703] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.704] GetLastError () returned 0x5 [0139.704] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27cbc188, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27cbc188, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa44, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipsfra.xml", cAlternateFileName="")) returned 1 [0139.704] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.704] GetLastError () returned 0x5 [0139.704] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27ce22e5, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27ce22e5, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa5c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipshrv.xml", cAlternateFileName="")) returned 1 [0139.704] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.705] GetLastError () returned 0x5 [0139.705] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27ce22e5, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27ce22e5, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9de, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipsita.xml", cAlternateFileName="")) returned 1 [0139.705] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.705] GetLastError () returned 0x5 [0139.705] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d08442, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d08442, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9188b373, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9da, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipsjpn.xml", cAlternateFileName="")) returned 1 [0139.705] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.705] GetLastError () returned 0x5 [0139.705] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipskor.xml", cAlternateFileName="")) returned 1 [0139.705] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.706] GetLastError () returned 0x5 [0139.706] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dc49d13, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5dc49d13, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2a1fc7a0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IpsMigrationPlugin.dll", cAlternateFileName="")) returned 1 [0139.706] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa42, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipsnld.xml", cAlternateFileName="")) returned 1 [0139.706] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.706] GetLastError () returned 0x5 [0139.706] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa14, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipsnor.xml", cAlternateFileName="")) returned 1 [0139.706] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.706] GetLastError () returned 0x5 [0139.706] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d546fc, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d546fc, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa28, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipsplk.xml", cAlternateFileName="")) returned 1 [0139.706] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.707] GetLastError () returned 0x5 [0139.707] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63de1b63, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x63de1b63, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2a991650, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IpsPlugin.dll", cAlternateFileName="")) returned 1 [0139.707] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d546fc, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d546fc, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipsptb.xml", cAlternateFileName="")) returned 1 [0139.707] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.707] GetLastError () returned 0x5 [0139.707] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d7a859, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d7a859, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipsptg.xml", cAlternateFileName="")) returned 1 [0139.707] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.707] GetLastError () returned 0x5 [0139.707] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d7a859, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d7a859, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa54, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipsrom.xml", cAlternateFileName="")) returned 1 [0139.707] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.708] GetLastError () returned 0x5 [0139.708] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27da09b6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27da09b6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9ee, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipsrus.xml", cAlternateFileName="")) returned 1 [0139.708] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.708] GetLastError () returned 0x5 [0139.708] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27da09b6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27da09b6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipssrb.xml", cAlternateFileName="")) returned 1 [0139.708] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.709] GetLastError () returned 0x5 [0139.709] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27dc6b13, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27dc6b13, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipssrl.xml", cAlternateFileName="")) returned 1 [0139.709] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.709] GetLastError () returned 0x5 [0139.709] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27decc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27decc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9d8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipssve.xml", cAlternateFileName="")) returned 1 [0139.709] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.709] GetLastError () returned 0x5 [0139.709] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="it-IT", cAlternateFileName="")) returned 1 [0139.709] GetProcessHeap () returned 0x4e0000 [0139.709] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x82) returned 0x4fa058 [0139.709] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0139.710] GetProcessHeap () returned 0x4e0000 [0139.710] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0139.710] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.710] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9e26c68, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea015e21, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea015e21, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0139.710] GetProcessHeap () returned 0x4e0000 [0139.710] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x284) returned 0x527118 [0139.710] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.710] GetLastError () returned 0x5 [0139.710] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9e26c68, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea015e21, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea015e21, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0139.710] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0139.710] GetProcessHeap () returned 0x4e0000 [0139.710] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0139.710] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0139.710] GetProcessHeap () returned 0x4e0000 [0139.710] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x82) returned 0x4fa058 [0139.710] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0139.711] GetProcessHeap () returned 0x4e0000 [0139.711] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0139.711] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.711] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe68981a0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6aad4b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6aad4b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0139.711] GetProcessHeap () returned 0x4e0000 [0139.711] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x284) returned 0x527118 [0139.711] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.711] GetLastError () returned 0x5 [0139.711] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe68981a0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6aad4b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6aad4b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0139.711] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0139.711] GetProcessHeap () returned 0x4e0000 [0139.711] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0139.711] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b45ecf9, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x8b45ecf9, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2b0dd120, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x14de00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="journal.dll", cAlternateFileName="")) returned 1 [0139.711] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0139.712] GetProcessHeap () returned 0x4e0000 [0139.712] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x82) returned 0x4fa058 [0139.712] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0139.712] GetProcessHeap () returned 0x4e0000 [0139.712] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0139.712] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.712] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4e1cef6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe507e4c6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe507e4c6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0139.712] GetProcessHeap () returned 0x4e0000 [0139.712] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x284) returned 0x527118 [0139.712] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.712] GetLastError () returned 0x5 [0139.712] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4e1cef6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe507e4c6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe507e4c6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0139.712] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0139.713] GetProcessHeap () returned 0x4e0000 [0139.713] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0139.713] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0139.713] GetProcessHeap () returned 0x4e0000 [0139.713] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x82) returned 0x4fa058 [0139.713] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0139.714] GetProcessHeap () returned 0x4e0000 [0139.714] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0139.714] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.714] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe608f802, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe627e9bb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe62a4b18, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0139.714] GetProcessHeap () returned 0x4e0000 [0139.714] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x284) returned 0x527118 [0139.714] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.715] GetLastError () returned 0x5 [0139.715] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe608f802, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe627e9bb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe62a4b18, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0139.715] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0139.715] GetProcessHeap () returned 0x4e0000 [0139.715] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0139.715] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0139.715] GetProcessHeap () returned 0x4e0000 [0139.715] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x82) returned 0x4fa058 [0139.715] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0139.715] GetProcessHeap () returned 0x4e0000 [0139.715] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0139.715] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.715] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe721d8e0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe7432bf6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe7458d53, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0139.715] GetProcessHeap () returned 0x4e0000 [0139.715] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x284) returned 0x527118 [0139.715] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.716] GetLastError () returned 0x5 [0139.716] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe721d8e0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe7432bf6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe7458d53, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0139.716] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0139.716] GetProcessHeap () returned 0x4e0000 [0139.716] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0139.716] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e22d6e, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x69e22d6e, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x3188e7b0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a0200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="micaut.dll", cAlternateFileName="")) returned 1 [0139.716] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x472c5956, ftCreationTime.dwHighDateTime=0x1ca040e, ftLastAccessTime.dwLowDateTime=0xa4945a00, ftLastAccessTime.dwHighDateTime=0x1ca0424, ftLastWriteTime.dwLowDateTime=0x9fcc4285, ftLastWriteTime.dwHighDateTime=0x1ca0425, nFileSizeHigh=0x0, nFileSizeLow=0x7c000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Ink.dll", cAlternateFileName="")) returned 1 [0139.716] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa12394d3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa12394d3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa125f634, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x179c00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mip.exe", cAlternateFileName="")) returned 1 [0139.716] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ad46e47, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5ad46e47, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x344e2230, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x609c00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mraut.dll", cAlternateFileName="")) returned 1 [0139.716] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66c00201, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x66c00201, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x34eb4c90, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xc200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mshwgst.dll", cAlternateFileName="")) returned 1 [0139.716] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901e133e, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x901e133e, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x353c2bb0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x105a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mshwLatin.dll", cAlternateFileName="")) returned 1 [0139.716] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0139.716] GetProcessHeap () returned 0x4e0000 [0139.716] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x82) returned 0x4fa058 [0139.716] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0139.716] GetProcessHeap () returned 0x4e0000 [0139.716] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0139.717] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.717] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xead074bc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeaef6675, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeaef6675, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0139.717] GetProcessHeap () returned 0x4e0000 [0139.717] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x284) returned 0x527118 [0139.717] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.717] GetLastError () returned 0x5 [0139.717] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xead074bc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeaef6675, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeaef6675, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0139.717] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0139.717] GetProcessHeap () returned 0x4e0000 [0139.717] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0139.717] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0139.717] GetProcessHeap () returned 0x4e0000 [0139.717] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x82) returned 0x4fa058 [0139.717] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0139.717] GetProcessHeap () returned 0x4e0000 [0139.718] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0139.718] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.718] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4fe5f52, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe52213c5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5247522, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0139.718] GetProcessHeap () returned 0x4e0000 [0139.718] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x284) returned 0x527118 [0139.718] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.718] GetLastError () returned 0x5 [0139.718] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4fe5f52, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe52213c5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5247522, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0139.718] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0139.718] GetProcessHeap () returned 0x4e0000 [0139.718] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0139.718] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0139.718] GetProcessHeap () returned 0x4e0000 [0139.718] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x82) returned 0x4fa058 [0139.718] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0139.719] GetProcessHeap () returned 0x4e0000 [0139.719] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0139.719] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.719] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe42361e6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe44977b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe44977b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0139.719] GetProcessHeap () returned 0x4e0000 [0139.719] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x284) returned 0x527118 [0139.719] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.720] GetLastError () returned 0x5 [0139.720] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe42361e6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe44977b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe44977b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0139.720] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0139.720] GetProcessHeap () returned 0x4e0000 [0139.720] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0139.720] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0139.720] GetProcessHeap () returned 0x4e0000 [0139.720] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x82) returned 0x4fa058 [0139.720] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0139.721] GetProcessHeap () returned 0x4e0000 [0139.721] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0139.721] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.721] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe59917ef, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5b809a8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5b809a8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0139.721] GetProcessHeap () returned 0x4e0000 [0139.721] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x284) returned 0x527118 [0139.721] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.721] GetLastError () returned 0x5 [0139.721] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe59917ef, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5b809a8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5b809a8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0139.721] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0139.721] GetProcessHeap () returned 0x4e0000 [0139.721] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0139.721] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0139.721] GetProcessHeap () returned 0x4e0000 [0139.721] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x82) returned 0x4fa058 [0139.721] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0139.722] GetProcessHeap () returned 0x4e0000 [0139.722] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0139.722] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.722] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4bbb926, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4dd0c3c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4dd0c3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0139.722] GetProcessHeap () returned 0x4e0000 [0139.722] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x284) returned 0x527118 [0139.722] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.722] GetLastError () returned 0x5 [0139.722] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4bbb926, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4dd0c3c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4dd0c3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0139.722] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0139.723] GetProcessHeap () returned 0x4e0000 [0139.723] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0139.723] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0139.723] GetProcessHeap () returned 0x4e0000 [0139.723] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x82) returned 0x4fa058 [0139.723] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0139.723] GetProcessHeap () returned 0x4e0000 [0139.723] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0139.723] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.723] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe215549d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2390910, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2390910, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0139.723] GetProcessHeap () returned 0x4e0000 [0139.723] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x284) returned 0x527118 [0139.723] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.724] GetLastError () returned 0x5 [0139.724] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe215549d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2390910, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2390910, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0139.724] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0139.724] GetProcessHeap () returned 0x4e0000 [0139.724] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0139.724] GetProcessHeap () returned 0x4e0000 [0139.724] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x82) returned 0x4fa058 [0139.724] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0139.725] GetProcessHeap () returned 0x4e0000 [0139.725] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0139.726] GetProcessHeap () returned 0x4e0000 [0139.726] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x284) returned 0x527118 [0139.726] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.727] GetLastError () returned 0x5 [0139.727] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6a1a1d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea8dce90, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea902fed, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0139.727] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0139.727] GetProcessHeap () returned 0x4e0000 [0139.727] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0139.727] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a593198, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6a593198, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xf44c0670, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xa9c00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ShapeCollector.exe", cAlternateFileName="")) returned 1 [0139.727] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0139.727] GetProcessHeap () returned 0x4e0000 [0139.727] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x82) returned 0x4fa058 [0139.727] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0139.728] GetProcessHeap () returned 0x4e0000 [0139.728] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0139.728] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.728] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe526d67f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe54f4dac, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe54f4dac, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0139.728] GetProcessHeap () returned 0x4e0000 [0139.728] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x284) returned 0x527118 [0139.728] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.728] GetLastError () returned 0x5 [0139.728] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe526d67f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe54f4dac, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe54f4dac, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0139.728] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0139.728] GetProcessHeap () returned 0x4e0000 [0139.728] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0139.728] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0139.728] GetProcessHeap () returned 0x4e0000 [0139.728] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x82) returned 0x4fa058 [0139.728] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0139.729] GetProcessHeap () returned 0x4e0000 [0139.729] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0139.729] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.729] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92d84cc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe94ed7e2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe94ed7e2, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0139.729] GetProcessHeap () returned 0x4e0000 [0139.729] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x284) returned 0x527118 [0139.729] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.729] GetLastError () returned 0x5 [0139.729] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92d84cc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe94ed7e2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe94ed7e2, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0139.729] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0139.730] GetProcessHeap () returned 0x4e0000 [0139.730] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0139.730] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0139.730] GetProcessHeap () returned 0x4e0000 [0139.730] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8c) returned 0x4fa058 [0139.730] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0139.730] GetProcessHeap () returned 0x4e0000 [0139.730] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0139.730] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.730] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4177b15, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4177b15, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0139.730] GetProcessHeap () returned 0x4e0000 [0139.730] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x28e) returned 0x527118 [0139.730] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-cs\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.730] GetLastError () returned 0x5 [0139.730] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4177b15, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4177b15, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0139.731] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0139.731] GetProcessHeap () returned 0x4e0000 [0139.731] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0139.731] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0139.731] GetProcessHeap () returned 0x4e0000 [0139.731] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x82) returned 0x4fa058 [0139.731] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0139.732] GetProcessHeap () returned 0x4e0000 [0139.732] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0139.732] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.732] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe779eb51, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe79d9fc4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe79d9fc4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0139.732] GetProcessHeap () returned 0x4e0000 [0139.732] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x284) returned 0x527118 [0139.732] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.733] GetLastError () returned 0x5 [0139.733] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe779eb51, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe79d9fc4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe79d9fc4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0139.733] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0139.733] GetProcessHeap () returned 0x4e0000 [0139.733] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0139.733] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56ef1310, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x56ef1310, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x449d3e50, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x9e00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TabIpsps.dll", cAlternateFileName="")) returned 1 [0139.733] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bf05363, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bf05363, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bf05363, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6d600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tabskb.dll", cAlternateFileName="")) returned 1 [0139.733] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45c03bb8, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x45c03bb8, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xf8825d20, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x36c00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TabTip.exe", cAlternateFileName="")) returned 1 [0139.733] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="th-TH", cAlternateFileName="")) returned 1 [0139.733] GetProcessHeap () returned 0x4e0000 [0139.733] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x82) returned 0x4fa058 [0139.733] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0139.734] GetProcessHeap () returned 0x4e0000 [0139.734] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0139.734] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.734] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f46414, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe91a79e4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe91a79e4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0139.734] GetProcessHeap () returned 0x4e0000 [0139.734] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x284) returned 0x527118 [0139.734] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.734] GetLastError () returned 0x5 [0139.734] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f46414, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe91a79e4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe91a79e4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0139.734] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0139.734] GetProcessHeap () returned 0x4e0000 [0139.734] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0139.734] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41bbeec8, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x41bbeec8, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44c363f0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1b000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TipBand.dll", cAlternateFileName="")) returned 1 [0139.734] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d6a2945, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5d6a2945, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x18975da0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x85000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TipRes.dll", cAlternateFileName="")) returned 1 [0139.734] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d7038f2, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x3d7038f2, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x18975da0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll", cAlternateFileName="")) returned 1 [0139.734] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa125f634, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa125f634, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa1285794, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x130600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipskins.dll", cAlternateFileName="")) returned 1 [0139.734] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1213373, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa1213373, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa12394d3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x7ae00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tiptsf.dll", cAlternateFileName="")) returned 1 [0139.734] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3dda83b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3dda83b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3dda83b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tpcps.dll", cAlternateFileName="")) returned 1 [0139.734] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0139.734] GetProcessHeap () returned 0x4e0000 [0139.734] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x82) returned 0x4fa058 [0139.734] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0139.735] GetProcessHeap () returned 0x4e0000 [0139.735] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0139.735] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.735] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a6eb476, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a6eb476, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a6eb476, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0139.735] GetProcessHeap () returned 0x4e0000 [0139.735] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x284) returned 0x527118 [0139.735] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.735] GetLastError () returned 0x5 [0139.735] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a6eb476, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a6eb476, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a6eb476, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0139.735] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0139.735] GetProcessHeap () returned 0x4e0000 [0139.735] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0139.735] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0139.735] GetProcessHeap () returned 0x4e0000 [0139.735] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x82) returned 0x4fa058 [0139.736] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0139.736] GetProcessHeap () returned 0x4e0000 [0139.736] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0139.736] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.736] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe29f63af, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2c31822, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2c31822, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0139.736] GetProcessHeap () returned 0x4e0000 [0139.736] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x284) returned 0x527118 [0139.736] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.736] GetLastError () returned 0x5 [0139.736] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe29f63af, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2c31822, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2c31822, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0139.736] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0139.736] GetProcessHeap () returned 0x4e0000 [0139.737] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0139.737] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0139.737] GetProcessHeap () returned 0x4e0000 [0139.737] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x82) returned 0x4fa058 [0139.737] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0139.738] GetProcessHeap () returned 0x4e0000 [0139.738] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0139.738] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.738] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d513f43, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d513f43, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d53a0a3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0139.738] GetProcessHeap () returned 0x4e0000 [0139.738] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x284) returned 0x527118 [0139.738] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.739] GetLastError () returned 0x5 [0139.739] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d513f43, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d513f43, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d53a0a3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0139.739] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0139.739] GetProcessHeap () returned 0x4e0000 [0139.739] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0139.739] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0139.739] GetProcessHeap () returned 0x4e0000 [0139.739] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x82) returned 0x4fa058 [0139.739] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0139.739] GetProcessHeap () returned 0x4e0000 [0139.739] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0139.739] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.739] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe268a454, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe287960d, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe287960d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0139.740] GetProcessHeap () returned 0x4e0000 [0139.740] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x284) returned 0x527118 [0139.740] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.740] GetLastError () returned 0x5 [0139.740] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe268a454, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe287960d, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe287960d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0139.740] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0139.740] GetProcessHeap () returned 0x4e0000 [0139.740] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0139.740] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0139.740] FindClose (in: hFindFile=0x522f58 | out: hFindFile=0x522f58) returned 1 [0139.740] GetProcessHeap () returned 0x4e0000 [0139.740] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x525e90 | out: hHeap=0x4e0000) returned 1 [0139.740] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSClientDataMgr", cAlternateFileName="MSCLIE~1")) returned 1 [0139.740] GetProcessHeap () returned 0x4e0000 [0139.740] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8e) returned 0x4fa058 [0139.740] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\*.*", lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f58 [0139.741] GetProcessHeap () returned 0x4e0000 [0139.741] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0139.741] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0139.741] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad59fd00, ftCreationTime.dwHighDateTime=0x1ca9454, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad59fd00, ftLastWriteTime.dwHighDateTime=0x1ca9454, nFileSizeHigh=0x0, nFileSizeLow=0x665a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSCDM.DLL", cAlternateFileName="")) returned 1 [0139.741] GetProcessHeap () returned 0x4e0000 [0139.741] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x290) returned 0x525e90 [0139.741] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad59fd00, ftCreationTime.dwHighDateTime=0x1ca9454, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad59fd00, ftLastWriteTime.dwHighDateTime=0x1ca9454, nFileSizeHigh=0x0, nFileSizeLow=0x665a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSCDM.DLL", cAlternateFileName="")) returned 0 [0139.741] FindClose (in: hFindFile=0x522f58 | out: hFindFile=0x522f58) returned 1 [0139.742] GetProcessHeap () returned 0x4e0000 [0139.742] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x525e90 | out: hHeap=0x4e0000) returned 1 [0139.742] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSInfo", cAlternateFileName="")) returned 1 [0139.742] GetProcessHeap () returned 0x4e0000 [0139.742] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x7c) returned 0x4fa058 [0139.742] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\*.*", lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f58 [0139.742] GetProcessHeap () returned 0x4e0000 [0139.742] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0139.742] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0139.742] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-US", cAlternateFileName="")) returned 1 [0139.742] GetProcessHeap () returned 0x4e0000 [0139.742] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x27e) returned 0x525e90 [0139.742] GetProcessHeap () returned 0x4e0000 [0139.742] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x88) returned 0x4fa058 [0139.742] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0139.742] GetProcessHeap () returned 0x4e0000 [0139.743] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0139.743] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0139.743] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0a09f, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca0a09f, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x6800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msinfo32.exe.mui", cAlternateFileName="")) returned 1 [0139.743] GetProcessHeap () returned 0x4e0000 [0139.743] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x28a) returned 0x527120 [0139.743] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.745] GetLastError () returned 0x5 [0139.745] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0a09f, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca0a09f, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x6800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msinfo32.exe.mui", cAlternateFileName="")) returned 0 [0139.745] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0139.745] GetProcessHeap () returned 0x4e0000 [0139.745] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527120 | out: hHeap=0x4e0000) returned 1 [0139.745] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x830a4e7c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x830a4e7c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x830cafdd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5c800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msinfo32.exe", cAlternateFileName="")) returned 1 [0139.745] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x830a4e7c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x830a4e7c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x830cafdd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5c800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msinfo32.exe", cAlternateFileName="")) returned 0 [0139.745] FindClose (in: hFindFile=0x522f58 | out: hFindFile=0x522f58) returned 1 [0139.745] GetProcessHeap () returned 0x4e0000 [0139.745] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x525e90 | out: hHeap=0x4e0000) returned 1 [0139.745] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OFFICE14", cAlternateFileName="")) returned 1 [0139.745] GetProcessHeap () returned 0x4e0000 [0139.745] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x80) returned 0x4fa058 [0139.745] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f58 [0139.746] GetProcessHeap () returned 0x4e0000 [0139.746] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0139.746] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0139.746] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 1 [0139.746] GetProcessHeap () returned 0x4e0000 [0139.746] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x282) returned 0x525e90 [0139.746] GetProcessHeap () returned 0x4e0000 [0139.746] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8a) returned 0x4fa058 [0139.746] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0139.747] GetProcessHeap () returned 0x4e0000 [0139.747] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0139.747] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0139.747] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81925f00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x81925f00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0x305a8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACEINTL.DLL", cAlternateFileName="")) returned 1 [0139.747] GetProcessHeap () returned 0x4e0000 [0139.747] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x28c) returned 0x527128 [0139.747] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0xcdb0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACEODBCI.DLL", cAlternateFileName="")) returned 1 [0139.747] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x51d0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACERECR.DLL", cAlternateFileName="")) returned 1 [0139.747] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81925f00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x81925f00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0xd2990, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACEWSTR.DLL", cAlternateFileName="")) returned 1 [0139.747] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f139500, ftCreationTime.dwHighDateTime=0x1c69359, ftLastAccessTime.dwLowDateTime=0xee2ce510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7f139500, ftLastWriteTime.dwHighDateTime=0x1c69359, nFileSizeHigh=0x0, nFileSizeLow=0x19a3ff, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ADO210.CHM", cAlternateFileName="")) returned 1 [0139.747] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0139.748] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x24defd0 | out: lpFileSize=0x24defd0*=1680383) returned 1 [0139.748] GetProcessHeap () returned 0x4e0000 [0139.748] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0139.748] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0139.748] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.748] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24defbc, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defbc*=0x1, lpOverlapped=0x0) returned 1 [0139.750] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defc0 | out: phKey=0x24defc0*=0x522fd8) returned 1 [0139.750] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0139.750] GetProcessHeap () returned 0x4e0000 [0139.750] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0139.750] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24defa0*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24defa0*=0x30) returned 1 [0139.750] CryptDestroyKey (hKey=0x522fd8) returned 1 [0139.750] WriteFile (in: hFile=0x100, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24defbc, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24defbc*=0x30, lpOverlapped=0x0) returned 1 [0139.750] WriteFile (in: hFile=0x100, lpBuffer=0x24defc4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defbc, lpOverlapped=0x0 | out: lpBuffer=0x24defc4*, lpNumberOfBytesWritten=0x24defbc*=0x4, lpOverlapped=0x0) returned 1 [0139.750] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defbc, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defbc*=0x10, lpOverlapped=0x0) returned 1 [0139.750] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defbc, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defbc*=0x80, lpOverlapped=0x0) returned 1 [0139.750] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe8 | out: lpNewFilePointer=0x0) returned 1 [0139.750] WriteFile (in: hFile=0x100, lpBuffer=0x24defd8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defbc, lpOverlapped=0x0 | out: lpBuffer=0x24defd8*, lpNumberOfBytesWritten=0x24defbc*=0x8, lpOverlapped=0x0) returned 1 [0139.750] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defc0 | out: phKey=0x24defc0*=0x522fd8) returned 1 [0139.750] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0139.751] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24def90 | out: lpNewFilePointer=0x0) returned 1 [0139.751] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def84*=0x40000, lpOverlapped=0x0) returned 1 [0139.756] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def8c*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24def8c*=0x40000) returned 1 [0139.761] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.761] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24def88, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def88*=0x40000, lpOverlapped=0x0) returned 1 [0139.762] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x19a4c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.762] WriteFile (in: hFile=0x100, lpBuffer=0x24def90*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24def88, lpOverlapped=0x0 | out: lpBuffer=0x24def90*, lpNumberOfBytesWritten=0x24def88*=0x8, lpOverlapped=0x0) returned 1 [0139.762] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x88bff, lpNewFilePointer=0x0, dwMoveMethod=0x24def90 | out: lpNewFilePointer=0x0) returned 1 [0139.762] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def84*=0x40000, lpOverlapped=0x0) returned 1 [0139.766] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def8c*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24def8c*=0x40000) returned 1 [0139.768] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x88bff, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.769] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24def88, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def88*=0x40000, lpOverlapped=0x0) returned 1 [0139.769] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x19a4c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.769] WriteFile (in: hFile=0x100, lpBuffer=0x24def90*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24def88, lpOverlapped=0x0 | out: lpBuffer=0x24def90*, lpNumberOfBytesWritten=0x24def88*=0x8, lpOverlapped=0x0) returned 1 [0139.770] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x15a400, lpNewFilePointer=0x0, dwMoveMethod=0x24def90 | out: lpNewFilePointer=0x0) returned 1 [0139.770] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def84*=0x40000, lpOverlapped=0x0) returned 1 [0139.773] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def8c*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24def8c*=0x40000) returned 1 [0139.776] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x15a400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.776] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24def88, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def88*=0x40000, lpOverlapped=0x0) returned 1 [0139.777] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x19a4c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.777] WriteFile (in: hFile=0x100, lpBuffer=0x24def90*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24def88, lpOverlapped=0x0 | out: lpBuffer=0x24def90*, lpNumberOfBytesWritten=0x24def88*=0x8, lpOverlapped=0x0) returned 1 [0139.777] CryptDestroyKey (hKey=0x522fd8) returned 1 [0139.777] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x19a4c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.777] SetEndOfFile (hFile=0x100) returned 1 [0139.780] GetProcessHeap () returned 0x4e0000 [0139.780] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0139.780] GetProcessHeap () returned 0x4e0000 [0139.780] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0139.780] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0139.781] CloseHandle (hObject=0x100) returned 1 [0139.781] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4b06d00, ftCreationTime.dwHighDateTime=0x1ca9127, ftLastAccessTime.dwLowDateTime=0xee2ce510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe4b06d00, ftLastWriteTime.dwHighDateTime=0x1ca9127, nFileSizeHigh=0x0, nFileSizeLow=0x25b50, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ALRTINTL.DLL", cAlternateFileName="")) returned 1 [0139.781] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e15000, ftCreationTime.dwHighDateTime=0x1cbf3e5, ftLastAccessTime.dwLowDateTime=0xc24a9ec0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe5e15000, ftLastWriteTime.dwHighDateTime=0x1cbf3e5, nFileSizeHigh=0x0, nFileSizeLow=0x269380, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSOINTL.DLL", cAlternateFileName="")) returned 1 [0139.781] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b30dd00, ftCreationTime.dwHighDateTime=0x1cac9ab, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5b30dd00, ftLastWriteTime.dwHighDateTime=0x1cac9ab, nFileSizeHigh=0x0, nFileSizeLow=0xd980, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSOINTL.DLL.IDX_DLL", cAlternateFileName="MSOINT~1.IDX")) returned 1 [0139.781] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0139.782] GetProcessHeap () returned 0x4e0000 [0139.782] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0139.782] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0139.782] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0139.782] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0139.782] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0139.782] GetProcessHeap () returned 0x4e0000 [0139.782] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x50) returned 0x4fd470 [0139.782] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fd470*, pdwDataLen=0x24defa8*=0x50, dwBufLen=0x50 | out: pbData=0x4fd470*, pdwDataLen=0x24defa8*=0x50) returned 1 [0139.782] CryptDestroyKey (hKey=0x522fd8) returned 1 [0139.782] WriteFile (in: hFile=0x100, lpBuffer=0x4fd470*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd470*, lpNumberOfBytesWritten=0x24defc8*=0x50, lpOverlapped=0x0) returned 1 [0139.784] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0139.784] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0139.784] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0139.784] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0139.784] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0139.784] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0139.784] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0139.784] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.784] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xd980, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xd980, lpOverlapped=0x0) returned 1 [0139.786] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xd980, dwBufLen=0xd980 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xd980) returned 1 [0139.786] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.786] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xd980, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xd980, lpOverlapped=0x0) returned 1 [0139.787] CryptDestroyKey (hKey=0x522fd8) returned 1 [0139.787] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xda64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.787] SetEndOfFile (hFile=0x100) returned 1 [0139.790] GetProcessHeap () returned 0x4e0000 [0139.790] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fd470 | out: hHeap=0x4e0000) returned 1 [0139.790] GetProcessHeap () returned 0x4e0000 [0139.790] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0139.790] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0139.791] CloseHandle (hObject=0x100) returned 1 [0139.791] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c620a00, ftCreationTime.dwHighDateTime=0x1cac9ab, ftLastAccessTime.dwLowDateTime=0xeee8f1b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5c620a00, ftLastWriteTime.dwHighDateTime=0x1cac9ab, nFileSizeHigh=0x0, nFileSizeLow=0x152f80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSOINTL.REST.IDX_DLL", cAlternateFileName="MSOINT~2.IDX")) returned 1 [0139.791] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0139.791] GetProcessHeap () returned 0x4e0000 [0139.791] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0139.791] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0139.791] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0139.791] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0139.792] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0139.792] GetProcessHeap () returned 0x4e0000 [0139.792] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x50) returned 0x4fd470 [0139.792] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fd470*, pdwDataLen=0x24defa8*=0x50, dwBufLen=0x50 | out: pbData=0x4fd470*, pdwDataLen=0x24defa8*=0x50) returned 1 [0139.792] CryptDestroyKey (hKey=0x522fd8) returned 1 [0139.792] WriteFile (in: hFile=0x100, lpBuffer=0x4fd470*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd470*, lpNumberOfBytesWritten=0x24defc8*=0x50, lpOverlapped=0x0) returned 1 [0139.794] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0139.794] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0139.794] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0139.794] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0139.794] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0139.794] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0139.794] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0139.794] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.794] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x100000, lpOverlapped=0x0) returned 1 [0139.811] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x100000, dwBufLen=0x100000 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x100000) returned 1 [0139.820] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.820] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x100000, lpOverlapped=0x0) returned 1 [0139.824] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x153064, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.824] WriteFile (in: hFile=0x100, lpBuffer=0x24def90*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x24def90*, lpNumberOfBytesWritten=0x24def84*=0x8, lpOverlapped=0x0) returned 1 [0139.824] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.824] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x52f80, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x52f80, lpOverlapped=0x0) returned 1 [0139.835] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x52f80, dwBufLen=0x52f80 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x52f80) returned 1 [0139.837] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.838] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x52f80, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x52f80, lpOverlapped=0x0) returned 1 [0139.839] CryptDestroyKey (hKey=0x522fd8) returned 1 [0139.839] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x153064, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.839] SetEndOfFile (hFile=0x100) returned 1 [0139.842] GetProcessHeap () returned 0x4e0000 [0139.842] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fd470 | out: hHeap=0x4e0000) returned 1 [0139.842] GetProcessHeap () returned 0x4e0000 [0139.842] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0139.842] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0139.843] CloseHandle (hObject=0x100) returned 1 [0139.843] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15d97a00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0xeeedb470, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x15d97a00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0xa388, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSSOAPR3.DLL", cAlternateFileName="")) returned 1 [0139.843] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x356f9800, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x356f9800, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x2d88, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OARPMANR.DLL", cAlternateFileName="")) returned 1 [0139.843] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d183e00, ftCreationTime.dwHighDateTime=0x1ca520c, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4d183e00, ftLastWriteTime.dwHighDateTime=0x1ca520c, nFileSizeHigh=0x0, nFileSizeLow=0x795, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="README.HTM", cAlternateFileName="")) returned 1 [0139.843] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0139.845] GetProcessHeap () returned 0x4e0000 [0139.845] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0139.845] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0139.845] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0139.845] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xb, lpOverlapped=0x0) returned 1 [0139.847] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0139.847] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0139.847] GetProcessHeap () returned 0x4e0000 [0139.847] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0139.847] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30) returned 1 [0139.847] CryptDestroyKey (hKey=0x522fd8) returned 1 [0139.847] WriteFile (in: hFile=0x100, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24defc8*=0x30, lpOverlapped=0x0) returned 1 [0139.847] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0139.847] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0139.847] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0139.847] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0139.847] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0139.847] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0139.847] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0139.847] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.848] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x795, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x795, lpOverlapped=0x0) returned 1 [0139.848] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x7a0, dwBufLen=0x7a0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x7a0) returned 1 [0139.848] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.848] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x7a0, lpOverlapped=0x0) returned 1 [0139.848] CryptDestroyKey (hKey=0x522fd8) returned 1 [0139.848] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x864, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.848] SetEndOfFile (hFile=0x100) returned 1 [0139.850] GetProcessHeap () returned 0x4e0000 [0139.850] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0139.850] GetProcessHeap () returned 0x4e0000 [0139.850] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0139.850] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0139.851] CloseHandle (hObject=0x100) returned 1 [0139.851] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb401ca00, ftCreationTime.dwHighDateTime=0x1cbdec9, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb401ca00, ftLastWriteTime.dwHighDateTime=0x1cbdec9, nFileSizeHigh=0x0, nFileSizeLow=0x19b80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="xlsrvintl.dll", cAlternateFileName="XLSRVI~1.DLL")) returned 1 [0139.851] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb401ca00, ftCreationTime.dwHighDateTime=0x1cbdec9, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb401ca00, ftLastWriteTime.dwHighDateTime=0x1cbdec9, nFileSizeHigh=0x0, nFileSizeLow=0x19b80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="xlsrvintl.dll", cAlternateFileName="XLSRVI~1.DLL")) returned 0 [0139.851] GetProcessHeap () returned 0x4e0000 [0139.851] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0139.851] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0139.851] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df020 | out: pbData=0x4f53d8, pdwDataLen=0x24df020) returned 1 [0139.851] CryptDestroyKey (hKey=0x522fd8) returned 1 [0139.852] GetProcessHeap () returned 0x4e0000 [0139.852] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0139.852] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0139.852] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df020 | out: pbData=0x4f5420, pdwDataLen=0x24df020) returned 1 [0139.852] CryptDestroyKey (hKey=0x522fd8) returned 1 [0139.852] GetProcessHeap () returned 0x4e0000 [0139.852] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5273c0 [0139.852] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0139.852] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5273c0, pdwDataLen=0x24df020 | out: pbData=0x5273c0, pdwDataLen=0x24df020) returned 1 [0139.852] CryptDestroyKey (hKey=0x522fd8) returned 1 [0139.852] wsprintfW (in: param_1=0x24ddffc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\readme-warning.txt") returned 79 [0139.852] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0139.853] WriteFile (in: hFile=0x100, lpBuffer=0x5273c0*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddff8, lpOverlapped=0x0 | out: lpBuffer=0x5273c0*, lpNumberOfBytesWritten=0x24ddff8*=0x6c3, lpOverlapped=0x0) returned 1 [0139.854] CloseHandle (hObject=0x100) returned 1 [0139.854] GetProcessHeap () returned 0x4e0000 [0139.854] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273c0 | out: hHeap=0x4e0000) returned 1 [0139.854] GetProcessHeap () returned 0x4e0000 [0139.854] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0139.854] GetProcessHeap () returned 0x4e0000 [0139.854] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0139.854] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0139.854] GetProcessHeap () returned 0x4e0000 [0139.854] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527128 | out: hHeap=0x4e0000) returned 1 [0139.854] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x703dbc00, ftCreationTime.dwHighDateTime=0x1cbdfc0, ftLastAccessTime.dwLowDateTime=0xd80a4ee0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x703dbc00, ftLastWriteTime.dwHighDateTime=0x1cbdfc0, nFileSizeHigh=0x0, nFileSizeLow=0x310788, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACECORE.DLL", cAlternateFileName="")) returned 1 [0139.854] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd80f11a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xb5db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACEDAO.DLL", cAlternateFileName="")) returned 1 [0139.855] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81925f00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0x51128590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81925f00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0xa990, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACEERR.DLL", cAlternateFileName="")) returned 1 [0139.855] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd8117300, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xf73a8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACEES.DLL", cAlternateFileName="")) returned 1 [0139.855] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd8117300, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x6bfa0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACEEXCH.DLL", cAlternateFileName="")) returned 1 [0139.855] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd813d460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xdbb98, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACEEXCL.DLL", cAlternateFileName="")) returned 1 [0139.855] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95c9c200, ftCreationTime.dwHighDateTime=0x1cba070, ftLastAccessTime.dwLowDateTime=0xd813d460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x95c9c200, ftLastWriteTime.dwHighDateTime=0x1cba070, nFileSizeHigh=0x0, nFileSizeLow=0x53bb0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACEODBC.DLL", cAlternateFileName="")) returned 1 [0139.855] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0x51128590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x3db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACEODDBS.DLL", cAlternateFileName="")) returned 1 [0139.855] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0x5e99f630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x3db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACEODEXL.DLL", cAlternateFileName="")) returned 1 [0139.855] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0x5e99f630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x3db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACEODTXT.DLL", cAlternateFileName="")) returned 1 [0139.855] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd8189720, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x833a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACEOLEDB.DLL", cAlternateFileName="")) returned 1 [0139.855] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96faef00, ftCreationTime.dwHighDateTime=0x1cba070, ftLastAccessTime.dwLowDateTime=0xd8247e00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x96faef00, ftLastWriteTime.dwHighDateTime=0x1cba070, nFileSizeHigh=0x0, nFileSizeLow=0x6e398, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACER3X.DLL", cAlternateFileName="")) returned 1 [0139.855] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95c9c200, ftCreationTime.dwHighDateTime=0x1cba070, ftLastAccessTime.dwLowDateTime=0xd826df60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x95c9c200, ftLastWriteTime.dwHighDateTime=0x1cba070, nFileSizeHigh=0x0, nFileSizeLow=0xd9c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACERCLR.DLL", cAlternateFileName="")) returned 1 [0139.855] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35d59d00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd826df60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x35d59d00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xa8da0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACEREP.DLL", cAlternateFileName="")) returned 1 [0139.855] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35d59d00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd82940c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x35d59d00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x48990, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACETXT.DLL", cAlternateFileName="")) returned 1 [0139.855] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1092c00, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xd82ba220, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1092c00, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x2e8da0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACEWDAT.DLL", cAlternateFileName="")) returned 1 [0139.855] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e0c9f00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xcf0c7d40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8e0c9f00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x4dba0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACEWSS.DLL", cAlternateFileName="")) returned 1 [0139.855] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35d59d00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd82e0380, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x35d59d00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x7a998, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACEXBE.DLL", cAlternateFileName="")) returned 1 [0139.855] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67c38700, ftCreationTime.dwHighDateTime=0x1cbc9fc, ftLastAccessTime.dwLowDateTime=0xe5d21520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x67c38700, ftLastWriteTime.dwHighDateTime=0x1cbc9fc, nFileSizeHigh=0x0, nFileSizeLow=0x5e158, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ATLCONV.DLL", cAlternateFileName="")) returned 1 [0139.855] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb10f7500, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0xda5b0540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb10f7500, ftLastWriteTime.dwHighDateTime=0x1cbe56c, nFileSizeHigh=0x0, nFileSizeLow=0x4d67b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Csi.dll", cAlternateFileName="")) returned 1 [0139.855] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef87d800, ftCreationTime.dwHighDateTime=0x1cb8cce, ftLastAccessTime.dwLowDateTime=0xda5d66a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xef87d800, ftLastWriteTime.dwHighDateTime=0x1cb8cce, nFileSizeHigh=0x0, nFileSizeLow=0x1b3980, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CsiSoap.dll", cAlternateFileName="")) returned 1 [0139.855] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Cultures", cAlternateFileName="")) returned 1 [0139.855] GetProcessHeap () returned 0x4e0000 [0139.855] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x92) returned 0x4fa058 [0139.855] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0139.856] GetProcessHeap () returned 0x4e0000 [0139.856] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0139.856] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0139.856] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cbc7d00, ftCreationTime.dwHighDateTime=0x1cbe3e3, ftLastAccessTime.dwLowDateTime=0xcef24e20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7cbc7d00, ftLastWriteTime.dwHighDateTime=0x1cbe3e3, nFileSizeHigh=0x0, nFileSizeLow=0x419360, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OFFICE.ODF", cAlternateFileName="")) returned 1 [0139.856] GetProcessHeap () returned 0x4e0000 [0139.856] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x294) returned 0x527128 [0139.856] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0139.856] GetLastError () returned 0x20 [0139.857] GetProcessHeap () returned 0x4e0000 [0139.857] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x100000) returned 0x24e0020 [0139.857] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x24e0020, Length=0x100000, ResultLength=0x0 | out: SystemInformation=0x24e0020, ResultLength=0x0) returned 0x0 [0139.891] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.892] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.892] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.892] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.892] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.892] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.892] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.892] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.892] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.892] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.892] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.892] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.893] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.893] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.893] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.893] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.893] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.893] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.893] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.893] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.893] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.893] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.893] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.893] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.894] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.894] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.894] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.894] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.894] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.894] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.894] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.894] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.894] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.894] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.894] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.895] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.895] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.895] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.895] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.895] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.895] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.895] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.895] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.895] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.895] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.895] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.895] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.896] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.896] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.896] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.896] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.896] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.896] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.896] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.896] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.896] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.896] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.896] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.897] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.897] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.897] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.897] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.897] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.897] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.897] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.897] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.897] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.897] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.897] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.897] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.898] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.898] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.898] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.898] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.898] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.898] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.898] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.898] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.898] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.898] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.898] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.898] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.899] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.899] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.899] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.899] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.899] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.899] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.899] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.899] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.899] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.899] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.899] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.899] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.900] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.900] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.900] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.900] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.900] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.900] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.900] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.900] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.900] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.900] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.900] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.900] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.901] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.901] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.901] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.901] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.901] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.901] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.901] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.901] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.901] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.901] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.901] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.902] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.902] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.902] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.902] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.902] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.902] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.902] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.902] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.902] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.902] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.902] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.902] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.903] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.903] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.903] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.903] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.903] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.903] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.903] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.903] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.903] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.903] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.903] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.903] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.904] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.904] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.904] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.904] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.904] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.904] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.904] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.904] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.904] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.904] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.904] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.905] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.905] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.905] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.905] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.905] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.905] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.905] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.905] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.905] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.905] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.905] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.905] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.906] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.906] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.906] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.906] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.906] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.906] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.906] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.906] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.906] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.906] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.906] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.907] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.907] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.907] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.907] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.907] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.907] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.907] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.907] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.907] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.907] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.907] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.908] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.908] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.908] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.908] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.908] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.908] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.908] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.908] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.908] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.908] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.908] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.909] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.909] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.909] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.909] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.909] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.909] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.909] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.909] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.909] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.909] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.909] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.910] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.910] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.910] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.910] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.910] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.910] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.910] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.910] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.910] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.910] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.910] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.910] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.911] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.911] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.911] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.911] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.911] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0139.911] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0139.911] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0139.911] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0139.911] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0139.911] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0139.911] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0139.911] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0139.912] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0139.912] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0139.912] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x148) returned 0x0 [0139.912] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x148) returned 0x0 [0139.912] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0139.912] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0139.912] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0139.912] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0139.912] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0139.912] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0139.913] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0139.913] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0139.913] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0139.913] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0139.913] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x184) returned 0x0 [0139.913] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x184) returned 0x0 [0139.913] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x184) returned 0x0 [0139.914] GetFileType (hFile=0x104) returned 0x1 [0139.914] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32") returned 0x17 [0139.915] CloseHandle (hObject=0x104) returned 1 [0139.915] GetFileType (hFile=0x100) returned 0x1 [0139.915] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32") returned 0x17 [0139.916] CloseHandle (hObject=0x100) returned 1 [0139.916] GetFileType (hFile=0x104) returned 0x1 [0139.916] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a") returned 0x6b [0139.917] CloseHandle (hObject=0x104) returned 1 [0139.917] GetFileType (hFile=0x100) returned 0x0 [0139.917] CloseHandle (hObject=0x100) returned 1 [0139.917] GetFileType (hFile=0x104) returned 0x1 [0139.917] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0139.918] CloseHandle (hObject=0x104) returned 1 [0139.918] GetFileType (hFile=0x100) returned 0x1 [0139.918] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0139.918] CloseHandle (hObject=0x100) returned 1 [0139.919] GetFileType (hFile=0x104) returned 0x1 [0139.919] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_08e61857a83bc251") returned 0x64 [0139.919] CloseHandle (hObject=0x104) returned 1 [0139.919] GetFileType (hFile=0x100) returned 0x1 [0139.919] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.6161_none_0a1fd3a3a768b895") returned 0x64 [0139.920] CloseHandle (hObject=0x100) returned 1 [0139.920] GetFileType (hFile=0x104) returned 0x1 [0139.920] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0139.921] CloseHandle (hObject=0x104) returned 1 [0139.921] GetFileType (hFile=0x100) returned 0x1 [0139.921] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0139.921] CloseHandle (hObject=0x100) returned 1 [0139.921] GetFileType (hFile=0x104) returned 0x1 [0139.921] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0139.922] CloseHandle (hObject=0x104) returned 1 [0139.922] GetFileType (hFile=0x100) returned 0x1 [0139.922] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0139.923] CloseHandle (hObject=0x100) returned 1 [0139.923] GetFileType (hFile=0x104) returned 0x1 [0139.923] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0139.923] CloseHandle (hObject=0x104) returned 1 [0139.924] GetFileType (hFile=0x100) returned 0x1 [0139.924] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\Fonts\\StaticCache.dat") returned 0x24 [0139.924] CloseHandle (hObject=0x100) returned 1 [0139.924] GetFileType (hFile=0x104) returned 0x1 [0139.924] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_106f9be843a9b4e3") returned 0x7b [0139.925] CloseHandle (hObject=0x104) returned 1 [0139.925] GetFileType (hFile=0x100) returned 0x1 [0139.925] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_106f9be843a9b4e3\\comctl32.dll.mui") returned 0x8c [0139.926] CloseHandle (hObject=0x100) returned 1 [0139.926] GetFileType (hFile=0x104) returned 0x1 [0139.926] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0139.926] CloseHandle (hObject=0x104) returned 1 [0139.926] GetFileType (hFile=0x100) returned 0x1 [0139.926] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0139.927] CloseHandle (hObject=0x100) returned 1 [0139.927] GetFileType (hFile=0x104) returned 0x1 [0139.927] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0139.928] CloseHandle (hObject=0x104) returned 1 [0139.928] GetFileType (hFile=0x100) returned 0x1 [0139.928] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 0x5c [0139.929] CloseHandle (hObject=0x100) returned 1 [0139.929] GetFileType (hFile=0x104) returned 0x1 [0139.929] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 0x5b [0139.930] CloseHandle (hObject=0x104) returned 1 [0139.930] GetFileType (hFile=0x100) returned 0x1 [0139.930] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned") returned 0x66 [0139.931] CloseHandle (hObject=0x100) returned 1 [0139.931] GetFileType (hFile=0x104) returned 0x1 [0139.931] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0139.931] CloseHandle (hObject=0x104) returned 1 [0139.932] GetFileType (hFile=0x100) returned 0x1 [0139.932] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries") returned 0x4d [0139.933] CloseHandle (hObject=0x100) returned 1 [0139.933] GetFileType (hFile=0x104) returned 0x1 [0139.933] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries") returned 0x4d [0139.934] CloseHandle (hObject=0x104) returned 1 [0139.934] GetFileType (hFile=0x100) returned 0x1 [0139.934] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned") returned 0x66 [0139.934] CloseHandle (hObject=0x100) returned 1 [0139.934] GetFileType (hFile=0x104) returned 0x1 [0139.935] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\index.dat") returned 0x58 [0139.936] CloseHandle (hObject=0x104) returned 1 [0139.936] GetFileType (hFile=0x100) returned 0x1 [0139.936] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu") returned 0x2f [0139.937] CloseHandle (hObject=0x100) returned 1 [0139.937] GetFileType (hFile=0x104) returned 0x1 [0139.937] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu") returned 0x2f [0139.937] CloseHandle (hObject=0x104) returned 1 [0139.938] GetFileType (hFile=0x100) returned 0x1 [0139.938] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu") returned 0x4e [0139.939] CloseHandle (hObject=0x100) returned 1 [0139.939] GetFileType (hFile=0x104) returned 0x1 [0139.939] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu") returned 0x4e [0139.939] CloseHandle (hObject=0x104) returned 1 [0139.940] GetFileType (hFile=0x100) returned 0x1 [0139.940] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x29 [0139.940] CloseHandle (hObject=0x100) returned 1 [0139.940] GetFileType (hFile=0x104) returned 0x1 [0139.940] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x29 [0139.941] CloseHandle (hObject=0x104) returned 1 [0139.941] GetFileType (hFile=0x100) returned 0x1 [0139.941] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\Public\\Desktop") returned 0x1b [0139.942] CloseHandle (hObject=0x100) returned 1 [0139.942] GetFileType (hFile=0x104) returned 0x1 [0139.942] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\Public\\Desktop") returned 0x1b [0139.943] CloseHandle (hObject=0x104) returned 1 [0139.943] GetFileType (hFile=0x100) returned 0x1 [0139.943] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn") returned 0x46 [0139.944] CloseHandle (hObject=0x100) returned 1 [0139.944] GetFileType (hFile=0x104) returned 0x1 [0139.944] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn") returned 0x46 [0139.945] CloseHandle (hObject=0x104) returned 1 [0139.945] GetFileType (hFile=0x100) returned 0x1 [0139.945] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 0x5b [0139.946] CloseHandle (hObject=0x100) returned 1 [0139.946] GetFileType (hFile=0x104) returned 0x1 [0139.946] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 0x5d [0139.947] CloseHandle (hObject=0x104) returned 1 [0139.947] GetFileType (hFile=0x100) returned 0x1 [0139.947] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 0x5b [0139.954] CloseHandle (hObject=0x100) returned 1 [0139.956] GetFileType (hFile=0x104) returned 0x1 [0139.961] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 0x5c [0139.972] CloseHandle (hObject=0x104) returned 1 [0139.973] GetFileType (hFile=0x100) returned 0x1 [0139.973] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\wdmaud.drv.mui") returned 0x2c [0139.974] CloseHandle (hObject=0x100) returned 1 [0139.974] GetFileType (hFile=0x104) returned 0x1 [0139.974] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\MMDevAPI.dll.mui") returned 0x2e [0139.975] CloseHandle (hObject=0x104) returned 1 [0139.975] GetFileType (hFile=0x100) returned 0x1 [0139.975] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\bthprops.cpl.mui") returned 0x2e [0139.976] CloseHandle (hObject=0x100) returned 1 [0139.976] GetFileType (hFile=0x104) returned 0x1 [0139.976] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0139.976] CloseHandle (hObject=0x104) returned 1 [0139.976] GetFileType (hFile=0x100) returned 0x1 [0139.977] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0139.977] CloseHandle (hObject=0x100) returned 1 [0139.977] GetFileType (hFile=0x104) returned 0x1 [0139.977] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\msutb.dll.mui") returned 0x2b [0139.978] CloseHandle (hObject=0x104) returned 1 [0139.978] GetFileType (hFile=0x100) returned 0x1 [0139.978] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\msctf.dll.mui") returned 0x2b [0139.979] CloseHandle (hObject=0x100) returned 1 [0139.979] GetFileType (hFile=0x104) returned 0x1 [0139.979] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 0x5b [0139.980] CloseHandle (hObject=0x104) returned 1 [0139.980] GetFileType (hFile=0x100) returned 0x1 [0139.980] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 0x5b [0139.981] CloseHandle (hObject=0x100) returned 1 [0139.981] GetFileType (hFile=0x104) returned 0x1 [0139.981] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0139.982] CloseHandle (hObject=0x104) returned 1 [0139.982] GetFileType (hFile=0x100) returned 0x1 [0139.982] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 0x5b [0139.983] CloseHandle (hObject=0x100) returned 1 [0139.983] GetFileType (hFile=0x104) returned 0x1 [0139.983] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 0x5c [0139.984] CloseHandle (hObject=0x104) returned 1 [0139.984] GetFileType (hFile=0x100) returned 0x0 [0139.984] CloseHandle (hObject=0x100) returned 1 [0139.984] GetFileType (hFile=0x104) returned 0x1 [0139.984] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0139.985] CloseHandle (hObject=0x104) returned 1 [0139.985] GetFileType (hFile=0x100) returned 0x1 [0139.985] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts") returned 0x55 [0139.986] CloseHandle (hObject=0x100) returned 1 [0139.986] GetFileType (hFile=0x104) returned 0x1 [0139.986] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts") returned 0x55 [0139.987] CloseHandle (hObject=0x104) returned 1 [0139.987] GetFileType (hFile=0x100) returned 0x1 [0139.987] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0139.987] CloseHandle (hObject=0x100) returned 1 [0139.988] GetFileType (hFile=0x104) returned 0x1 [0139.988] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\netshell.dll.mui") returned 0x2e [0139.988] CloseHandle (hObject=0x104) returned 1 [0139.988] GetFileType (hFile=0x100) returned 0x1 [0139.988] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 0x5b [0139.989] CloseHandle (hObject=0x100) returned 1 [0139.990] GetFileType (hFile=0x104) returned 0x0 [0139.990] CloseHandle (hObject=0x104) returned 1 [0139.990] GetFileType (hFile=0x100) returned 0x1 [0139.990] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 0x5d [0139.991] CloseHandle (hObject=0x100) returned 1 [0139.991] GetFileType (hFile=0x104) returned 0x3 [0139.991] CloseHandle (hObject=0x104) returned 1 [0139.991] GetFileType (hFile=0x100) returned 0x1 [0139.991] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\KernelBase.dll.mui") returned 0x30 [0139.992] CloseHandle (hObject=0x100) returned 1 [0139.992] GetFileType (hFile=0x104) returned 0x1 [0139.992] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0139.992] CloseHandle (hObject=0x104) returned 1 [0139.992] GetFileType (hFile=0x100) returned 0x1 [0139.992] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0139.993] CloseHandle (hObject=0x100) returned 1 [0139.993] GetFileType (hFile=0x104) returned 0x1 [0139.993] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0139.994] CloseHandle (hObject=0x104) returned 1 [0139.994] GetFileType (hFile=0x100) returned 0x1 [0139.994] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0139.995] CloseHandle (hObject=0x100) returned 1 [0139.995] GetFileType (hFile=0x104) returned 0x1 [0139.995] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0139.995] CloseHandle (hObject=0x104) returned 1 [0139.995] GetFileType (hFile=0x100) returned 0x1 [0139.995] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt") returned 0x4b [0139.996] CloseHandle (hObject=0x100) returned 1 [0139.997] GetFileType (hFile=0x104) returned 0x1 [0139.997] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0139.998] CloseHandle (hObject=0x104) returned 1 [0139.998] GetFileType (hFile=0x100) returned 0x1 [0139.999] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 0x5b [0140.000] CloseHandle (hObject=0x100) returned 1 [0140.000] GetFileType (hFile=0x104) returned 0x1 [0140.000] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 0x5c [0140.001] CloseHandle (hObject=0x104) returned 1 [0140.001] GetFileType (hFile=0x100) returned 0x1 [0140.001] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 0x5b [0140.002] CloseHandle (hObject=0x100) returned 1 [0140.002] GetFileType (hFile=0x104) returned 0x1 [0140.002] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 0x5c [0140.003] CloseHandle (hObject=0x104) returned 1 [0140.003] GetFileType (hFile=0x100) returned 0x1 [0140.003] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\ActionCenter.dll.mui") returned 0x32 [0140.004] CloseHandle (hObject=0x100) returned 1 [0140.004] GetFileType (hFile=0x104) returned 0x1 [0140.004] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0140.005] CloseHandle (hObject=0x104) returned 1 [0140.005] GetFileType (hFile=0x100) returned 0x0 [0140.005] CloseHandle (hObject=0x100) returned 1 [0140.005] GetFileType (hFile=0x104) returned 0x1 [0140.005] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 0x5d [0140.006] CloseHandle (hObject=0x104) returned 1 [0140.006] GetFileType (hFile=0x100) returned 0x1 [0140.006] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 0x5c [0140.007] CloseHandle (hObject=0x100) returned 1 [0140.007] GetFileType (hFile=0x104) returned 0x1 [0140.007] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat") returned 0x70 [0140.008] CloseHandle (hObject=0x104) returned 1 [0140.008] GetFileType (hFile=0x100) returned 0x1 [0140.008] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat") returned 0x55 [0140.010] CloseHandle (hObject=0x100) returned 1 [0140.010] GetFileType (hFile=0x104) returned 0x1 [0140.010] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat") returned 0x5f [0140.011] CloseHandle (hObject=0x104) returned 1 [0140.011] GetFileType (hFile=0x100) returned 0x1 [0140.011] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012020022120200222\\index.dat") returned 0x78 [0140.013] CloseHandle (hObject=0x100) returned 1 [0140.013] GetFileType (hFile=0x104) returned 0x1 [0140.013] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32") returned 0x17 [0140.013] CloseHandle (hObject=0x104) returned 1 [0140.013] GetFileType (hFile=0x100) returned 0x0 [0140.014] CloseHandle (hObject=0x100) returned 1 [0140.014] GetFileType (hFile=0x104) returned 0x0 [0140.014] CloseHandle (hObject=0x104) returned 1 [0140.014] GetFileType (hFile=0x100) returned 0x1 [0140.014] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\KernelBase.dll.mui") returned 0x30 [0140.014] CloseHandle (hObject=0x100) returned 1 [0140.015] GetFileType (hFile=0x104) returned 0x1 [0140.015] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\msutb.dll.mui") returned 0x2b [0140.015] CloseHandle (hObject=0x104) returned 1 [0140.015] GetFileType (hFile=0x100) returned 0x1 [0140.015] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32") returned 0x17 [0140.016] CloseHandle (hObject=0x100) returned 1 [0140.016] GetFileType (hFile=0x104) returned 0x0 [0140.016] CloseHandle (hObject=0x104) returned 1 [0140.016] GetFileType (hFile=0x100) returned 0x1 [0140.016] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0140.017] CloseHandle (hObject=0x100) returned 1 [0140.017] GetFileType (hFile=0x104) returned 0x1 [0140.017] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\DVD Maker") returned 0x1e [0140.017] CloseHandle (hObject=0x104) returned 1 [0140.017] GetFileType (hFile=0x100) returned 0x1 [0140.017] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0140.018] CloseHandle (hObject=0x100) returned 1 [0140.018] GetFileType (hFile=0x104) returned 0x1 [0140.018] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Reference Assemblies") returned 0x2f [0140.018] CloseHandle (hObject=0x104) returned 1 [0140.018] GetFileType (hFile=0x100) returned 0x1 [0140.018] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0140.019] CloseHandle (hObject=0x100) returned 1 [0140.019] GetFileType (hFile=0x104) returned 0x1 [0140.019] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Common Files") returned 0x21 [0140.019] CloseHandle (hObject=0x104) returned 1 [0140.020] GetFileType (hFile=0x100) returned 0x1 [0140.020] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0140.020] CloseHandle (hObject=0x100) returned 1 [0140.020] GetFileType (hFile=0x104) returned 0x1 [0140.020] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Common Files") returned 0x27 [0140.021] CloseHandle (hObject=0x104) returned 1 [0140.021] GetFileType (hFile=0x100) returned 0x1 [0140.021] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0140.021] CloseHandle (hObject=0x100) returned 1 [0140.021] GetFileType (hFile=0x104) returned 0x1 [0140.021] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Reference Assemblies") returned 0x29 [0140.022] CloseHandle (hObject=0x104) returned 1 [0140.022] GetFileType (hFile=0x100) returned 0x1 [0140.022] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0140.022] CloseHandle (hObject=0x100) returned 1 [0140.022] GetFileType (hFile=0x104) returned 0x1 [0140.022] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft Visual Studio 8") returned 0x34 [0140.023] CloseHandle (hObject=0x104) returned 1 [0140.023] GetFileType (hFile=0x100) returned 0x1 [0140.023] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0140.023] CloseHandle (hObject=0x100) returned 1 [0140.023] GetFileType (hFile=0x104) returned 0x1 [0140.023] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Office") returned 0x25 [0140.024] CloseHandle (hObject=0x104) returned 1 [0140.024] GetFileType (hFile=0x100) returned 0x1 [0140.024] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0140.024] CloseHandle (hObject=0x100) returned 1 [0140.025] GetFileType (hFile=0x104) returned 0x1 [0140.025] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Mail") returned 0x21 [0140.025] CloseHandle (hObject=0x104) returned 1 [0140.025] GetFileType (hFile=0x100) returned 0x1 [0140.025] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0140.026] CloseHandle (hObject=0x100) returned 1 [0140.026] GetFileType (hFile=0x104) returned 0x1 [0140.026] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft.NET") returned 0x28 [0140.029] CloseHandle (hObject=0x104) returned 1 [0140.029] GetFileType (hFile=0x100) returned 0x1 [0140.029] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0140.030] CloseHandle (hObject=0x100) returned 1 [0140.030] GetFileType (hFile=0x104) returned 0x1 [0140.030] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Media Player") returned 0x29 [0140.030] CloseHandle (hObject=0x104) returned 1 [0140.030] GetFileType (hFile=0x100) returned 0x1 [0140.030] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0140.031] CloseHandle (hObject=0x100) returned 1 [0140.031] GetFileType (hFile=0x104) returned 0x1 [0140.031] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox") returned 0x2a [0140.031] CloseHandle (hObject=0x104) returned 1 [0140.031] GetFileType (hFile=0x100) returned 0x1 [0140.031] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0140.032] CloseHandle (hObject=0x100) returned 1 [0140.032] GetFileType (hFile=0x104) returned 0x1 [0140.032] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Common Files") returned 0x21 [0140.032] CloseHandle (hObject=0x104) returned 1 [0140.032] GetFileType (hFile=0x100) returned 0x1 [0140.032] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0140.033] CloseHandle (hObject=0x100) returned 1 [0140.033] GetFileType (hFile=0x104) returned 0x1 [0140.033] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Google") returned 0x21 [0140.034] CloseHandle (hObject=0x104) returned 1 [0140.034] GetFileType (hFile=0x100) returned 0x1 [0140.034] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0140.034] CloseHandle (hObject=0x100) returned 1 [0140.034] GetFileType (hFile=0x104) returned 0x1 [0140.034] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\MSBuild") returned 0x1c [0140.035] CloseHandle (hObject=0x104) returned 1 [0140.035] GetFileType (hFile=0x100) returned 0x1 [0140.035] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0140.035] CloseHandle (hObject=0x100) returned 1 [0140.035] GetFileType (hFile=0x104) returned 0x1 [0140.035] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Portable Devices") returned 0x2d [0140.036] CloseHandle (hObject=0x104) returned 1 [0140.036] GetFileType (hFile=0x100) returned 0x1 [0140.036] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0140.036] CloseHandle (hObject=0x100) returned 1 [0140.037] GetFileType (hFile=0x104) returned 0x1 [0140.037] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services") returned 0x36 [0140.037] CloseHandle (hObject=0x104) returned 1 [0140.037] GetFileType (hFile=0x100) returned 0x1 [0140.037] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0140.038] CloseHandle (hObject=0x100) returned 1 [0140.038] GetFileType (hFile=0x104) returned 0x1 [0140.038] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Google") returned 0x21 [0140.038] CloseHandle (hObject=0x104) returned 1 [0140.038] GetFileType (hFile=0x100) returned 0x1 [0140.038] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0140.039] CloseHandle (hObject=0x100) returned 1 [0140.039] GetFileType (hFile=0x104) returned 0x1 [0140.039] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Journal") returned 0x24 [0140.039] CloseHandle (hObject=0x104) returned 1 [0140.039] GetFileType (hFile=0x100) returned 0x1 [0140.039] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0140.040] CloseHandle (hObject=0x100) returned 1 [0140.040] GetFileType (hFile=0x104) returned 0x1 [0140.040] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows NT") returned 0x25 [0140.040] CloseHandle (hObject=0x104) returned 1 [0140.040] GetFileType (hFile=0x100) returned 0x1 [0140.040] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0140.041] CloseHandle (hObject=0x100) returned 1 [0140.041] GetFileType (hFile=0x104) returned 0x1 [0140.041] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\DVD Maker") returned 0x1e [0140.042] CloseHandle (hObject=0x104) returned 1 [0140.042] GetFileType (hFile=0x100) returned 0x1 [0140.042] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0140.042] CloseHandle (hObject=0x100) returned 1 [0140.042] GetFileType (hFile=0x104) returned 0x1 [0140.042] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Analysis Services") returned 0x30 [0140.043] CloseHandle (hObject=0x104) returned 1 [0140.043] GetFileType (hFile=0x100) returned 0x1 [0140.043] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0140.043] CloseHandle (hObject=0x100) returned 1 [0140.044] GetFileType (hFile=0x104) returned 0x1 [0140.044] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows NT") returned 0x25 [0140.044] CloseHandle (hObject=0x104) returned 1 [0140.044] GetFileType (hFile=0x100) returned 0x1 [0140.044] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0140.045] CloseHandle (hObject=0x100) returned 1 [0140.045] GetFileType (hFile=0x104) returned 0x1 [0140.045] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Uninstall Information") returned 0x30 [0140.045] CloseHandle (hObject=0x104) returned 1 [0140.045] GetFileType (hFile=0x100) returned 0x1 [0140.045] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0140.046] CloseHandle (hObject=0x100) returned 1 [0140.046] GetFileType (hFile=0x104) returned 0x1 [0140.046] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Mail") returned 0x27 [0140.046] CloseHandle (hObject=0x104) returned 1 [0140.046] GetFileType (hFile=0x100) returned 0x1 [0140.046] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0140.047] CloseHandle (hObject=0x100) returned 1 [0140.047] GetFileType (hFile=0x104) returned 0x1 [0140.047] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Portable Devices") returned 0x2d [0140.047] CloseHandle (hObject=0x104) returned 1 [0140.048] GetFileType (hFile=0x100) returned 0x1 [0140.048] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0140.048] CloseHandle (hObject=0x100) returned 1 [0140.048] GetFileType (hFile=0x104) returned 0x1 [0140.048] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Uninstall Information") returned 0x30 [0140.049] CloseHandle (hObject=0x104) returned 1 [0140.049] GetFileType (hFile=0x100) returned 0x1 [0140.049] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0140.049] CloseHandle (hObject=0x100) returned 1 [0140.050] GetFileType (hFile=0x104) returned 0x1 [0140.050] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Uninstall Information") returned 0x30 [0140.050] CloseHandle (hObject=0x104) returned 1 [0140.050] GetFileType (hFile=0x100) returned 0x1 [0140.050] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0140.051] CloseHandle (hObject=0x100) returned 1 [0140.051] GetFileType (hFile=0x104) returned 0x1 [0140.051] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Reference Assemblies") returned 0x29 [0140.051] CloseHandle (hObject=0x104) returned 1 [0140.051] GetFileType (hFile=0x100) returned 0x1 [0140.051] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0140.052] CloseHandle (hObject=0x100) returned 1 [0140.052] GetFileType (hFile=0x104) returned 0x1 [0140.052] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Photo Viewer") returned 0x29 [0140.052] CloseHandle (hObject=0x104) returned 1 [0140.052] GetFileType (hFile=0x100) returned 0x1 [0140.052] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0140.053] CloseHandle (hObject=0x100) returned 1 [0140.053] GetFileType (hFile=0x104) returned 0x1 [0140.053] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows NT") returned 0x1f [0140.053] CloseHandle (hObject=0x104) returned 1 [0140.053] GetFileType (hFile=0x100) returned 0x1 [0140.053] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0140.054] CloseHandle (hObject=0x100) returned 1 [0140.054] GetFileType (hFile=0x104) returned 0x1 [0140.054] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Defender") returned 0x2b [0140.054] CloseHandle (hObject=0x104) returned 1 [0140.055] GetFileType (hFile=0x100) returned 0x1 [0140.055] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0140.055] CloseHandle (hObject=0x100) returned 1 [0140.055] GetFileType (hFile=0x104) returned 0x1 [0140.055] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Analysis Services") returned 0x30 [0140.056] CloseHandle (hObject=0x104) returned 1 [0140.056] GetFileType (hFile=0x100) returned 0x1 [0140.056] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0140.056] CloseHandle (hObject=0x100) returned 1 [0140.056] GetFileType (hFile=0x104) returned 0x1 [0140.056] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\DVD Maker") returned 0x1e [0140.057] CloseHandle (hObject=0x104) returned 1 [0140.057] GetFileType (hFile=0x100) returned 0x1 [0140.057] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0140.057] CloseHandle (hObject=0x100) returned 1 [0140.057] GetFileType (hFile=0x104) returned 0x1 [0140.057] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox") returned 0x2a [0140.058] CloseHandle (hObject=0x104) returned 1 [0140.058] GetFileType (hFile=0x100) returned 0x1 [0140.058] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0140.058] CloseHandle (hObject=0x100) returned 1 [0140.058] GetFileType (hFile=0x104) returned 0x1 [0140.058] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Uninstall Information") returned 0x30 [0140.059] CloseHandle (hObject=0x104) returned 1 [0140.059] GetFileType (hFile=0x100) returned 0x1 [0140.059] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0140.059] CloseHandle (hObject=0x100) returned 1 [0140.060] GetFileType (hFile=0x104) returned 0x1 [0140.060] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Internet Explorer") returned 0x2c [0140.060] CloseHandle (hObject=0x104) returned 1 [0140.060] GetFileType (hFile=0x100) returned 0x1 [0140.060] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0140.061] CloseHandle (hObject=0x100) returned 1 [0140.061] GetFileType (hFile=0x104) returned 0x1 [0140.061] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\MSBuild") returned 0x1c [0140.061] CloseHandle (hObject=0x104) returned 1 [0140.061] GetFileType (hFile=0x100) returned 0x1 [0140.061] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0140.062] CloseHandle (hObject=0x100) returned 1 [0140.062] GetFileType (hFile=0x104) returned 0x1 [0140.062] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Defender") returned 0x25 [0140.062] CloseHandle (hObject=0x104) returned 1 [0140.062] GetFileType (hFile=0x100) returned 0x1 [0140.062] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0140.063] CloseHandle (hObject=0x100) returned 1 [0140.063] GetFileType (hFile=0x104) returned 0x1 [0140.063] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\DVD Maker") returned 0x1e [0140.063] CloseHandle (hObject=0x104) returned 1 [0140.063] GetFileType (hFile=0x100) returned 0x1 [0140.063] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0140.064] CloseHandle (hObject=0x100) returned 1 [0140.064] GetFileType (hFile=0x104) returned 0x1 [0140.064] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Java") returned 0x1f [0140.065] CloseHandle (hObject=0x104) returned 1 [0140.065] GetFileType (hFile=0x100) returned 0x1 [0140.065] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0140.065] CloseHandle (hObject=0x100) returned 1 [0140.065] GetFileType (hFile=0x104) returned 0x1 [0140.065] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Synchronization Services") returned 0x37 [0140.066] CloseHandle (hObject=0x104) returned 1 [0140.066] GetFileType (hFile=0x100) returned 0x1 [0140.066] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0140.067] CloseHandle (hObject=0x100) returned 1 [0140.067] GetFileType (hFile=0x104) returned 0x1 [0140.067] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows NT") returned 0x1f [0140.067] CloseHandle (hObject=0x104) returned 1 [0140.067] GetFileType (hFile=0x100) returned 0x1 [0140.067] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0140.068] CloseHandle (hObject=0x100) returned 1 [0140.068] GetFileType (hFile=0x104) returned 0x1 [0140.068] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Common Files") returned 0x27 [0140.068] CloseHandle (hObject=0x104) returned 1 [0140.068] GetFileType (hFile=0x100) returned 0x1 [0140.068] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0140.069] CloseHandle (hObject=0x100) returned 1 [0140.069] GetFileType (hFile=0x104) returned 0x1 [0140.069] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Uninstall Information") returned 0x30 [0140.069] CloseHandle (hObject=0x104) returned 1 [0140.069] GetFileType (hFile=0x100) returned 0x1 [0140.070] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0140.070] CloseHandle (hObject=0x100) returned 1 [0140.070] GetFileType (hFile=0x104) returned 0x1 [0140.070] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services") returned 0x36 [0140.070] CloseHandle (hObject=0x104) returned 1 [0140.071] GetFileType (hFile=0x100) returned 0x1 [0140.071] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0140.071] CloseHandle (hObject=0x100) returned 1 [0140.071] GetFileType (hFile=0x104) returned 0x1 [0140.071] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft SQL Server Compact Edition") returned 0x39 [0140.072] CloseHandle (hObject=0x104) returned 1 [0140.072] GetFileType (hFile=0x100) returned 0x1 [0140.072] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0140.072] CloseHandle (hObject=0x100) returned 1 [0140.072] GetFileType (hFile=0x104) returned 0x1 [0140.073] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Reference Assemblies") returned 0x2f [0140.073] CloseHandle (hObject=0x104) returned 1 [0140.073] GetFileType (hFile=0x100) returned 0x1 [0140.073] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0140.074] CloseHandle (hObject=0x100) returned 1 [0140.074] GetFileType (hFile=0x104) returned 0x1 [0140.074] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Adobe") returned 0x20 [0140.074] CloseHandle (hObject=0x104) returned 1 [0140.074] GetFileType (hFile=0x100) returned 0x1 [0140.075] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0140.075] CloseHandle (hObject=0x100) returned 1 [0140.075] GetFileType (hFile=0x104) returned 0x1 [0140.075] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Mail") returned 0x27 [0140.075] CloseHandle (hObject=0x104) returned 1 [0140.076] GetFileType (hFile=0x100) returned 0x1 [0140.076] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0140.076] CloseHandle (hObject=0x100) returned 1 [0140.076] GetFileType (hFile=0x104) returned 0x1 [0140.076] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Sync Framework") returned 0x2d [0140.077] CloseHandle (hObject=0x104) returned 1 [0140.077] GetFileType (hFile=0x100) returned 0x1 [0140.077] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0140.077] CloseHandle (hObject=0x100) returned 1 [0140.077] GetFileType (hFile=0x104) returned 0x1 [0140.077] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Uninstall Information") returned 0x2a [0140.078] CloseHandle (hObject=0x104) returned 1 [0140.078] GetFileType (hFile=0x100) returned 0x1 [0140.078] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0140.078] CloseHandle (hObject=0x100) returned 1 [0140.078] GetFileType (hFile=0x104) returned 0x1 [0140.078] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Portable Devices") returned 0x2d [0140.079] CloseHandle (hObject=0x104) returned 1 [0140.079] GetFileType (hFile=0x100) returned 0x1 [0140.079] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0140.079] CloseHandle (hObject=0x100) returned 1 [0140.079] GetFileType (hFile=0x104) returned 0x1 [0140.079] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Internet Explorer") returned 0x26 [0140.080] CloseHandle (hObject=0x104) returned 1 [0140.080] GetFileType (hFile=0x100) returned 0x1 [0140.080] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0140.080] CloseHandle (hObject=0x100) returned 1 [0140.081] GetFileType (hFile=0x104) returned 0x1 [0140.081] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Internet Explorer") returned 0x26 [0140.081] CloseHandle (hObject=0x104) returned 1 [0140.081] GetFileType (hFile=0x100) returned 0x1 [0140.081] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0140.082] CloseHandle (hObject=0x100) returned 1 [0140.082] GetFileType (hFile=0x104) returned 0x1 [0140.082] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows NT") returned 0x1f [0140.082] CloseHandle (hObject=0x104) returned 1 [0140.082] GetFileType (hFile=0x100) returned 0x1 [0140.082] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0140.083] CloseHandle (hObject=0x100) returned 1 [0140.083] GetFileType (hFile=0x104) returned 0x1 [0140.083] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\MSBuild") returned 0x22 [0140.083] CloseHandle (hObject=0x104) returned 1 [0140.083] GetFileType (hFile=0x100) returned 0x1 [0140.083] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0140.084] CloseHandle (hObject=0x100) returned 1 [0140.084] GetFileType (hFile=0x104) returned 0x1 [0140.084] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Journal") returned 0x24 [0140.084] CloseHandle (hObject=0x104) returned 1 [0140.084] GetFileType (hFile=0x100) returned 0x1 [0140.085] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\Fonts\\StaticCache.dat") returned 0x24 [0140.085] CloseHandle (hObject=0x100) returned 1 [0140.085] GetFileType (hFile=0x104) returned 0x1 [0140.085] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0140.086] CloseHandle (hObject=0x104) returned 1 [0140.086] GetFileType (hFile=0x100) returned 0x1 [0140.086] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Google") returned 0x21 [0140.086] CloseHandle (hObject=0x100) returned 1 [0140.086] GetFileType (hFile=0x104) returned 0x1 [0140.086] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\Fonts\\StaticCache.dat") returned 0x24 [0140.087] CloseHandle (hObject=0x104) returned 1 [0140.087] GetFileType (hFile=0x100) returned 0x1 [0140.087] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0140.088] CloseHandle (hObject=0x100) returned 1 [0140.088] GetFileType (hFile=0x104) returned 0x1 [0140.088] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft.NET") returned 0x28 [0140.088] CloseHandle (hObject=0x104) returned 1 [0140.088] GetFileType (hFile=0x100) returned 0x1 [0140.088] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\Fonts\\StaticCache.dat") returned 0x24 [0140.089] CloseHandle (hObject=0x100) returned 1 [0140.089] GetFileType (hFile=0x104) returned 0x1 [0140.089] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0140.089] CloseHandle (hObject=0x104) returned 1 [0140.089] GetFileType (hFile=0x100) returned 0x1 [0140.089] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Mail") returned 0x21 [0140.090] CloseHandle (hObject=0x100) returned 1 [0140.090] GetFileType (hFile=0x104) returned 0x1 [0140.090] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\Fonts\\StaticCache.dat") returned 0x24 [0140.091] CloseHandle (hObject=0x104) returned 1 [0140.091] GetFileType (hFile=0x100) returned 0x1 [0140.091] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0140.091] CloseHandle (hObject=0x100) returned 1 [0140.091] GetFileType (hFile=0x104) returned 0x1 [0140.091] GetFinalPathNameByHandleW (in: hFile=0x104, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x31 [0140.092] CloseHandle (hObject=0x104) returned 1 [0140.092] GetFileType (hFile=0x100) returned 0x0 [0140.092] CloseHandle (hObject=0x100) returned 1 [0140.092] GetFileType (hFile=0x104) returned 0x3 [0140.092] CloseHandle (hObject=0x104) returned 1 [0140.093] GetFileType (hFile=0x100) returned 0x1 [0140.093] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui") returned 0x30 [0140.093] CloseHandle (hObject=0x100) returned 1 [0140.093] GetFileType (hFile=0x104) returned 0x0 [0140.093] CloseHandle (hObject=0x104) returned 1 [0140.094] GetFileType (hFile=0x100) returned 0x1 [0140.094] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32") returned 0x17 [0140.094] CloseHandle (hObject=0x100) returned 1 [0140.094] GetFileType (hFile=0x104) returned 0x0 [0140.094] CloseHandle (hObject=0x104) returned 1 [0140.094] GetFileType (hFile=0x100) returned 0x1 [0140.094] GetFinalPathNameByHandleW (in: hFile=0x100, lpszFilePath=0x24de808, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9") returned 0x74 [0140.095] CloseHandle (hObject=0x100) returned 1 [0140.095] GetProcessHeap () returned 0x4e0000 [0140.095] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x24e0020 | out: hHeap=0x4e0000) returned 1 [0140.096] Sleep (dwMilliseconds=0xa) [0140.104] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0140.104] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cbc7d00, ftCreationTime.dwHighDateTime=0x1cbe3e3, ftLastAccessTime.dwLowDateTime=0xcef24e20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7cbc7d00, ftLastWriteTime.dwHighDateTime=0x1cbe3e3, nFileSizeHigh=0x0, nFileSizeLow=0x419360, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OFFICE.ODF", cAlternateFileName="")) returned 0 [0140.104] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0140.104] GetProcessHeap () returned 0x4e0000 [0140.104] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527128 | out: hHeap=0x4e0000) returned 1 [0140.104] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x520efa00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xd83064e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x520efa00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x7eb48, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EXPSRV.DLL", cAlternateFileName="")) returned 1 [0140.104] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ebd7300, ftCreationTime.dwHighDateTime=0x1cba5c3, ftLastAccessTime.dwLowDateTime=0xcef710e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3ebd7300, ftLastWriteTime.dwHighDateTime=0x1cba5c3, nFileSizeHigh=0x0, nFileSizeLow=0x21d78, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EXP_PDF.DLL", cAlternateFileName="")) returned 1 [0140.104] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5bf6900, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xcf5b0aa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf5bf6900, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0x11578, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EXP_XPS.DLL", cAlternateFileName="")) returned 1 [0140.104] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd66e7600, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xe572de20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd66e7600, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x26560, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FLTLDR.EXE", cAlternateFileName="")) returned 1 [0140.104] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7bf3f00, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x53907610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7bf3f00, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x417360, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IACOM2.DLL", cAlternateFileName="")) returned 1 [0140.105] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x31d88, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LICLUA.EXE", cAlternateFileName="")) returned 1 [0140.105] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc821f600, ftCreationTime.dwHighDateTime=0x1cbdfb3, ftLastAccessTime.dwLowDateTime=0xd776b9a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc821f600, ftLastWriteTime.dwHighDateTime=0x1cbdfb3, nFileSizeHigh=0x0, nFileSizeLow=0x183d780, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSO.DLL", cAlternateFileName="")) returned 1 [0140.105] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee94c400, ftCreationTime.dwHighDateTime=0x1cb7007, ftLastAccessTime.dwLowDateTime=0xd6225500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xee94c400, ftLastWriteTime.dwHighDateTime=0x1cb7007, nFileSizeHigh=0x0, nFileSizeLow=0x73b60, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSOICONS.EXE", cAlternateFileName="")) returned 1 [0140.105] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e15000, ftCreationTime.dwHighDateTime=0x1cbf3e5, ftLastAccessTime.dwLowDateTime=0xec32f3e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe5e15000, ftLastWriteTime.dwHighDateTime=0x1cbf3e5, nFileSizeHigh=0x0, nFileSizeLow=0x4529780, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSORES.DLL", cAlternateFileName="")) returned 1 [0140.105] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4293d00, ftCreationTime.dwHighDateTime=0x1cbc468, ftLastAccessTime.dwLowDateTime=0xd77dddc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa4293d00, ftLastWriteTime.dwHighDateTime=0x1cbc468, nFileSizeHigh=0x0, nFileSizeLow=0x135f90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msoshext.dll", cAlternateFileName="")) returned 1 [0140.105] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc276d800, ftCreationTime.dwHighDateTime=0x1cab8aa, ftLastAccessTime.dwLowDateTime=0x6a050eb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc276d800, ftLastWriteTime.dwHighDateTime=0x1cab8aa, nFileSizeHigh=0x0, nFileSizeLow=0xdb50, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSOXEV.DLL", cAlternateFileName="")) returned 1 [0140.105] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553f4600, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x593ede30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553f4600, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x1d950, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSOXMLED.EXE", cAlternateFileName="")) returned 1 [0140.105] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553f4600, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x593ede30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553f4600, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0xdb80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSOXMLMF.DLL", cAlternateFileName="")) returned 1 [0140.105] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3922200, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0x59413f90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3922200, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x124980, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSPTLS.DLL", cAlternateFileName="")) returned 1 [0140.105] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15d97a00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15d97a00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0xac370, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSSOAP30.DLL", cAlternateFileName="")) returned 1 [0140.105] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8054ff00, ftCreationTime.dwHighDateTime=0x1cb7011, ftLastAccessTime.dwLowDateTime=0xcf459e40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8054ff00, ftLastWriteTime.dwHighDateTime=0x1cb7011, nFileSizeHigh=0x0, nFileSizeLow=0x1a5b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MUAUTH.CAB", cAlternateFileName="")) returned 1 [0140.105] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0140.106] GetProcessHeap () returned 0x4e0000 [0140.106] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0140.106] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0140.106] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0140.106] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x5, lpOverlapped=0x0) returned 1 [0140.108] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0140.108] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.108] GetProcessHeap () returned 0x4e0000 [0140.108] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0140.108] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0140.108] CryptDestroyKey (hKey=0x522f98) returned 1 [0140.108] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0140.108] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0140.108] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0140.109] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0140.109] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0140.109] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0140.109] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0140.109] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.109] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.109] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1a5b, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1a5b, lpOverlapped=0x0) returned 1 [0140.110] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1a60, dwBufLen=0x1a60 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1a60) returned 1 [0140.110] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.110] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1a60, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1a60, lpOverlapped=0x0) returned 1 [0140.110] CryptDestroyKey (hKey=0x522f98) returned 1 [0140.110] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1b24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.110] SetEndOfFile (hFile=0xdc) returned 1 [0140.112] GetProcessHeap () returned 0x4e0000 [0140.112] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0140.112] GetProcessHeap () returned 0x4e0000 [0140.112] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0140.112] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0140.114] CloseHandle (hObject=0xdc) returned 1 [0140.114] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8054ff00, ftCreationTime.dwHighDateTime=0x1cb7011, ftLastAccessTime.dwLowDateTime=0xcf47ffa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8054ff00, ftLastWriteTime.dwHighDateTime=0x1cb7011, nFileSizeHigh=0x0, nFileSizeLow=0x6190, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MUOPTIN.DLL", cAlternateFileName="")) returned 1 [0140.114] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x161d5800, ftCreationTime.dwHighDateTime=0x1cbd856, ftLastAccessTime.dwLowDateTime=0xd63a22c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x161d5800, ftLastWriteTime.dwHighDateTime=0x1cbd856, nFileSizeHigh=0x0, nFileSizeLow=0x38d88, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Oarpmany.exe", cAlternateFileName="")) returned 1 [0140.114] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f9d2900, ftCreationTime.dwHighDateTime=0x1cab9ac, ftLastAccessTime.dwLowDateTime=0xbe0f9da0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7f9d2900, ftLastWriteTime.dwHighDateTime=0x1cab9ac, nFileSizeHigh=0x0, nFileSizeLow=0x7568, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ODBCMON.DLL", cAlternateFileName="")) returned 1 [0140.114] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office Setup Controller", cAlternateFileName="OFFICE~1")) returned 1 [0140.114] GetProcessHeap () returned 0x4e0000 [0140.114] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xb0) returned 0x4fa058 [0140.114] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24df164, dwReserved1=0x77c7389e, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0140.116] GetProcessHeap () returned 0x4e0000 [0140.116] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0140.116] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24df164, dwReserved1=0x77c7389e, cFileName="..", cAlternateFileName="")) returned 1 [0140.117] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24df164, dwReserved1=0x77c7389e, cFileName="Access.en-us", cAlternateFileName="ACCESS~1.EN-")) returned 1 [0140.117] GetProcessHeap () returned 0x4e0000 [0140.117] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2b2) returned 0x527128 [0140.117] GetProcessHeap () returned 0x4e0000 [0140.117] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xca) returned 0x4fa058 [0140.117] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\*.*", lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522fd8 [0140.120] GetProcessHeap () returned 0x4e0000 [0140.120] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0140.120] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0140.120] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa5fe940, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x15419830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa5fe940, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x545, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AccessMUI.XML", cAlternateFileName="ACCESS~1.XML")) returned 1 [0140.120] GetProcessHeap () returned 0x4e0000 [0140.120] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2cc) returned 0x5273e8 [0140.120] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0140.120] GetProcessHeap () returned 0x4e0000 [0140.120] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0140.120] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0140.120] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded50 | out: lpNewFilePointer=0x0) returned 1 [0140.120] WriteFile (in: hFile=0x104, lpBuffer=0x24ded60*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded60*, lpNumberOfBytesWritten=0x24ded38*=0xb, lpOverlapped=0x0) returned 1 [0140.122] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.122] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.122] GetProcessHeap () returned 0x4e0000 [0140.122] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0140.122] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24ded18*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24ded18*=0x40) returned 1 [0140.122] CryptDestroyKey (hKey=0x523018) returned 1 [0140.122] WriteFile (in: hFile=0x104, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24ded38*=0x40, lpOverlapped=0x0) returned 1 [0140.122] WriteFile (in: hFile=0x104, lpBuffer=0x24ded40*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded40*, lpNumberOfBytesWritten=0x24ded38*=0x4, lpOverlapped=0x0) returned 1 [0140.123] WriteFile (in: hFile=0x104, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24ded38*=0x10, lpOverlapped=0x0) returned 1 [0140.123] WriteFile (in: hFile=0x104, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24ded38*=0x80, lpOverlapped=0x0) returned 1 [0140.123] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded48 | out: lpNewFilePointer=0x0) returned 1 [0140.123] WriteFile (in: hFile=0x104, lpBuffer=0x24ded58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded58*, lpNumberOfBytesWritten=0x24ded38*=0x8, lpOverlapped=0x0) returned 1 [0140.123] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.123] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.123] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.123] ReadFile (in: hFile=0x104, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x545, lpNumberOfBytesRead=0x24decf0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24decf0*=0x545, lpOverlapped=0x0) returned 1 [0140.123] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x550, dwBufLen=0x550 | out: pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x550) returned 1 [0140.123] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.123] WriteFile (in: hFile=0x104, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x24decf4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24decf4*=0x550, lpOverlapped=0x0) returned 1 [0140.123] CryptDestroyKey (hKey=0x523018) returned 1 [0140.123] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x624, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.123] SetEndOfFile (hFile=0x104) returned 1 [0140.125] GetProcessHeap () returned 0x4e0000 [0140.125] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0140.125] GetProcessHeap () returned 0x4e0000 [0140.125] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0140.126] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0140.126] CloseHandle (hObject=0x104) returned 1 [0140.126] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AccessMUISet.XML", cAlternateFileName="ACCESS~2.XML")) returned 1 [0140.126] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0140.130] GetProcessHeap () returned 0x4e0000 [0140.130] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0140.130] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0140.130] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded50 | out: lpNewFilePointer=0x0) returned 1 [0140.130] WriteFile (in: hFile=0x104, lpBuffer=0x24ded60*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded60*, lpNumberOfBytesWritten=0x24ded38*=0xd, lpOverlapped=0x0) returned 1 [0140.132] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.132] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.132] GetProcessHeap () returned 0x4e0000 [0140.132] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0140.132] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24ded18*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24ded18*=0x40) returned 1 [0140.132] CryptDestroyKey (hKey=0x523018) returned 1 [0140.132] WriteFile (in: hFile=0x104, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24ded38*=0x40, lpOverlapped=0x0) returned 1 [0140.132] WriteFile (in: hFile=0x104, lpBuffer=0x24ded40*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded40*, lpNumberOfBytesWritten=0x24ded38*=0x4, lpOverlapped=0x0) returned 1 [0140.132] WriteFile (in: hFile=0x104, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24ded38*=0x10, lpOverlapped=0x0) returned 1 [0140.132] WriteFile (in: hFile=0x104, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24ded38*=0x80, lpOverlapped=0x0) returned 1 [0140.132] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded48 | out: lpNewFilePointer=0x0) returned 1 [0140.133] WriteFile (in: hFile=0x104, lpBuffer=0x24ded58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded58*, lpNumberOfBytesWritten=0x24ded38*=0x8, lpOverlapped=0x0) returned 1 [0140.133] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.133] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.133] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.133] ReadFile (in: hFile=0x104, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x333, lpNumberOfBytesRead=0x24decf0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24decf0*=0x333, lpOverlapped=0x0) returned 1 [0140.133] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x340, dwBufLen=0x340 | out: pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x340) returned 1 [0140.133] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.133] WriteFile (in: hFile=0x104, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x24decf4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24decf4*=0x340, lpOverlapped=0x0) returned 1 [0140.133] CryptDestroyKey (hKey=0x523018) returned 1 [0140.133] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x414, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.133] SetEndOfFile (hFile=0x104) returned 1 [0140.135] GetProcessHeap () returned 0x4e0000 [0140.135] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0140.135] GetProcessHeap () returned 0x4e0000 [0140.135] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0140.136] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0140.136] CloseHandle (hObject=0x104) returned 1 [0140.136] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc111bb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0140.136] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0140.137] GetProcessHeap () returned 0x4e0000 [0140.137] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0140.137] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0140.137] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded50 | out: lpNewFilePointer=0x0) returned 1 [0140.137] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.137] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.138] GetProcessHeap () returned 0x4e0000 [0140.138] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0140.138] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24ded18*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24ded18*=0x30) returned 1 [0140.138] CryptDestroyKey (hKey=0x523018) returned 1 [0140.138] WriteFile (in: hFile=0x104, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24ded38*=0x30, lpOverlapped=0x0) returned 1 [0140.139] WriteFile (in: hFile=0x104, lpBuffer=0x24ded40*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded40*, lpNumberOfBytesWritten=0x24ded38*=0x4, lpOverlapped=0x0) returned 1 [0140.139] WriteFile (in: hFile=0x104, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24ded38*=0x10, lpOverlapped=0x0) returned 1 [0140.140] WriteFile (in: hFile=0x104, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24ded38*=0x80, lpOverlapped=0x0) returned 1 [0140.140] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded48 | out: lpNewFilePointer=0x0) returned 1 [0140.140] WriteFile (in: hFile=0x104, lpBuffer=0x24ded58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded58*, lpNumberOfBytesWritten=0x24ded38*=0x8, lpOverlapped=0x0) returned 1 [0140.140] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.140] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.140] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.140] ReadFile (in: hFile=0x104, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xa40, lpNumberOfBytesRead=0x24decf0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24decf0*=0xa40, lpOverlapped=0x0) returned 1 [0140.140] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24decf8*=0xa40, dwBufLen=0xa40 | out: pbData=0x22d0020*, pdwDataLen=0x24decf8*=0xa40) returned 1 [0140.140] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.140] WriteFile (in: hFile=0x104, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x24decf4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24decf4*=0xa40, lpOverlapped=0x0) returned 1 [0140.140] CryptDestroyKey (hKey=0x523018) returned 1 [0140.140] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xb04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.140] SetEndOfFile (hFile=0x104) returned 1 [0140.142] GetProcessHeap () returned 0x4e0000 [0140.142] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0140.142] GetProcessHeap () returned 0x4e0000 [0140.142] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0140.142] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0140.143] CloseHandle (hObject=0x104) returned 1 [0140.143] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc111bb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0140.143] GetProcessHeap () returned 0x4e0000 [0140.143] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0140.143] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0140.143] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24ded90 | out: pbData=0x4f53d8, pdwDataLen=0x24ded90) returned 1 [0140.143] CryptDestroyKey (hKey=0x523018) returned 1 [0140.144] GetProcessHeap () returned 0x4e0000 [0140.144] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0140.144] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0140.144] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24ded90 | out: pbData=0x4f5420, pdwDataLen=0x24ded90) returned 1 [0140.144] CryptDestroyKey (hKey=0x523018) returned 1 [0140.144] GetProcessHeap () returned 0x4e0000 [0140.144] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5276c0 [0140.144] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0140.144] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5276c0, pdwDataLen=0x24ded90 | out: pbData=0x5276c0, pdwDataLen=0x24ded90) returned 1 [0140.144] CryptDestroyKey (hKey=0x523018) returned 1 [0140.144] wsprintfW (in: param_1=0x24ddd6c, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\readme-warning.txt") returned 111 [0140.144] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0140.144] WriteFile (in: hFile=0x104, lpBuffer=0x5276c0*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddd68, lpOverlapped=0x0 | out: lpBuffer=0x5276c0*, lpNumberOfBytesWritten=0x24ddd68*=0x6c3, lpOverlapped=0x0) returned 1 [0140.146] CloseHandle (hObject=0x104) returned 1 [0140.146] GetProcessHeap () returned 0x4e0000 [0140.146] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5276c0 | out: hHeap=0x4e0000) returned 1 [0140.146] GetProcessHeap () returned 0x4e0000 [0140.146] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0140.146] GetProcessHeap () returned 0x4e0000 [0140.146] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0140.146] FindClose (in: hFindFile=0x522fd8 | out: hFindFile=0x522fd8) returned 1 [0140.146] GetProcessHeap () returned 0x4e0000 [0140.146] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273e8 | out: hHeap=0x4e0000) returned 1 [0140.146] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24df164, dwReserved1=0x77c7389e, cFileName="Excel.en-us", cAlternateFileName="EXCEL~1.EN-")) returned 1 [0140.146] GetProcessHeap () returned 0x4e0000 [0140.146] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xc8) returned 0x4fa058 [0140.146] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\*.*", lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522fd8 [0140.146] GetProcessHeap () returned 0x4e0000 [0140.146] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0140.147] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0140.147] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ExcelMUI.XML", cAlternateFileName="")) returned 1 [0140.147] GetProcessHeap () returned 0x4e0000 [0140.147] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2ca) returned 0x5273e8 [0140.147] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0140.147] GetProcessHeap () returned 0x4e0000 [0140.147] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0140.147] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0140.147] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded50 | out: lpNewFilePointer=0x0) returned 1 [0140.147] WriteFile (in: hFile=0x104, lpBuffer=0x24ded60*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded60*, lpNumberOfBytesWritten=0x24ded38*=0x3, lpOverlapped=0x0) returned 1 [0140.149] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.149] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.149] GetProcessHeap () returned 0x4e0000 [0140.149] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0140.149] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24ded18*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24ded18*=0x40) returned 1 [0140.149] CryptDestroyKey (hKey=0x523018) returned 1 [0140.149] WriteFile (in: hFile=0x104, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24ded38*=0x40, lpOverlapped=0x0) returned 1 [0140.149] WriteFile (in: hFile=0x104, lpBuffer=0x24ded40*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded40*, lpNumberOfBytesWritten=0x24ded38*=0x4, lpOverlapped=0x0) returned 1 [0140.149] WriteFile (in: hFile=0x104, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24ded38*=0x10, lpOverlapped=0x0) returned 1 [0140.149] WriteFile (in: hFile=0x104, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24ded38*=0x80, lpOverlapped=0x0) returned 1 [0140.149] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded48 | out: lpNewFilePointer=0x0) returned 1 [0140.149] WriteFile (in: hFile=0x104, lpBuffer=0x24ded58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded58*, lpNumberOfBytesWritten=0x24ded38*=0x8, lpOverlapped=0x0) returned 1 [0140.149] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.149] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.149] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.149] ReadFile (in: hFile=0x104, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x61d, lpNumberOfBytesRead=0x24decf0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24decf0*=0x61d, lpOverlapped=0x0) returned 1 [0140.150] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x620, dwBufLen=0x620 | out: pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x620) returned 1 [0140.150] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.150] WriteFile (in: hFile=0x104, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x24decf4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24decf4*=0x620, lpOverlapped=0x0) returned 1 [0140.150] CryptDestroyKey (hKey=0x523018) returned 1 [0140.150] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x6f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.150] SetEndOfFile (hFile=0x104) returned 1 [0140.152] GetProcessHeap () returned 0x4e0000 [0140.152] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0140.152] GetProcessHeap () returned 0x4e0000 [0140.152] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0140.152] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0140.153] CloseHandle (hObject=0x104) returned 1 [0140.153] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0140.153] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0140.154] GetProcessHeap () returned 0x4e0000 [0140.154] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0140.154] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0140.154] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded50 | out: lpNewFilePointer=0x0) returned 1 [0140.154] WriteFile (in: hFile=0x104, lpBuffer=0x24ded60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded60*, lpNumberOfBytesWritten=0x24ded38*=0x8, lpOverlapped=0x0) returned 1 [0140.156] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.156] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.156] GetProcessHeap () returned 0x4e0000 [0140.156] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0140.156] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24ded18*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24ded18*=0x30) returned 1 [0140.156] CryptDestroyKey (hKey=0x523018) returned 1 [0140.156] WriteFile (in: hFile=0x104, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24ded38*=0x30, lpOverlapped=0x0) returned 1 [0140.156] WriteFile (in: hFile=0x104, lpBuffer=0x24ded40*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded40*, lpNumberOfBytesWritten=0x24ded38*=0x4, lpOverlapped=0x0) returned 1 [0140.156] WriteFile (in: hFile=0x104, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24ded38*=0x10, lpOverlapped=0x0) returned 1 [0140.156] WriteFile (in: hFile=0x104, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24ded38*=0x80, lpOverlapped=0x0) returned 1 [0140.156] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded48 | out: lpNewFilePointer=0x0) returned 1 [0140.156] WriteFile (in: hFile=0x104, lpBuffer=0x24ded58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded58*, lpNumberOfBytesWritten=0x24ded38*=0x8, lpOverlapped=0x0) returned 1 [0140.156] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.156] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.156] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.157] ReadFile (in: hFile=0x104, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x8f8, lpNumberOfBytesRead=0x24decf0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24decf0*=0x8f8, lpOverlapped=0x0) returned 1 [0140.157] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x900, dwBufLen=0x900 | out: pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x900) returned 1 [0140.157] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.157] WriteFile (in: hFile=0x104, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x24decf4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24decf4*=0x900, lpOverlapped=0x0) returned 1 [0140.157] CryptDestroyKey (hKey=0x523018) returned 1 [0140.157] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x9c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.157] SetEndOfFile (hFile=0x104) returned 1 [0140.159] GetProcessHeap () returned 0x4e0000 [0140.159] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0140.159] GetProcessHeap () returned 0x4e0000 [0140.159] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0140.159] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0140.161] CloseHandle (hObject=0x104) returned 1 [0140.161] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0140.161] GetProcessHeap () returned 0x4e0000 [0140.161] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0140.161] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0140.161] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24ded90 | out: pbData=0x4f53d8, pdwDataLen=0x24ded90) returned 1 [0140.161] CryptDestroyKey (hKey=0x523018) returned 1 [0140.162] GetProcessHeap () returned 0x4e0000 [0140.162] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0140.162] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0140.162] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24ded90 | out: pbData=0x4f5420, pdwDataLen=0x24ded90) returned 1 [0140.162] CryptDestroyKey (hKey=0x523018) returned 1 [0140.162] GetProcessHeap () returned 0x4e0000 [0140.162] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5276c0 [0140.162] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0140.162] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5276c0, pdwDataLen=0x24ded90 | out: pbData=0x5276c0, pdwDataLen=0x24ded90) returned 1 [0140.162] CryptDestroyKey (hKey=0x523018) returned 1 [0140.162] wsprintfW (in: param_1=0x24ddd6c, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\readme-warning.txt") returned 110 [0140.162] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0140.162] WriteFile (in: hFile=0x104, lpBuffer=0x5276c0*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddd68, lpOverlapped=0x0 | out: lpBuffer=0x5276c0*, lpNumberOfBytesWritten=0x24ddd68*=0x6c3, lpOverlapped=0x0) returned 1 [0140.163] CloseHandle (hObject=0x104) returned 1 [0140.163] GetProcessHeap () returned 0x4e0000 [0140.163] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5276c0 | out: hHeap=0x4e0000) returned 1 [0140.163] GetProcessHeap () returned 0x4e0000 [0140.163] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0140.163] GetProcessHeap () returned 0x4e0000 [0140.164] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0140.164] FindClose (in: hFindFile=0x522fd8 | out: hFindFile=0x522fd8) returned 1 [0140.164] GetProcessHeap () returned 0x4e0000 [0140.164] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273e8 | out: hHeap=0x4e0000) returned 1 [0140.164] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24df164, dwReserved1=0x77c7389e, cFileName="Groove.en-us", cAlternateFileName="GROOVE~1.EN-")) returned 1 [0140.164] GetProcessHeap () returned 0x4e0000 [0140.164] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xca) returned 0x4fa058 [0140.164] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\*.*", lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522fd8 [0140.165] GetProcessHeap () returned 0x4e0000 [0140.165] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0140.165] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0140.165] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd658ff0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="GrooveMUI.XML", cAlternateFileName="GROOVE~1.XML")) returned 1 [0140.165] GetProcessHeap () returned 0x4e0000 [0140.165] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2cc) returned 0x5273e8 [0140.165] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0140.165] GetProcessHeap () returned 0x4e0000 [0140.165] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0140.165] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0140.165] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded50 | out: lpNewFilePointer=0x0) returned 1 [0140.165] WriteFile (in: hFile=0x104, lpBuffer=0x24ded60*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded60*, lpNumberOfBytesWritten=0x24ded38*=0xf, lpOverlapped=0x0) returned 1 [0140.167] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.167] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.167] GetProcessHeap () returned 0x4e0000 [0140.167] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0140.167] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24ded18*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24ded18*=0x40) returned 1 [0140.167] CryptDestroyKey (hKey=0x523018) returned 1 [0140.167] WriteFile (in: hFile=0x104, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24ded38*=0x40, lpOverlapped=0x0) returned 1 [0140.167] WriteFile (in: hFile=0x104, lpBuffer=0x24ded40*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded40*, lpNumberOfBytesWritten=0x24ded38*=0x4, lpOverlapped=0x0) returned 1 [0140.167] WriteFile (in: hFile=0x104, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24ded38*=0x10, lpOverlapped=0x0) returned 1 [0140.168] WriteFile (in: hFile=0x104, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24ded38*=0x80, lpOverlapped=0x0) returned 1 [0140.168] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded48 | out: lpNewFilePointer=0x0) returned 1 [0140.168] WriteFile (in: hFile=0x104, lpBuffer=0x24ded58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded58*, lpNumberOfBytesWritten=0x24ded38*=0x8, lpOverlapped=0x0) returned 1 [0140.168] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.168] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.168] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.168] ReadFile (in: hFile=0x104, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x391, lpNumberOfBytesRead=0x24decf0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24decf0*=0x391, lpOverlapped=0x0) returned 1 [0140.168] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x3a0, dwBufLen=0x3a0 | out: pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x3a0) returned 1 [0140.168] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.168] WriteFile (in: hFile=0x104, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x24decf4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24decf4*=0x3a0, lpOverlapped=0x0) returned 1 [0140.168] CryptDestroyKey (hKey=0x523018) returned 1 [0140.168] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.168] SetEndOfFile (hFile=0x104) returned 1 [0140.170] GetProcessHeap () returned 0x4e0000 [0140.171] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0140.171] GetProcessHeap () returned 0x4e0000 [0140.171] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0140.171] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0140.172] CloseHandle (hObject=0x104) returned 1 [0140.172] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee803530, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0140.172] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0140.173] GetProcessHeap () returned 0x4e0000 [0140.173] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0140.173] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0140.173] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded50 | out: lpNewFilePointer=0x0) returned 1 [0140.173] WriteFile (in: hFile=0x104, lpBuffer=0x24ded60*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded60*, lpNumberOfBytesWritten=0x24ded38*=0x4, lpOverlapped=0x0) returned 1 [0140.175] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.175] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.175] GetProcessHeap () returned 0x4e0000 [0140.175] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0140.175] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24ded18*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24ded18*=0x30) returned 1 [0140.175] CryptDestroyKey (hKey=0x523018) returned 1 [0140.175] WriteFile (in: hFile=0x104, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24ded38*=0x30, lpOverlapped=0x0) returned 1 [0140.175] WriteFile (in: hFile=0x104, lpBuffer=0x24ded40*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded40*, lpNumberOfBytesWritten=0x24ded38*=0x4, lpOverlapped=0x0) returned 1 [0140.175] WriteFile (in: hFile=0x104, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24ded38*=0x10, lpOverlapped=0x0) returned 1 [0140.175] WriteFile (in: hFile=0x104, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24ded38*=0x80, lpOverlapped=0x0) returned 1 [0140.175] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded48 | out: lpNewFilePointer=0x0) returned 1 [0140.175] WriteFile (in: hFile=0x104, lpBuffer=0x24ded58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded58*, lpNumberOfBytesWritten=0x24ded38*=0x8, lpOverlapped=0x0) returned 1 [0140.176] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.176] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.176] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.176] ReadFile (in: hFile=0x104, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5ac, lpNumberOfBytesRead=0x24decf0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24decf0*=0x5ac, lpOverlapped=0x0) returned 1 [0140.176] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x5b0) returned 1 [0140.176] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.176] WriteFile (in: hFile=0x104, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x24decf4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24decf4*=0x5b0, lpOverlapped=0x0) returned 1 [0140.176] CryptDestroyKey (hKey=0x523018) returned 1 [0140.176] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x674, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.176] SetEndOfFile (hFile=0x104) returned 1 [0140.178] GetProcessHeap () returned 0x4e0000 [0140.178] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0140.178] GetProcessHeap () returned 0x4e0000 [0140.178] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0140.178] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0140.181] CloseHandle (hObject=0x104) returned 1 [0140.181] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee803530, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0140.181] GetProcessHeap () returned 0x4e0000 [0140.181] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0140.181] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0140.181] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24ded90 | out: pbData=0x4f53d8, pdwDataLen=0x24ded90) returned 1 [0140.181] CryptDestroyKey (hKey=0x523018) returned 1 [0140.181] GetProcessHeap () returned 0x4e0000 [0140.181] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0140.182] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0140.182] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24ded90 | out: pbData=0x4f5420, pdwDataLen=0x24ded90) returned 1 [0140.182] CryptDestroyKey (hKey=0x523018) returned 1 [0140.182] GetProcessHeap () returned 0x4e0000 [0140.182] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5276c0 [0140.182] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0140.182] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5276c0, pdwDataLen=0x24ded90 | out: pbData=0x5276c0, pdwDataLen=0x24ded90) returned 1 [0140.182] CryptDestroyKey (hKey=0x523018) returned 1 [0140.182] wsprintfW (in: param_1=0x24ddd6c, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\readme-warning.txt") returned 111 [0140.182] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0140.182] WriteFile (in: hFile=0x104, lpBuffer=0x5276c0*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddd68, lpOverlapped=0x0 | out: lpBuffer=0x5276c0*, lpNumberOfBytesWritten=0x24ddd68*=0x6c3, lpOverlapped=0x0) returned 1 [0140.183] CloseHandle (hObject=0x104) returned 1 [0140.183] GetProcessHeap () returned 0x4e0000 [0140.183] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5276c0 | out: hHeap=0x4e0000) returned 1 [0140.183] GetProcessHeap () returned 0x4e0000 [0140.183] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0140.184] GetProcessHeap () returned 0x4e0000 [0140.184] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0140.184] FindClose (in: hFindFile=0x522fd8 | out: hFindFile=0x522fd8) returned 1 [0140.184] GetProcessHeap () returned 0x4e0000 [0140.184] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273e8 | out: hHeap=0x4e0000) returned 1 [0140.184] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24df164, dwReserved1=0x77c7389e, cFileName="InfoPath.en-us", cAlternateFileName="INFOPA~1.EN-")) returned 1 [0140.184] GetProcessHeap () returned 0x4e0000 [0140.184] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xce) returned 0x4fa058 [0140.184] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\*.*", lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522fd8 [0140.185] GetProcessHeap () returned 0x4e0000 [0140.185] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0140.185] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0140.185] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e345a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="InfoPathMUI.XML", cAlternateFileName="INFOPA~1.XML")) returned 1 [0140.185] GetProcessHeap () returned 0x4e0000 [0140.185] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2d0) returned 0x5273e8 [0140.185] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0140.185] GetProcessHeap () returned 0x4e0000 [0140.185] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0140.185] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0140.185] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded50 | out: lpNewFilePointer=0x0) returned 1 [0140.186] WriteFile (in: hFile=0x104, lpBuffer=0x24ded60*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded60*, lpNumberOfBytesWritten=0x24ded38*=0x1, lpOverlapped=0x0) returned 1 [0140.187] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.187] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.187] GetProcessHeap () returned 0x4e0000 [0140.187] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0140.187] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24ded18*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24ded18*=0x40) returned 1 [0140.187] CryptDestroyKey (hKey=0x523018) returned 1 [0140.188] WriteFile (in: hFile=0x104, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24ded38*=0x40, lpOverlapped=0x0) returned 1 [0140.188] WriteFile (in: hFile=0x104, lpBuffer=0x24ded40*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded40*, lpNumberOfBytesWritten=0x24ded38*=0x4, lpOverlapped=0x0) returned 1 [0140.188] WriteFile (in: hFile=0x104, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24ded38*=0x10, lpOverlapped=0x0) returned 1 [0140.188] WriteFile (in: hFile=0x104, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24ded38*=0x80, lpOverlapped=0x0) returned 1 [0140.188] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded48 | out: lpNewFilePointer=0x0) returned 1 [0140.188] WriteFile (in: hFile=0x104, lpBuffer=0x24ded58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded58*, lpNumberOfBytesWritten=0x24ded38*=0x8, lpOverlapped=0x0) returned 1 [0140.188] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.188] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.188] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.188] ReadFile (in: hFile=0x104, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4cf, lpNumberOfBytesRead=0x24decf0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24decf0*=0x4cf, lpOverlapped=0x0) returned 1 [0140.188] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x4d0, dwBufLen=0x4d0 | out: pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x4d0) returned 1 [0140.188] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.188] WriteFile (in: hFile=0x104, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x24decf4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24decf4*=0x4d0, lpOverlapped=0x0) returned 1 [0140.188] CryptDestroyKey (hKey=0x523018) returned 1 [0140.188] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x5a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.189] SetEndOfFile (hFile=0x104) returned 1 [0140.191] GetProcessHeap () returned 0x4e0000 [0140.191] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0140.191] GetProcessHeap () returned 0x4e0000 [0140.191] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0140.191] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0140.191] CloseHandle (hObject=0x104) returned 1 [0140.191] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0140.192] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0140.192] GetProcessHeap () returned 0x4e0000 [0140.192] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0140.192] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0140.192] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded50 | out: lpNewFilePointer=0x0) returned 1 [0140.192] WriteFile (in: hFile=0x104, lpBuffer=0x24ded60*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded60*, lpNumberOfBytesWritten=0x24ded38*=0x4, lpOverlapped=0x0) returned 1 [0140.195] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.195] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.195] GetProcessHeap () returned 0x4e0000 [0140.195] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0140.195] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24ded18*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24ded18*=0x30) returned 1 [0140.195] CryptDestroyKey (hKey=0x523018) returned 1 [0140.195] WriteFile (in: hFile=0x104, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24ded38*=0x30, lpOverlapped=0x0) returned 1 [0140.195] WriteFile (in: hFile=0x104, lpBuffer=0x24ded40*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded40*, lpNumberOfBytesWritten=0x24ded38*=0x4, lpOverlapped=0x0) returned 1 [0140.195] WriteFile (in: hFile=0x104, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24ded38*=0x10, lpOverlapped=0x0) returned 1 [0140.195] WriteFile (in: hFile=0x104, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24ded38*=0x80, lpOverlapped=0x0) returned 1 [0140.195] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded48 | out: lpNewFilePointer=0x0) returned 1 [0140.196] WriteFile (in: hFile=0x104, lpBuffer=0x24ded58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded58*, lpNumberOfBytesWritten=0x24ded38*=0x8, lpOverlapped=0x0) returned 1 [0140.196] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.196] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.196] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.196] ReadFile (in: hFile=0x104, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x73c, lpNumberOfBytesRead=0x24decf0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24decf0*=0x73c, lpOverlapped=0x0) returned 1 [0140.196] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x740, dwBufLen=0x740 | out: pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x740) returned 1 [0140.196] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.196] WriteFile (in: hFile=0x104, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x24decf4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24decf4*=0x740, lpOverlapped=0x0) returned 1 [0140.196] CryptDestroyKey (hKey=0x523018) returned 1 [0140.196] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x804, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.196] SetEndOfFile (hFile=0x104) returned 1 [0140.199] GetProcessHeap () returned 0x4e0000 [0140.199] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0140.199] GetProcessHeap () returned 0x4e0000 [0140.199] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0140.199] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0140.201] CloseHandle (hObject=0x104) returned 1 [0140.201] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0140.201] GetProcessHeap () returned 0x4e0000 [0140.201] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0140.201] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0140.201] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24ded90 | out: pbData=0x4f53d8, pdwDataLen=0x24ded90) returned 1 [0140.201] CryptDestroyKey (hKey=0x523018) returned 1 [0140.201] GetProcessHeap () returned 0x4e0000 [0140.202] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0140.202] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0140.202] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24ded90 | out: pbData=0x4f5420, pdwDataLen=0x24ded90) returned 1 [0140.202] CryptDestroyKey (hKey=0x523018) returned 1 [0140.202] GetProcessHeap () returned 0x4e0000 [0140.202] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5276c0 [0140.202] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0140.202] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5276c0, pdwDataLen=0x24ded90 | out: pbData=0x5276c0, pdwDataLen=0x24ded90) returned 1 [0140.202] CryptDestroyKey (hKey=0x523018) returned 1 [0140.202] wsprintfW (in: param_1=0x24ddd6c, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\readme-warning.txt") returned 113 [0140.202] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0140.202] WriteFile (in: hFile=0x104, lpBuffer=0x5276c0*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddd68, lpOverlapped=0x0 | out: lpBuffer=0x5276c0*, lpNumberOfBytesWritten=0x24ddd68*=0x6c3, lpOverlapped=0x0) returned 1 [0140.203] CloseHandle (hObject=0x104) returned 1 [0140.203] GetProcessHeap () returned 0x4e0000 [0140.203] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5276c0 | out: hHeap=0x4e0000) returned 1 [0140.203] GetProcessHeap () returned 0x4e0000 [0140.203] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0140.203] GetProcessHeap () returned 0x4e0000 [0140.203] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0140.204] FindClose (in: hFindFile=0x522fd8 | out: hFindFile=0x522fd8) returned 1 [0140.204] GetProcessHeap () returned 0x4e0000 [0140.204] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273e8 | out: hHeap=0x4e0000) returned 1 [0140.204] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0x6b277670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x8b7b8, dwReserved0=0x24df164, dwReserved1=0x77c7389e, cFileName="ODeploy.exe", cAlternateFileName="")) returned 1 [0140.204] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24df164, dwReserved1=0x77c7389e, cFileName="Office.en-us", cAlternateFileName="OFFICE~1.EN-")) returned 1 [0140.204] GetProcessHeap () returned 0x4e0000 [0140.204] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xca) returned 0x4fa058 [0140.204] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*.*", lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522fd8 [0140.206] GetProcessHeap () returned 0x4e0000 [0140.206] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0140.206] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0140.206] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9fff00, ftCreationTime.dwHighDateTime=0x1cba028, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e9fff00, ftLastWriteTime.dwHighDateTime=0x1cba028, nFileSizeHigh=0x0, nFileSizeLow=0x3b78, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BRANDING.DLL", cAlternateFileName="")) returned 1 [0140.206] GetProcessHeap () returned 0x4e0000 [0140.206] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2cc) returned 0x5273e8 [0140.206] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x470e1800, ftCreationTime.dwHighDateTime=0x1caccea, ftLastAccessTime.dwLowDateTime=0x15334ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x470e1800, ftLastWriteTime.dwHighDateTime=0x1caccea, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BRANDING.XML", cAlternateFileName="")) returned 1 [0140.206] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0140.207] GetProcessHeap () returned 0x4e0000 [0140.207] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0140.207] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0140.207] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded50 | out: lpNewFilePointer=0x0) returned 1 [0140.207] WriteFile (in: hFile=0x104, lpBuffer=0x24ded60*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded60*, lpNumberOfBytesWritten=0x24ded38*=0xb, lpOverlapped=0x0) returned 1 [0140.208] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.209] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.209] GetProcessHeap () returned 0x4e0000 [0140.209] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0140.209] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24ded18*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24ded18*=0x40) returned 1 [0140.209] CryptDestroyKey (hKey=0x523018) returned 1 [0140.209] WriteFile (in: hFile=0x104, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24ded38*=0x40, lpOverlapped=0x0) returned 1 [0140.209] WriteFile (in: hFile=0x104, lpBuffer=0x24ded40*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded40*, lpNumberOfBytesWritten=0x24ded38*=0x4, lpOverlapped=0x0) returned 1 [0140.209] WriteFile (in: hFile=0x104, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24ded38*=0x10, lpOverlapped=0x0) returned 1 [0140.209] WriteFile (in: hFile=0x104, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24ded38*=0x80, lpOverlapped=0x0) returned 1 [0140.209] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded48 | out: lpNewFilePointer=0x0) returned 1 [0140.209] WriteFile (in: hFile=0x104, lpBuffer=0x24ded58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded58*, lpNumberOfBytesWritten=0x24ded38*=0x8, lpOverlapped=0x0) returned 1 [0140.209] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.209] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.209] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.209] ReadFile (in: hFile=0x104, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x91975, lpNumberOfBytesRead=0x24decf0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24decf0*=0x91975, lpOverlapped=0x0) returned 1 [0140.215] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x91980, dwBufLen=0x91980 | out: pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x91980) returned 1 [0140.220] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.221] WriteFile (in: hFile=0x104, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x24decf4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24decf4*=0x91980, lpOverlapped=0x0) returned 1 [0140.222] CryptDestroyKey (hKey=0x523018) returned 1 [0140.223] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x91a54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.223] SetEndOfFile (hFile=0x104) returned 1 [0140.225] GetProcessHeap () returned 0x4e0000 [0140.225] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0140.225] GetProcessHeap () returned 0x4e0000 [0140.225] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0140.225] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0140.226] CloseHandle (hObject=0x104) returned 1 [0140.226] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4114ea00, ftCreationTime.dwHighDateTime=0x1ca6af2, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4114ea00, ftLastWriteTime.dwHighDateTime=0x1ca6af2, nFileSizeHigh=0x0, nFileSizeLow=0x11644, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OCT.CHM", cAlternateFileName="")) returned 1 [0140.226] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0140.227] GetProcessHeap () returned 0x4e0000 [0140.227] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0140.227] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0140.227] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded50 | out: lpNewFilePointer=0x0) returned 1 [0140.227] WriteFile (in: hFile=0x104, lpBuffer=0x24ded60*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded60*, lpNumberOfBytesWritten=0x24ded38*=0xc, lpOverlapped=0x0) returned 1 [0140.229] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.229] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.229] GetProcessHeap () returned 0x4e0000 [0140.229] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0140.229] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24ded18*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24ded18*=0x30) returned 1 [0140.229] CryptDestroyKey (hKey=0x523018) returned 1 [0140.229] WriteFile (in: hFile=0x104, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24ded38*=0x30, lpOverlapped=0x0) returned 1 [0140.229] WriteFile (in: hFile=0x104, lpBuffer=0x24ded40*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded40*, lpNumberOfBytesWritten=0x24ded38*=0x4, lpOverlapped=0x0) returned 1 [0140.230] WriteFile (in: hFile=0x104, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24ded38*=0x10, lpOverlapped=0x0) returned 1 [0140.230] WriteFile (in: hFile=0x104, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24ded38*=0x80, lpOverlapped=0x0) returned 1 [0140.230] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded48 | out: lpNewFilePointer=0x0) returned 1 [0140.230] WriteFile (in: hFile=0x104, lpBuffer=0x24ded58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded58*, lpNumberOfBytesWritten=0x24ded38*=0x8, lpOverlapped=0x0) returned 1 [0140.230] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.230] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.230] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.230] ReadFile (in: hFile=0x104, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x11644, lpNumberOfBytesRead=0x24decf0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24decf0*=0x11644, lpOverlapped=0x0) returned 1 [0140.231] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x11650, dwBufLen=0x11650 | out: pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x11650) returned 1 [0140.232] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.232] WriteFile (in: hFile=0x104, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x11650, lpNumberOfBytesWritten=0x24decf4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24decf4*=0x11650, lpOverlapped=0x0) returned 1 [0140.232] CryptDestroyKey (hKey=0x523018) returned 1 [0140.232] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x11714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.232] SetEndOfFile (hFile=0x104) returned 1 [0140.235] GetProcessHeap () returned 0x4e0000 [0140.235] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0140.235] GetProcessHeap () returned 0x4e0000 [0140.235] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0140.235] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0140.236] CloseHandle (hObject=0x104) returned 1 [0140.236] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7c27050, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7c27050, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15b5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OfficeMUI.XML", cAlternateFileName="OFFICE~1.XML")) returned 1 [0140.236] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0140.236] GetProcessHeap () returned 0x4e0000 [0140.236] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0140.236] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0140.236] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded50 | out: lpNewFilePointer=0x0) returned 1 [0140.236] WriteFile (in: hFile=0x104, lpBuffer=0x24ded60*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded60*, lpNumberOfBytesWritten=0x24ded38*=0xb, lpOverlapped=0x0) returned 1 [0140.238] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.238] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.238] GetProcessHeap () returned 0x4e0000 [0140.238] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0140.238] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24ded18*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24ded18*=0x40) returned 1 [0140.238] CryptDestroyKey (hKey=0x523018) returned 1 [0140.238] WriteFile (in: hFile=0x104, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24ded38*=0x40, lpOverlapped=0x0) returned 1 [0140.238] WriteFile (in: hFile=0x104, lpBuffer=0x24ded40*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded40*, lpNumberOfBytesWritten=0x24ded38*=0x4, lpOverlapped=0x0) returned 1 [0140.238] WriteFile (in: hFile=0x104, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24ded38*=0x10, lpOverlapped=0x0) returned 1 [0140.239] WriteFile (in: hFile=0x104, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24ded38*=0x80, lpOverlapped=0x0) returned 1 [0140.239] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded48 | out: lpNewFilePointer=0x0) returned 1 [0140.239] WriteFile (in: hFile=0x104, lpBuffer=0x24ded58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded58*, lpNumberOfBytesWritten=0x24ded38*=0x8, lpOverlapped=0x0) returned 1 [0140.239] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.239] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.239] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.239] ReadFile (in: hFile=0x104, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x15b5, lpNumberOfBytesRead=0x24decf0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24decf0*=0x15b5, lpOverlapped=0x0) returned 1 [0140.240] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x15c0, dwBufLen=0x15c0 | out: pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x15c0) returned 1 [0140.240] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.240] WriteFile (in: hFile=0x104, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x24decf4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24decf4*=0x15c0, lpOverlapped=0x0) returned 1 [0140.240] CryptDestroyKey (hKey=0x523018) returned 1 [0140.240] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x1694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.240] SetEndOfFile (hFile=0x104) returned 1 [0140.243] GetProcessHeap () returned 0x4e0000 [0140.243] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0140.243] GetProcessHeap () returned 0x4e0000 [0140.243] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0140.243] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0140.244] CloseHandle (hObject=0x104) returned 1 [0140.244] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf2b422b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OfficeMUISet.XML", cAlternateFileName="OFFICE~2.XML")) returned 1 [0140.244] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0140.244] GetProcessHeap () returned 0x4e0000 [0140.244] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0140.244] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0140.244] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded50 | out: lpNewFilePointer=0x0) returned 1 [0140.245] WriteFile (in: hFile=0x104, lpBuffer=0x24ded60*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded60*, lpNumberOfBytesWritten=0x24ded38*=0xd, lpOverlapped=0x0) returned 1 [0140.246] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.246] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.246] GetProcessHeap () returned 0x4e0000 [0140.246] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0140.246] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24ded18*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24ded18*=0x40) returned 1 [0140.246] CryptDestroyKey (hKey=0x523018) returned 1 [0140.247] WriteFile (in: hFile=0x104, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24ded38*=0x40, lpOverlapped=0x0) returned 1 [0140.247] WriteFile (in: hFile=0x104, lpBuffer=0x24ded40*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded40*, lpNumberOfBytesWritten=0x24ded38*=0x4, lpOverlapped=0x0) returned 1 [0140.247] WriteFile (in: hFile=0x104, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24ded38*=0x10, lpOverlapped=0x0) returned 1 [0140.247] WriteFile (in: hFile=0x104, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24ded38*=0x80, lpOverlapped=0x0) returned 1 [0140.247] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded48 | out: lpNewFilePointer=0x0) returned 1 [0140.247] WriteFile (in: hFile=0x104, lpBuffer=0x24ded58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded58*, lpNumberOfBytesWritten=0x24ded38*=0x8, lpOverlapped=0x0) returned 1 [0140.247] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.247] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.247] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.247] ReadFile (in: hFile=0x104, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x333, lpNumberOfBytesRead=0x24decf0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24decf0*=0x333, lpOverlapped=0x0) returned 1 [0140.247] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x340, dwBufLen=0x340 | out: pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x340) returned 1 [0140.247] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.247] WriteFile (in: hFile=0x104, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x24decf4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24decf4*=0x340, lpOverlapped=0x0) returned 1 [0140.247] CryptDestroyKey (hKey=0x523018) returned 1 [0140.247] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x414, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.248] SetEndOfFile (hFile=0x104) returned 1 [0140.250] GetProcessHeap () returned 0x4e0000 [0140.250] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0140.250] GetProcessHeap () returned 0x4e0000 [0140.250] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0140.250] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0140.251] CloseHandle (hObject=0x104) returned 1 [0140.251] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x2ed80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OSETUPUI.DLL", cAlternateFileName="")) returned 1 [0140.251] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4804a00, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd4804a00, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x3d90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="promointl.dll", cAlternateFileName="PROMOI~1.DLL")) returned 1 [0140.251] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d0b6300, ftCreationTime.dwHighDateTime=0x1ca9107, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x2d0b6300, ftLastWriteTime.dwHighDateTime=0x1ca9107, nFileSizeHigh=0x0, nFileSizeLow=0x9339, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PSCONFIG.CHM", cAlternateFileName="")) returned 1 [0140.251] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0140.252] GetProcessHeap () returned 0x4e0000 [0140.252] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0140.252] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0140.252] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded50 | out: lpNewFilePointer=0x0) returned 1 [0140.252] WriteFile (in: hFile=0x104, lpBuffer=0x24ded60*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded60*, lpNumberOfBytesWritten=0x24ded38*=0x7, lpOverlapped=0x0) returned 1 [0140.253] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.253] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.254] GetProcessHeap () returned 0x4e0000 [0140.254] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0140.254] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24ded18*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24ded18*=0x40) returned 1 [0140.254] CryptDestroyKey (hKey=0x523018) returned 1 [0140.254] WriteFile (in: hFile=0x104, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24ded38*=0x40, lpOverlapped=0x0) returned 1 [0140.254] WriteFile (in: hFile=0x104, lpBuffer=0x24ded40*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded40*, lpNumberOfBytesWritten=0x24ded38*=0x4, lpOverlapped=0x0) returned 1 [0140.254] WriteFile (in: hFile=0x104, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24ded38*=0x10, lpOverlapped=0x0) returned 1 [0140.254] WriteFile (in: hFile=0x104, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24ded38*=0x80, lpOverlapped=0x0) returned 1 [0140.254] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded48 | out: lpNewFilePointer=0x0) returned 1 [0140.254] WriteFile (in: hFile=0x104, lpBuffer=0x24ded58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded58*, lpNumberOfBytesWritten=0x24ded38*=0x8, lpOverlapped=0x0) returned 1 [0140.254] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.254] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.254] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.254] ReadFile (in: hFile=0x104, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x9339, lpNumberOfBytesRead=0x24decf0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24decf0*=0x9339, lpOverlapped=0x0) returned 1 [0140.255] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x9340, dwBufLen=0x9340 | out: pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x9340) returned 1 [0140.256] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.256] WriteFile (in: hFile=0x104, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x9340, lpNumberOfBytesWritten=0x24decf4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24decf4*=0x9340, lpOverlapped=0x0) returned 1 [0140.256] CryptDestroyKey (hKey=0x523018) returned 1 [0140.256] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x9414, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.256] SetEndOfFile (hFile=0x104) returned 1 [0140.258] GetProcessHeap () returned 0x4e0000 [0140.258] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0140.258] GetProcessHeap () returned 0x4e0000 [0140.258] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0140.258] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0140.259] CloseHandle (hObject=0x104) returned 1 [0140.259] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a8bce00, ftCreationTime.dwHighDateTime=0x1ca910f, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7a8bce00, ftLastWriteTime.dwHighDateTime=0x1ca910f, nFileSizeHigh=0x0, nFileSizeLow=0x6931, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PSS10O.CHM", cAlternateFileName="")) returned 1 [0140.259] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0140.259] GetProcessHeap () returned 0x4e0000 [0140.259] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0140.259] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0140.259] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded50 | out: lpNewFilePointer=0x0) returned 1 [0140.260] WriteFile (in: hFile=0x104, lpBuffer=0x24ded60*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded60*, lpNumberOfBytesWritten=0x24ded38*=0xf, lpOverlapped=0x0) returned 1 [0140.261] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.261] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.261] GetProcessHeap () returned 0x4e0000 [0140.261] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0140.261] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24ded18*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24ded18*=0x30) returned 1 [0140.261] CryptDestroyKey (hKey=0x523018) returned 1 [0140.261] WriteFile (in: hFile=0x104, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24ded38*=0x30, lpOverlapped=0x0) returned 1 [0140.261] WriteFile (in: hFile=0x104, lpBuffer=0x24ded40*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded40*, lpNumberOfBytesWritten=0x24ded38*=0x4, lpOverlapped=0x0) returned 1 [0140.262] WriteFile (in: hFile=0x104, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24ded38*=0x10, lpOverlapped=0x0) returned 1 [0140.262] WriteFile (in: hFile=0x104, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24ded38*=0x80, lpOverlapped=0x0) returned 1 [0140.262] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded48 | out: lpNewFilePointer=0x0) returned 1 [0140.262] WriteFile (in: hFile=0x104, lpBuffer=0x24ded58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded58*, lpNumberOfBytesWritten=0x24ded38*=0x8, lpOverlapped=0x0) returned 1 [0140.262] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.262] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.262] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.262] ReadFile (in: hFile=0x104, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x6931, lpNumberOfBytesRead=0x24decf0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24decf0*=0x6931, lpOverlapped=0x0) returned 1 [0140.263] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x6940, dwBufLen=0x6940 | out: pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x6940) returned 1 [0140.263] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.263] WriteFile (in: hFile=0x104, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6940, lpNumberOfBytesWritten=0x24decf4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24decf4*=0x6940, lpOverlapped=0x0) returned 1 [0140.264] CryptDestroyKey (hKey=0x523018) returned 1 [0140.264] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x6a04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.264] SetEndOfFile (hFile=0x104) returned 1 [0140.266] GetProcessHeap () returned 0x4e0000 [0140.266] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0140.266] GetProcessHeap () returned 0x4e0000 [0140.266] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0140.266] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0140.267] CloseHandle (hObject=0x104) returned 1 [0140.267] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7d4800, ftCreationTime.dwHighDateTime=0x1ca910f, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa7d4800, ftLastWriteTime.dwHighDateTime=0x1ca910f, nFileSizeHigh=0x0, nFileSizeLow=0x6a3b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PSS10R.CHM", cAlternateFileName="")) returned 1 [0140.267] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0140.268] GetProcessHeap () returned 0x4e0000 [0140.268] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0140.268] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0140.268] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded50 | out: lpNewFilePointer=0x0) returned 1 [0140.268] WriteFile (in: hFile=0x104, lpBuffer=0x24ded60*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded60*, lpNumberOfBytesWritten=0x24ded38*=0x5, lpOverlapped=0x0) returned 1 [0140.269] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.269] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.269] GetProcessHeap () returned 0x4e0000 [0140.269] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0140.269] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24ded18*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24ded18*=0x30) returned 1 [0140.269] CryptDestroyKey (hKey=0x523018) returned 1 [0140.269] WriteFile (in: hFile=0x104, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24ded38*=0x30, lpOverlapped=0x0) returned 1 [0140.269] WriteFile (in: hFile=0x104, lpBuffer=0x24ded40*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded40*, lpNumberOfBytesWritten=0x24ded38*=0x4, lpOverlapped=0x0) returned 1 [0140.270] WriteFile (in: hFile=0x104, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24ded38*=0x10, lpOverlapped=0x0) returned 1 [0140.270] WriteFile (in: hFile=0x104, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24ded38*=0x80, lpOverlapped=0x0) returned 1 [0140.270] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded48 | out: lpNewFilePointer=0x0) returned 1 [0140.270] WriteFile (in: hFile=0x104, lpBuffer=0x24ded58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded58*, lpNumberOfBytesWritten=0x24ded38*=0x8, lpOverlapped=0x0) returned 1 [0140.270] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.270] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.270] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.270] ReadFile (in: hFile=0x104, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x6a3b, lpNumberOfBytesRead=0x24decf0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24decf0*=0x6a3b, lpOverlapped=0x0) returned 1 [0140.271] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x6a40, dwBufLen=0x6a40 | out: pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x6a40) returned 1 [0140.271] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.271] WriteFile (in: hFile=0x104, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x24decf4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24decf4*=0x6a40, lpOverlapped=0x0) returned 1 [0140.271] CryptDestroyKey (hKey=0x523018) returned 1 [0140.271] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x6b04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.271] SetEndOfFile (hFile=0x104) returned 1 [0140.273] GetProcessHeap () returned 0x4e0000 [0140.274] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0140.274] GetProcessHeap () returned 0x4e0000 [0140.274] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0140.274] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0140.274] CloseHandle (hObject=0x104) returned 1 [0140.274] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49087c00, ftCreationTime.dwHighDateTime=0x1ca95c1, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x49087c00, ftLastWriteTime.dwHighDateTime=0x1ca95c1, nFileSizeHigh=0x0, nFileSizeLow=0x10676, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SETUP.CHM", cAlternateFileName="")) returned 1 [0140.274] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0140.275] GetProcessHeap () returned 0x4e0000 [0140.275] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0140.276] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0140.276] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded50 | out: lpNewFilePointer=0x0) returned 1 [0140.276] WriteFile (in: hFile=0x104, lpBuffer=0x24ded60*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded60*, lpNumberOfBytesWritten=0x24ded38*=0xa, lpOverlapped=0x0) returned 1 [0140.298] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.298] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.298] GetProcessHeap () returned 0x4e0000 [0140.298] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0140.298] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24ded18*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24ded18*=0x30) returned 1 [0140.298] CryptDestroyKey (hKey=0x523018) returned 1 [0140.298] WriteFile (in: hFile=0x104, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24ded38*=0x30, lpOverlapped=0x0) returned 1 [0140.298] WriteFile (in: hFile=0x104, lpBuffer=0x24ded40*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded40*, lpNumberOfBytesWritten=0x24ded38*=0x4, lpOverlapped=0x0) returned 1 [0140.298] WriteFile (in: hFile=0x104, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24ded38*=0x10, lpOverlapped=0x0) returned 1 [0140.298] WriteFile (in: hFile=0x104, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24ded38*=0x80, lpOverlapped=0x0) returned 1 [0140.299] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded48 | out: lpNewFilePointer=0x0) returned 1 [0140.299] WriteFile (in: hFile=0x104, lpBuffer=0x24ded58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded58*, lpNumberOfBytesWritten=0x24ded38*=0x8, lpOverlapped=0x0) returned 1 [0140.299] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.299] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.299] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.299] ReadFile (in: hFile=0x104, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x10676, lpNumberOfBytesRead=0x24decf0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24decf0*=0x10676, lpOverlapped=0x0) returned 1 [0140.300] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x10680, dwBufLen=0x10680 | out: pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x10680) returned 1 [0140.301] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.301] WriteFile (in: hFile=0x104, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x24decf4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24decf4*=0x10680, lpOverlapped=0x0) returned 1 [0140.301] CryptDestroyKey (hKey=0x523018) returned 1 [0140.301] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x10744, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.301] SetEndOfFile (hFile=0x104) returned 1 [0140.304] GetProcessHeap () returned 0x4e0000 [0140.304] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0140.304] GetProcessHeap () returned 0x4e0000 [0140.304] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0140.304] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0140.304] CloseHandle (hObject=0x104) returned 1 [0140.305] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf2b422b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0140.305] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0140.305] GetProcessHeap () returned 0x4e0000 [0140.305] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0140.305] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0140.305] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded50 | out: lpNewFilePointer=0x0) returned 1 [0140.305] WriteFile (in: hFile=0x104, lpBuffer=0x24ded60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded60*, lpNumberOfBytesWritten=0x24ded38*=0x8, lpOverlapped=0x0) returned 1 [0140.307] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.307] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.307] GetProcessHeap () returned 0x4e0000 [0140.307] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0140.307] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24ded18*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24ded18*=0x30) returned 1 [0140.307] CryptDestroyKey (hKey=0x523018) returned 1 [0140.307] WriteFile (in: hFile=0x104, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24ded38*=0x30, lpOverlapped=0x0) returned 1 [0140.307] WriteFile (in: hFile=0x104, lpBuffer=0x24ded40*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded40*, lpNumberOfBytesWritten=0x24ded38*=0x4, lpOverlapped=0x0) returned 1 [0140.307] WriteFile (in: hFile=0x104, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24ded38*=0x10, lpOverlapped=0x0) returned 1 [0140.307] WriteFile (in: hFile=0x104, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24ded38*=0x80, lpOverlapped=0x0) returned 1 [0140.308] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded48 | out: lpNewFilePointer=0x0) returned 1 [0140.308] WriteFile (in: hFile=0x104, lpBuffer=0x24ded58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded58*, lpNumberOfBytesWritten=0x24ded38*=0x8, lpOverlapped=0x0) returned 1 [0140.308] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.308] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.308] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.308] ReadFile (in: hFile=0x104, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2488, lpNumberOfBytesRead=0x24decf0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24decf0*=0x2488, lpOverlapped=0x0) returned 1 [0140.317] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x2490, dwBufLen=0x2490 | out: pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x2490) returned 1 [0140.317] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.317] WriteFile (in: hFile=0x104, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x24decf4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24decf4*=0x2490, lpOverlapped=0x0) returned 1 [0140.317] CryptDestroyKey (hKey=0x523018) returned 1 [0140.317] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x2554, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.317] SetEndOfFile (hFile=0x104) returned 1 [0140.319] GetProcessHeap () returned 0x4e0000 [0140.319] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0140.319] GetProcessHeap () returned 0x4e0000 [0140.319] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0140.320] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0140.320] CloseHandle (hObject=0x104) returned 1 [0140.320] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf2b422b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0140.320] GetProcessHeap () returned 0x4e0000 [0140.320] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0140.321] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0140.321] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24ded90 | out: pbData=0x4f53d8, pdwDataLen=0x24ded90) returned 1 [0140.321] CryptDestroyKey (hKey=0x523018) returned 1 [0140.321] GetProcessHeap () returned 0x4e0000 [0140.321] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0140.321] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0140.321] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24ded90 | out: pbData=0x4f5420, pdwDataLen=0x24ded90) returned 1 [0140.321] CryptDestroyKey (hKey=0x523018) returned 1 [0140.321] GetProcessHeap () returned 0x4e0000 [0140.321] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5276c0 [0140.321] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0140.321] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5276c0, pdwDataLen=0x24ded90 | out: pbData=0x5276c0, pdwDataLen=0x24ded90) returned 1 [0140.321] CryptDestroyKey (hKey=0x523018) returned 1 [0140.321] wsprintfW (in: param_1=0x24ddd6c, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\readme-warning.txt") returned 111 [0140.321] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0140.322] WriteFile (in: hFile=0x104, lpBuffer=0x5276c0*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddd68, lpOverlapped=0x0 | out: lpBuffer=0x5276c0*, lpNumberOfBytesWritten=0x24ddd68*=0x6c3, lpOverlapped=0x0) returned 1 [0140.322] CloseHandle (hObject=0x104) returned 1 [0140.323] GetProcessHeap () returned 0x4e0000 [0140.323] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5276c0 | out: hHeap=0x4e0000) returned 1 [0140.323] GetProcessHeap () returned 0x4e0000 [0140.323] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0140.323] GetProcessHeap () returned 0x4e0000 [0140.323] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0140.323] FindClose (in: hFindFile=0x522fd8 | out: hFindFile=0x522fd8) returned 1 [0140.323] GetProcessHeap () returned 0x4e0000 [0140.323] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273e8 | out: hHeap=0x4e0000) returned 1 [0140.323] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24df164, dwReserved1=0x77c7389e, cFileName="Office32.en-us", cAlternateFileName="OFFICE~2.EN-")) returned 1 [0140.323] GetProcessHeap () returned 0x4e0000 [0140.323] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xce) returned 0x4fa058 [0140.323] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\*.*", lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522fd8 [0140.325] GetProcessHeap () returned 0x4e0000 [0140.325] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0140.325] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0140.325] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office32MUI.XML", cAlternateFileName="OFFICE~1.XML")) returned 1 [0140.325] GetProcessHeap () returned 0x4e0000 [0140.325] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2d0) returned 0x5273e8 [0140.325] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0140.326] GetProcessHeap () returned 0x4e0000 [0140.326] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0140.326] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0140.326] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded50 | out: lpNewFilePointer=0x0) returned 1 [0140.326] WriteFile (in: hFile=0x104, lpBuffer=0x24ded60*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded60*, lpNumberOfBytesWritten=0x24ded38*=0x9, lpOverlapped=0x0) returned 1 [0140.336] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.336] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.336] GetProcessHeap () returned 0x4e0000 [0140.336] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0140.336] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24ded18*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24ded18*=0x40) returned 1 [0140.336] CryptDestroyKey (hKey=0x523018) returned 1 [0140.336] WriteFile (in: hFile=0x104, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24ded38*=0x40, lpOverlapped=0x0) returned 1 [0140.336] WriteFile (in: hFile=0x104, lpBuffer=0x24ded40*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded40*, lpNumberOfBytesWritten=0x24ded38*=0x4, lpOverlapped=0x0) returned 1 [0140.336] WriteFile (in: hFile=0x104, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24ded38*=0x10, lpOverlapped=0x0) returned 1 [0140.336] WriteFile (in: hFile=0x104, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24ded38*=0x80, lpOverlapped=0x0) returned 1 [0140.336] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded48 | out: lpNewFilePointer=0x0) returned 1 [0140.336] WriteFile (in: hFile=0x104, lpBuffer=0x24ded58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded58*, lpNumberOfBytesWritten=0x24ded38*=0x8, lpOverlapped=0x0) returned 1 [0140.336] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.336] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.336] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.336] ReadFile (in: hFile=0x104, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x567, lpNumberOfBytesRead=0x24decf0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24decf0*=0x567, lpOverlapped=0x0) returned 1 [0140.337] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x570, dwBufLen=0x570 | out: pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x570) returned 1 [0140.337] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.337] WriteFile (in: hFile=0x104, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x24decf4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24decf4*=0x570, lpOverlapped=0x0) returned 1 [0140.337] CryptDestroyKey (hKey=0x523018) returned 1 [0140.337] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x644, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.337] SetEndOfFile (hFile=0x104) returned 1 [0140.339] GetProcessHeap () returned 0x4e0000 [0140.339] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0140.339] GetProcessHeap () returned 0x4e0000 [0140.339] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0140.339] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0140.342] CloseHandle (hObject=0x104) returned 1 [0140.342] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0140.342] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0140.343] GetProcessHeap () returned 0x4e0000 [0140.343] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0140.343] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0140.343] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded50 | out: lpNewFilePointer=0x0) returned 1 [0140.343] WriteFile (in: hFile=0x104, lpBuffer=0x24ded60*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded60*, lpNumberOfBytesWritten=0x24ded38*=0x6, lpOverlapped=0x0) returned 1 [0140.355] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.355] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.355] GetProcessHeap () returned 0x4e0000 [0140.355] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0140.355] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24ded18*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24ded18*=0x30) returned 1 [0140.355] CryptDestroyKey (hKey=0x523018) returned 1 [0140.355] WriteFile (in: hFile=0x104, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24ded38*=0x30, lpOverlapped=0x0) returned 1 [0140.356] WriteFile (in: hFile=0x104, lpBuffer=0x24ded40*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded40*, lpNumberOfBytesWritten=0x24ded38*=0x4, lpOverlapped=0x0) returned 1 [0140.356] WriteFile (in: hFile=0x104, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24ded38*=0x10, lpOverlapped=0x0) returned 1 [0140.356] WriteFile (in: hFile=0x104, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24ded38*=0x80, lpOverlapped=0x0) returned 1 [0140.356] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded48 | out: lpNewFilePointer=0x0) returned 1 [0140.356] WriteFile (in: hFile=0x104, lpBuffer=0x24ded58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded58*, lpNumberOfBytesWritten=0x24ded38*=0x8, lpOverlapped=0x0) returned 1 [0140.356] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.356] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.356] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.356] ReadFile (in: hFile=0x104, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x93a, lpNumberOfBytesRead=0x24decf0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24decf0*=0x93a, lpOverlapped=0x0) returned 1 [0140.356] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x940, dwBufLen=0x940 | out: pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x940) returned 1 [0140.356] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.356] WriteFile (in: hFile=0x104, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x24decf4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24decf4*=0x940, lpOverlapped=0x0) returned 1 [0140.356] CryptDestroyKey (hKey=0x523018) returned 1 [0140.356] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xa04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.356] SetEndOfFile (hFile=0x104) returned 1 [0140.358] GetProcessHeap () returned 0x4e0000 [0140.359] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0140.359] GetProcessHeap () returned 0x4e0000 [0140.359] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0140.359] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0140.361] CloseHandle (hObject=0x104) returned 1 [0140.361] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0140.361] GetProcessHeap () returned 0x4e0000 [0140.361] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0140.361] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0140.361] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24ded90 | out: pbData=0x4f53d8, pdwDataLen=0x24ded90) returned 1 [0140.361] CryptDestroyKey (hKey=0x523018) returned 1 [0140.361] GetProcessHeap () returned 0x4e0000 [0140.361] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0140.361] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0140.361] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24ded90 | out: pbData=0x4f5420, pdwDataLen=0x24ded90) returned 1 [0140.361] CryptDestroyKey (hKey=0x523018) returned 1 [0140.361] GetProcessHeap () returned 0x4e0000 [0140.361] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5276c0 [0140.361] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0140.361] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5276c0, pdwDataLen=0x24ded90 | out: pbData=0x5276c0, pdwDataLen=0x24ded90) returned 1 [0140.361] CryptDestroyKey (hKey=0x523018) returned 1 [0140.361] wsprintfW (in: param_1=0x24ddd6c, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\readme-warning.txt") returned 113 [0140.362] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0140.362] WriteFile (in: hFile=0x104, lpBuffer=0x5276c0*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddd68, lpOverlapped=0x0 | out: lpBuffer=0x5276c0*, lpNumberOfBytesWritten=0x24ddd68*=0x6c3, lpOverlapped=0x0) returned 1 [0140.363] CloseHandle (hObject=0x104) returned 1 [0140.363] GetProcessHeap () returned 0x4e0000 [0140.363] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5276c0 | out: hHeap=0x4e0000) returned 1 [0140.363] GetProcessHeap () returned 0x4e0000 [0140.363] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0140.363] GetProcessHeap () returned 0x4e0000 [0140.363] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0140.363] FindClose (in: hFindFile=0x522fd8 | out: hFindFile=0x522fd8) returned 1 [0140.363] GetProcessHeap () returned 0x4e0000 [0140.363] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273e8 | out: hHeap=0x4e0000) returned 1 [0140.363] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24df164, dwReserved1=0x77c7389e, cFileName="Office32.WW", cAlternateFileName="")) returned 1 [0140.363] GetProcessHeap () returned 0x4e0000 [0140.363] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xc8) returned 0x4fa058 [0140.363] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\*.*", lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522fd8 [0140.364] GetProcessHeap () returned 0x4e0000 [0140.364] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0140.364] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0140.364] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe09b760, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office32WW.XML", cAlternateFileName="OFFICE~1.XML")) returned 1 [0140.364] GetProcessHeap () returned 0x4e0000 [0140.364] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2ca) returned 0x5273e8 [0140.364] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0140.365] GetProcessHeap () returned 0x4e0000 [0140.365] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0140.365] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0140.365] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded50 | out: lpNewFilePointer=0x0) returned 1 [0140.365] WriteFile (in: hFile=0x104, lpBuffer=0x24ded60*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded60*, lpNumberOfBytesWritten=0x24ded38*=0xe, lpOverlapped=0x0) returned 1 [0140.366] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.366] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.366] GetProcessHeap () returned 0x4e0000 [0140.366] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0140.367] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24ded18*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24ded18*=0x40) returned 1 [0140.367] CryptDestroyKey (hKey=0x523018) returned 1 [0140.367] WriteFile (in: hFile=0x104, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24ded38*=0x40, lpOverlapped=0x0) returned 1 [0140.367] WriteFile (in: hFile=0x104, lpBuffer=0x24ded40*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded40*, lpNumberOfBytesWritten=0x24ded38*=0x4, lpOverlapped=0x0) returned 1 [0140.367] WriteFile (in: hFile=0x104, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24ded38*=0x10, lpOverlapped=0x0) returned 1 [0140.367] WriteFile (in: hFile=0x104, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24ded38*=0x80, lpOverlapped=0x0) returned 1 [0140.367] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded48 | out: lpNewFilePointer=0x0) returned 1 [0140.367] WriteFile (in: hFile=0x104, lpBuffer=0x24ded58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded58*, lpNumberOfBytesWritten=0x24ded38*=0x8, lpOverlapped=0x0) returned 1 [0140.367] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.367] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.367] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.367] ReadFile (in: hFile=0x104, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x10b2, lpNumberOfBytesRead=0x24decf0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24decf0*=0x10b2, lpOverlapped=0x0) returned 1 [0140.368] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x10c0, dwBufLen=0x10c0 | out: pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x10c0) returned 1 [0140.368] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.368] WriteFile (in: hFile=0x104, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x24decf4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24decf4*=0x10c0, lpOverlapped=0x0) returned 1 [0140.368] CryptDestroyKey (hKey=0x523018) returned 1 [0140.368] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x1194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.368] SetEndOfFile (hFile=0x104) returned 1 [0140.389] GetProcessHeap () returned 0x4e0000 [0140.389] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0140.389] GetProcessHeap () returned 0x4e0000 [0140.389] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0140.389] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0140.390] CloseHandle (hObject=0x104) returned 1 [0140.390] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe09b760, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office32WW.XML", cAlternateFileName="OFFICE~1.XML")) returned 0 [0140.390] GetProcessHeap () returned 0x4e0000 [0140.390] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0140.390] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0140.390] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24ded90 | out: pbData=0x4f53d8, pdwDataLen=0x24ded90) returned 1 [0140.390] CryptDestroyKey (hKey=0x523018) returned 1 [0140.390] GetProcessHeap () returned 0x4e0000 [0140.390] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0140.391] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0140.391] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24ded90 | out: pbData=0x4f5420, pdwDataLen=0x24ded90) returned 1 [0140.391] CryptDestroyKey (hKey=0x523018) returned 1 [0140.391] GetProcessHeap () returned 0x4e0000 [0140.391] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5276c0 [0140.391] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0140.391] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5276c0, pdwDataLen=0x24ded90 | out: pbData=0x5276c0, pdwDataLen=0x24ded90) returned 1 [0140.391] CryptDestroyKey (hKey=0x523018) returned 1 [0140.391] wsprintfW (in: param_1=0x24ddd6c, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\readme-warning.txt") returned 110 [0140.391] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0140.391] WriteFile (in: hFile=0x104, lpBuffer=0x5276c0*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddd68, lpOverlapped=0x0 | out: lpBuffer=0x5276c0*, lpNumberOfBytesWritten=0x24ddd68*=0x6c3, lpOverlapped=0x0) returned 1 [0140.392] CloseHandle (hObject=0x104) returned 1 [0140.393] GetProcessHeap () returned 0x4e0000 [0140.393] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5276c0 | out: hHeap=0x4e0000) returned 1 [0140.393] GetProcessHeap () returned 0x4e0000 [0140.393] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0140.393] GetProcessHeap () returned 0x4e0000 [0140.393] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0140.393] FindClose (in: hFindFile=0x522fd8 | out: hFindFile=0x522fd8) returned 1 [0140.393] GetProcessHeap () returned 0x4e0000 [0140.393] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273e8 | out: hHeap=0x4e0000) returned 1 [0140.393] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24df164, dwReserved1=0x77c7389e, cFileName="OneNote.en-us", cAlternateFileName="ONENOT~1.EN-")) returned 1 [0140.393] GetProcessHeap () returned 0x4e0000 [0140.393] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xcc) returned 0x4fa058 [0140.393] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\*.*", lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522fd8 [0140.396] GetProcessHeap () returned 0x4e0000 [0140.396] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0140.396] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0140.396] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58ed930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OneNoteMUI.XML", cAlternateFileName="ONENOT~1.XML")) returned 1 [0140.396] GetProcessHeap () returned 0x4e0000 [0140.396] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2ce) returned 0x5273e8 [0140.396] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0140.396] GetProcessHeap () returned 0x4e0000 [0140.396] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0140.396] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0140.396] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded50 | out: lpNewFilePointer=0x0) returned 1 [0140.396] WriteFile (in: hFile=0x104, lpBuffer=0x24ded60*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded60*, lpNumberOfBytesWritten=0x24ded38*=0xa, lpOverlapped=0x0) returned 1 [0140.458] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.458] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.458] GetProcessHeap () returned 0x4e0000 [0140.459] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0140.459] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24ded18*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24ded18*=0x40) returned 1 [0140.459] CryptDestroyKey (hKey=0x523018) returned 1 [0140.459] WriteFile (in: hFile=0x104, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24ded38*=0x40, lpOverlapped=0x0) returned 1 [0140.459] WriteFile (in: hFile=0x104, lpBuffer=0x24ded40*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded40*, lpNumberOfBytesWritten=0x24ded38*=0x4, lpOverlapped=0x0) returned 1 [0140.459] WriteFile (in: hFile=0x104, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24ded38*=0x10, lpOverlapped=0x0) returned 1 [0140.459] WriteFile (in: hFile=0x104, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24ded38*=0x80, lpOverlapped=0x0) returned 1 [0140.459] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded48 | out: lpNewFilePointer=0x0) returned 1 [0140.459] WriteFile (in: hFile=0x104, lpBuffer=0x24ded58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded58*, lpNumberOfBytesWritten=0x24ded38*=0x8, lpOverlapped=0x0) returned 1 [0140.460] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.460] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.460] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.460] ReadFile (in: hFile=0x104, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x646, lpNumberOfBytesRead=0x24decf0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24decf0*=0x646, lpOverlapped=0x0) returned 1 [0140.460] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x650, dwBufLen=0x650 | out: pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x650) returned 1 [0140.460] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.460] WriteFile (in: hFile=0x104, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x24decf4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24decf4*=0x650, lpOverlapped=0x0) returned 1 [0140.460] CryptDestroyKey (hKey=0x523018) returned 1 [0140.460] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x724, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.460] SetEndOfFile (hFile=0x104) returned 1 [0140.466] GetProcessHeap () returned 0x4e0000 [0140.466] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0140.466] GetProcessHeap () returned 0x4e0000 [0140.466] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0140.466] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0140.467] CloseHandle (hObject=0x104) returned 1 [0140.467] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e0d4a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0140.467] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0140.468] GetProcessHeap () returned 0x4e0000 [0140.468] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0140.468] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0140.468] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded50 | out: lpNewFilePointer=0x0) returned 1 [0140.468] WriteFile (in: hFile=0x104, lpBuffer=0x24ded60*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded60*, lpNumberOfBytesWritten=0x24ded38*=0xc, lpOverlapped=0x0) returned 1 [0140.471] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.471] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.471] GetProcessHeap () returned 0x4e0000 [0140.471] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0140.471] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24ded18*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24ded18*=0x30) returned 1 [0140.471] CryptDestroyKey (hKey=0x523018) returned 1 [0140.471] WriteFile (in: hFile=0x104, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24ded38*=0x30, lpOverlapped=0x0) returned 1 [0140.471] WriteFile (in: hFile=0x104, lpBuffer=0x24ded40*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded40*, lpNumberOfBytesWritten=0x24ded38*=0x4, lpOverlapped=0x0) returned 1 [0140.471] WriteFile (in: hFile=0x104, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24ded38*=0x10, lpOverlapped=0x0) returned 1 [0140.471] WriteFile (in: hFile=0x104, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24ded38*=0x80, lpOverlapped=0x0) returned 1 [0140.471] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded48 | out: lpNewFilePointer=0x0) returned 1 [0140.471] WriteFile (in: hFile=0x104, lpBuffer=0x24ded58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded58*, lpNumberOfBytesWritten=0x24ded38*=0x8, lpOverlapped=0x0) returned 1 [0140.471] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.472] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.472] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.472] ReadFile (in: hFile=0x104, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7c4, lpNumberOfBytesRead=0x24decf0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24decf0*=0x7c4, lpOverlapped=0x0) returned 1 [0140.472] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x7d0, dwBufLen=0x7d0 | out: pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x7d0) returned 1 [0140.472] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.472] WriteFile (in: hFile=0x104, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x24decf4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24decf4*=0x7d0, lpOverlapped=0x0) returned 1 [0140.472] CryptDestroyKey (hKey=0x523018) returned 1 [0140.472] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x894, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.472] SetEndOfFile (hFile=0x104) returned 1 [0140.475] GetProcessHeap () returned 0x4e0000 [0140.475] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0140.475] GetProcessHeap () returned 0x4e0000 [0140.475] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0140.475] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0140.478] CloseHandle (hObject=0x104) returned 1 [0140.478] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e0d4a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0140.478] GetProcessHeap () returned 0x4e0000 [0140.478] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0140.478] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0140.478] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24ded90 | out: pbData=0x4f53d8, pdwDataLen=0x24ded90) returned 1 [0140.478] CryptDestroyKey (hKey=0x523018) returned 1 [0140.478] GetProcessHeap () returned 0x4e0000 [0140.478] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0140.479] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0140.479] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24ded90 | out: pbData=0x4f5420, pdwDataLen=0x24ded90) returned 1 [0140.479] CryptDestroyKey (hKey=0x523018) returned 1 [0140.479] GetProcessHeap () returned 0x4e0000 [0140.479] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5276c0 [0140.479] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0140.479] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5276c0, pdwDataLen=0x24ded90 | out: pbData=0x5276c0, pdwDataLen=0x24ded90) returned 1 [0140.479] CryptDestroyKey (hKey=0x523018) returned 1 [0140.479] wsprintfW (in: param_1=0x24ddd6c, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\readme-warning.txt") returned 112 [0140.479] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0140.480] WriteFile (in: hFile=0x104, lpBuffer=0x5276c0*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddd68, lpOverlapped=0x0 | out: lpBuffer=0x5276c0*, lpNumberOfBytesWritten=0x24ddd68*=0x6c3, lpOverlapped=0x0) returned 1 [0140.481] CloseHandle (hObject=0x104) returned 1 [0140.481] GetProcessHeap () returned 0x4e0000 [0140.481] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5276c0 | out: hHeap=0x4e0000) returned 1 [0140.481] GetProcessHeap () returned 0x4e0000 [0140.481] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0140.481] GetProcessHeap () returned 0x4e0000 [0140.481] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0140.481] FindClose (in: hFindFile=0x522fd8 | out: hFindFile=0x522fd8) returned 1 [0140.481] GetProcessHeap () returned 0x4e0000 [0140.481] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273e8 | out: hHeap=0x4e0000) returned 1 [0140.481] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x302b0500, ftCreationTime.dwHighDateTime=0x1cba073, ftLastAccessTime.dwLowDateTime=0xcf459e40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x302b0500, ftLastWriteTime.dwHighDateTime=0x1cba073, nFileSizeHigh=0x0, nFileSizeLow=0x709b68, dwReserved0=0x24df164, dwReserved1=0x77c7389e, cFileName="OSETUP.DLL", cAlternateFileName="")) returned 1 [0140.481] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x598fccf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0xb9a0, dwReserved0=0x24df164, dwReserved1=0x77c7389e, cFileName="OSetupPS.dll", cAlternateFileName="")) returned 1 [0140.481] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24df164, dwReserved1=0x77c7389e, cFileName="Outlook.en-us", cAlternateFileName="OUTLOO~1.EN-")) returned 1 [0140.481] GetProcessHeap () returned 0x4e0000 [0140.481] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xcc) returned 0x4fa058 [0140.481] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\*.*", lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522fd8 [0140.482] GetProcessHeap () returned 0x4e0000 [0140.483] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0140.483] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0140.483] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee827f20, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OutlookMUI.XML", cAlternateFileName="OUTLOO~1.XML")) returned 1 [0140.483] GetProcessHeap () returned 0x4e0000 [0140.483] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2ce) returned 0x5273e8 [0140.483] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0140.483] GetProcessHeap () returned 0x4e0000 [0140.483] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0140.483] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0140.483] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded50 | out: lpNewFilePointer=0x0) returned 1 [0140.483] WriteFile (in: hFile=0x104, lpBuffer=0x24ded60*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded60*, lpNumberOfBytesWritten=0x24ded38*=0xe, lpOverlapped=0x0) returned 1 [0140.486] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.486] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.486] GetProcessHeap () returned 0x4e0000 [0140.486] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0140.487] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24ded18*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24ded18*=0x40) returned 1 [0140.487] CryptDestroyKey (hKey=0x523018) returned 1 [0140.487] WriteFile (in: hFile=0x104, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24ded38*=0x40, lpOverlapped=0x0) returned 1 [0140.487] WriteFile (in: hFile=0x104, lpBuffer=0x24ded40*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded40*, lpNumberOfBytesWritten=0x24ded38*=0x4, lpOverlapped=0x0) returned 1 [0140.487] WriteFile (in: hFile=0x104, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24ded38*=0x10, lpOverlapped=0x0) returned 1 [0140.487] WriteFile (in: hFile=0x104, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24ded38*=0x80, lpOverlapped=0x0) returned 1 [0140.487] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded48 | out: lpNewFilePointer=0x0) returned 1 [0140.487] WriteFile (in: hFile=0x104, lpBuffer=0x24ded58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded58*, lpNumberOfBytesWritten=0x24ded38*=0x8, lpOverlapped=0x0) returned 1 [0140.487] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.487] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.487] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.487] ReadFile (in: hFile=0x104, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xc72, lpNumberOfBytesRead=0x24decf0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24decf0*=0xc72, lpOverlapped=0x0) returned 1 [0140.488] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24decf8*=0xc80, dwBufLen=0xc80 | out: pbData=0x22d0020*, pdwDataLen=0x24decf8*=0xc80) returned 1 [0140.488] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.488] WriteFile (in: hFile=0x104, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x24decf4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24decf4*=0xc80, lpOverlapped=0x0) returned 1 [0140.488] CryptDestroyKey (hKey=0x523018) returned 1 [0140.488] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xd54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.488] SetEndOfFile (hFile=0x104) returned 1 [0140.491] GetProcessHeap () returned 0x4e0000 [0140.491] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0140.491] GetProcessHeap () returned 0x4e0000 [0140.491] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0140.491] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0140.492] CloseHandle (hObject=0x104) returned 1 [0140.492] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0140.492] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0140.493] GetProcessHeap () returned 0x4e0000 [0140.493] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0140.493] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0140.493] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded50 | out: lpNewFilePointer=0x0) returned 1 [0140.494] WriteFile (in: hFile=0x104, lpBuffer=0x24ded60*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded60*, lpNumberOfBytesWritten=0x24ded38*=0x1, lpOverlapped=0x0) returned 1 [0140.496] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.496] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.496] GetProcessHeap () returned 0x4e0000 [0140.496] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0140.496] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24ded18*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24ded18*=0x30) returned 1 [0140.496] CryptDestroyKey (hKey=0x523018) returned 1 [0140.496] WriteFile (in: hFile=0x104, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24ded38*=0x30, lpOverlapped=0x0) returned 1 [0140.496] WriteFile (in: hFile=0x104, lpBuffer=0x24ded40*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded40*, lpNumberOfBytesWritten=0x24ded38*=0x4, lpOverlapped=0x0) returned 1 [0140.496] WriteFile (in: hFile=0x104, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24ded38*=0x10, lpOverlapped=0x0) returned 1 [0140.497] WriteFile (in: hFile=0x104, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24ded38*=0x80, lpOverlapped=0x0) returned 1 [0140.497] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded48 | out: lpNewFilePointer=0x0) returned 1 [0140.497] WriteFile (in: hFile=0x104, lpBuffer=0x24ded58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded58*, lpNumberOfBytesWritten=0x24ded38*=0x8, lpOverlapped=0x0) returned 1 [0140.497] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.497] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.497] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.497] ReadFile (in: hFile=0x104, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x106f, lpNumberOfBytesRead=0x24decf0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24decf0*=0x106f, lpOverlapped=0x0) returned 1 [0140.498] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x1070, dwBufLen=0x1070 | out: pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x1070) returned 1 [0140.498] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.498] WriteFile (in: hFile=0x104, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x24decf4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24decf4*=0x1070, lpOverlapped=0x0) returned 1 [0140.498] CryptDestroyKey (hKey=0x523018) returned 1 [0140.498] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x1134, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.498] SetEndOfFile (hFile=0x104) returned 1 [0140.501] GetProcessHeap () returned 0x4e0000 [0140.501] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0140.501] GetProcessHeap () returned 0x4e0000 [0140.501] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0140.501] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0140.504] CloseHandle (hObject=0x104) returned 1 [0140.504] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0140.504] GetProcessHeap () returned 0x4e0000 [0140.504] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0140.504] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0140.504] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24ded90 | out: pbData=0x4f53d8, pdwDataLen=0x24ded90) returned 1 [0140.504] CryptDestroyKey (hKey=0x523018) returned 1 [0140.504] GetProcessHeap () returned 0x4e0000 [0140.505] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0140.505] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0140.505] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24ded90 | out: pbData=0x4f5420, pdwDataLen=0x24ded90) returned 1 [0140.505] CryptDestroyKey (hKey=0x523018) returned 1 [0140.505] GetProcessHeap () returned 0x4e0000 [0140.505] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5276c0 [0140.505] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0140.505] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5276c0, pdwDataLen=0x24ded90 | out: pbData=0x5276c0, pdwDataLen=0x24ded90) returned 1 [0140.505] CryptDestroyKey (hKey=0x523018) returned 1 [0140.505] wsprintfW (in: param_1=0x24ddd6c, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\readme-warning.txt") returned 112 [0140.505] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0140.506] WriteFile (in: hFile=0x104, lpBuffer=0x5276c0*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddd68, lpOverlapped=0x0 | out: lpBuffer=0x5276c0*, lpNumberOfBytesWritten=0x24ddd68*=0x6c3, lpOverlapped=0x0) returned 1 [0140.507] CloseHandle (hObject=0x104) returned 1 [0140.507] GetProcessHeap () returned 0x4e0000 [0140.507] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5276c0 | out: hHeap=0x4e0000) returned 1 [0140.507] GetProcessHeap () returned 0x4e0000 [0140.507] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0140.507] GetProcessHeap () returned 0x4e0000 [0140.507] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0140.507] FindClose (in: hFindFile=0x522fd8 | out: hFindFile=0x522fd8) returned 1 [0140.507] GetProcessHeap () returned 0x4e0000 [0140.507] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273e8 | out: hHeap=0x4e0000) returned 1 [0140.507] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6cee1d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x24df164, dwReserved1=0x77c7389e, cFileName="pidgenx.dll", cAlternateFileName="")) returned 1 [0140.507] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17eefe00, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0xbe99ad60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x17eefe00, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x24df164, dwReserved1=0x77c7389e, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0140.507] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0140.509] GetProcessHeap () returned 0x4e0000 [0140.509] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0140.509] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0140.509] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0140.509] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x6, lpOverlapped=0x0) returned 1 [0140.511] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0140.511] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.511] GetProcessHeap () returned 0x4e0000 [0140.511] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x50) returned 0x4fd470 [0140.511] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fd470*, pdwDataLen=0x24defa8*=0x50, dwBufLen=0x50 | out: pbData=0x4fd470*, pdwDataLen=0x24defa8*=0x50) returned 1 [0140.511] CryptDestroyKey (hKey=0x522fd8) returned 1 [0140.511] WriteFile (in: hFile=0x100, lpBuffer=0x4fd470*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd470*, lpNumberOfBytesWritten=0x24defc8*=0x50, lpOverlapped=0x0) returned 1 [0140.511] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0140.511] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0140.512] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0140.512] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0140.512] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0140.512] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0140.512] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.512] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.512] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xaec3a, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xaec3a, lpOverlapped=0x0) returned 1 [0140.521] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xaec40, dwBufLen=0xaec40 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xaec40) returned 1 [0140.530] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.530] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xaec40, lpOverlapped=0x0) returned 1 [0140.533] CryptDestroyKey (hKey=0x522fd8) returned 1 [0140.533] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xaed24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.533] SetEndOfFile (hFile=0x100) returned 1 [0140.537] GetProcessHeap () returned 0x4e0000 [0140.537] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fd470 | out: hHeap=0x4e0000) returned 1 [0140.537] GetProcessHeap () returned 0x4e0000 [0140.537] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0140.537] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0140.554] CloseHandle (hObject=0x100) returned 1 [0140.554] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6904ef00, ftCreationTime.dwHighDateTime=0x1ca912c, ftLastAccessTime.dwLowDateTime=0x6cf07e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6904ef00, ftLastWriteTime.dwHighDateTime=0x1ca912c, nFileSizeHigh=0x0, nFileSizeLow=0x3d78, dwReserved0=0x24df164, dwReserved1=0x77c7389e, cFileName="pkeyconfig.companion.dll", cAlternateFileName="PKEYCO~1.DLL")) returned 1 [0140.554] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24df164, dwReserved1=0x77c7389e, cFileName="PowerPoint.en-us", cAlternateFileName="POWERP~1.EN-")) returned 1 [0140.554] GetProcessHeap () returned 0x4e0000 [0140.554] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xd2) returned 0x4fa058 [0140.554] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\*.*", lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24deed4, dwReserved1=0x77c7389e, cFileName=".", cAlternateFileName="")) returned 0x522fd8 [0140.557] GetProcessHeap () returned 0x4e0000 [0140.557] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0140.557] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24deed4, dwReserved1=0x77c7389e, cFileName="..", cAlternateFileName="")) returned 1 [0140.557] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5db14d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x24deed4, dwReserved1=0x77c7389e, cFileName="PowerPointMUI.XML", cAlternateFileName="POWERP~1.XML")) returned 1 [0140.557] GetProcessHeap () returned 0x4e0000 [0140.557] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2d4) returned 0x5273e8 [0140.557] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0140.558] GetProcessHeap () returned 0x4e0000 [0140.558] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0140.558] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0140.558] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded50 | out: lpNewFilePointer=0x0) returned 1 [0140.558] WriteFile (in: hFile=0x104, lpBuffer=0x24ded60*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded60*, lpNumberOfBytesWritten=0x24ded38*=0x6, lpOverlapped=0x0) returned 1 [0140.561] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.561] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.561] GetProcessHeap () returned 0x4e0000 [0140.561] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0140.561] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24ded18*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24ded18*=0x40) returned 1 [0140.561] CryptDestroyKey (hKey=0x523018) returned 1 [0140.561] WriteFile (in: hFile=0x104, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24ded38*=0x40, lpOverlapped=0x0) returned 1 [0140.561] WriteFile (in: hFile=0x104, lpBuffer=0x24ded40*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded40*, lpNumberOfBytesWritten=0x24ded38*=0x4, lpOverlapped=0x0) returned 1 [0140.562] WriteFile (in: hFile=0x104, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24ded38*=0x10, lpOverlapped=0x0) returned 1 [0140.562] WriteFile (in: hFile=0x104, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24ded38*=0x80, lpOverlapped=0x0) returned 1 [0140.562] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded48 | out: lpNewFilePointer=0x0) returned 1 [0140.562] WriteFile (in: hFile=0x104, lpBuffer=0x24ded58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded58*, lpNumberOfBytesWritten=0x24ded38*=0x8, lpOverlapped=0x0) returned 1 [0140.562] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.562] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.562] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.562] ReadFile (in: hFile=0x104, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5aa, lpNumberOfBytesRead=0x24decf0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24decf0*=0x5aa, lpOverlapped=0x0) returned 1 [0140.562] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x5b0) returned 1 [0140.562] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.562] WriteFile (in: hFile=0x104, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x24decf4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24decf4*=0x5b0, lpOverlapped=0x0) returned 1 [0140.562] CryptDestroyKey (hKey=0x523018) returned 1 [0140.562] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.563] SetEndOfFile (hFile=0x104) returned 1 [0140.565] GetProcessHeap () returned 0x4e0000 [0140.565] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0140.565] GetProcessHeap () returned 0x4e0000 [0140.565] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0140.565] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0140.566] CloseHandle (hObject=0x104) returned 1 [0140.566] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x24deed4, dwReserved1=0x77c7389e, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0140.567] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0140.568] GetProcessHeap () returned 0x4e0000 [0140.568] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0140.568] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0140.568] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded50 | out: lpNewFilePointer=0x0) returned 1 [0140.568] WriteFile (in: hFile=0x104, lpBuffer=0x24ded60*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded60*, lpNumberOfBytesWritten=0x24ded38*=0x2, lpOverlapped=0x0) returned 1 [0140.570] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.570] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.570] GetProcessHeap () returned 0x4e0000 [0140.570] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0140.570] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24ded18*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24ded18*=0x30) returned 1 [0140.570] CryptDestroyKey (hKey=0x523018) returned 1 [0140.570] WriteFile (in: hFile=0x104, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24ded38*=0x30, lpOverlapped=0x0) returned 1 [0140.570] WriteFile (in: hFile=0x104, lpBuffer=0x24ded40*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded40*, lpNumberOfBytesWritten=0x24ded38*=0x4, lpOverlapped=0x0) returned 1 [0140.570] WriteFile (in: hFile=0x104, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24ded38*=0x10, lpOverlapped=0x0) returned 1 [0140.571] WriteFile (in: hFile=0x104, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24ded38*=0x80, lpOverlapped=0x0) returned 1 [0140.571] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded48 | out: lpNewFilePointer=0x0) returned 1 [0140.571] WriteFile (in: hFile=0x104, lpBuffer=0x24ded58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded58*, lpNumberOfBytesWritten=0x24ded38*=0x8, lpOverlapped=0x0) returned 1 [0140.571] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.571] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.571] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.571] ReadFile (in: hFile=0x104, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x75e, lpNumberOfBytesRead=0x24decf0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24decf0*=0x75e, lpOverlapped=0x0) returned 1 [0140.571] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x760, dwBufLen=0x760 | out: pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x760) returned 1 [0140.571] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.571] WriteFile (in: hFile=0x104, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x24decf4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24decf4*=0x760, lpOverlapped=0x0) returned 1 [0140.571] CryptDestroyKey (hKey=0x523018) returned 1 [0140.571] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x824, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.572] SetEndOfFile (hFile=0x104) returned 1 [0140.574] GetProcessHeap () returned 0x4e0000 [0140.574] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0140.574] GetProcessHeap () returned 0x4e0000 [0140.574] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0140.575] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0140.578] CloseHandle (hObject=0x104) returned 1 [0140.578] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x24deed4, dwReserved1=0x77c7389e, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0140.578] GetProcessHeap () returned 0x4e0000 [0140.578] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0140.578] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0140.578] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24ded90 | out: pbData=0x4f53d8, pdwDataLen=0x24ded90) returned 1 [0140.578] CryptDestroyKey (hKey=0x523018) returned 1 [0140.578] GetProcessHeap () returned 0x4e0000 [0140.578] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0140.578] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0140.578] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24ded90 | out: pbData=0x4f5420, pdwDataLen=0x24ded90) returned 1 [0140.578] CryptDestroyKey (hKey=0x523018) returned 1 [0140.578] GetProcessHeap () returned 0x4e0000 [0140.578] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5276c8 [0140.578] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0140.579] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5276c8, pdwDataLen=0x24ded90 | out: pbData=0x5276c8, pdwDataLen=0x24ded90) returned 1 [0140.579] CryptDestroyKey (hKey=0x523018) returned 1 [0140.579] wsprintfW (in: param_1=0x24ddd6c, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\readme-warning.txt") returned 115 [0140.579] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0140.579] WriteFile (in: hFile=0x104, lpBuffer=0x5276c8*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddd68, lpOverlapped=0x0 | out: lpBuffer=0x5276c8*, lpNumberOfBytesWritten=0x24ddd68*=0x6c3, lpOverlapped=0x0) returned 1 [0140.581] CloseHandle (hObject=0x104) returned 1 [0140.581] GetProcessHeap () returned 0x4e0000 [0140.581] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5276c8 | out: hHeap=0x4e0000) returned 1 [0140.581] GetProcessHeap () returned 0x4e0000 [0140.581] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0140.581] GetProcessHeap () returned 0x4e0000 [0140.581] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0140.581] FindClose (in: hFindFile=0x522fd8 | out: hFindFile=0x522fd8) returned 1 [0140.581] GetProcessHeap () returned 0x4e0000 [0140.581] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273e8 | out: hHeap=0x4e0000) returned 1 [0140.581] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24df164, dwReserved1=0x77c7389e, cFileName="PRJPROR", cAlternateFileName="")) returned 1 [0140.581] GetProcessHeap () returned 0x4e0000 [0140.581] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xc0) returned 0x4fa058 [0140.581] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\*.*", lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24deed4, dwReserved1=0x77c7389e, cFileName=".", cAlternateFileName="")) returned 0x522fd8 [0140.595] GetProcessHeap () returned 0x4e0000 [0140.595] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0140.595] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24deed4, dwReserved1=0x77c7389e, cFileName="..", cAlternateFileName="")) returned 1 [0140.595] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa60fd8f0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbe2e8f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1915, dwReserved0=0x24deed4, dwReserved1=0x77c7389e, cFileName="PrjProrWW.XML", cAlternateFileName="PRJPRO~1.XML")) returned 1 [0140.595] GetProcessHeap () returned 0x4e0000 [0140.595] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2c2) returned 0x5273e8 [0140.595] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0140.596] GetProcessHeap () returned 0x4e0000 [0140.596] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0140.597] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0140.597] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded50 | out: lpNewFilePointer=0x0) returned 1 [0140.597] WriteFile (in: hFile=0x104, lpBuffer=0x24ded60*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded60*, lpNumberOfBytesWritten=0x24ded38*=0xb, lpOverlapped=0x0) returned 1 [0140.599] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.599] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.599] GetProcessHeap () returned 0x4e0000 [0140.599] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0140.599] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24ded18*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24ded18*=0x40) returned 1 [0140.599] CryptDestroyKey (hKey=0x523018) returned 1 [0140.599] WriteFile (in: hFile=0x104, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24ded38*=0x40, lpOverlapped=0x0) returned 1 [0140.599] WriteFile (in: hFile=0x104, lpBuffer=0x24ded40*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded40*, lpNumberOfBytesWritten=0x24ded38*=0x4, lpOverlapped=0x0) returned 1 [0140.599] WriteFile (in: hFile=0x104, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24ded38*=0x10, lpOverlapped=0x0) returned 1 [0140.599] WriteFile (in: hFile=0x104, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24ded38*=0x80, lpOverlapped=0x0) returned 1 [0140.599] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded48 | out: lpNewFilePointer=0x0) returned 1 [0140.600] WriteFile (in: hFile=0x104, lpBuffer=0x24ded58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded58*, lpNumberOfBytesWritten=0x24ded38*=0x8, lpOverlapped=0x0) returned 1 [0140.600] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.600] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.600] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.600] ReadFile (in: hFile=0x104, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1915, lpNumberOfBytesRead=0x24decf0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24decf0*=0x1915, lpOverlapped=0x0) returned 1 [0140.601] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x1920, dwBufLen=0x1920 | out: pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x1920) returned 1 [0140.601] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.601] WriteFile (in: hFile=0x104, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x24decf4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24decf4*=0x1920, lpOverlapped=0x0) returned 1 [0140.602] CryptDestroyKey (hKey=0x523018) returned 1 [0140.602] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x19f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.602] SetEndOfFile (hFile=0x104) returned 1 [0140.604] GetProcessHeap () returned 0x4e0000 [0140.604] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0140.604] GetProcessHeap () returned 0x4e0000 [0140.604] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0140.604] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0140.605] CloseHandle (hObject=0x104) returned 1 [0140.606] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c227b0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x24deed4, dwReserved1=0x77c7389e, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0140.606] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0140.607] GetProcessHeap () returned 0x4e0000 [0140.607] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0140.607] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0140.607] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded50 | out: lpNewFilePointer=0x0) returned 1 [0140.607] WriteFile (in: hFile=0x104, lpBuffer=0x24ded60*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded60*, lpNumberOfBytesWritten=0x24ded38*=0x5, lpOverlapped=0x0) returned 1 [0140.609] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.609] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.609] GetProcessHeap () returned 0x4e0000 [0140.609] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0140.609] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24ded18*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24ded18*=0x30) returned 1 [0140.609] CryptDestroyKey (hKey=0x523018) returned 1 [0140.609] WriteFile (in: hFile=0x104, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24ded38*=0x30, lpOverlapped=0x0) returned 1 [0140.610] WriteFile (in: hFile=0x104, lpBuffer=0x24ded40*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded40*, lpNumberOfBytesWritten=0x24ded38*=0x4, lpOverlapped=0x0) returned 1 [0140.610] WriteFile (in: hFile=0x104, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24ded38*=0x10, lpOverlapped=0x0) returned 1 [0140.610] WriteFile (in: hFile=0x104, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24ded38*=0x80, lpOverlapped=0x0) returned 1 [0140.610] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded48 | out: lpNewFilePointer=0x0) returned 1 [0140.610] WriteFile (in: hFile=0x104, lpBuffer=0x24ded58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded58*, lpNumberOfBytesWritten=0x24ded38*=0x8, lpOverlapped=0x0) returned 1 [0140.610] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.610] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.610] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.610] ReadFile (in: hFile=0x104, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x412b, lpNumberOfBytesRead=0x24decf0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24decf0*=0x412b, lpOverlapped=0x0) returned 1 [0140.611] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x4130, dwBufLen=0x4130 | out: pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x4130) returned 1 [0140.612] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.612] WriteFile (in: hFile=0x104, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x24decf4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24decf4*=0x4130, lpOverlapped=0x0) returned 1 [0140.612] CryptDestroyKey (hKey=0x523018) returned 1 [0140.612] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x41f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.612] SetEndOfFile (hFile=0x104) returned 1 [0140.615] GetProcessHeap () returned 0x4e0000 [0140.615] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0140.615] GetProcessHeap () returned 0x4e0000 [0140.615] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0140.615] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0140.616] CloseHandle (hObject=0x104) returned 1 [0140.616] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c227b0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x24deed4, dwReserved1=0x77c7389e, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0140.616] GetProcessHeap () returned 0x4e0000 [0140.616] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0140.616] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0140.616] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24ded90 | out: pbData=0x4f53d8, pdwDataLen=0x24ded90) returned 1 [0140.616] CryptDestroyKey (hKey=0x523018) returned 1 [0140.616] GetProcessHeap () returned 0x4e0000 [0140.616] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0140.616] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0140.616] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24ded90 | out: pbData=0x4f5420, pdwDataLen=0x24ded90) returned 1 [0140.616] CryptDestroyKey (hKey=0x523018) returned 1 [0140.616] GetProcessHeap () returned 0x4e0000 [0140.616] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5276b8 [0140.617] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0140.617] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5276b8, pdwDataLen=0x24ded90 | out: pbData=0x5276b8, pdwDataLen=0x24ded90) returned 1 [0140.617] CryptDestroyKey (hKey=0x523018) returned 1 [0140.617] wsprintfW (in: param_1=0x24ddd6c, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\readme-warning.txt") returned 106 [0140.617] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0140.628] WriteFile (in: hFile=0x104, lpBuffer=0x5276b8*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddd68, lpOverlapped=0x0 | out: lpBuffer=0x5276b8*, lpNumberOfBytesWritten=0x24ddd68*=0x6c3, lpOverlapped=0x0) returned 1 [0140.630] CloseHandle (hObject=0x104) returned 1 [0140.630] GetProcessHeap () returned 0x4e0000 [0140.630] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5276b8 | out: hHeap=0x4e0000) returned 1 [0140.630] GetProcessHeap () returned 0x4e0000 [0140.630] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0140.630] GetProcessHeap () returned 0x4e0000 [0140.630] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0140.630] FindClose (in: hFindFile=0x522fd8 | out: hFindFile=0x522fd8) returned 1 [0140.631] GetProcessHeap () returned 0x4e0000 [0140.631] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273e8 | out: hHeap=0x4e0000) returned 1 [0140.631] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24df164, dwReserved1=0x77c7389e, cFileName="Project.en-us", cAlternateFileName="PROJEC~1.EN-")) returned 1 [0140.631] GetProcessHeap () returned 0x4e0000 [0140.631] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xcc) returned 0x4fa058 [0140.631] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\*.*", lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24deed4, dwReserved1=0x77c7389e, cFileName=".", cAlternateFileName="")) returned 0x522fd8 [0140.632] GetProcessHeap () returned 0x4e0000 [0140.632] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0140.632] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24deed4, dwReserved1=0x77c7389e, cFileName="..", cAlternateFileName="")) returned 1 [0140.632] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5b2ebe0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf551ba0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x24deed4, dwReserved1=0x77c7389e, cFileName="ProjectMUI.XML", cAlternateFileName="PROJEC~1.XML")) returned 1 [0140.632] GetProcessHeap () returned 0x4e0000 [0140.632] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2ce) returned 0x5273e8 [0140.632] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0140.633] GetProcessHeap () returned 0x4e0000 [0140.633] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0140.633] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0140.633] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded50 | out: lpNewFilePointer=0x0) returned 1 [0140.633] WriteFile (in: hFile=0x104, lpBuffer=0x24ded60*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded60*, lpNumberOfBytesWritten=0x24ded38*=0x4, lpOverlapped=0x0) returned 1 [0140.635] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.635] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.635] GetProcessHeap () returned 0x4e0000 [0140.635] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0140.635] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24ded18*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24ded18*=0x40) returned 1 [0140.635] CryptDestroyKey (hKey=0x523018) returned 1 [0140.635] WriteFile (in: hFile=0x104, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24ded38*=0x40, lpOverlapped=0x0) returned 1 [0140.635] WriteFile (in: hFile=0x104, lpBuffer=0x24ded40*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded40*, lpNumberOfBytesWritten=0x24ded38*=0x4, lpOverlapped=0x0) returned 1 [0140.635] WriteFile (in: hFile=0x104, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24ded38*=0x10, lpOverlapped=0x0) returned 1 [0140.635] WriteFile (in: hFile=0x104, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24ded38*=0x80, lpOverlapped=0x0) returned 1 [0140.635] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded48 | out: lpNewFilePointer=0x0) returned 1 [0140.636] WriteFile (in: hFile=0x104, lpBuffer=0x24ded58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded58*, lpNumberOfBytesWritten=0x24ded38*=0x8, lpOverlapped=0x0) returned 1 [0140.636] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.636] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.636] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.636] ReadFile (in: hFile=0x104, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5ac, lpNumberOfBytesRead=0x24decf0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24decf0*=0x5ac, lpOverlapped=0x0) returned 1 [0140.636] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x5b0) returned 1 [0140.636] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.636] WriteFile (in: hFile=0x104, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x24decf4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24decf4*=0x5b0, lpOverlapped=0x0) returned 1 [0140.636] CryptDestroyKey (hKey=0x523018) returned 1 [0140.636] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.636] SetEndOfFile (hFile=0x104) returned 1 [0140.639] GetProcessHeap () returned 0x4e0000 [0140.639] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0140.639] GetProcessHeap () returned 0x4e0000 [0140.639] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0140.639] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0140.640] CloseHandle (hObject=0x104) returned 1 [0140.640] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5bc88d0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x24deed4, dwReserved1=0x77c7389e, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0140.640] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0140.641] GetProcessHeap () returned 0x4e0000 [0140.641] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0140.641] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0140.641] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded50 | out: lpNewFilePointer=0x0) returned 1 [0140.641] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.641] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.641] GetProcessHeap () returned 0x4e0000 [0140.641] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0140.641] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24ded18*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24ded18*=0x30) returned 1 [0140.641] CryptDestroyKey (hKey=0x523018) returned 1 [0140.641] WriteFile (in: hFile=0x104, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24ded38*=0x30, lpOverlapped=0x0) returned 1 [0140.643] WriteFile (in: hFile=0x104, lpBuffer=0x24ded40*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded40*, lpNumberOfBytesWritten=0x24ded38*=0x4, lpOverlapped=0x0) returned 1 [0140.643] WriteFile (in: hFile=0x104, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24ded38*=0x10, lpOverlapped=0x0) returned 1 [0140.643] WriteFile (in: hFile=0x104, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24ded38*=0x80, lpOverlapped=0x0) returned 1 [0140.643] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded48 | out: lpNewFilePointer=0x0) returned 1 [0140.643] WriteFile (in: hFile=0x104, lpBuffer=0x24ded58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded58*, lpNumberOfBytesWritten=0x24ded38*=0x8, lpOverlapped=0x0) returned 1 [0140.644] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.644] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.644] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.644] ReadFile (in: hFile=0x104, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x750, lpNumberOfBytesRead=0x24decf0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24decf0*=0x750, lpOverlapped=0x0) returned 1 [0140.644] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x750, dwBufLen=0x750 | out: pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x750) returned 1 [0140.644] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.644] WriteFile (in: hFile=0x104, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x750, lpNumberOfBytesWritten=0x24decf4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24decf4*=0x750, lpOverlapped=0x0) returned 1 [0140.644] CryptDestroyKey (hKey=0x523018) returned 1 [0140.644] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.644] SetEndOfFile (hFile=0x104) returned 1 [0140.647] GetProcessHeap () returned 0x4e0000 [0140.647] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0140.647] GetProcessHeap () returned 0x4e0000 [0140.647] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0140.647] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0140.652] CloseHandle (hObject=0x104) returned 1 [0140.652] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5bc88d0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x24deed4, dwReserved1=0x77c7389e, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0140.652] GetProcessHeap () returned 0x4e0000 [0140.652] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0140.652] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0140.652] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24ded90 | out: pbData=0x4f53d8, pdwDataLen=0x24ded90) returned 1 [0140.652] CryptDestroyKey (hKey=0x523018) returned 1 [0140.652] GetProcessHeap () returned 0x4e0000 [0140.652] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0140.652] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0140.652] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24ded90 | out: pbData=0x4f5420, pdwDataLen=0x24ded90) returned 1 [0140.652] CryptDestroyKey (hKey=0x523018) returned 1 [0140.653] GetProcessHeap () returned 0x4e0000 [0140.653] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5276c0 [0140.653] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0140.653] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5276c0, pdwDataLen=0x24ded90 | out: pbData=0x5276c0, pdwDataLen=0x24ded90) returned 1 [0140.653] CryptDestroyKey (hKey=0x523018) returned 1 [0140.653] wsprintfW (in: param_1=0x24ddd6c, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\readme-warning.txt") returned 112 [0140.653] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0140.653] WriteFile (in: hFile=0x104, lpBuffer=0x5276c0*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddd68, lpOverlapped=0x0 | out: lpBuffer=0x5276c0*, lpNumberOfBytesWritten=0x24ddd68*=0x6c3, lpOverlapped=0x0) returned 1 [0140.655] CloseHandle (hObject=0x104) returned 1 [0140.655] GetProcessHeap () returned 0x4e0000 [0140.655] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5276c0 | out: hHeap=0x4e0000) returned 1 [0140.655] GetProcessHeap () returned 0x4e0000 [0140.655] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0140.655] GetProcessHeap () returned 0x4e0000 [0140.655] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0140.655] FindClose (in: hFindFile=0x522fd8 | out: hFindFile=0x522fd8) returned 1 [0140.655] GetProcessHeap () returned 0x4e0000 [0140.655] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273e8 | out: hHeap=0x4e0000) returned 1 [0140.655] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24df164, dwReserved1=0x77c7389e, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0140.655] GetProcessHeap () returned 0x4e0000 [0140.655] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xc2) returned 0x4fa058 [0140.655] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\*.*", lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24deed4, dwReserved1=0x77c7389e, cFileName=".", cAlternateFileName="")) returned 0x522fd8 [0140.657] GetProcessHeap () returned 0x4e0000 [0140.657] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0140.657] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24deed4, dwReserved1=0x77c7389e, cFileName="..", cAlternateFileName="")) returned 1 [0140.657] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01be3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x24deed4, dwReserved1=0x77c7389e, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0140.657] GetProcessHeap () returned 0x4e0000 [0140.657] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2c4) returned 0x5273e8 [0140.657] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0140.657] GetProcessHeap () returned 0x4e0000 [0140.657] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0140.657] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0140.657] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded50 | out: lpNewFilePointer=0x0) returned 1 [0140.657] WriteFile (in: hFile=0x104, lpBuffer=0x24ded60*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded60*, lpNumberOfBytesWritten=0x24ded38*=0xd, lpOverlapped=0x0) returned 1 [0140.667] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.667] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.667] GetProcessHeap () returned 0x4e0000 [0140.667] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0140.667] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24ded18*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24ded18*=0x30) returned 1 [0140.667] CryptDestroyKey (hKey=0x523018) returned 1 [0140.667] WriteFile (in: hFile=0x104, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24ded38*=0x30, lpOverlapped=0x0) returned 1 [0140.667] WriteFile (in: hFile=0x104, lpBuffer=0x24ded40*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded40*, lpNumberOfBytesWritten=0x24ded38*=0x4, lpOverlapped=0x0) returned 1 [0140.667] WriteFile (in: hFile=0x104, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24ded38*=0x10, lpOverlapped=0x0) returned 1 [0140.668] WriteFile (in: hFile=0x104, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24ded38*=0x80, lpOverlapped=0x0) returned 1 [0140.668] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded48 | out: lpNewFilePointer=0x0) returned 1 [0140.668] WriteFile (in: hFile=0x104, lpBuffer=0x24ded58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded58*, lpNumberOfBytesWritten=0x24ded38*=0x8, lpOverlapped=0x0) returned 1 [0140.668] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.668] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.668] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.668] ReadFile (in: hFile=0x104, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x543, lpNumberOfBytesRead=0x24decf0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24decf0*=0x543, lpOverlapped=0x0) returned 1 [0140.668] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x550, dwBufLen=0x550 | out: pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x550) returned 1 [0140.668] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.668] WriteFile (in: hFile=0x104, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x24decf4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24decf4*=0x550, lpOverlapped=0x0) returned 1 [0140.668] CryptDestroyKey (hKey=0x523018) returned 1 [0140.668] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.668] SetEndOfFile (hFile=0x104) returned 1 [0140.671] GetProcessHeap () returned 0x4e0000 [0140.671] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0140.671] GetProcessHeap () returned 0x4e0000 [0140.671] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0140.671] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0140.672] CloseHandle (hObject=0x104) returned 1 [0140.672] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01be3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x24deed4, dwReserved1=0x77c7389e, cFileName="Proof.XML", cAlternateFileName="")) returned 0 [0140.672] GetProcessHeap () returned 0x4e0000 [0140.672] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0140.672] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0140.673] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24ded90 | out: pbData=0x4f53d8, pdwDataLen=0x24ded90) returned 1 [0140.673] CryptDestroyKey (hKey=0x523018) returned 1 [0140.673] GetProcessHeap () returned 0x4e0000 [0140.673] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0140.673] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0140.673] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24ded90 | out: pbData=0x4f5420, pdwDataLen=0x24ded90) returned 1 [0140.673] CryptDestroyKey (hKey=0x523018) returned 1 [0140.673] GetProcessHeap () returned 0x4e0000 [0140.673] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5276b8 [0140.673] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0140.673] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5276b8, pdwDataLen=0x24ded90 | out: pbData=0x5276b8, pdwDataLen=0x24ded90) returned 1 [0140.673] CryptDestroyKey (hKey=0x523018) returned 1 [0140.673] wsprintfW (in: param_1=0x24ddd6c, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\readme-warning.txt") returned 107 [0140.673] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0140.674] WriteFile (in: hFile=0x104, lpBuffer=0x5276b8*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddd68, lpOverlapped=0x0 | out: lpBuffer=0x5276b8*, lpNumberOfBytesWritten=0x24ddd68*=0x6c3, lpOverlapped=0x0) returned 1 [0140.675] CloseHandle (hObject=0x104) returned 1 [0140.675] GetProcessHeap () returned 0x4e0000 [0140.675] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5276b8 | out: hHeap=0x4e0000) returned 1 [0140.675] GetProcessHeap () returned 0x4e0000 [0140.675] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0140.675] GetProcessHeap () returned 0x4e0000 [0140.675] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0140.675] FindClose (in: hFindFile=0x522fd8 | out: hFindFile=0x522fd8) returned 1 [0140.675] GetProcessHeap () returned 0x4e0000 [0140.675] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273e8 | out: hHeap=0x4e0000) returned 1 [0140.676] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24df164, dwReserved1=0x77c7389e, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0140.676] GetProcessHeap () returned 0x4e0000 [0140.676] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xc2) returned 0x4fa058 [0140.676] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\*.*", lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24deed4, dwReserved1=0x77c7389e, cFileName=".", cAlternateFileName="")) returned 0x522fd8 [0140.677] GetProcessHeap () returned 0x4e0000 [0140.677] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0140.677] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24deed4, dwReserved1=0x77c7389e, cFileName="..", cAlternateFileName="")) returned 1 [0140.677] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4e37e00, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x24deed4, dwReserved1=0x77c7389e, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0140.677] GetProcessHeap () returned 0x4e0000 [0140.677] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2c4) returned 0x5273e8 [0140.677] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0140.678] GetProcessHeap () returned 0x4e0000 [0140.678] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0140.678] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0140.678] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded50 | out: lpNewFilePointer=0x0) returned 1 [0140.678] WriteFile (in: hFile=0x104, lpBuffer=0x24ded60*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded60*, lpNumberOfBytesWritten=0x24ded38*=0xf, lpOverlapped=0x0) returned 1 [0140.684] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.684] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.684] GetProcessHeap () returned 0x4e0000 [0140.684] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0140.684] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24ded18*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24ded18*=0x30) returned 1 [0140.684] CryptDestroyKey (hKey=0x523018) returned 1 [0140.684] WriteFile (in: hFile=0x104, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24ded38*=0x30, lpOverlapped=0x0) returned 1 [0140.685] WriteFile (in: hFile=0x104, lpBuffer=0x24ded40*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded40*, lpNumberOfBytesWritten=0x24ded38*=0x4, lpOverlapped=0x0) returned 1 [0140.685] WriteFile (in: hFile=0x104, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24ded38*=0x10, lpOverlapped=0x0) returned 1 [0140.685] WriteFile (in: hFile=0x104, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24ded38*=0x80, lpOverlapped=0x0) returned 1 [0140.685] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded48 | out: lpNewFilePointer=0x0) returned 1 [0140.685] WriteFile (in: hFile=0x104, lpBuffer=0x24ded58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded58*, lpNumberOfBytesWritten=0x24ded38*=0x8, lpOverlapped=0x0) returned 1 [0140.685] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.685] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.685] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.685] ReadFile (in: hFile=0x104, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5b1, lpNumberOfBytesRead=0x24decf0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24decf0*=0x5b1, lpOverlapped=0x0) returned 1 [0140.685] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x5c0, dwBufLen=0x5c0 | out: pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x5c0) returned 1 [0140.685] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.686] WriteFile (in: hFile=0x104, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x24decf4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24decf4*=0x5c0, lpOverlapped=0x0) returned 1 [0140.686] CryptDestroyKey (hKey=0x523018) returned 1 [0140.686] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.686] SetEndOfFile (hFile=0x104) returned 1 [0140.688] GetProcessHeap () returned 0x4e0000 [0140.688] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0140.688] GetProcessHeap () returned 0x4e0000 [0140.688] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0140.689] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0140.689] CloseHandle (hObject=0x104) returned 1 [0140.689] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4e37e00, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x24deed4, dwReserved1=0x77c7389e, cFileName="Proof.XML", cAlternateFileName="")) returned 0 [0140.690] GetProcessHeap () returned 0x4e0000 [0140.690] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0140.690] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0140.690] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24ded90 | out: pbData=0x4f53d8, pdwDataLen=0x24ded90) returned 1 [0140.690] CryptDestroyKey (hKey=0x523018) returned 1 [0140.690] GetProcessHeap () returned 0x4e0000 [0140.690] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0140.690] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0140.690] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24ded90 | out: pbData=0x4f5420, pdwDataLen=0x24ded90) returned 1 [0140.690] CryptDestroyKey (hKey=0x523018) returned 1 [0140.690] GetProcessHeap () returned 0x4e0000 [0140.690] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5276b8 [0140.690] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0140.690] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5276b8, pdwDataLen=0x24ded90 | out: pbData=0x5276b8, pdwDataLen=0x24ded90) returned 1 [0140.690] CryptDestroyKey (hKey=0x523018) returned 1 [0140.690] wsprintfW (in: param_1=0x24ddd6c, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\readme-warning.txt") returned 107 [0140.690] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0140.691] WriteFile (in: hFile=0x104, lpBuffer=0x5276b8*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddd68, lpOverlapped=0x0 | out: lpBuffer=0x5276b8*, lpNumberOfBytesWritten=0x24ddd68*=0x6c3, lpOverlapped=0x0) returned 1 [0140.692] CloseHandle (hObject=0x104) returned 1 [0140.692] GetProcessHeap () returned 0x4e0000 [0140.692] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5276b8 | out: hHeap=0x4e0000) returned 1 [0140.692] GetProcessHeap () returned 0x4e0000 [0140.692] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0140.692] GetProcessHeap () returned 0x4e0000 [0140.692] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0140.692] FindClose (in: hFindFile=0x522fd8 | out: hFindFile=0x522fd8) returned 1 [0140.693] GetProcessHeap () returned 0x4e0000 [0140.693] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273e8 | out: hHeap=0x4e0000) returned 1 [0140.693] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24df164, dwReserved1=0x77c7389e, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0140.693] GetProcessHeap () returned 0x4e0000 [0140.693] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xc2) returned 0x4fa058 [0140.693] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\*.*", lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24deed4, dwReserved1=0x77c7389e, cFileName=".", cAlternateFileName="")) returned 0x522fd8 [0140.694] GetProcessHeap () returned 0x4e0000 [0140.694] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0140.694] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24deed4, dwReserved1=0x77c7389e, cFileName="..", cAlternateFileName="")) returned 1 [0140.695] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2bd90c0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x24deed4, dwReserved1=0x77c7389e, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0140.695] GetProcessHeap () returned 0x4e0000 [0140.695] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2c4) returned 0x5273e8 [0140.695] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0140.695] GetProcessHeap () returned 0x4e0000 [0140.695] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0140.695] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0140.695] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded50 | out: lpNewFilePointer=0x0) returned 1 [0140.695] WriteFile (in: hFile=0x104, lpBuffer=0x24ded60*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded60*, lpNumberOfBytesWritten=0x24ded38*=0xe, lpOverlapped=0x0) returned 1 [0140.704] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.704] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.704] GetProcessHeap () returned 0x4e0000 [0140.704] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0140.704] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24ded18*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24ded18*=0x30) returned 1 [0140.704] CryptDestroyKey (hKey=0x523018) returned 1 [0140.704] WriteFile (in: hFile=0x104, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24ded38*=0x30, lpOverlapped=0x0) returned 1 [0140.704] WriteFile (in: hFile=0x104, lpBuffer=0x24ded40*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded40*, lpNumberOfBytesWritten=0x24ded38*=0x4, lpOverlapped=0x0) returned 1 [0140.704] WriteFile (in: hFile=0x104, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24ded38*=0x10, lpOverlapped=0x0) returned 1 [0140.704] WriteFile (in: hFile=0x104, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24ded38*=0x80, lpOverlapped=0x0) returned 1 [0140.704] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded48 | out: lpNewFilePointer=0x0) returned 1 [0140.705] WriteFile (in: hFile=0x104, lpBuffer=0x24ded58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded58*, lpNumberOfBytesWritten=0x24ded38*=0x8, lpOverlapped=0x0) returned 1 [0140.705] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.705] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.705] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.705] ReadFile (in: hFile=0x104, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5b2, lpNumberOfBytesRead=0x24decf0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24decf0*=0x5b2, lpOverlapped=0x0) returned 1 [0140.705] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x5c0, dwBufLen=0x5c0 | out: pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x5c0) returned 1 [0140.705] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.705] WriteFile (in: hFile=0x104, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x24decf4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24decf4*=0x5c0, lpOverlapped=0x0) returned 1 [0140.705] CryptDestroyKey (hKey=0x523018) returned 1 [0140.705] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.705] SetEndOfFile (hFile=0x104) returned 1 [0140.708] GetProcessHeap () returned 0x4e0000 [0140.708] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0140.708] GetProcessHeap () returned 0x4e0000 [0140.708] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0140.708] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0140.709] CloseHandle (hObject=0x104) returned 1 [0140.709] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2bd90c0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x24deed4, dwReserved1=0x77c7389e, cFileName="Proof.XML", cAlternateFileName="")) returned 0 [0140.709] GetProcessHeap () returned 0x4e0000 [0140.709] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0140.709] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0140.709] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24ded90 | out: pbData=0x4f53d8, pdwDataLen=0x24ded90) returned 1 [0140.709] CryptDestroyKey (hKey=0x523018) returned 1 [0140.709] GetProcessHeap () returned 0x4e0000 [0140.709] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0140.710] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0140.710] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24ded90 | out: pbData=0x4f5420, pdwDataLen=0x24ded90) returned 1 [0140.710] CryptDestroyKey (hKey=0x523018) returned 1 [0140.710] GetProcessHeap () returned 0x4e0000 [0140.710] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5276b8 [0140.710] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0140.710] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5276b8, pdwDataLen=0x24ded90 | out: pbData=0x5276b8, pdwDataLen=0x24ded90) returned 1 [0140.710] CryptDestroyKey (hKey=0x523018) returned 1 [0140.710] wsprintfW (in: param_1=0x24ddd6c, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\readme-warning.txt") returned 107 [0140.710] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0140.710] WriteFile (in: hFile=0x104, lpBuffer=0x5276b8*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddd68, lpOverlapped=0x0 | out: lpBuffer=0x5276b8*, lpNumberOfBytesWritten=0x24ddd68*=0x6c3, lpOverlapped=0x0) returned 1 [0140.712] CloseHandle (hObject=0x104) returned 1 [0140.712] GetProcessHeap () returned 0x4e0000 [0140.712] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5276b8 | out: hHeap=0x4e0000) returned 1 [0140.712] GetProcessHeap () returned 0x4e0000 [0140.712] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0140.712] GetProcessHeap () returned 0x4e0000 [0140.712] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0140.712] FindClose (in: hFindFile=0x522fd8 | out: hFindFile=0x522fd8) returned 1 [0140.716] GetProcessHeap () returned 0x4e0000 [0140.716] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273e8 | out: hHeap=0x4e0000) returned 1 [0140.716] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24df164, dwReserved1=0x77c7389e, cFileName="Proofing.en-us", cAlternateFileName="PROOFI~1.EN-")) returned 1 [0140.716] GetProcessHeap () returned 0x4e0000 [0140.716] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xce) returned 0x4fa058 [0140.716] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\*.*", lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24deed4, dwReserved1=0x77c7389e, cFileName=".", cAlternateFileName="")) returned 0x522fd8 [0140.716] GetProcessHeap () returned 0x4e0000 [0140.716] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0140.716] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24deed4, dwReserved1=0x77c7389e, cFileName="..", cAlternateFileName="")) returned 1 [0140.716] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0x24deed4, dwReserved1=0x77c7389e, cFileName="Proofing.XML", cAlternateFileName="")) returned 1 [0140.716] GetProcessHeap () returned 0x4e0000 [0140.717] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2d0) returned 0x5273e8 [0140.717] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0140.718] GetProcessHeap () returned 0x4e0000 [0140.718] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0140.718] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0140.718] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded50 | out: lpNewFilePointer=0x0) returned 1 [0140.718] WriteFile (in: hFile=0x104, lpBuffer=0x24ded60*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded60*, lpNumberOfBytesWritten=0x24ded38*=0x5, lpOverlapped=0x0) returned 1 [0140.720] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.720] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.720] GetProcessHeap () returned 0x4e0000 [0140.720] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0140.720] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24ded18*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24ded18*=0x40) returned 1 [0140.720] CryptDestroyKey (hKey=0x523018) returned 1 [0140.720] WriteFile (in: hFile=0x104, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24ded38*=0x40, lpOverlapped=0x0) returned 1 [0140.720] WriteFile (in: hFile=0x104, lpBuffer=0x24ded40*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded40*, lpNumberOfBytesWritten=0x24ded38*=0x4, lpOverlapped=0x0) returned 1 [0140.720] WriteFile (in: hFile=0x104, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24ded38*=0x10, lpOverlapped=0x0) returned 1 [0140.720] WriteFile (in: hFile=0x104, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24ded38*=0x80, lpOverlapped=0x0) returned 1 [0140.720] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded48 | out: lpNewFilePointer=0x0) returned 1 [0140.720] WriteFile (in: hFile=0x104, lpBuffer=0x24ded58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded58*, lpNumberOfBytesWritten=0x24ded38*=0x8, lpOverlapped=0x0) returned 1 [0140.721] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.721] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.721] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.721] ReadFile (in: hFile=0x104, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x32b, lpNumberOfBytesRead=0x24decf0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24decf0*=0x32b, lpOverlapped=0x0) returned 1 [0140.721] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x330, dwBufLen=0x330 | out: pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x330) returned 1 [0140.721] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.721] WriteFile (in: hFile=0x104, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x24decf4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24decf4*=0x330, lpOverlapped=0x0) returned 1 [0140.721] CryptDestroyKey (hKey=0x523018) returned 1 [0140.721] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x404, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.721] SetEndOfFile (hFile=0x104) returned 1 [0140.724] GetProcessHeap () returned 0x4e0000 [0140.724] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0140.724] GetProcessHeap () returned 0x4e0000 [0140.724] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0140.724] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0140.725] CloseHandle (hObject=0x104) returned 1 [0140.725] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58c6830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x24deed4, dwReserved1=0x77c7389e, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0140.725] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0140.725] GetProcessHeap () returned 0x4e0000 [0140.725] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0140.725] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0140.725] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded50 | out: lpNewFilePointer=0x0) returned 1 [0140.726] WriteFile (in: hFile=0x104, lpBuffer=0x24ded60*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded60*, lpNumberOfBytesWritten=0x24ded38*=0x4, lpOverlapped=0x0) returned 1 [0140.729] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.729] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.729] GetProcessHeap () returned 0x4e0000 [0140.729] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0140.729] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24ded18*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24ded18*=0x30) returned 1 [0140.729] CryptDestroyKey (hKey=0x523018) returned 1 [0140.729] WriteFile (in: hFile=0x104, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24ded38*=0x30, lpOverlapped=0x0) returned 1 [0140.729] WriteFile (in: hFile=0x104, lpBuffer=0x24ded40*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded40*, lpNumberOfBytesWritten=0x24ded38*=0x4, lpOverlapped=0x0) returned 1 [0140.729] WriteFile (in: hFile=0x104, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24ded38*=0x10, lpOverlapped=0x0) returned 1 [0140.729] WriteFile (in: hFile=0x104, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24ded38*=0x80, lpOverlapped=0x0) returned 1 [0140.729] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded48 | out: lpNewFilePointer=0x0) returned 1 [0140.729] WriteFile (in: hFile=0x104, lpBuffer=0x24ded58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded58*, lpNumberOfBytesWritten=0x24ded38*=0x8, lpOverlapped=0x0) returned 1 [0140.730] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.730] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.730] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.730] ReadFile (in: hFile=0x104, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x16fc, lpNumberOfBytesRead=0x24decf0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24decf0*=0x16fc, lpOverlapped=0x0) returned 1 [0140.731] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x1700, dwBufLen=0x1700 | out: pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x1700) returned 1 [0140.731] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.731] WriteFile (in: hFile=0x104, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x24decf4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24decf4*=0x1700, lpOverlapped=0x0) returned 1 [0140.731] CryptDestroyKey (hKey=0x523018) returned 1 [0140.731] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x17c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.731] SetEndOfFile (hFile=0x104) returned 1 [0140.734] GetProcessHeap () returned 0x4e0000 [0140.734] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0140.734] GetProcessHeap () returned 0x4e0000 [0140.734] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0140.734] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0140.736] CloseHandle (hObject=0x104) returned 1 [0140.737] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58c6830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x24deed4, dwReserved1=0x77c7389e, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0140.737] GetProcessHeap () returned 0x4e0000 [0140.737] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0140.737] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0140.737] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24ded90 | out: pbData=0x4f53d8, pdwDataLen=0x24ded90) returned 1 [0140.737] CryptDestroyKey (hKey=0x523018) returned 1 [0140.737] GetProcessHeap () returned 0x4e0000 [0140.737] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0140.737] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0140.737] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24ded90 | out: pbData=0x4f5420, pdwDataLen=0x24ded90) returned 1 [0140.737] CryptDestroyKey (hKey=0x523018) returned 1 [0140.737] GetProcessHeap () returned 0x4e0000 [0140.737] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5276c0 [0140.737] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0140.737] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5276c0, pdwDataLen=0x24ded90 | out: pbData=0x5276c0, pdwDataLen=0x24ded90) returned 1 [0140.737] CryptDestroyKey (hKey=0x523018) returned 1 [0140.737] wsprintfW (in: param_1=0x24ddd6c, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\readme-warning.txt") returned 113 [0140.738] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0140.738] WriteFile (in: hFile=0x104, lpBuffer=0x5276c0*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddd68, lpOverlapped=0x0 | out: lpBuffer=0x5276c0*, lpNumberOfBytesWritten=0x24ddd68*=0x6c3, lpOverlapped=0x0) returned 1 [0140.739] CloseHandle (hObject=0x104) returned 1 [0140.740] GetProcessHeap () returned 0x4e0000 [0140.740] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5276c0 | out: hHeap=0x4e0000) returned 1 [0140.740] GetProcessHeap () returned 0x4e0000 [0140.740] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0140.740] GetProcessHeap () returned 0x4e0000 [0140.740] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0140.740] FindClose (in: hFindFile=0x522fd8 | out: hFindFile=0x522fd8) returned 1 [0140.740] GetProcessHeap () returned 0x4e0000 [0140.740] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273e8 | out: hHeap=0x4e0000) returned 1 [0140.740] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24df164, dwReserved1=0x77c7389e, cFileName="PROPLUSR", cAlternateFileName="")) returned 1 [0140.740] GetProcessHeap () returned 0x4e0000 [0140.740] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xc2) returned 0x4fa058 [0140.740] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\*.*", lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24deed4, dwReserved1=0x77c7389e, cFileName=".", cAlternateFileName="")) returned 0x522fd8 [0140.747] GetProcessHeap () returned 0x4e0000 [0140.747] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0140.747] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24deed4, dwReserved1=0x77c7389e, cFileName="..", cAlternateFileName="")) returned 1 [0140.747] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x170fe40, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x41d4, dwReserved0=0x24deed4, dwReserved1=0x77c7389e, cFileName="ProPlusrWW.XML", cAlternateFileName="PROPLU~1.XML")) returned 1 [0140.747] GetProcessHeap () returned 0x4e0000 [0140.747] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2c4) returned 0x5273e8 [0140.747] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0140.748] GetProcessHeap () returned 0x4e0000 [0140.748] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0140.748] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0140.748] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded50 | out: lpNewFilePointer=0x0) returned 1 [0140.748] WriteFile (in: hFile=0x104, lpBuffer=0x24ded60*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded60*, lpNumberOfBytesWritten=0x24ded38*=0xc, lpOverlapped=0x0) returned 1 [0140.750] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.750] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.750] GetProcessHeap () returned 0x4e0000 [0140.750] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0140.750] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24ded18*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24ded18*=0x40) returned 1 [0140.750] CryptDestroyKey (hKey=0x523018) returned 1 [0140.750] WriteFile (in: hFile=0x104, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24ded38*=0x40, lpOverlapped=0x0) returned 1 [0140.750] WriteFile (in: hFile=0x104, lpBuffer=0x24ded40*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded40*, lpNumberOfBytesWritten=0x24ded38*=0x4, lpOverlapped=0x0) returned 1 [0140.750] WriteFile (in: hFile=0x104, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24ded38*=0x10, lpOverlapped=0x0) returned 1 [0140.750] WriteFile (in: hFile=0x104, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24ded38*=0x80, lpOverlapped=0x0) returned 1 [0140.750] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded48 | out: lpNewFilePointer=0x0) returned 1 [0140.750] WriteFile (in: hFile=0x104, lpBuffer=0x24ded58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded58*, lpNumberOfBytesWritten=0x24ded38*=0x8, lpOverlapped=0x0) returned 1 [0140.750] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.750] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.750] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.751] ReadFile (in: hFile=0x104, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x41d4, lpNumberOfBytesRead=0x24decf0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24decf0*=0x41d4, lpOverlapped=0x0) returned 1 [0140.751] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x41e0, dwBufLen=0x41e0 | out: pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x41e0) returned 1 [0140.752] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.752] WriteFile (in: hFile=0x104, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x24decf4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24decf4*=0x41e0, lpOverlapped=0x0) returned 1 [0140.752] CryptDestroyKey (hKey=0x523018) returned 1 [0140.752] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x42b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.752] SetEndOfFile (hFile=0x104) returned 1 [0140.754] GetProcessHeap () returned 0x4e0000 [0140.754] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0140.754] GetProcessHeap () returned 0x4e0000 [0140.754] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0140.754] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0140.755] CloseHandle (hObject=0x104) returned 1 [0140.755] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18177c50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x24deed4, dwReserved1=0x77c7389e, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0140.755] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0140.755] GetProcessHeap () returned 0x4e0000 [0140.755] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0140.755] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0140.755] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded50 | out: lpNewFilePointer=0x0) returned 1 [0140.755] WriteFile (in: hFile=0x104, lpBuffer=0x24ded60*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded60*, lpNumberOfBytesWritten=0x24ded38*=0xa, lpOverlapped=0x0) returned 1 [0140.757] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.757] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.757] GetProcessHeap () returned 0x4e0000 [0140.757] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0140.757] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24ded18*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24ded18*=0x30) returned 1 [0140.757] CryptDestroyKey (hKey=0x523018) returned 1 [0140.757] WriteFile (in: hFile=0x104, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24ded38*=0x30, lpOverlapped=0x0) returned 1 [0140.757] WriteFile (in: hFile=0x104, lpBuffer=0x24ded40*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded40*, lpNumberOfBytesWritten=0x24ded38*=0x4, lpOverlapped=0x0) returned 1 [0140.757] WriteFile (in: hFile=0x104, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24ded38*=0x10, lpOverlapped=0x0) returned 1 [0140.757] WriteFile (in: hFile=0x104, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24ded38*=0x80, lpOverlapped=0x0) returned 1 [0140.758] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded48 | out: lpNewFilePointer=0x0) returned 1 [0140.758] WriteFile (in: hFile=0x104, lpBuffer=0x24ded58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded58*, lpNumberOfBytesWritten=0x24ded38*=0x8, lpOverlapped=0x0) returned 1 [0140.758] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.758] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.758] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.758] ReadFile (in: hFile=0x104, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7976, lpNumberOfBytesRead=0x24decf0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24decf0*=0x7976, lpOverlapped=0x0) returned 1 [0140.759] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x7980, dwBufLen=0x7980 | out: pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x7980) returned 1 [0140.759] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.759] WriteFile (in: hFile=0x104, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x24decf4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24decf4*=0x7980, lpOverlapped=0x0) returned 1 [0140.759] CryptDestroyKey (hKey=0x523018) returned 1 [0140.760] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x7a44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.760] SetEndOfFile (hFile=0x104) returned 1 [0140.762] GetProcessHeap () returned 0x4e0000 [0140.762] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0140.762] GetProcessHeap () returned 0x4e0000 [0140.762] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0140.762] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0140.762] CloseHandle (hObject=0x104) returned 1 [0140.763] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18177c50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x24deed4, dwReserved1=0x77c7389e, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0140.763] GetProcessHeap () returned 0x4e0000 [0140.763] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0140.763] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0140.763] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24ded90 | out: pbData=0x4f53d8, pdwDataLen=0x24ded90) returned 1 [0140.763] CryptDestroyKey (hKey=0x523018) returned 1 [0140.763] GetProcessHeap () returned 0x4e0000 [0140.763] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0140.763] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0140.763] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24ded90 | out: pbData=0x4f5420, pdwDataLen=0x24ded90) returned 1 [0140.763] CryptDestroyKey (hKey=0x523018) returned 1 [0140.763] GetProcessHeap () returned 0x4e0000 [0140.763] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5276b8 [0140.763] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0140.763] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5276b8, pdwDataLen=0x24ded90 | out: pbData=0x5276b8, pdwDataLen=0x24ded90) returned 1 [0140.763] CryptDestroyKey (hKey=0x523018) returned 1 [0140.763] wsprintfW (in: param_1=0x24ddd6c, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\readme-warning.txt") returned 107 [0140.763] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0140.766] WriteFile (in: hFile=0x104, lpBuffer=0x5276b8*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddd68, lpOverlapped=0x0 | out: lpBuffer=0x5276b8*, lpNumberOfBytesWritten=0x24ddd68*=0x6c3, lpOverlapped=0x0) returned 1 [0140.767] CloseHandle (hObject=0x104) returned 1 [0140.767] GetProcessHeap () returned 0x4e0000 [0140.767] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5276b8 | out: hHeap=0x4e0000) returned 1 [0140.767] GetProcessHeap () returned 0x4e0000 [0140.767] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0140.767] GetProcessHeap () returned 0x4e0000 [0140.767] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0140.767] FindClose (in: hFindFile=0x522fd8 | out: hFindFile=0x522fd8) returned 1 [0140.767] GetProcessHeap () returned 0x4e0000 [0140.767] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273e8 | out: hHeap=0x4e0000) returned 1 [0140.767] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24df164, dwReserved1=0x77c7389e, cFileName="Publisher.en-us", cAlternateFileName="PUBLIS~1.EN-")) returned 1 [0140.767] GetProcessHeap () returned 0x4e0000 [0140.767] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xd0) returned 0x4fa058 [0140.767] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\*.*", lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24deed4, dwReserved1=0x77c7389e, cFileName=".", cAlternateFileName="")) returned 0x522fd8 [0140.768] GetProcessHeap () returned 0x4e0000 [0140.768] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0140.768] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24deed4, dwReserved1=0x77c7389e, cFileName="..", cAlternateFileName="")) returned 1 [0140.768] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x24deed4, dwReserved1=0x77c7389e, cFileName="PublisherMUI.XML", cAlternateFileName="PUBLIS~1.XML")) returned 1 [0140.768] GetProcessHeap () returned 0x4e0000 [0140.768] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2d2) returned 0x5273e8 [0140.768] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0140.768] GetProcessHeap () returned 0x4e0000 [0140.768] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0140.768] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0140.768] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded50 | out: lpNewFilePointer=0x0) returned 1 [0140.769] WriteFile (in: hFile=0x104, lpBuffer=0x24ded60*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded60*, lpNumberOfBytesWritten=0x24ded38*=0x6, lpOverlapped=0x0) returned 1 [0140.770] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.770] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.770] GetProcessHeap () returned 0x4e0000 [0140.770] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0140.770] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24ded18*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24ded18*=0x40) returned 1 [0140.770] CryptDestroyKey (hKey=0x523018) returned 1 [0140.770] WriteFile (in: hFile=0x104, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24ded38*=0x40, lpOverlapped=0x0) returned 1 [0140.770] WriteFile (in: hFile=0x104, lpBuffer=0x24ded40*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded40*, lpNumberOfBytesWritten=0x24ded38*=0x4, lpOverlapped=0x0) returned 1 [0140.771] WriteFile (in: hFile=0x104, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24ded38*=0x10, lpOverlapped=0x0) returned 1 [0140.771] WriteFile (in: hFile=0x104, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24ded38*=0x80, lpOverlapped=0x0) returned 1 [0140.771] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded48 | out: lpNewFilePointer=0x0) returned 1 [0140.771] WriteFile (in: hFile=0x104, lpBuffer=0x24ded58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded58*, lpNumberOfBytesWritten=0x24ded38*=0x8, lpOverlapped=0x0) returned 1 [0140.771] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.771] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.771] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.771] ReadFile (in: hFile=0x104, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5aa, lpNumberOfBytesRead=0x24decf0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24decf0*=0x5aa, lpOverlapped=0x0) returned 1 [0140.771] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x5b0) returned 1 [0140.771] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.771] WriteFile (in: hFile=0x104, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x24decf4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24decf4*=0x5b0, lpOverlapped=0x0) returned 1 [0140.771] CryptDestroyKey (hKey=0x523018) returned 1 [0140.771] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.771] SetEndOfFile (hFile=0x104) returned 1 [0140.774] GetProcessHeap () returned 0x4e0000 [0140.774] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0140.774] GetProcessHeap () returned 0x4e0000 [0140.774] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0140.774] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0140.774] CloseHandle (hObject=0x104) returned 1 [0140.775] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x24deed4, dwReserved1=0x77c7389e, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0140.775] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0140.775] GetProcessHeap () returned 0x4e0000 [0140.775] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0140.776] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0140.776] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded50 | out: lpNewFilePointer=0x0) returned 1 [0140.776] WriteFile (in: hFile=0x104, lpBuffer=0x24ded60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded60*, lpNumberOfBytesWritten=0x24ded38*=0x8, lpOverlapped=0x0) returned 1 [0140.781] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.781] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.781] GetProcessHeap () returned 0x4e0000 [0140.781] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0140.781] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24ded18*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24ded18*=0x30) returned 1 [0140.781] CryptDestroyKey (hKey=0x523018) returned 1 [0140.781] WriteFile (in: hFile=0x104, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24ded38*=0x30, lpOverlapped=0x0) returned 1 [0140.781] WriteFile (in: hFile=0x104, lpBuffer=0x24ded40*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded40*, lpNumberOfBytesWritten=0x24ded38*=0x4, lpOverlapped=0x0) returned 1 [0140.781] WriteFile (in: hFile=0x104, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24ded38*=0x10, lpOverlapped=0x0) returned 1 [0140.781] WriteFile (in: hFile=0x104, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24ded38*=0x80, lpOverlapped=0x0) returned 1 [0140.781] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded48 | out: lpNewFilePointer=0x0) returned 1 [0140.781] WriteFile (in: hFile=0x104, lpBuffer=0x24ded58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded58*, lpNumberOfBytesWritten=0x24ded38*=0x8, lpOverlapped=0x0) returned 1 [0140.781] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.781] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.781] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.781] ReadFile (in: hFile=0x104, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x648, lpNumberOfBytesRead=0x24decf0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24decf0*=0x648, lpOverlapped=0x0) returned 1 [0140.782] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x650, dwBufLen=0x650 | out: pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x650) returned 1 [0140.782] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.782] WriteFile (in: hFile=0x104, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x24decf4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24decf4*=0x650, lpOverlapped=0x0) returned 1 [0140.782] CryptDestroyKey (hKey=0x523018) returned 1 [0140.782] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.782] SetEndOfFile (hFile=0x104) returned 1 [0140.784] GetProcessHeap () returned 0x4e0000 [0140.784] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0140.784] GetProcessHeap () returned 0x4e0000 [0140.784] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0140.784] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0140.792] CloseHandle (hObject=0x104) returned 1 [0140.792] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x24deed4, dwReserved1=0x77c7389e, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0140.792] GetProcessHeap () returned 0x4e0000 [0140.793] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0140.793] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0140.793] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24ded90 | out: pbData=0x4f53d8, pdwDataLen=0x24ded90) returned 1 [0140.793] CryptDestroyKey (hKey=0x523018) returned 1 [0140.793] GetProcessHeap () returned 0x4e0000 [0140.793] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0140.793] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0140.793] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24ded90 | out: pbData=0x4f5420, pdwDataLen=0x24ded90) returned 1 [0140.793] CryptDestroyKey (hKey=0x523018) returned 1 [0140.793] GetProcessHeap () returned 0x4e0000 [0140.793] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5276c8 [0140.793] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0140.793] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5276c8, pdwDataLen=0x24ded90 | out: pbData=0x5276c8, pdwDataLen=0x24ded90) returned 1 [0140.793] CryptDestroyKey (hKey=0x523018) returned 1 [0140.793] wsprintfW (in: param_1=0x24ddd6c, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\readme-warning.txt") returned 114 [0140.793] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0140.794] WriteFile (in: hFile=0x104, lpBuffer=0x5276c8*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddd68, lpOverlapped=0x0 | out: lpBuffer=0x5276c8*, lpNumberOfBytesWritten=0x24ddd68*=0x6c3, lpOverlapped=0x0) returned 1 [0140.795] CloseHandle (hObject=0x104) returned 1 [0140.795] GetProcessHeap () returned 0x4e0000 [0140.795] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5276c8 | out: hHeap=0x4e0000) returned 1 [0140.795] GetProcessHeap () returned 0x4e0000 [0140.795] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0140.795] GetProcessHeap () returned 0x4e0000 [0140.795] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0140.795] FindClose (in: hFindFile=0x522fd8 | out: hFindFile=0x522fd8) returned 1 [0140.795] GetProcessHeap () returned 0x4e0000 [0140.795] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273e8 | out: hHeap=0x4e0000) returned 1 [0140.795] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cba0700, ftCreationTime.dwHighDateTime=0x1cb7664, ftLastAccessTime.dwLowDateTime=0xd78c2600, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8cba0700, ftLastWriteTime.dwHighDateTime=0x1cb7664, nFileSizeHigh=0x0, nFileSizeLow=0x150378, dwReserved0=0x24df164, dwReserved1=0x77c7389e, cFileName="Setup.exe", cAlternateFileName="")) returned 1 [0140.795] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24df164, dwReserved1=0x77c7389e, cFileName="Visio.en-us", cAlternateFileName="VISIO~1.EN-")) returned 1 [0140.795] GetProcessHeap () returned 0x4e0000 [0140.795] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xc8) returned 0x4fa058 [0140.795] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\*.*", lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24deed4, dwReserved1=0x77c7389e, cFileName=".", cAlternateFileName="")) returned 0x522fd8 [0140.797] GetProcessHeap () returned 0x4e0000 [0140.797] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0140.797] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24deed4, dwReserved1=0x77c7389e, cFileName="..", cAlternateFileName="")) returned 1 [0140.797] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43bdc500, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861, dwReserved0=0x24deed4, dwReserved1=0x77c7389e, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0140.797] GetProcessHeap () returned 0x4e0000 [0140.797] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2ca) returned 0x5273e8 [0140.798] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0140.798] GetProcessHeap () returned 0x4e0000 [0140.798] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0140.798] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0140.798] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded50 | out: lpNewFilePointer=0x0) returned 1 [0140.799] WriteFile (in: hFile=0x104, lpBuffer=0x24ded60*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded60*, lpNumberOfBytesWritten=0x24ded38*=0xf, lpOverlapped=0x0) returned 1 [0140.803] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.803] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.803] GetProcessHeap () returned 0x4e0000 [0140.803] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0140.803] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24ded18*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24ded18*=0x30) returned 1 [0140.803] CryptDestroyKey (hKey=0x523018) returned 1 [0140.803] WriteFile (in: hFile=0x104, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24ded38*=0x30, lpOverlapped=0x0) returned 1 [0140.803] WriteFile (in: hFile=0x104, lpBuffer=0x24ded40*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded40*, lpNumberOfBytesWritten=0x24ded38*=0x4, lpOverlapped=0x0) returned 1 [0140.803] WriteFile (in: hFile=0x104, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24ded38*=0x10, lpOverlapped=0x0) returned 1 [0140.804] WriteFile (in: hFile=0x104, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24ded38*=0x80, lpOverlapped=0x0) returned 1 [0140.804] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded48 | out: lpNewFilePointer=0x0) returned 1 [0140.804] WriteFile (in: hFile=0x104, lpBuffer=0x24ded58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded58*, lpNumberOfBytesWritten=0x24ded38*=0x8, lpOverlapped=0x0) returned 1 [0140.804] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.804] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.804] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.804] ReadFile (in: hFile=0x104, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1861, lpNumberOfBytesRead=0x24decf0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24decf0*=0x1861, lpOverlapped=0x0) returned 1 [0140.805] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x1870, dwBufLen=0x1870 | out: pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x1870) returned 1 [0140.805] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.805] WriteFile (in: hFile=0x104, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x24decf4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24decf4*=0x1870, lpOverlapped=0x0) returned 1 [0140.805] CryptDestroyKey (hKey=0x523018) returned 1 [0140.805] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x1934, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.805] SetEndOfFile (hFile=0x104) returned 1 [0140.808] GetProcessHeap () returned 0x4e0000 [0140.808] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0140.808] GetProcessHeap () returned 0x4e0000 [0140.808] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0140.809] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0140.809] CloseHandle (hObject=0x104) returned 1 [0140.809] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4359ac00, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50b66320, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x24deed4, dwReserved1=0x77c7389e, cFileName="VisioMUI.XML", cAlternateFileName="")) returned 1 [0140.809] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0140.810] GetProcessHeap () returned 0x4e0000 [0140.810] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0140.810] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0140.810] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded50 | out: lpNewFilePointer=0x0) returned 1 [0140.810] WriteFile (in: hFile=0x104, lpBuffer=0x24ded60*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded60*, lpNumberOfBytesWritten=0x24ded38*=0x1, lpOverlapped=0x0) returned 1 [0140.812] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.812] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.812] GetProcessHeap () returned 0x4e0000 [0140.812] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0140.812] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24ded18*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24ded18*=0x40) returned 1 [0140.812] CryptDestroyKey (hKey=0x523018) returned 1 [0140.812] WriteFile (in: hFile=0x104, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24ded38*=0x40, lpOverlapped=0x0) returned 1 [0140.812] WriteFile (in: hFile=0x104, lpBuffer=0x24ded40*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded40*, lpNumberOfBytesWritten=0x24ded38*=0x4, lpOverlapped=0x0) returned 1 [0140.812] WriteFile (in: hFile=0x104, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24ded38*=0x10, lpOverlapped=0x0) returned 1 [0140.813] WriteFile (in: hFile=0x104, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24ded38*=0x80, lpOverlapped=0x0) returned 1 [0140.813] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded48 | out: lpNewFilePointer=0x0) returned 1 [0140.813] WriteFile (in: hFile=0x104, lpBuffer=0x24ded58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded58*, lpNumberOfBytesWritten=0x24ded38*=0x8, lpOverlapped=0x0) returned 1 [0140.813] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.813] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.813] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.813] ReadFile (in: hFile=0x104, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x251f, lpNumberOfBytesRead=0x24decf0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24decf0*=0x251f, lpOverlapped=0x0) returned 1 [0140.814] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x2520, dwBufLen=0x2520 | out: pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x2520) returned 1 [0140.814] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.814] WriteFile (in: hFile=0x104, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x24decf4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24decf4*=0x2520, lpOverlapped=0x0) returned 1 [0140.814] CryptDestroyKey (hKey=0x523018) returned 1 [0140.814] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x25f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.814] SetEndOfFile (hFile=0x104) returned 1 [0140.816] GetProcessHeap () returned 0x4e0000 [0140.816] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0140.816] GetProcessHeap () returned 0x4e0000 [0140.816] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0140.816] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0140.819] CloseHandle (hObject=0x104) returned 1 [0140.819] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4359ac00, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50b66320, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x24deed4, dwReserved1=0x77c7389e, cFileName="VisioMUI.XML", cAlternateFileName="")) returned 0 [0140.819] GetProcessHeap () returned 0x4e0000 [0140.819] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0140.819] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0140.819] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24ded90 | out: pbData=0x4f53d8, pdwDataLen=0x24ded90) returned 1 [0140.819] CryptDestroyKey (hKey=0x523018) returned 1 [0140.819] GetProcessHeap () returned 0x4e0000 [0140.819] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0140.819] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0140.819] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24ded90 | out: pbData=0x4f5420, pdwDataLen=0x24ded90) returned 1 [0140.819] CryptDestroyKey (hKey=0x523018) returned 1 [0140.819] GetProcessHeap () returned 0x4e0000 [0140.819] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5276c0 [0140.819] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0140.819] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5276c0, pdwDataLen=0x24ded90 | out: pbData=0x5276c0, pdwDataLen=0x24ded90) returned 1 [0140.819] CryptDestroyKey (hKey=0x523018) returned 1 [0140.819] wsprintfW (in: param_1=0x24ddd6c, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\readme-warning.txt") returned 110 [0140.819] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0140.820] WriteFile (in: hFile=0x104, lpBuffer=0x5276c0*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddd68, lpOverlapped=0x0 | out: lpBuffer=0x5276c0*, lpNumberOfBytesWritten=0x24ddd68*=0x6c3, lpOverlapped=0x0) returned 1 [0140.821] CloseHandle (hObject=0x104) returned 1 [0140.821] GetProcessHeap () returned 0x4e0000 [0140.821] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5276c0 | out: hHeap=0x4e0000) returned 1 [0140.821] GetProcessHeap () returned 0x4e0000 [0140.821] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0140.821] GetProcessHeap () returned 0x4e0000 [0140.821] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0140.821] FindClose (in: hFindFile=0x522fd8 | out: hFindFile=0x522fd8) returned 1 [0140.821] GetProcessHeap () returned 0x4e0000 [0140.821] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273e8 | out: hHeap=0x4e0000) returned 1 [0140.821] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24df164, dwReserved1=0x77c7389e, cFileName="VISIOR", cAlternateFileName="")) returned 1 [0140.821] GetProcessHeap () returned 0x4e0000 [0140.821] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xbe) returned 0x4fa058 [0140.821] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\*.*", lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24deed4, dwReserved1=0x77c7389e, cFileName=".", cAlternateFileName="")) returned 0x522fd8 [0140.822] GetProcessHeap () returned 0x4e0000 [0140.822] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0140.822] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24deed4, dwReserved1=0x77c7389e, cFileName="..", cAlternateFileName="")) returned 1 [0140.822] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a6d3200, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d3200, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x5061, dwReserved0=0x24deed4, dwReserved1=0x77c7389e, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0140.822] GetProcessHeap () returned 0x4e0000 [0140.822] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2c0) returned 0x5273e8 [0140.822] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0140.823] GetProcessHeap () returned 0x4e0000 [0140.823] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0140.823] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0140.823] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded50 | out: lpNewFilePointer=0x0) returned 1 [0140.823] WriteFile (in: hFile=0x104, lpBuffer=0x24ded60*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded60*, lpNumberOfBytesWritten=0x24ded38*=0xf, lpOverlapped=0x0) returned 1 [0140.833] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.833] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.833] GetProcessHeap () returned 0x4e0000 [0140.833] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0140.833] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24ded18*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24ded18*=0x30) returned 1 [0140.833] CryptDestroyKey (hKey=0x523018) returned 1 [0140.833] WriteFile (in: hFile=0x104, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24ded38*=0x30, lpOverlapped=0x0) returned 1 [0140.833] WriteFile (in: hFile=0x104, lpBuffer=0x24ded40*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded40*, lpNumberOfBytesWritten=0x24ded38*=0x4, lpOverlapped=0x0) returned 1 [0140.833] WriteFile (in: hFile=0x104, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24ded38*=0x10, lpOverlapped=0x0) returned 1 [0140.833] WriteFile (in: hFile=0x104, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24ded38*=0x80, lpOverlapped=0x0) returned 1 [0140.833] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded48 | out: lpNewFilePointer=0x0) returned 1 [0140.834] WriteFile (in: hFile=0x104, lpBuffer=0x24ded58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded58*, lpNumberOfBytesWritten=0x24ded38*=0x8, lpOverlapped=0x0) returned 1 [0140.834] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.834] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.834] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.834] ReadFile (in: hFile=0x104, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5061, lpNumberOfBytesRead=0x24decf0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24decf0*=0x5061, lpOverlapped=0x0) returned 1 [0140.835] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x5070, dwBufLen=0x5070 | out: pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x5070) returned 1 [0140.835] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.835] WriteFile (in: hFile=0x104, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x24decf4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24decf4*=0x5070, lpOverlapped=0x0) returned 1 [0140.835] CryptDestroyKey (hKey=0x523018) returned 1 [0140.835] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x5134, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.835] SetEndOfFile (hFile=0x104) returned 1 [0140.838] GetProcessHeap () returned 0x4e0000 [0140.838] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0140.838] GetProcessHeap () returned 0x4e0000 [0140.838] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0140.838] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0140.838] CloseHandle (hObject=0x104) returned 1 [0140.839] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x468a2b70, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x83258520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x24deed4, dwReserved1=0x77c7389e, cFileName="VisiorWW.XML", cAlternateFileName="")) returned 1 [0140.839] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0140.839] GetProcessHeap () returned 0x4e0000 [0140.839] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0140.839] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0140.839] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded50 | out: lpNewFilePointer=0x0) returned 1 [0140.839] WriteFile (in: hFile=0x104, lpBuffer=0x24ded60*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded60*, lpNumberOfBytesWritten=0x24ded38*=0xd, lpOverlapped=0x0) returned 1 [0140.841] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.841] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.841] GetProcessHeap () returned 0x4e0000 [0140.841] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0140.841] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24ded18*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24ded18*=0x40) returned 1 [0140.841] CryptDestroyKey (hKey=0x523018) returned 1 [0140.841] WriteFile (in: hFile=0x104, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24ded38*=0x40, lpOverlapped=0x0) returned 1 [0140.841] WriteFile (in: hFile=0x104, lpBuffer=0x24ded40*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded40*, lpNumberOfBytesWritten=0x24ded38*=0x4, lpOverlapped=0x0) returned 1 [0140.841] WriteFile (in: hFile=0x104, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24ded38*=0x10, lpOverlapped=0x0) returned 1 [0140.841] WriteFile (in: hFile=0x104, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24ded38*=0x80, lpOverlapped=0x0) returned 1 [0140.841] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded48 | out: lpNewFilePointer=0x0) returned 1 [0140.841] WriteFile (in: hFile=0x104, lpBuffer=0x24ded58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded58*, lpNumberOfBytesWritten=0x24ded38*=0x8, lpOverlapped=0x0) returned 1 [0140.841] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.842] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.842] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.842] ReadFile (in: hFile=0x104, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2213, lpNumberOfBytesRead=0x24decf0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24decf0*=0x2213, lpOverlapped=0x0) returned 1 [0140.845] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x2220, dwBufLen=0x2220 | out: pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x2220) returned 1 [0140.845] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.846] WriteFile (in: hFile=0x104, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x24decf4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24decf4*=0x2220, lpOverlapped=0x0) returned 1 [0140.846] CryptDestroyKey (hKey=0x523018) returned 1 [0140.846] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x22f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.846] SetEndOfFile (hFile=0x104) returned 1 [0140.849] GetProcessHeap () returned 0x4e0000 [0140.849] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0140.849] GetProcessHeap () returned 0x4e0000 [0140.849] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0140.849] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0140.850] CloseHandle (hObject=0x104) returned 1 [0140.850] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x468a2b70, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x83258520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x24deed4, dwReserved1=0x77c7389e, cFileName="VisiorWW.XML", cAlternateFileName="")) returned 0 [0140.850] GetProcessHeap () returned 0x4e0000 [0140.850] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0140.850] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0140.850] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24ded90 | out: pbData=0x4f53d8, pdwDataLen=0x24ded90) returned 1 [0140.850] CryptDestroyKey (hKey=0x523018) returned 1 [0140.850] GetProcessHeap () returned 0x4e0000 [0140.850] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0140.850] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0140.850] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24ded90 | out: pbData=0x4f5420, pdwDataLen=0x24ded90) returned 1 [0140.850] CryptDestroyKey (hKey=0x523018) returned 1 [0140.850] GetProcessHeap () returned 0x4e0000 [0140.850] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5276b0 [0140.851] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0140.851] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5276b0, pdwDataLen=0x24ded90 | out: pbData=0x5276b0, pdwDataLen=0x24ded90) returned 1 [0140.851] CryptDestroyKey (hKey=0x523018) returned 1 [0140.851] wsprintfW (in: param_1=0x24ddd6c, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\readme-warning.txt") returned 105 [0140.851] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0140.853] WriteFile (in: hFile=0x104, lpBuffer=0x5276b0*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddd68, lpOverlapped=0x0 | out: lpBuffer=0x5276b0*, lpNumberOfBytesWritten=0x24ddd68*=0x6c3, lpOverlapped=0x0) returned 1 [0140.855] CloseHandle (hObject=0x104) returned 1 [0140.855] GetProcessHeap () returned 0x4e0000 [0140.855] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5276b0 | out: hHeap=0x4e0000) returned 1 [0140.855] GetProcessHeap () returned 0x4e0000 [0140.855] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0140.855] GetProcessHeap () returned 0x4e0000 [0140.855] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0140.855] FindClose (in: hFindFile=0x522fd8 | out: hFindFile=0x522fd8) returned 1 [0140.855] GetProcessHeap () returned 0x4e0000 [0140.855] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273e8 | out: hHeap=0x4e0000) returned 1 [0140.855] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24df164, dwReserved1=0x77c7389e, cFileName="Word.en-us", cAlternateFileName="WORD~1.EN-")) returned 1 [0140.855] GetProcessHeap () returned 0x4e0000 [0140.855] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xc6) returned 0x4fa058 [0140.855] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\*.*", lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24deed4, dwReserved1=0x77c7389e, cFileName=".", cAlternateFileName="")) returned 0x522fd8 [0140.856] GetProcessHeap () returned 0x4e0000 [0140.856] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0140.856] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24deed4, dwReserved1=0x77c7389e, cFileName="..", cAlternateFileName="")) returned 1 [0140.857] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe076d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978, dwReserved0=0x24deed4, dwReserved1=0x77c7389e, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0140.857] GetProcessHeap () returned 0x4e0000 [0140.857] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2c8) returned 0x5273e8 [0140.857] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0140.858] GetProcessHeap () returned 0x4e0000 [0140.858] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0140.858] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0140.858] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded50 | out: lpNewFilePointer=0x0) returned 1 [0140.858] WriteFile (in: hFile=0x104, lpBuffer=0x24ded60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded60*, lpNumberOfBytesWritten=0x24ded38*=0x8, lpOverlapped=0x0) returned 1 [0140.860] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.860] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.860] GetProcessHeap () returned 0x4e0000 [0140.860] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0140.861] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24ded18*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24ded18*=0x30) returned 1 [0140.861] CryptDestroyKey (hKey=0x523018) returned 1 [0140.861] WriteFile (in: hFile=0x104, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24ded38*=0x30, lpOverlapped=0x0) returned 1 [0140.861] WriteFile (in: hFile=0x104, lpBuffer=0x24ded40*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded40*, lpNumberOfBytesWritten=0x24ded38*=0x4, lpOverlapped=0x0) returned 1 [0140.861] WriteFile (in: hFile=0x104, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24ded38*=0x10, lpOverlapped=0x0) returned 1 [0140.861] WriteFile (in: hFile=0x104, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24ded38*=0x80, lpOverlapped=0x0) returned 1 [0140.861] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded48 | out: lpNewFilePointer=0x0) returned 1 [0140.861] WriteFile (in: hFile=0x104, lpBuffer=0x24ded58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded58*, lpNumberOfBytesWritten=0x24ded38*=0x8, lpOverlapped=0x0) returned 1 [0140.861] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.861] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.861] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.861] ReadFile (in: hFile=0x104, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x978, lpNumberOfBytesRead=0x24decf0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24decf0*=0x978, lpOverlapped=0x0) returned 1 [0140.862] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x980, dwBufLen=0x980 | out: pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x980) returned 1 [0140.862] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.862] WriteFile (in: hFile=0x104, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x24decf4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24decf4*=0x980, lpOverlapped=0x0) returned 1 [0140.862] CryptDestroyKey (hKey=0x523018) returned 1 [0140.862] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xa44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.862] SetEndOfFile (hFile=0x104) returned 1 [0140.865] GetProcessHeap () returned 0x4e0000 [0140.865] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0140.865] GetProcessHeap () returned 0x4e0000 [0140.865] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0140.865] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0140.866] CloseHandle (hObject=0x104) returned 1 [0140.866] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x24deed4, dwReserved1=0x77c7389e, cFileName="WordMUI.XML", cAlternateFileName="")) returned 1 [0140.866] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0140.867] GetProcessHeap () returned 0x4e0000 [0140.867] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0140.867] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0140.867] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded50 | out: lpNewFilePointer=0x0) returned 1 [0140.867] WriteFile (in: hFile=0x104, lpBuffer=0x24ded60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded60*, lpNumberOfBytesWritten=0x24ded38*=0x8, lpOverlapped=0x0) returned 1 [0140.873] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.873] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.873] GetProcessHeap () returned 0x4e0000 [0140.873] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0140.873] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24ded18*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24ded18*=0x40) returned 1 [0140.873] CryptDestroyKey (hKey=0x523018) returned 1 [0140.873] WriteFile (in: hFile=0x104, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24ded38*=0x40, lpOverlapped=0x0) returned 1 [0140.873] WriteFile (in: hFile=0x104, lpBuffer=0x24ded40*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded40*, lpNumberOfBytesWritten=0x24ded38*=0x4, lpOverlapped=0x0) returned 1 [0140.873] WriteFile (in: hFile=0x104, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24ded38*=0x10, lpOverlapped=0x0) returned 1 [0140.874] WriteFile (in: hFile=0x104, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24ded38*=0x80, lpOverlapped=0x0) returned 1 [0140.874] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded48 | out: lpNewFilePointer=0x0) returned 1 [0140.874] WriteFile (in: hFile=0x104, lpBuffer=0x24ded58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded58*, lpNumberOfBytesWritten=0x24ded38*=0x8, lpOverlapped=0x0) returned 1 [0140.874] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0140.874] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.874] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.874] ReadFile (in: hFile=0x104, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x708, lpNumberOfBytesRead=0x24decf0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24decf0*=0x708, lpOverlapped=0x0) returned 1 [0140.874] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x710, dwBufLen=0x710 | out: pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x710) returned 1 [0140.874] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.874] WriteFile (in: hFile=0x104, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x24decf4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24decf4*=0x710, lpOverlapped=0x0) returned 1 [0140.874] CryptDestroyKey (hKey=0x523018) returned 1 [0140.874] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x7e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.875] SetEndOfFile (hFile=0x104) returned 1 [0140.878] GetProcessHeap () returned 0x4e0000 [0140.878] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0140.878] GetProcessHeap () returned 0x4e0000 [0140.878] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0140.878] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0140.881] CloseHandle (hObject=0x104) returned 1 [0140.881] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x24deed4, dwReserved1=0x77c7389e, cFileName="WordMUI.XML", cAlternateFileName="")) returned 0 [0140.881] GetProcessHeap () returned 0x4e0000 [0140.881] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0140.881] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0140.881] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24ded90 | out: pbData=0x4f53d8, pdwDataLen=0x24ded90) returned 1 [0140.882] CryptDestroyKey (hKey=0x523018) returned 1 [0140.882] GetProcessHeap () returned 0x4e0000 [0140.882] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0140.882] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0140.882] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24ded90 | out: pbData=0x4f5420, pdwDataLen=0x24ded90) returned 1 [0140.882] CryptDestroyKey (hKey=0x523018) returned 1 [0140.882] GetProcessHeap () returned 0x4e0000 [0140.882] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5276b8 [0140.882] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0140.882] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5276b8, pdwDataLen=0x24ded90 | out: pbData=0x5276b8, pdwDataLen=0x24ded90) returned 1 [0140.882] CryptDestroyKey (hKey=0x523018) returned 1 [0140.882] wsprintfW (in: param_1=0x24ddd6c, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\readme-warning.txt") returned 109 [0140.882] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0140.883] WriteFile (in: hFile=0x104, lpBuffer=0x5276b8*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddd68, lpOverlapped=0x0 | out: lpBuffer=0x5276b8*, lpNumberOfBytesWritten=0x24ddd68*=0x6c3, lpOverlapped=0x0) returned 1 [0140.884] CloseHandle (hObject=0x104) returned 1 [0140.884] GetProcessHeap () returned 0x4e0000 [0140.884] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5276b8 | out: hHeap=0x4e0000) returned 1 [0140.884] GetProcessHeap () returned 0x4e0000 [0140.884] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0140.884] GetProcessHeap () returned 0x4e0000 [0140.885] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0140.885] FindClose (in: hFindFile=0x522fd8 | out: hFindFile=0x522fd8) returned 1 [0140.885] GetProcessHeap () returned 0x4e0000 [0140.885] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273e8 | out: hHeap=0x4e0000) returned 1 [0140.885] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24df164, dwReserved1=0x77c7389e, cFileName="Word.en-us", cAlternateFileName="WORD~1.EN-")) returned 0 [0140.885] GetProcessHeap () returned 0x4e0000 [0140.885] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0140.885] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0140.885] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df020 | out: pbData=0x4f53d8, pdwDataLen=0x24df020) returned 1 [0140.885] CryptDestroyKey (hKey=0x522fd8) returned 1 [0140.885] GetProcessHeap () returned 0x4e0000 [0140.885] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0140.885] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0140.885] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df020 | out: pbData=0x4f5420, pdwDataLen=0x24df020) returned 1 [0140.885] CryptDestroyKey (hKey=0x522fd8) returned 1 [0140.885] GetProcessHeap () returned 0x4e0000 [0140.885] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5273e8 [0140.885] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0140.885] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5273e8, pdwDataLen=0x24df020 | out: pbData=0x5273e8, pdwDataLen=0x24df020) returned 1 [0140.886] CryptDestroyKey (hKey=0x522fd8) returned 1 [0140.886] wsprintfW (in: param_1=0x24ddffc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\readme-warning.txt") returned 98 [0140.886] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0140.886] WriteFile (in: hFile=0x100, lpBuffer=0x5273e8*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddff8, lpOverlapped=0x0 | out: lpBuffer=0x5273e8*, lpNumberOfBytesWritten=0x24ddff8*=0x6c3, lpOverlapped=0x0) returned 1 [0140.887] CloseHandle (hObject=0x100) returned 1 [0140.887] GetProcessHeap () returned 0x4e0000 [0140.888] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273e8 | out: hHeap=0x4e0000) returned 1 [0140.888] GetProcessHeap () returned 0x4e0000 [0140.888] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0140.888] GetProcessHeap () returned 0x4e0000 [0140.888] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0140.888] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0140.888] GetProcessHeap () returned 0x4e0000 [0140.888] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527128 | out: hHeap=0x4e0000) returned 1 [0140.888] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6bc953f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x2560, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OFFREL.DLL", cAlternateFileName="")) returned 1 [0140.888] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6c2166d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x4d88, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OPHPROXY.DLL", cAlternateFileName="")) returned 1 [0140.888] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6a43200, ftCreationTime.dwHighDateTime=0x1cb700e, ftLastAccessTime.dwLowDateTime=0xcf47ffa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf6a43200, ftLastWriteTime.dwHighDateTime=0x1cb700e, nFileSizeHigh=0x0, nFileSizeLow=0x47a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OPTINPS.DLL", cAlternateFileName="")) returned 1 [0140.888] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1570ec00, ftCreationTime.dwHighDateTime=0x1cbc479, ftLastAccessTime.dwLowDateTime=0xe5d21520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1570ec00, ftLastWriteTime.dwHighDateTime=0x1cbc479, nFileSizeHigh=0x0, nFileSizeLow=0xb7ba8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PJ11OD11.DLL", cAlternateFileName="")) returned 1 [0140.888] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a461000, ftCreationTime.dwHighDateTime=0x1cb7018, ftLastAccessTime.dwLowDateTime=0xe5d47680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9a461000, ftLastWriteTime.dwHighDateTime=0x1cb7018, nFileSizeHigh=0x0, nFileSizeLow=0x3fb90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PJRESC.DLL", cAlternateFileName="")) returned 1 [0140.888] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74bd800, ftCreationTime.dwHighDateTime=0x1cb71c8, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x74bd800, ftLastWriteTime.dwHighDateTime=0x1cb71c8, nFileSizeHigh=0x0, nFileSizeLow=0x3c2b90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PRJRES.DLL", cAlternateFileName="")) returned 1 [0140.888] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a199a00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xdac16060, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a199a00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x1c8b68, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RICHED20.DLL", cAlternateFileName="")) returned 1 [0140.888] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7339ac00, ftCreationTime.dwHighDateTime=0x1cbdfc2, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7339ac00, ftLastWriteTime.dwHighDateTime=0x1cbdfc2, nFileSizeHigh=0x0, nFileSizeLow=0x90778, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SERCONV.DLL", cAlternateFileName="")) returned 1 [0140.888] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xded68100, ftCreationTime.dwHighDateTime=0x1cb5970, ftLastAccessTime.dwLowDateTime=0xd68d72e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xded68100, ftLastWriteTime.dwHighDateTime=0x1cb5970, nFileSizeHigh=0x0, nFileSizeLow=0xc6b00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="USP10.DLL", cAlternateFileName="")) returned 1 [0140.888] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x520efa00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xd83064e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x520efa00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0xc150, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VBAJET32.DLL", cAlternateFileName="")) returned 1 [0140.888] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14a84d00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0x5e5e73d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14a84d00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0x23f90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WISC30.DLL", cAlternateFileName="")) returned 1 [0140.888] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14a84d00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0x5e5e73d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14a84d00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0x23f90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WISC30.DLL", cAlternateFileName="")) returned 0 [0140.888] GetProcessHeap () returned 0x4e0000 [0140.889] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0140.889] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df248, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f98) returned 1 [0140.889] CryptDecrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df2b0 | out: pbData=0x4f53d8, pdwDataLen=0x24df2b0) returned 1 [0140.889] CryptDestroyKey (hKey=0x522f98) returned 1 [0140.889] GetProcessHeap () returned 0x4e0000 [0140.889] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0140.889] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df248, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f98) returned 1 [0140.889] CryptDecrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df2b0 | out: pbData=0x4f5420, pdwDataLen=0x24df2b0) returned 1 [0140.889] CryptDestroyKey (hKey=0x522f98) returned 1 [0140.889] GetProcessHeap () returned 0x4e0000 [0140.889] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x53d070 [0140.889] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df248, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f98) returned 1 [0140.889] CryptDecrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x53d070, pdwDataLen=0x24df2b0 | out: pbData=0x53d070, pdwDataLen=0x24df2b0) returned 1 [0140.889] CryptDestroyKey (hKey=0x522f98) returned 1 [0140.889] wsprintfW (in: param_1=0x24de28c, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\readme-warning.txt") returned 74 [0140.889] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0140.890] WriteFile (in: hFile=0xdc, lpBuffer=0x53d070*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24de288, lpOverlapped=0x0 | out: lpBuffer=0x53d070*, lpNumberOfBytesWritten=0x24de288*=0x6c3, lpOverlapped=0x0) returned 1 [0140.891] CloseHandle (hObject=0xdc) returned 1 [0140.892] GetProcessHeap () returned 0x4e0000 [0140.892] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x53d070 | out: hHeap=0x4e0000) returned 1 [0140.892] GetProcessHeap () returned 0x4e0000 [0140.892] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0140.892] GetProcessHeap () returned 0x4e0000 [0140.892] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0140.892] FindClose (in: hFindFile=0x522f58 | out: hFindFile=0x522f58) returned 1 [0140.892] GetProcessHeap () returned 0x4e0000 [0140.892] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x525e90 | out: hHeap=0x4e0000) returned 1 [0140.892] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1 [0140.892] GetProcessHeap () returned 0x4e0000 [0140.892] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xb0) returned 0x4fa058 [0140.892] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\*.*", lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f58 [0140.893] GetProcessHeap () returned 0x4e0000 [0140.894] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0140.894] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0140.894] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x24500, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OSPPC.DLL", cAlternateFileName="")) returned 1 [0140.894] GetProcessHeap () returned 0x4e0000 [0140.894] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2b2) returned 0x53d070 [0140.894] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59922e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x1be700, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OSPPCEXT.DLL", cAlternateFileName="")) returned 1 [0140.894] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x2d7e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="osppobjs-spp-plugin-manifest-signed.xrm-ms", cAlternateFileName="OSPPOB~1.XRM")) returned 1 [0140.894] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0140.894] GetProcessHeap () returned 0x4e0000 [0140.894] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0140.894] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0140.895] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0140.895] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0140.897] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0140.897] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.897] GetProcessHeap () returned 0x4e0000 [0140.897] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x70) returned 0x4fa058 [0140.897] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fa058*, pdwDataLen=0x24df238*=0x70, dwBufLen=0x70 | out: pbData=0x4fa058*, pdwDataLen=0x24df238*=0x70) returned 1 [0140.897] CryptDestroyKey (hKey=0x522f98) returned 1 [0140.897] WriteFile (in: hFile=0xdc, lpBuffer=0x4fa058*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fa058*, lpNumberOfBytesWritten=0x24df258*=0x70, lpOverlapped=0x0) returned 1 [0140.897] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0140.897] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0140.897] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0140.898] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0140.898] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0140.898] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0140.898] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.898] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.898] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2d7e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2d7e, lpOverlapped=0x0) returned 1 [0140.900] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2d80, dwBufLen=0x2d80 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2d80) returned 1 [0140.900] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.900] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2d80, lpOverlapped=0x0) returned 1 [0140.900] CryptDestroyKey (hKey=0x522f98) returned 1 [0140.900] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2e84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.900] SetEndOfFile (hFile=0xdc) returned 1 [0140.903] GetProcessHeap () returned 0x4e0000 [0140.903] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0140.903] GetProcessHeap () returned 0x4e0000 [0140.903] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0140.903] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0140.904] CloseHandle (hObject=0xdc) returned 1 [0140.904] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59948fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x212b00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OSPPOBJS.DLL", cAlternateFileName="")) returned 1 [0140.905] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf332800, ftCreationTime.dwHighDateTime=0x1cabc8a, ftLastAccessTime.dwLowDateTime=0x59948fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf332800, ftLastWriteTime.dwHighDateTime=0x1cabc8a, nFileSizeHigh=0x0, nFileSizeLow=0x3d60, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OSPPREARM.EXE", cAlternateFileName="OSPPRE~1.EXE")) returned 1 [0140.905] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59995270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x4b2700, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OSPPSVC.EXE", cAlternateFileName="")) returned 1 [0140.905] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59995270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x23b10, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OSPPWMI.DLL", cAlternateFileName="")) returned 1 [0140.905] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0xba5e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OSPPWMI.MOF", cAlternateFileName="")) returned 1 [0140.905] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0140.905] GetProcessHeap () returned 0x4e0000 [0140.905] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0140.905] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0140.905] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0140.905] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0140.910] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0140.910] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.911] GetProcessHeap () returned 0x4e0000 [0140.911] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0140.911] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0140.911] CryptDestroyKey (hKey=0x522f98) returned 1 [0140.911] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0140.911] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0140.911] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0140.911] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0140.911] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0140.911] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0140.911] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0140.911] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.911] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.912] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xba5e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xba5e, lpOverlapped=0x0) returned 1 [0140.913] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xba60, dwBufLen=0xba60 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xba60) returned 1 [0140.914] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.914] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xba60, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xba60, lpOverlapped=0x0) returned 1 [0140.914] CryptDestroyKey (hKey=0x522f98) returned 1 [0140.914] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xbb34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.914] SetEndOfFile (hFile=0xdc) returned 1 [0140.917] GetProcessHeap () returned 0x4e0000 [0140.917] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0140.917] GetProcessHeap () returned 0x4e0000 [0140.917] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0140.917] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0140.918] CloseHandle (hObject=0xdc) returned 1 [0140.918] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0xba5e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OSPPWMI.MOF", cAlternateFileName="")) returned 0 [0140.918] GetProcessHeap () returned 0x4e0000 [0140.918] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0140.918] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df248, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f98) returned 1 [0140.918] CryptDecrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df2b0 | out: pbData=0x4f53d8, pdwDataLen=0x24df2b0) returned 1 [0140.918] CryptDestroyKey (hKey=0x522f98) returned 1 [0140.918] GetProcessHeap () returned 0x4e0000 [0140.918] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0140.918] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df248, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f98) returned 1 [0140.918] CryptDecrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df2b0 | out: pbData=0x4f5420, pdwDataLen=0x24df2b0) returned 1 [0140.918] CryptDestroyKey (hKey=0x522f98) returned 1 [0140.918] GetProcessHeap () returned 0x4e0000 [0140.918] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x53d330 [0140.918] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df248, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f98) returned 1 [0140.919] CryptDecrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x53d330, pdwDataLen=0x24df2b0 | out: pbData=0x53d330, pdwDataLen=0x24df2b0) returned 1 [0140.919] CryptDestroyKey (hKey=0x522f98) returned 1 [0140.919] wsprintfW (in: param_1=0x24de28c, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\readme-warning.txt") returned 98 [0140.919] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0140.919] WriteFile (in: hFile=0xdc, lpBuffer=0x53d330*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24de288, lpOverlapped=0x0 | out: lpBuffer=0x53d330*, lpNumberOfBytesWritten=0x24de288*=0x6c3, lpOverlapped=0x0) returned 1 [0140.920] CloseHandle (hObject=0xdc) returned 1 [0140.920] GetProcessHeap () returned 0x4e0000 [0140.920] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x53d330 | out: hHeap=0x4e0000) returned 1 [0140.920] GetProcessHeap () returned 0x4e0000 [0140.920] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0140.920] GetProcessHeap () returned 0x4e0000 [0140.920] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0140.920] FindClose (in: hFindFile=0x522f58 | out: hFindFile=0x522f58) returned 1 [0140.920] GetProcessHeap () returned 0x4e0000 [0140.921] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x53d070 | out: hHeap=0x4e0000) returned 1 [0140.921] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PROOF", cAlternateFileName="")) returned 1 [0140.921] GetProcessHeap () returned 0x4e0000 [0140.921] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x7a) returned 0x4fa058 [0140.921] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\*.*", lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f58 [0140.922] GetProcessHeap () returned 0x4e0000 [0140.922] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0140.922] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0140.922] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa07d0e00, ftCreationTime.dwHighDateTime=0x1ca2cea, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa07d0e00, ftLastWriteTime.dwHighDateTime=0x1ca2cea, nFileSizeHigh=0x0, nFileSizeLow=0x90540, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSLID.DLL", cAlternateFileName="")) returned 1 [0140.922] GetProcessHeap () returned 0x4e0000 [0140.922] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x27c) returned 0x53d070 [0140.922] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x782b2c00, ftCreationTime.dwHighDateTime=0x1bada3f, ftLastAccessTime.dwLowDateTime=0x98a53b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x782b2c00, ftLastWriteTime.dwHighDateTime=0x1bada3f, nFileSizeHigh=0x0, nFileSizeLow=0x6c67b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSWDS_EN.LEX", cAlternateFileName="")) returned 1 [0140.922] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0140.923] GetProcessHeap () returned 0x4e0000 [0140.923] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0140.923] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0140.923] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0140.923] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x5, lpOverlapped=0x0) returned 1 [0140.924] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0140.925] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.925] GetProcessHeap () returned 0x4e0000 [0140.925] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0140.925] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0140.925] CryptDestroyKey (hKey=0x522f98) returned 1 [0140.925] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0140.925] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0140.925] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0140.925] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0140.925] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0140.925] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0140.925] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0140.925] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.925] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.925] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x6c67b, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x6c67b, lpOverlapped=0x0) returned 1 [0140.931] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6c680, dwBufLen=0x6c680 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6c680) returned 1 [0140.935] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.935] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6c680, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x6c680, lpOverlapped=0x0) returned 1 [0140.936] CryptDestroyKey (hKey=0x522f98) returned 1 [0140.936] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6c754, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.936] SetEndOfFile (hFile=0xdc) returned 1 [0140.939] GetProcessHeap () returned 0x4e0000 [0140.939] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0140.939] GetProcessHeap () returned 0x4e0000 [0140.939] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0140.940] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0140.940] CloseHandle (hObject=0xdc) returned 1 [0140.940] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e2ea00, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x5b0da70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe5e2ea00, ftLastWriteTime.dwHighDateTime=0x1bdf5d3, nFileSizeHigh=0x0, nFileSizeLow=0x60983, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSWDS_ES.LEX", cAlternateFileName="")) returned 1 [0140.940] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0140.941] GetProcessHeap () returned 0x4e0000 [0140.941] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0140.941] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0140.941] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0140.941] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xd, lpOverlapped=0x0) returned 1 [0140.943] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0140.943] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.943] GetProcessHeap () returned 0x4e0000 [0140.943] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0140.943] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0140.943] CryptDestroyKey (hKey=0x522f98) returned 1 [0140.943] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0140.943] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0140.943] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0140.943] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0140.943] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0140.943] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0140.943] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0140.943] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.943] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.943] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x60983, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x60983, lpOverlapped=0x0) returned 1 [0140.949] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x60990, dwBufLen=0x60990 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x60990) returned 1 [0140.952] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.952] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x60990, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x60990, lpOverlapped=0x0) returned 1 [0140.953] CryptDestroyKey (hKey=0x522f98) returned 1 [0140.953] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x60a64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.953] SetEndOfFile (hFile=0xdc) returned 1 [0140.956] GetProcessHeap () returned 0x4e0000 [0140.956] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0140.956] GetProcessHeap () returned 0x4e0000 [0140.956] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0140.956] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0140.959] CloseHandle (hObject=0xdc) returned 1 [0140.959] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf3c9300, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x78ced70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf3c9300, ftLastWriteTime.dwHighDateTime=0x1bdf5d3, nFileSizeHigh=0x0, nFileSizeLow=0x482ef, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSWDS_FR.LEX", cAlternateFileName="")) returned 1 [0140.959] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0140.960] GetProcessHeap () returned 0x4e0000 [0140.960] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0140.960] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0140.960] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0140.960] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x1, lpOverlapped=0x0) returned 1 [0140.962] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0140.962] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.962] GetProcessHeap () returned 0x4e0000 [0140.962] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0140.962] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0140.962] CryptDestroyKey (hKey=0x522f98) returned 1 [0140.962] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0140.962] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0140.963] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0140.963] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0140.963] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0140.963] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0140.963] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0140.963] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.963] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.963] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x482ef, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x482ef, lpOverlapped=0x0) returned 1 [0140.967] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x482f0, dwBufLen=0x482f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x482f0) returned 1 [0140.970] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.970] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x482f0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x482f0, lpOverlapped=0x0) returned 1 [0140.971] CryptDestroyKey (hKey=0x522f98) returned 1 [0140.971] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x483c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.971] SetEndOfFile (hFile=0xdc) returned 1 [0140.973] GetProcessHeap () returned 0x4e0000 [0140.973] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0140.973] GetProcessHeap () returned 0x4e0000 [0140.973] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0140.973] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0140.974] CloseHandle (hObject=0xdc) returned 1 [0140.974] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf3c9300, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x78ced70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf3c9300, ftLastWriteTime.dwHighDateTime=0x1bdf5d3, nFileSizeHigh=0x0, nFileSizeLow=0x482ef, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSWDS_FR.LEX", cAlternateFileName="")) returned 0 [0140.974] GetProcessHeap () returned 0x4e0000 [0140.974] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0140.974] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df248, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f98) returned 1 [0140.974] CryptDecrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df2b0 | out: pbData=0x4f53d8, pdwDataLen=0x24df2b0) returned 1 [0140.974] CryptDestroyKey (hKey=0x522f98) returned 1 [0140.974] GetProcessHeap () returned 0x4e0000 [0140.974] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0140.974] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df248, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f98) returned 1 [0140.974] CryptDecrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df2b0 | out: pbData=0x4f5420, pdwDataLen=0x24df2b0) returned 1 [0140.974] CryptDestroyKey (hKey=0x522f98) returned 1 [0140.975] GetProcessHeap () returned 0x4e0000 [0140.975] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x53d2f8 [0140.975] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df248, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f98) returned 1 [0140.975] CryptDecrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x53d2f8, pdwDataLen=0x24df2b0 | out: pbData=0x53d2f8, pdwDataLen=0x24df2b0) returned 1 [0140.975] CryptDestroyKey (hKey=0x522f98) returned 1 [0140.975] wsprintfW (in: param_1=0x24de28c, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\readme-warning.txt") returned 71 [0140.975] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0140.975] WriteFile (in: hFile=0xdc, lpBuffer=0x53d2f8*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24de288, lpOverlapped=0x0 | out: lpBuffer=0x53d2f8*, lpNumberOfBytesWritten=0x24de288*=0x6c3, lpOverlapped=0x0) returned 1 [0140.976] CloseHandle (hObject=0xdc) returned 1 [0140.976] GetProcessHeap () returned 0x4e0000 [0140.976] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x53d2f8 | out: hHeap=0x4e0000) returned 1 [0140.976] GetProcessHeap () returned 0x4e0000 [0140.976] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0140.976] GetProcessHeap () returned 0x4e0000 [0140.976] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0140.977] FindClose (in: hFindFile=0x522f58 | out: hFindFile=0x522f58) returned 1 [0140.977] GetProcessHeap () returned 0x4e0000 [0140.977] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x53d070 | out: hHeap=0x4e0000) returned 1 [0140.977] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Smart Tag", cAlternateFileName="SMARTT~1")) returned 1 [0140.977] GetProcessHeap () returned 0x4e0000 [0140.977] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x82) returned 0x4fa058 [0140.977] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*.*", lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f58 [0140.979] GetProcessHeap () returned 0x4e0000 [0140.979] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0140.979] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0140.979] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 1 [0140.979] GetProcessHeap () returned 0x4e0000 [0140.979] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x284) returned 0x53d070 [0140.979] GetProcessHeap () returned 0x4e0000 [0140.979] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8c) returned 0x4fa058 [0140.979] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0140.980] GetProcessHeap () returned 0x4e0000 [0140.980] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0140.980] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0140.980] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc52bb100, ftCreationTime.dwHighDateTime=0x1ca6185, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc52bb100, ftLastWriteTime.dwHighDateTime=0x1ca6185, nFileSizeHigh=0x0, nFileSizeLow=0x2cc7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MCABOUT.HTM", cAlternateFileName="")) returned 1 [0140.980] GetProcessHeap () returned 0x4e0000 [0140.980] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x28e) returned 0x53d300 [0140.981] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0140.981] GetProcessHeap () returned 0x4e0000 [0140.981] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0140.981] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0140.981] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0140.981] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x9, lpOverlapped=0x0) returned 1 [0140.983] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0140.983] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.983] GetProcessHeap () returned 0x4e0000 [0140.983] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0140.983] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0140.983] CryptDestroyKey (hKey=0x522fd8) returned 1 [0140.983] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0140.983] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0140.983] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0140.983] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0140.983] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0140.983] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0140.983] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0140.983] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.983] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.983] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2cc7, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x2cc7, lpOverlapped=0x0) returned 1 [0140.984] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x2cd0, dwBufLen=0x2cd0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x2cd0) returned 1 [0140.984] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.984] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2cd0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x2cd0, lpOverlapped=0x0) returned 1 [0140.985] CryptDestroyKey (hKey=0x522fd8) returned 1 [0140.985] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x2da4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.985] SetEndOfFile (hFile=0x100) returned 1 [0140.987] GetProcessHeap () returned 0x4e0000 [0140.987] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0140.987] GetProcessHeap () returned 0x4e0000 [0140.987] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0140.987] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0140.988] CloseHandle (hObject=0x100) returned 1 [0140.988] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x4380, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="STINTL.DLL", cAlternateFileName="")) returned 1 [0140.988] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc65b900, ftCreationTime.dwHighDateTime=0x1caac22, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xdc65b900, ftLastWriteTime.dwHighDateTime=0x1caac22, nFileSizeHigh=0x0, nFileSizeLow=0x3580, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="STINTL.DLL.IDX_DLL", cAlternateFileName="STINTL~1.IDX")) returned 1 [0140.988] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0140.989] GetProcessHeap () returned 0x4e0000 [0140.989] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0140.989] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0140.989] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0140.989] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0140.989] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.989] GetProcessHeap () returned 0x4e0000 [0140.989] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0140.989] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0140.989] CryptDestroyKey (hKey=0x522fd8) returned 1 [0140.989] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0140.991] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0140.991] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0140.991] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0140.991] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0140.991] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0140.991] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0140.991] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0140.991] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.991] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3580, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x3580, lpOverlapped=0x0) returned 1 [0140.992] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x3580, dwBufLen=0x3580 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x3580) returned 1 [0140.993] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.993] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3580, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x3580, lpOverlapped=0x0) returned 1 [0140.993] CryptDestroyKey (hKey=0x522fd8) returned 1 [0140.993] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x3654, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.993] SetEndOfFile (hFile=0x100) returned 1 [0140.995] GetProcessHeap () returned 0x4e0000 [0140.995] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0140.995] GetProcessHeap () returned 0x4e0000 [0140.995] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0140.995] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0140.998] CloseHandle (hObject=0x100) returned 1 [0140.998] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc65b900, ftCreationTime.dwHighDateTime=0x1caac22, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xdc65b900, ftLastWriteTime.dwHighDateTime=0x1caac22, nFileSizeHigh=0x0, nFileSizeLow=0x3580, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="STINTL.DLL.IDX_DLL", cAlternateFileName="STINTL~1.IDX")) returned 0 [0140.998] GetProcessHeap () returned 0x4e0000 [0140.998] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0140.998] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0140.998] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df020 | out: pbData=0x4f53d8, pdwDataLen=0x24df020) returned 1 [0140.998] CryptDestroyKey (hKey=0x522fd8) returned 1 [0140.998] GetProcessHeap () returned 0x4e0000 [0140.998] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0140.998] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0140.998] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df020 | out: pbData=0x4f5420, pdwDataLen=0x24df020) returned 1 [0140.998] CryptDestroyKey (hKey=0x522fd8) returned 1 [0140.998] GetProcessHeap () returned 0x4e0000 [0140.998] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x53d598 [0140.999] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0140.999] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x53d598, pdwDataLen=0x24df020 | out: pbData=0x53d598, pdwDataLen=0x24df020) returned 1 [0140.999] CryptDestroyKey (hKey=0x522fd8) returned 1 [0140.999] wsprintfW (in: param_1=0x24ddffc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\readme-warning.txt") returned 80 [0140.999] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0140.999] WriteFile (in: hFile=0x100, lpBuffer=0x53d598*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddff8, lpOverlapped=0x0 | out: lpBuffer=0x53d598*, lpNumberOfBytesWritten=0x24ddff8*=0x6c3, lpOverlapped=0x0) returned 1 [0141.000] CloseHandle (hObject=0x100) returned 1 [0141.001] GetProcessHeap () returned 0x4e0000 [0141.001] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x53d598 | out: hHeap=0x4e0000) returned 1 [0141.001] GetProcessHeap () returned 0x4e0000 [0141.001] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0141.001] GetProcessHeap () returned 0x4e0000 [0141.001] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0141.001] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0141.001] GetProcessHeap () returned 0x4e0000 [0141.001] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x53d300 | out: hHeap=0x4e0000) returned 1 [0141.001] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x1e380, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FBIBLIO.DLL", cAlternateFileName="")) returned 1 [0141.001] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x17f80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FDATE.DLL", cAlternateFileName="")) returned 1 [0141.001] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x35380, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FPERSON.DLL", cAlternateFileName="")) returned 1 [0141.001] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66f78700, ftCreationTime.dwHighDateTime=0x1cb7000, ftLastAccessTime.dwLowDateTime=0xc251c2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x66f78700, ftLastWriteTime.dwHighDateTime=0x1cb7000, nFileSizeHigh=0x0, nFileSizeLow=0x2c380, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FPLACE.DLL", cAlternateFileName="")) returned 1 [0141.001] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79275700, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x79275700, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x26d80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FSTOCK.DLL", cAlternateFileName="")) returned 1 [0141.001] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6a43200, ftCreationTime.dwHighDateTime=0x1cb700e, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf6a43200, ftLastWriteTime.dwHighDateTime=0x1cb700e, nFileSizeHigh=0x0, nFileSizeLow=0x39580, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IETAG.DLL", cAlternateFileName="")) returned 1 [0141.001] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x18b80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IMCONTACT.DLL", cAlternateFileName="IMCONT~1.DLL")) returned 1 [0141.001] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LISTS", cAlternateFileName="")) returned 1 [0141.001] GetProcessHeap () returned 0x4e0000 [0141.001] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8e) returned 0x524ea0 [0141.001] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0141.003] GetProcessHeap () returned 0x4e0000 [0141.003] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x524ea0 | out: hHeap=0x4e0000) returned 1 [0141.003] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0141.003] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 1 [0141.003] GetProcessHeap () returned 0x4e0000 [0141.003] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x290) returned 0x53d300 [0141.003] GetProcessHeap () returned 0x4e0000 [0141.003] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x98) returned 0x4fa058 [0141.003] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\*.*", lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522fd8 [0141.003] GetProcessHeap () returned 0x4e0000 [0141.003] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0141.003] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0141.004] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x310fad00, ftCreationTime.dwHighDateTime=0x1c2d758, ftLastAccessTime.dwLowDateTime=0xeed123f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x310fad00, ftLastWriteTime.dwHighDateTime=0x1c2d758, nFileSizeHigh=0x0, nFileSizeLow=0x22d6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DATES.XML", cAlternateFileName="")) returned 1 [0141.004] GetProcessHeap () returned 0x4e0000 [0141.004] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x29a) returned 0x53e5a0 [0141.004] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0141.004] GetProcessHeap () returned 0x4e0000 [0141.004] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0141.004] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0141.004] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded50 | out: lpNewFilePointer=0x0) returned 1 [0141.004] WriteFile (in: hFile=0x104, lpBuffer=0x24ded60*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded60*, lpNumberOfBytesWritten=0x24ded38*=0xa, lpOverlapped=0x0) returned 1 [0141.006] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0141.006] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.006] GetProcessHeap () returned 0x4e0000 [0141.006] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0141.006] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24ded18*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24ded18*=0x30) returned 1 [0141.006] CryptDestroyKey (hKey=0x523018) returned 1 [0141.006] WriteFile (in: hFile=0x104, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24ded38*=0x30, lpOverlapped=0x0) returned 1 [0141.007] WriteFile (in: hFile=0x104, lpBuffer=0x24ded40*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded40*, lpNumberOfBytesWritten=0x24ded38*=0x4, lpOverlapped=0x0) returned 1 [0141.007] WriteFile (in: hFile=0x104, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24ded38*=0x10, lpOverlapped=0x0) returned 1 [0141.007] WriteFile (in: hFile=0x104, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24ded38*=0x80, lpOverlapped=0x0) returned 1 [0141.007] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded48 | out: lpNewFilePointer=0x0) returned 1 [0141.007] WriteFile (in: hFile=0x104, lpBuffer=0x24ded58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded58*, lpNumberOfBytesWritten=0x24ded38*=0x8, lpOverlapped=0x0) returned 1 [0141.007] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0141.007] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.007] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.007] ReadFile (in: hFile=0x104, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x22d6, lpNumberOfBytesRead=0x24decf0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24decf0*=0x22d6, lpOverlapped=0x0) returned 1 [0141.008] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x22e0, dwBufLen=0x22e0 | out: pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x22e0) returned 1 [0141.008] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.008] WriteFile (in: hFile=0x104, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x24decf4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24decf4*=0x22e0, lpOverlapped=0x0) returned 1 [0141.008] CryptDestroyKey (hKey=0x523018) returned 1 [0141.008] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x23a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.008] SetEndOfFile (hFile=0x104) returned 1 [0141.011] GetProcessHeap () returned 0x4e0000 [0141.011] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0141.011] GetProcessHeap () returned 0x4e0000 [0141.011] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0141.011] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0141.014] CloseHandle (hObject=0x104) returned 1 [0141.014] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a301d00, ftCreationTime.dwHighDateTime=0x1c2d7fa, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8a301d00, ftLastWriteTime.dwHighDateTime=0x1c2d7fa, nFileSizeHigh=0x0, nFileSizeLow=0x734, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PHONE.XML", cAlternateFileName="")) returned 1 [0141.014] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0141.014] GetProcessHeap () returned 0x4e0000 [0141.014] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0141.014] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0141.014] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded50 | out: lpNewFilePointer=0x0) returned 1 [0141.014] WriteFile (in: hFile=0x104, lpBuffer=0x24ded60*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded60*, lpNumberOfBytesWritten=0x24ded38*=0xc, lpOverlapped=0x0) returned 1 [0141.016] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0141.016] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.016] GetProcessHeap () returned 0x4e0000 [0141.016] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0141.016] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24ded18*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24ded18*=0x30) returned 1 [0141.016] CryptDestroyKey (hKey=0x523018) returned 1 [0141.016] WriteFile (in: hFile=0x104, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24ded38*=0x30, lpOverlapped=0x0) returned 1 [0141.016] WriteFile (in: hFile=0x104, lpBuffer=0x24ded40*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded40*, lpNumberOfBytesWritten=0x24ded38*=0x4, lpOverlapped=0x0) returned 1 [0141.016] WriteFile (in: hFile=0x104, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24ded38*=0x10, lpOverlapped=0x0) returned 1 [0141.016] WriteFile (in: hFile=0x104, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24ded38*=0x80, lpOverlapped=0x0) returned 1 [0141.017] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded48 | out: lpNewFilePointer=0x0) returned 1 [0141.017] WriteFile (in: hFile=0x104, lpBuffer=0x24ded58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded58*, lpNumberOfBytesWritten=0x24ded38*=0x8, lpOverlapped=0x0) returned 1 [0141.017] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0141.017] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.017] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.017] ReadFile (in: hFile=0x104, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x734, lpNumberOfBytesRead=0x24decf0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24decf0*=0x734, lpOverlapped=0x0) returned 1 [0141.017] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x740, dwBufLen=0x740 | out: pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x740) returned 1 [0141.017] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.017] WriteFile (in: hFile=0x104, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x24decf4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24decf4*=0x740, lpOverlapped=0x0) returned 1 [0141.017] CryptDestroyKey (hKey=0x523018) returned 1 [0141.017] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x804, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.017] SetEndOfFile (hFile=0x104) returned 1 [0141.019] GetProcessHeap () returned 0x4e0000 [0141.019] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0141.019] GetProcessHeap () returned 0x4e0000 [0141.019] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0141.019] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0141.020] CloseHandle (hObject=0x104) returned 1 [0141.020] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1271800, ftCreationTime.dwHighDateTime=0x1c4481e, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc1271800, ftLastWriteTime.dwHighDateTime=0x1c4481e, nFileSizeHigh=0x0, nFileSizeLow=0x9869, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="STOCKS.DAT", cAlternateFileName="")) returned 1 [0141.020] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0141.022] GetProcessHeap () returned 0x4e0000 [0141.022] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0141.022] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0141.022] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded50 | out: lpNewFilePointer=0x0) returned 1 [0141.022] WriteFile (in: hFile=0x104, lpBuffer=0x24ded60*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded60*, lpNumberOfBytesWritten=0x24ded38*=0x7, lpOverlapped=0x0) returned 1 [0141.024] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0141.024] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.024] GetProcessHeap () returned 0x4e0000 [0141.024] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0141.024] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24ded18*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24ded18*=0x30) returned 1 [0141.024] CryptDestroyKey (hKey=0x523018) returned 1 [0141.024] WriteFile (in: hFile=0x104, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24ded38*=0x30, lpOverlapped=0x0) returned 1 [0141.024] WriteFile (in: hFile=0x104, lpBuffer=0x24ded40*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded40*, lpNumberOfBytesWritten=0x24ded38*=0x4, lpOverlapped=0x0) returned 1 [0141.024] WriteFile (in: hFile=0x104, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24ded38*=0x10, lpOverlapped=0x0) returned 1 [0141.024] WriteFile (in: hFile=0x104, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24ded38*=0x80, lpOverlapped=0x0) returned 1 [0141.024] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded48 | out: lpNewFilePointer=0x0) returned 1 [0141.024] WriteFile (in: hFile=0x104, lpBuffer=0x24ded58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded58*, lpNumberOfBytesWritten=0x24ded38*=0x8, lpOverlapped=0x0) returned 1 [0141.025] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0141.025] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.025] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.025] ReadFile (in: hFile=0x104, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x9869, lpNumberOfBytesRead=0x24decf0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24decf0*=0x9869, lpOverlapped=0x0) returned 1 [0141.026] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x9870, dwBufLen=0x9870 | out: pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x9870) returned 1 [0141.026] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.026] WriteFile (in: hFile=0x104, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x9870, lpNumberOfBytesWritten=0x24decf4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24decf4*=0x9870, lpOverlapped=0x0) returned 1 [0141.026] CryptDestroyKey (hKey=0x523018) returned 1 [0141.026] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x9934, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.027] SetEndOfFile (hFile=0x104) returned 1 [0141.029] GetProcessHeap () returned 0x4e0000 [0141.029] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0141.029] GetProcessHeap () returned 0x4e0000 [0141.029] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0141.029] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0141.030] CloseHandle (hObject=0x104) returned 1 [0141.030] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5866b900, ftCreationTime.dwHighDateTime=0x1c29047, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5866b900, ftLastWriteTime.dwHighDateTime=0x1c29047, nFileSizeHigh=0x0, nFileSizeLow=0xa7f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="STOCKS.XML", cAlternateFileName="")) returned 1 [0141.030] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0141.030] GetProcessHeap () returned 0x4e0000 [0141.030] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0141.030] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0141.030] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded50 | out: lpNewFilePointer=0x0) returned 1 [0141.031] WriteFile (in: hFile=0x104, lpBuffer=0x24ded60*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded60*, lpNumberOfBytesWritten=0x24ded38*=0x1, lpOverlapped=0x0) returned 1 [0141.032] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0141.032] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.032] GetProcessHeap () returned 0x4e0000 [0141.032] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0141.032] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24ded18*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24ded18*=0x30) returned 1 [0141.032] CryptDestroyKey (hKey=0x523018) returned 1 [0141.033] WriteFile (in: hFile=0x104, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24ded38*=0x30, lpOverlapped=0x0) returned 1 [0141.033] WriteFile (in: hFile=0x104, lpBuffer=0x24ded40*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded40*, lpNumberOfBytesWritten=0x24ded38*=0x4, lpOverlapped=0x0) returned 1 [0141.033] WriteFile (in: hFile=0x104, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24ded38*=0x10, lpOverlapped=0x0) returned 1 [0141.033] WriteFile (in: hFile=0x104, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24ded38*=0x80, lpOverlapped=0x0) returned 1 [0141.033] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded48 | out: lpNewFilePointer=0x0) returned 1 [0141.033] WriteFile (in: hFile=0x104, lpBuffer=0x24ded58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded58*, lpNumberOfBytesWritten=0x24ded38*=0x8, lpOverlapped=0x0) returned 1 [0141.033] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0141.033] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.033] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.033] ReadFile (in: hFile=0x104, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xa7f, lpNumberOfBytesRead=0x24decf0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24decf0*=0xa7f, lpOverlapped=0x0) returned 1 [0141.033] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24decf8*=0xa80, dwBufLen=0xa80 | out: pbData=0x22d0020*, pdwDataLen=0x24decf8*=0xa80) returned 1 [0141.033] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.033] WriteFile (in: hFile=0x104, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xa80, lpNumberOfBytesWritten=0x24decf4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24decf4*=0xa80, lpOverlapped=0x0) returned 1 [0141.033] CryptDestroyKey (hKey=0x523018) returned 1 [0141.033] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xb44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.033] SetEndOfFile (hFile=0x104) returned 1 [0141.035] GetProcessHeap () returned 0x4e0000 [0141.035] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0141.036] GetProcessHeap () returned 0x4e0000 [0141.036] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0141.036] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0141.036] CloseHandle (hObject=0x104) returned 1 [0141.041] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36acb00, ftCreationTime.dwHighDateTime=0x1c2dd39, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x36acb00, ftLastWriteTime.dwHighDateTime=0x1c2dd39, nFileSizeHigh=0x0, nFileSizeLow=0x2174, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TIME.XML", cAlternateFileName="")) returned 1 [0141.041] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0141.041] GetProcessHeap () returned 0x4e0000 [0141.041] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0141.041] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0141.041] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded50 | out: lpNewFilePointer=0x0) returned 1 [0141.041] WriteFile (in: hFile=0x104, lpBuffer=0x24ded60*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded60*, lpNumberOfBytesWritten=0x24ded38*=0xc, lpOverlapped=0x0) returned 1 [0141.043] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0141.043] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.043] GetProcessHeap () returned 0x4e0000 [0141.043] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0141.043] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24ded18*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24ded18*=0x30) returned 1 [0141.043] CryptDestroyKey (hKey=0x523018) returned 1 [0141.043] WriteFile (in: hFile=0x104, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24ded38*=0x30, lpOverlapped=0x0) returned 1 [0141.044] WriteFile (in: hFile=0x104, lpBuffer=0x24ded40*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded40*, lpNumberOfBytesWritten=0x24ded38*=0x4, lpOverlapped=0x0) returned 1 [0141.044] WriteFile (in: hFile=0x104, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24ded38*=0x10, lpOverlapped=0x0) returned 1 [0141.044] WriteFile (in: hFile=0x104, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24ded38*=0x80, lpOverlapped=0x0) returned 1 [0141.044] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded48 | out: lpNewFilePointer=0x0) returned 1 [0141.044] WriteFile (in: hFile=0x104, lpBuffer=0x24ded58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded58*, lpNumberOfBytesWritten=0x24ded38*=0x8, lpOverlapped=0x0) returned 1 [0141.044] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0141.044] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.044] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.044] ReadFile (in: hFile=0x104, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2174, lpNumberOfBytesRead=0x24decf0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24decf0*=0x2174, lpOverlapped=0x0) returned 1 [0141.045] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x2180, dwBufLen=0x2180 | out: pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x2180) returned 1 [0141.045] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.045] WriteFile (in: hFile=0x104, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x24decf4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24decf4*=0x2180, lpOverlapped=0x0) returned 1 [0141.045] CryptDestroyKey (hKey=0x523018) returned 1 [0141.045] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x2244, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.045] SetEndOfFile (hFile=0x104) returned 1 [0141.047] GetProcessHeap () returned 0x4e0000 [0141.048] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0141.048] GetProcessHeap () returned 0x4e0000 [0141.048] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0141.048] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0141.048] CloseHandle (hObject=0x104) returned 1 [0141.048] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36acb00, ftCreationTime.dwHighDateTime=0x1c2dd39, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x36acb00, ftLastWriteTime.dwHighDateTime=0x1c2dd39, nFileSizeHigh=0x0, nFileSizeLow=0x2174, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TIME.XML", cAlternateFileName="")) returned 0 [0141.048] GetProcessHeap () returned 0x4e0000 [0141.048] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0141.049] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0141.049] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24ded90 | out: pbData=0x4f53d8, pdwDataLen=0x24ded90) returned 1 [0141.049] CryptDestroyKey (hKey=0x523018) returned 1 [0141.049] GetProcessHeap () returned 0x4e0000 [0141.049] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0141.049] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0141.049] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24ded90 | out: pbData=0x4f5420, pdwDataLen=0x24ded90) returned 1 [0141.049] CryptDestroyKey (hKey=0x523018) returned 1 [0141.049] GetProcessHeap () returned 0x4e0000 [0141.049] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x53e848 [0141.049] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0141.049] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x53e848, pdwDataLen=0x24ded90 | out: pbData=0x53e848, pdwDataLen=0x24ded90) returned 1 [0141.049] CryptDestroyKey (hKey=0x523018) returned 1 [0141.049] wsprintfW (in: param_1=0x24ddd6c, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\readme-warning.txt") returned 86 [0141.049] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0141.049] WriteFile (in: hFile=0x104, lpBuffer=0x53e848*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddd68, lpOverlapped=0x0 | out: lpBuffer=0x53e848*, lpNumberOfBytesWritten=0x24ddd68*=0x6c3, lpOverlapped=0x0) returned 1 [0141.050] CloseHandle (hObject=0x104) returned 1 [0141.051] GetProcessHeap () returned 0x4e0000 [0141.051] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x53e848 | out: hHeap=0x4e0000) returned 1 [0141.051] GetProcessHeap () returned 0x4e0000 [0141.051] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0141.051] GetProcessHeap () returned 0x4e0000 [0141.051] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0141.051] FindClose (in: hFindFile=0x522fd8 | out: hFindFile=0x522fd8) returned 1 [0141.051] GetProcessHeap () returned 0x4e0000 [0141.051] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x53e5a0 | out: hHeap=0x4e0000) returned 1 [0141.051] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11f34c00, ftCreationTime.dwHighDateTime=0x1c62260, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11f34c00, ftLastWriteTime.dwHighDateTime=0x1c62260, nFileSizeHigh=0x0, nFileSizeLow=0x377ef, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BASMLA.XSL", cAlternateFileName="")) returned 1 [0141.051] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.051] GetProcessHeap () returned 0x4e0000 [0141.051] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0141.051] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0141.052] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0141.052] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x1, lpOverlapped=0x0) returned 1 [0141.054] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.054] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.054] GetProcessHeap () returned 0x4e0000 [0141.054] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0141.054] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30) returned 1 [0141.054] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.054] WriteFile (in: hFile=0x100, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24defc8*=0x30, lpOverlapped=0x0) returned 1 [0141.054] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0141.054] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0141.054] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0141.054] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0141.054] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0141.054] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.054] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.054] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.054] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x377ef, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x377ef, lpOverlapped=0x0) returned 1 [0141.057] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x377f0, dwBufLen=0x377f0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x377f0) returned 1 [0141.059] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.059] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x377f0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x377f0, lpOverlapped=0x0) returned 1 [0141.060] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.060] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x378b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.060] SetEndOfFile (hFile=0x100) returned 1 [0141.064] GetProcessHeap () returned 0x4e0000 [0141.064] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0141.064] GetProcessHeap () returned 0x4e0000 [0141.064] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0141.064] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0141.064] CloseHandle (hObject=0x100) returned 1 [0141.065] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11f34c00, ftCreationTime.dwHighDateTime=0x1c62260, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11f34c00, ftLastWriteTime.dwHighDateTime=0x1c62260, nFileSizeHigh=0x0, nFileSizeLow=0x377ef, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BASMLA.XSL", cAlternateFileName="")) returned 0 [0141.065] GetProcessHeap () returned 0x4e0000 [0141.065] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0141.065] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0141.065] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df020 | out: pbData=0x4f53d8, pdwDataLen=0x24df020) returned 1 [0141.065] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.065] GetProcessHeap () returned 0x4e0000 [0141.065] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0141.065] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0141.065] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df020 | out: pbData=0x4f5420, pdwDataLen=0x24df020) returned 1 [0141.065] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.065] GetProcessHeap () returned 0x4e0000 [0141.065] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x53d598 [0141.065] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0141.065] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x53d598, pdwDataLen=0x24df020 | out: pbData=0x53d598, pdwDataLen=0x24df020) returned 1 [0141.065] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.065] wsprintfW (in: param_1=0x24ddffc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\readme-warning.txt") returned 81 [0141.065] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.066] WriteFile (in: hFile=0x100, lpBuffer=0x53d598*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddff8, lpOverlapped=0x0 | out: lpBuffer=0x53d598*, lpNumberOfBytesWritten=0x24ddff8*=0x6c3, lpOverlapped=0x0) returned 1 [0141.067] CloseHandle (hObject=0x100) returned 1 [0141.067] GetProcessHeap () returned 0x4e0000 [0141.067] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x53d598 | out: hHeap=0x4e0000) returned 1 [0141.067] GetProcessHeap () returned 0x4e0000 [0141.067] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0141.067] GetProcessHeap () returned 0x4e0000 [0141.067] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0141.067] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0141.067] GetProcessHeap () returned 0x4e0000 [0141.067] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x53d300 | out: hHeap=0x4e0000) returned 1 [0141.068] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93e94600, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x583906f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x93e94600, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x1b180, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="METCONV.DLL", cAlternateFileName="")) returned 1 [0141.068] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85f12000, ftCreationTime.dwHighDateTime=0x1c9a11f, ftLastAccessTime.dwLowDateTime=0x69a83910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x85f12000, ftLastWriteTime.dwHighDateTime=0x1c9a11f, nFileSizeHigh=0x0, nFileSizeLow=0x120eb8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="METCONV.TXT", cAlternateFileName="")) returned 1 [0141.068] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0141.069] GetProcessHeap () returned 0x4e0000 [0141.069] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0141.069] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0141.069] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0141.069] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0141.071] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0141.071] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.071] GetProcessHeap () returned 0x4e0000 [0141.071] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0141.071] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0141.071] CryptDestroyKey (hKey=0x522f98) returned 1 [0141.071] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0141.071] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0141.071] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0141.071] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0141.071] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0141.071] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0141.071] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0141.071] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.071] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.072] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x100000, lpOverlapped=0x0) returned 1 [0141.084] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x100000, dwBufLen=0x100000 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x100000) returned 1 [0141.094] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.094] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x100000, lpOverlapped=0x0) returned 1 [0141.097] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x120f94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.097] WriteFile (in: hFile=0xdc, lpBuffer=0x24df220*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x24df220*, lpNumberOfBytesWritten=0x24df214*=0x8, lpOverlapped=0x0) returned 1 [0141.097] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.097] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x20eb8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x20eb8, lpOverlapped=0x0) returned 1 [0141.097] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x20ec0, dwBufLen=0x20ec0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x20ec0) returned 1 [0141.098] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.098] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x20ec0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x20ec0, lpOverlapped=0x0) returned 1 [0141.099] CryptDestroyKey (hKey=0x522f98) returned 1 [0141.099] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x120f94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.099] SetEndOfFile (hFile=0xdc) returned 1 [0141.102] GetProcessHeap () returned 0x4e0000 [0141.102] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0141.102] GetProcessHeap () returned 0x4e0000 [0141.103] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0141.103] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0141.104] CloseHandle (hObject=0xdc) returned 1 [0141.104] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x802a9400, ftCreationTime.dwHighDateTime=0x1caad0b, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x802a9400, ftLastWriteTime.dwHighDateTime=0x1caad0b, nFileSizeHigh=0x0, nFileSizeLow=0x59180, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MOFL.DLL", cAlternateFileName="")) returned 1 [0141.104] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab68100, ftCreationTime.dwHighDateTime=0x1cac9a5, ftLastAccessTime.dwLowDateTime=0x5943a0f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab68100, ftLastWriteTime.dwHighDateTime=0x1cac9a5, nFileSizeHigh=0x0, nFileSizeLow=0x3574, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSTAG.TLB", cAlternateFileName="")) returned 1 [0141.104] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0141.108] GetProcessHeap () returned 0x4e0000 [0141.108] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0141.108] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0141.108] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0141.108] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0141.110] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0141.110] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.110] GetProcessHeap () returned 0x4e0000 [0141.110] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0141.110] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0141.110] CryptDestroyKey (hKey=0x522f98) returned 1 [0141.110] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0141.110] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0141.110] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0141.110] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0141.110] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0141.110] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0141.110] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0141.111] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.111] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.111] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3574, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3574, lpOverlapped=0x0) returned 1 [0141.112] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3580, dwBufLen=0x3580 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3580) returned 1 [0141.112] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.112] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3580, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3580, lpOverlapped=0x0) returned 1 [0141.112] CryptDestroyKey (hKey=0x522f98) returned 1 [0141.112] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3644, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.112] SetEndOfFile (hFile=0xdc) returned 1 [0141.115] GetProcessHeap () returned 0x4e0000 [0141.115] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0141.115] GetProcessHeap () returned 0x4e0000 [0141.115] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0141.115] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0141.115] CloseHandle (hObject=0xdc) returned 1 [0141.116] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x3d80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SmartTagInstall.exe", cAlternateFileName="SMARTT~1.EXE")) returned 1 [0141.116] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x3d80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SmartTagInstall.exe", cAlternateFileName="SMARTT~1.EXE")) returned 0 [0141.116] GetProcessHeap () returned 0x4e0000 [0141.116] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0141.116] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df248, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f98) returned 1 [0141.116] CryptDecrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df2b0 | out: pbData=0x4f53d8, pdwDataLen=0x24df2b0) returned 1 [0141.116] CryptDestroyKey (hKey=0x522f98) returned 1 [0141.116] GetProcessHeap () returned 0x4e0000 [0141.116] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0141.116] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df248, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f98) returned 1 [0141.116] CryptDecrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df2b0 | out: pbData=0x4f5420, pdwDataLen=0x24df2b0) returned 1 [0141.116] CryptDestroyKey (hKey=0x522f98) returned 1 [0141.116] GetProcessHeap () returned 0x4e0000 [0141.116] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x526e88 [0141.116] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df248, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f98) returned 1 [0141.116] CryptDecrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x526e88, pdwDataLen=0x24df2b0 | out: pbData=0x526e88, pdwDataLen=0x24df2b0) returned 1 [0141.116] CryptDestroyKey (hKey=0x522f98) returned 1 [0141.116] wsprintfW (in: param_1=0x24de28c, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\readme-warning.txt") returned 75 [0141.116] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0141.117] WriteFile (in: hFile=0xdc, lpBuffer=0x526e88*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24de288, lpOverlapped=0x0 | out: lpBuffer=0x526e88*, lpNumberOfBytesWritten=0x24de288*=0x6c3, lpOverlapped=0x0) returned 1 [0141.118] CloseHandle (hObject=0xdc) returned 1 [0141.118] GetProcessHeap () returned 0x4e0000 [0141.118] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x526e88 | out: hHeap=0x4e0000) returned 1 [0141.118] GetProcessHeap () returned 0x4e0000 [0141.118] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0141.118] GetProcessHeap () returned 0x4e0000 [0141.118] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0141.118] FindClose (in: hFindFile=0x522f58 | out: hFindFile=0x522f58) returned 1 [0141.119] GetProcessHeap () returned 0x4e0000 [0141.119] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x53d070 | out: hHeap=0x4e0000) returned 1 [0141.119] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Source Engine", cAlternateFileName="SOURCE~1")) returned 1 [0141.119] GetProcessHeap () returned 0x4e0000 [0141.119] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8a) returned 0x524ea0 [0141.119] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\*.*", lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f58 [0141.120] GetProcessHeap () returned 0x4e0000 [0141.120] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x524ea0 | out: hHeap=0x4e0000) returned 1 [0141.120] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0141.120] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfcedc00, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcfcedc00, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OSE.EXE", cAlternateFileName="")) returned 1 [0141.120] GetProcessHeap () returned 0x4e0000 [0141.120] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x28c) returned 0x526e88 [0141.120] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfcedc00, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcfcedc00, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OSE.EXE", cAlternateFileName="")) returned 0 [0141.120] FindClose (in: hFindFile=0x522f58 | out: hFindFile=0x522f58) returned 1 [0141.120] GetProcessHeap () returned 0x4e0000 [0141.120] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x526e88 | out: hHeap=0x4e0000) returned 1 [0141.120] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0141.120] GetProcessHeap () returned 0x4e0000 [0141.120] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x84) returned 0x4fa058 [0141.120] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f58 [0141.123] GetProcessHeap () returned 0x4e0000 [0141.123] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0141.123] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0141.123] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2608de, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2608de, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xcdfff30e, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Bears.htm", cAlternateFileName="")) returned 1 [0141.123] GetProcessHeap () returned 0x4e0000 [0141.124] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x286) returned 0x526e88 [0141.124] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0141.124] GetLastError () returned 0x5 [0141.124] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa352261, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Bears.jpg", cAlternateFileName="")) returned 1 [0141.124] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0141.124] GetLastError () returned 0x5 [0141.124] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ca9e3b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4ca9e3b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4421c165, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa0f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Blue_Gradient.jpg", cAlternateFileName="")) returned 1 [0141.124] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0141.125] GetLastError () returned 0x5 [0141.125] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ccff98, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4ccff98, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x442422c3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x11eb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Cave_Drawings.gif", cAlternateFileName="")) returned 1 [0141.125] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0141.125] GetLastError () returned 0x5 [0141.125] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4d6850c, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4d6850c, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4434cc55, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x90f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Connectivity.gif", cAlternateFileName="")) returned 1 [0141.125] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0141.125] GetLastError () returned 0x5 [0141.125] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x80425158, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bf1d2d9, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bf1d2d9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0141.125] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5015d96, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5015d96, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x444c9a01, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xed0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Dotted_Lines.emf", cAlternateFileName="")) returned 1 [0141.125] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0141.126] GetLastError () returned 0x5 [0141.126] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce04b5c8, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Garden.htm", cAlternateFileName="")) returned 1 [0141.126] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0141.126] GetLastError () returned 0x5 [0141.126] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa410937, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x5d3f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Garden.jpg", cAlternateFileName="")) returned 1 [0141.126] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0141.126] GetLastError () returned 0x5 [0141.126] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc50881ad, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc50881ad, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x444efb5f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1594, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Genko_1.emf", cAlternateFileName="")) returned 1 [0141.126] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0141.127] GetLastError () returned 0x5 [0141.127] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc50d4467, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc50d4467, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44515cbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2864, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Genko_2.emf", cAlternateFileName="")) returned 1 [0141.127] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0141.127] GetLastError () returned 0x5 [0141.127] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5120721, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5120721, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4453be1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1c7f4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Graph.emf", cAlternateFileName="")) returned 1 [0141.127] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0141.128] GetLastError () returned 0x5 [0141.128] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2d2cf5, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2d2cf5, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce071725, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Green Bubbles.htm", cAlternateFileName="")) returned 1 [0141.128] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0141.129] GetLastError () returned 0x5 [0141.129] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2f8e52, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2f8e52, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa436a95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1906, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="GreenBubbles.jpg", cAlternateFileName="")) returned 1 [0141.129] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0141.129] GetLastError () returned 0x5 [0141.129] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4fc9adc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4fc9adc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4453be1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xb68, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="grid_(cm).wmf", cAlternateFileName="")) returned 1 [0141.129] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0141.129] GetLastError () returned 0x5 [0141.129] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4fa397f, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4fa397f, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44692a69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d4a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="grid_(inch).wmf", cAlternateFileName="")) returned 1 [0141.129] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0141.129] GetLastError () returned 0x5 [0141.129] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce31efaf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce31efaf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce0bd9df, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Hand Prints.htm", cAlternateFileName="")) returned 1 [0141.129] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0141.130] GetLastError () returned 0x5 [0141.130] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce31efaf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce31efaf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa45cbf3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HandPrints.jpg", cAlternateFileName="")) returned 1 [0141.130] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0141.131] GetLastError () returned 0x5 [0141.131] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5192b38, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5192b38, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4480f815, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x252ec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Memo.emf", cAlternateFileName="")) returned 1 [0141.131] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0141.131] GetLastError () returned 0x5 [0141.132] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4e4cd3a, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4e4cd3a, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44835973, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x8a1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Monet.jpg", cAlternateFileName="")) returned 1 [0141.132] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\monet.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0141.132] GetLastError () returned 0x5 [0141.132] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc51dedf2, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc51dedf2, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x448cdeeb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1060, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Month_Calendar.emf", cAlternateFileName="")) returned 1 [0141.132] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\month_calendar.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0141.132] GetLastError () returned 0x5 [0141.132] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc522b0ac, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc522b0ac, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x448cdeeb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x65b4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Music.emf", cAlternateFileName="")) returned 1 [0141.132] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\music.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0141.133] GetLastError () returned 0x5 [0141.133] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ebf151, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4ebf151, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44b2f4cb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xb86, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Notebook.jpg", cAlternateFileName="")) returned 1 [0141.133] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0141.133] GetLastError () returned 0x5 [0141.133] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce31efaf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce31efaf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce0e3b3c, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Orange Circles.htm", cAlternateFileName="")) returned 1 [0141.134] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0141.134] GetLastError () returned 0x5 [0141.134] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce34510c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce34510c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa4cf00d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x18ed, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OrangeCircles.jpg", cAlternateFileName="")) returned 1 [0141.134] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0141.134] GetLastError () returned 0x5 [0141.134] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce34510c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce34510c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce109c99, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Peacock.htm", cAlternateFileName="")) returned 1 [0141.134] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0141.135] GetLastError () returned 0x5 [0141.135] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3913c6, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3913c6, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa51b2c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Peacock.jpg", cAlternateFileName="")) returned 1 [0141.135] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0141.135] GetLastError () returned 0x5 [0141.135] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4f0b40b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4f0b40b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44b55629, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf8d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Pine_Lumber.jpg", cAlternateFileName="")) returned 1 [0141.135] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0141.136] GetLastError () returned 0x5 [0141.136] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4f31568, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4f31568, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44bc7a43, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Pretty_Peacock.jpg", cAlternateFileName="")) returned 1 [0141.136] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0141.136] GetLastError () returned 0x5 [0141.136] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4f7d822, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4f7d822, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44bc7a43, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36e1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Psychedelic.jpg", cAlternateFileName="")) returned 1 [0141.136] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0141.137] GetLastError () returned 0x5 [0141.137] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3913c6, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3913c6, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce12fdf6, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Roses.htm", cAlternateFileName="")) returned 1 [0141.137] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0141.137] GetLastError () returned 0x5 [0141.137] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3b7523, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3b7523, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa567585, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Roses.jpg", cAlternateFileName="")) returned 1 [0141.137] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0141.138] GetLastError () returned 0x5 [0141.138] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc53cdfab, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc53cdfab, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x45148cd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3da0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Sand_Paper.jpg", cAlternateFileName="")) returned 1 [0141.138] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\sand_paper.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0141.138] GetLastError () returned 0x5 [0141.138] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5277366, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5277366, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4516ee37, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x91c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Seyes.emf", cAlternateFileName="")) returned 1 [0141.138] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\seyes.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0141.138] GetLastError () returned 0x5 [0141.139] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3b7523, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3b7523, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce17c0b0, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Shades of Blue.htm", cAlternateFileName="")) returned 1 [0141.139] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0141.139] GetLastError () returned 0x5 [0141.139] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3b7523, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3b7523, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa58d6e3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ShadesOfBlue.jpg", cAlternateFileName="")) returned 1 [0141.139] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0141.139] GetLastError () returned 0x5 [0141.139] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc530f8da, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc530f8da, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x45194f95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13d8c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Shorthand.emf", cAlternateFileName="")) returned 1 [0141.140] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shorthand.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0141.140] GetLastError () returned 0x5 [0141.140] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc541a265, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc541a265, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x451bb0f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7c6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Small_News.jpg", cAlternateFileName="")) returned 1 [0141.140] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0141.140] GetLastError () returned 0x5 [0141.140] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3dd680, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3dd680, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce1a220d, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Soft Blue.htm", cAlternateFileName="")) returned 1 [0141.140] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0141.141] GetLastError () returned 0x5 [0141.141] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3dd680, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3dd680, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa5b3841, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2949, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SoftBlue.jpg", cAlternateFileName="")) returned 1 [0141.141] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0141.142] GetLastError () returned 0x5 [0141.142] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3dd680, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3dd680, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce1c836a, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Stars.htm", cAlternateFileName="")) returned 1 [0141.142] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0141.142] GetLastError () returned 0x5 [0141.142] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce4037dd, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce4037dd, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa5ffafd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Stars.jpg", cAlternateFileName="")) returned 1 [0141.142] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0141.143] GetLastError () returned 0x5 [0141.143] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc54403c2, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc54403c2, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x452797c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x748, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Stucco.gif", cAlternateFileName="")) returned 1 [0141.143] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stucco.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0141.143] GetLastError () returned 0x5 [0141.143] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc548c67c, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc548c67c, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4529f927, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xe42, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Tanspecks.jpg", cAlternateFileName="")) returned 1 [0141.143] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tanspecks.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0141.144] GetLastError () returned 0x5 [0141.144] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc54b27d9, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc54b27d9, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4573c389, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x121e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Tiki.gif", cAlternateFileName="")) returned 1 [0141.144] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tiki.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0141.144] GetLastError () returned 0x5 [0141.144] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc535bb94, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc535bb94, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4573c389, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x6860, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="To_Do_List.emf", cAlternateFileName="")) returned 1 [0141.144] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\to_do_list.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0141.144] GetLastError () returned 0x5 [0141.144] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc54fea93, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc54fea93, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x457ae7a3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc60, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="White_Chocolate.jpg", cAlternateFileName="")) returned 1 [0141.144] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\white_chocolate.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0141.145] GetLastError () returned 0x5 [0141.145] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5524bf0, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5524bf0, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x457faa5f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3ad7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Wrinkled_Paper.gif", cAlternateFileName="")) returned 1 [0141.145] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0141.145] GetLastError () returned 0x5 [0141.145] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5524bf0, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5524bf0, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x457faa5f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3ad7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Wrinkled_Paper.gif", cAlternateFileName="")) returned 0 [0141.145] FindClose (in: hFindFile=0x522f58 | out: hFindFile=0x522f58) returned 1 [0141.146] GetProcessHeap () returned 0x4e0000 [0141.146] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x526e88 | out: hHeap=0x4e0000) returned 1 [0141.146] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TextConv", cAlternateFileName="")) returned 1 [0141.146] GetProcessHeap () returned 0x4e0000 [0141.146] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x80) returned 0x4fa058 [0141.146] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\*.*", lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f58 [0141.147] GetProcessHeap () returned 0x4e0000 [0141.147] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0141.147] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0141.147] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-US", cAlternateFileName="")) returned 1 [0141.147] GetProcessHeap () returned 0x4e0000 [0141.147] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x282) returned 0x526e88 [0141.147] GetProcessHeap () returned 0x4e0000 [0141.147] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8c) returned 0x524ea0 [0141.147] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0141.147] GetProcessHeap () returned 0x4e0000 [0141.147] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x524ea0 | out: hHeap=0x4e0000) returned 1 [0141.147] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0141.147] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0 [0141.147] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0141.147] GetProcessHeap () returned 0x4e0000 [0141.147] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4e0000) returned 1 [0141.147] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xcf518520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x23d78, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSCONV97.DLL", cAlternateFileName="")) returned 1 [0141.147] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aeaee00, ftCreationTime.dwHighDateTime=0x1ca9122, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1aeaee00, ftLastWriteTime.dwHighDateTime=0x1ca9122, nFileSizeHigh=0x0, nFileSizeLow=0x8f68, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RECOVR32.CNV", cAlternateFileName="")) returned 1 [0141.148] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0141.148] GetProcessHeap () returned 0x4e0000 [0141.148] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0141.148] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0141.148] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0141.148] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0141.163] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0141.163] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.163] GetProcessHeap () returned 0x4e0000 [0141.163] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0141.163] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0141.163] CryptDestroyKey (hKey=0x522f98) returned 1 [0141.163] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0141.163] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0141.163] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0141.163] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0141.164] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0141.164] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0141.164] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0141.164] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.164] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.164] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x8f68, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x8f68, lpOverlapped=0x0) returned 1 [0141.165] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8f70, dwBufLen=0x8f70 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8f70) returned 1 [0141.165] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.165] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x8f70, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x8f70, lpOverlapped=0x0) returned 1 [0141.166] CryptDestroyKey (hKey=0x522f98) returned 1 [0141.166] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x9044, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.166] SetEndOfFile (hFile=0xdc) returned 1 [0141.168] GetProcessHeap () returned 0x4e0000 [0141.168] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0141.168] GetProcessHeap () returned 0x4e0000 [0141.168] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0141.168] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0141.173] CloseHandle (hObject=0xdc) returned 1 [0141.173] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f938f00, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f938f00, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0xdfa0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Wks9Pxy.cnv", cAlternateFileName="")) returned 1 [0141.173] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0141.174] GetProcessHeap () returned 0x4e0000 [0141.174] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0141.175] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0141.175] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0141.175] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0141.175] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.175] GetProcessHeap () returned 0x4e0000 [0141.175] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0141.175] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0141.175] CryptDestroyKey (hKey=0x522f98) returned 1 [0141.175] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0141.177] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0141.177] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0141.177] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0141.177] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0141.177] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0141.177] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0141.177] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.177] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.178] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xdfa0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xdfa0, lpOverlapped=0x0) returned 1 [0141.179] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xdfa0, dwBufLen=0xdfa0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xdfa0) returned 1 [0141.180] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.180] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xdfa0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xdfa0, lpOverlapped=0x0) returned 1 [0141.180] CryptDestroyKey (hKey=0x522f98) returned 1 [0141.180] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xe074, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.180] SetEndOfFile (hFile=0xdc) returned 1 [0141.183] GetProcessHeap () returned 0x4e0000 [0141.183] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0141.183] GetProcessHeap () returned 0x4e0000 [0141.183] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0141.183] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0141.184] CloseHandle (hObject=0xdc) returned 1 [0141.184] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56ce200, ftCreationTime.dwHighDateTime=0x1cbd856, ftLastAccessTime.dwLowDateTime=0xc226ea20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56ce200, ftLastWriteTime.dwHighDateTime=0x1cbd856, nFileSizeHigh=0x0, nFileSizeLow=0x30170, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WPFT532.CNV", cAlternateFileName="")) returned 1 [0141.184] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0141.185] GetProcessHeap () returned 0x4e0000 [0141.185] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0141.185] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0141.185] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0141.185] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0141.185] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.185] GetProcessHeap () returned 0x4e0000 [0141.185] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0141.185] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0141.185] CryptDestroyKey (hKey=0x522f98) returned 1 [0141.185] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0141.188] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0141.188] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0141.188] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0141.188] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0141.188] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0141.188] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0141.188] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.188] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.188] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x30170, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x30170, lpOverlapped=0x0) returned 1 [0141.191] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x30170, dwBufLen=0x30170 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x30170) returned 1 [0141.193] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.193] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x30170, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x30170, lpOverlapped=0x0) returned 1 [0141.193] CryptDestroyKey (hKey=0x522f98) returned 1 [0141.193] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x30244, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.193] SetEndOfFile (hFile=0xdc) returned 1 [0141.197] GetProcessHeap () returned 0x4e0000 [0141.197] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0141.197] GetProcessHeap () returned 0x4e0000 [0141.197] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0141.197] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0141.198] CloseHandle (hObject=0xdc) returned 1 [0141.198] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xc2294b80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x46b70, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WPFT632.CNV", cAlternateFileName="")) returned 1 [0141.198] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0141.198] GetProcessHeap () returned 0x4e0000 [0141.199] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0141.199] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0141.199] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0141.199] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0141.199] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.199] GetProcessHeap () returned 0x4e0000 [0141.199] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0141.199] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0141.199] CryptDestroyKey (hKey=0x522f98) returned 1 [0141.199] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0141.207] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0141.207] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0141.208] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0141.208] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0141.208] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0141.208] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0141.208] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.208] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.208] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x46b70, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x46b70, lpOverlapped=0x0) returned 1 [0141.215] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x46b70, dwBufLen=0x46b70 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x46b70) returned 1 [0141.217] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.217] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x46b70, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x46b70, lpOverlapped=0x0) returned 1 [0141.218] CryptDestroyKey (hKey=0x522f98) returned 1 [0141.218] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x46c44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.218] SetEndOfFile (hFile=0xdc) returned 1 [0141.221] GetProcessHeap () returned 0x4e0000 [0141.221] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0141.221] GetProcessHeap () returned 0x4e0000 [0141.221] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0141.221] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0141.221] CloseHandle (hObject=0xdc) returned 1 [0141.222] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xc2294b80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x46b70, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WPFT632.CNV", cAlternateFileName="")) returned 0 [0141.222] GetProcessHeap () returned 0x4e0000 [0141.222] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0141.222] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df248, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f98) returned 1 [0141.222] CryptDecrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df2b0 | out: pbData=0x4f53d8, pdwDataLen=0x24df2b0) returned 1 [0141.222] CryptDestroyKey (hKey=0x522f98) returned 1 [0141.222] GetProcessHeap () returned 0x4e0000 [0141.222] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0141.222] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df248, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f98) returned 1 [0141.222] CryptDecrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df2b0 | out: pbData=0x4f5420, pdwDataLen=0x24df2b0) returned 1 [0141.222] CryptDestroyKey (hKey=0x522f98) returned 1 [0141.222] GetProcessHeap () returned 0x4e0000 [0141.222] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x527118 [0141.222] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df248, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f98) returned 1 [0141.222] CryptDecrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x527118, pdwDataLen=0x24df2b0 | out: pbData=0x527118, pdwDataLen=0x24df2b0) returned 1 [0141.222] CryptDestroyKey (hKey=0x522f98) returned 1 [0141.222] wsprintfW (in: param_1=0x24de28c, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\readme-warning.txt") returned 74 [0141.222] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0141.225] WriteFile (in: hFile=0xdc, lpBuffer=0x527118*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24de288, lpOverlapped=0x0 | out: lpBuffer=0x527118*, lpNumberOfBytesWritten=0x24de288*=0x6c3, lpOverlapped=0x0) returned 1 [0141.226] CloseHandle (hObject=0xdc) returned 1 [0141.226] GetProcessHeap () returned 0x4e0000 [0141.226] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0141.227] GetProcessHeap () returned 0x4e0000 [0141.227] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0141.227] GetProcessHeap () returned 0x4e0000 [0141.227] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0141.227] FindClose (in: hFindFile=0x522f58 | out: hFindFile=0x522f58) returned 1 [0141.227] GetProcessHeap () returned 0x4e0000 [0141.227] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x526e88 | out: hHeap=0x4e0000) returned 1 [0141.227] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THEMES14", cAlternateFileName="")) returned 1 [0141.227] GetProcessHeap () returned 0x4e0000 [0141.227] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x80) returned 0x4fa058 [0141.227] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f58 [0141.241] GetProcessHeap () returned 0x4e0000 [0141.241] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0141.242] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0141.243] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AFTRNOON", cAlternateFileName="")) returned 1 [0141.243] GetProcessHeap () returned 0x4e0000 [0141.243] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x282) returned 0x526e88 [0141.243] GetProcessHeap () returned 0x4e0000 [0141.243] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x92) returned 0x4fa058 [0141.243] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0141.243] GetProcessHeap () returned 0x4e0000 [0141.243] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0141.243] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0141.243] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdad6ec00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdad6ec00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xe58e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AFTRNOON.ELM", cAlternateFileName="")) returned 1 [0141.243] GetProcessHeap () returned 0x4e0000 [0141.243] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x294) returned 0x527118 [0141.243] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.244] GetProcessHeap () returned 0x4e0000 [0141.244] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0141.245] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0141.245] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0141.245] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x2, lpOverlapped=0x0) returned 1 [0141.246] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.246] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.246] GetProcessHeap () returned 0x4e0000 [0141.246] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0141.246] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0141.246] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.246] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0141.246] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0141.246] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0141.247] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0141.247] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0141.247] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0141.247] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.247] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.247] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.247] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xe58e, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xe58e, lpOverlapped=0x0) returned 1 [0141.248] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xe590, dwBufLen=0xe590 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xe590) returned 1 [0141.248] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.248] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe590, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xe590, lpOverlapped=0x0) returned 1 [0141.249] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.249] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xe664, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.249] SetEndOfFile (hFile=0x100) returned 1 [0141.251] GetProcessHeap () returned 0x4e0000 [0141.251] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0141.251] GetProcessHeap () returned 0x4e0000 [0141.251] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0141.251] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0141.252] CloseHandle (hObject=0x100) returned 1 [0141.252] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e63000, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86e63000, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x22b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AFTRNOON.INF", cAlternateFileName="")) returned 1 [0141.252] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.252] GetProcessHeap () returned 0x4e0000 [0141.252] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0141.252] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0141.252] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0141.252] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x5, lpOverlapped=0x0) returned 1 [0141.254] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.254] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.254] GetProcessHeap () returned 0x4e0000 [0141.254] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0141.254] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0141.254] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.254] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0141.254] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0141.254] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0141.254] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0141.254] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0141.255] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0141.255] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.255] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.255] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.255] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x22b, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x22b, lpOverlapped=0x0) returned 1 [0141.255] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x230, dwBufLen=0x230 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x230) returned 1 [0141.255] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.255] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x230, lpOverlapped=0x0) returned 1 [0141.255] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.255] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x304, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.255] SetEndOfFile (hFile=0x100) returned 1 [0141.257] GetProcessHeap () returned 0x4e0000 [0141.257] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0141.257] GetProcessHeap () returned 0x4e0000 [0141.257] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0141.257] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0141.260] CloseHandle (hObject=0x100) returned 1 [0141.260] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85b50300, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x85b50300, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x621, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0141.260] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.261] GetProcessHeap () returned 0x4e0000 [0141.261] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0141.261] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0141.261] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0141.261] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xf, lpOverlapped=0x0) returned 1 [0141.263] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.263] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.263] GetProcessHeap () returned 0x4e0000 [0141.263] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0141.263] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0141.263] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.263] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0141.263] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0141.263] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0141.263] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0141.263] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0141.263] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0141.263] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.263] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.263] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.263] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x621, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x621, lpOverlapped=0x0) returned 1 [0141.264] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x630, dwBufLen=0x630 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x630) returned 1 [0141.264] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.264] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x630, lpOverlapped=0x0) returned 1 [0141.264] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.264] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x704, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.264] SetEndOfFile (hFile=0x100) returned 1 [0141.266] GetProcessHeap () returned 0x4e0000 [0141.266] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0141.266] GetProcessHeap () returned 0x4e0000 [0141.266] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0141.266] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0141.266] CloseHandle (hObject=0x100) returned 1 [0141.267] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e63000, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86e63000, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x6292, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0141.267] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.268] GetProcessHeap () returned 0x4e0000 [0141.268] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0141.268] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0141.268] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0141.268] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xe, lpOverlapped=0x0) returned 1 [0141.269] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.269] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.270] GetProcessHeap () returned 0x4e0000 [0141.270] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0141.270] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0141.270] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.270] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0141.270] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0141.270] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0141.270] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0141.270] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0141.270] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0141.270] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.270] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.270] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.270] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x6292, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x6292, lpOverlapped=0x0) returned 1 [0141.271] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x62a0, dwBufLen=0x62a0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x62a0) returned 1 [0141.271] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.271] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x62a0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x62a0, lpOverlapped=0x0) returned 1 [0141.272] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.272] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x6374, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.272] SetEndOfFile (hFile=0x100) returned 1 [0141.274] GetProcessHeap () returned 0x4e0000 [0141.274] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0141.274] GetProcessHeap () returned 0x4e0000 [0141.274] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0141.274] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0141.275] CloseHandle (hObject=0x100) returned 1 [0141.275] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e63000, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86e63000, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x6292, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0141.275] GetProcessHeap () returned 0x4e0000 [0141.275] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0141.275] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0141.275] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df020 | out: pbData=0x4f53d8, pdwDataLen=0x24df020) returned 1 [0141.275] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.275] GetProcessHeap () returned 0x4e0000 [0141.275] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0141.275] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0141.276] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df020 | out: pbData=0x4f5420, pdwDataLen=0x24df020) returned 1 [0141.276] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.276] GetProcessHeap () returned 0x4e0000 [0141.276] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5273b8 [0141.276] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0141.276] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5273b8, pdwDataLen=0x24df020 | out: pbData=0x5273b8, pdwDataLen=0x24df020) returned 1 [0141.276] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.276] wsprintfW (in: param_1=0x24ddffc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\readme-warning.txt") returned 83 [0141.276] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.276] WriteFile (in: hFile=0x100, lpBuffer=0x5273b8*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddff8, lpOverlapped=0x0 | out: lpBuffer=0x5273b8*, lpNumberOfBytesWritten=0x24ddff8*=0x6c3, lpOverlapped=0x0) returned 1 [0141.277] CloseHandle (hObject=0x100) returned 1 [0141.277] GetProcessHeap () returned 0x4e0000 [0141.277] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273b8 | out: hHeap=0x4e0000) returned 1 [0141.277] GetProcessHeap () returned 0x4e0000 [0141.277] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0141.277] GetProcessHeap () returned 0x4e0000 [0141.277] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0141.277] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0141.278] GetProcessHeap () returned 0x4e0000 [0141.278] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0141.278] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ARCTIC", cAlternateFileName="")) returned 1 [0141.278] GetProcessHeap () returned 0x4e0000 [0141.278] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8e) returned 0x524ea0 [0141.278] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0141.279] GetProcessHeap () returned 0x4e0000 [0141.279] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x524ea0 | out: hHeap=0x4e0000) returned 1 [0141.279] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0141.279] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc081900, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5146e3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdc081900, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x10fc7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ARCTIC.ELM", cAlternateFileName="")) returned 1 [0141.279] GetProcessHeap () returned 0x4e0000 [0141.279] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x290) returned 0x527118 [0141.279] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.280] GetProcessHeap () returned 0x4e0000 [0141.280] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0141.280] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0141.280] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0141.280] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x9, lpOverlapped=0x0) returned 1 [0141.282] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.282] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.282] GetProcessHeap () returned 0x4e0000 [0141.282] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0141.282] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30) returned 1 [0141.282] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.282] WriteFile (in: hFile=0x100, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24defc8*=0x30, lpOverlapped=0x0) returned 1 [0141.282] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0141.282] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0141.282] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0141.282] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0141.282] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0141.283] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.283] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.283] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.283] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x10fc7, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x10fc7, lpOverlapped=0x0) returned 1 [0141.284] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x10fd0, dwBufLen=0x10fd0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x10fd0) returned 1 [0141.284] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.284] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x10fd0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x10fd0, lpOverlapped=0x0) returned 1 [0141.285] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.285] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x11094, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.285] SetEndOfFile (hFile=0x100) returned 1 [0141.287] GetProcessHeap () returned 0x4e0000 [0141.287] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0141.287] GetProcessHeap () returned 0x4e0000 [0141.287] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0141.287] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0141.288] CloseHandle (hObject=0x100) returned 1 [0141.288] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5146e3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x201, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ARCTIC.INF", cAlternateFileName="")) returned 1 [0141.288] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.288] GetProcessHeap () returned 0x4e0000 [0141.288] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0141.288] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0141.288] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0141.288] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xf, lpOverlapped=0x0) returned 1 [0141.290] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.290] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.290] GetProcessHeap () returned 0x4e0000 [0141.290] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0141.290] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30) returned 1 [0141.290] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.290] WriteFile (in: hFile=0x100, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24defc8*=0x30, lpOverlapped=0x0) returned 1 [0141.290] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0141.290] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0141.290] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0141.290] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0141.290] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0141.290] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.290] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.291] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.291] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x201, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x201, lpOverlapped=0x0) returned 1 [0141.291] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x210, dwBufLen=0x210 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x210) returned 1 [0141.291] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.291] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x210, lpOverlapped=0x0) returned 1 [0141.291] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.291] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x2d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.291] SetEndOfFile (hFile=0x100) returned 1 [0141.293] GetProcessHeap () returned 0x4e0000 [0141.293] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0141.293] GetProcessHeap () returned 0x4e0000 [0141.293] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0141.293] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0141.308] CloseHandle (hObject=0x100) returned 1 [0141.308] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0xba9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0141.308] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.309] GetProcessHeap () returned 0x4e0000 [0141.309] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0141.309] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0141.309] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0141.309] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x7, lpOverlapped=0x0) returned 1 [0141.311] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.311] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.311] GetProcessHeap () returned 0x4e0000 [0141.311] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0141.311] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0141.311] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.311] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0141.311] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0141.311] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0141.311] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0141.311] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0141.311] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0141.312] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.312] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.312] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.312] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xba9, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xba9, lpOverlapped=0x0) returned 1 [0141.312] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xbb0, dwBufLen=0xbb0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xbb0) returned 1 [0141.312] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.312] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xbb0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xbb0, lpOverlapped=0x0) returned 1 [0141.312] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.312] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xc84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.312] SetEndOfFile (hFile=0x100) returned 1 [0141.314] GetProcessHeap () returned 0x4e0000 [0141.314] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0141.314] GetProcessHeap () returned 0x4e0000 [0141.314] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0141.314] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0141.315] CloseHandle (hObject=0x100) returned 1 [0141.315] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x4d44, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0141.315] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.316] GetProcessHeap () returned 0x4e0000 [0141.316] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0141.316] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0141.316] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0141.316] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xc, lpOverlapped=0x0) returned 1 [0141.318] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.318] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.318] GetProcessHeap () returned 0x4e0000 [0141.318] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0141.318] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0141.318] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.318] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0141.318] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0141.318] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0141.318] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0141.318] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0141.318] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0141.319] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.319] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.319] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.319] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4d44, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x4d44, lpOverlapped=0x0) returned 1 [0141.320] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x4d50, dwBufLen=0x4d50 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x4d50) returned 1 [0141.320] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.320] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4d50, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x4d50, lpOverlapped=0x0) returned 1 [0141.320] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.320] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x4e24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.320] SetEndOfFile (hFile=0x100) returned 1 [0141.322] GetProcessHeap () returned 0x4e0000 [0141.322] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0141.322] GetProcessHeap () returned 0x4e0000 [0141.322] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0141.322] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0141.323] CloseHandle (hObject=0x100) returned 1 [0141.323] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x4d44, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0141.323] GetProcessHeap () returned 0x4e0000 [0141.323] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0141.323] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0141.323] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df020 | out: pbData=0x4f53d8, pdwDataLen=0x24df020) returned 1 [0141.323] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.323] GetProcessHeap () returned 0x4e0000 [0141.323] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0141.323] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0141.323] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df020 | out: pbData=0x4f5420, pdwDataLen=0x24df020) returned 1 [0141.323] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.323] GetProcessHeap () returned 0x4e0000 [0141.323] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5273b0 [0141.324] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0141.324] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5273b0, pdwDataLen=0x24df020 | out: pbData=0x5273b0, pdwDataLen=0x24df020) returned 1 [0141.324] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.324] wsprintfW (in: param_1=0x24ddffc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\readme-warning.txt") returned 81 [0141.324] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.324] WriteFile (in: hFile=0x100, lpBuffer=0x5273b0*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddff8, lpOverlapped=0x0 | out: lpBuffer=0x5273b0*, lpNumberOfBytesWritten=0x24ddff8*=0x6c3, lpOverlapped=0x0) returned 1 [0141.325] CloseHandle (hObject=0x100) returned 1 [0141.325] GetProcessHeap () returned 0x4e0000 [0141.325] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273b0 | out: hHeap=0x4e0000) returned 1 [0141.325] GetProcessHeap () returned 0x4e0000 [0141.325] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0141.325] GetProcessHeap () returned 0x4e0000 [0141.325] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0141.325] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0141.325] GetProcessHeap () returned 0x4e0000 [0141.325] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0141.325] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AXIS", cAlternateFileName="")) returned 1 [0141.325] GetProcessHeap () returned 0x4e0000 [0141.326] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8a) returned 0x524ea0 [0141.326] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0141.327] GetProcessHeap () returned 0x4e0000 [0141.327] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x524ea0 | out: hHeap=0x4e0000) returned 1 [0141.327] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0141.327] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd394600, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd394600, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x189be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AXIS.ELM", cAlternateFileName="")) returned 1 [0141.327] GetProcessHeap () returned 0x4e0000 [0141.327] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x28c) returned 0x527118 [0141.327] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.327] GetProcessHeap () returned 0x4e0000 [0141.327] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0141.327] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0141.327] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0141.327] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x2, lpOverlapped=0x0) returned 1 [0141.329] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.329] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.329] GetProcessHeap () returned 0x4e0000 [0141.329] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0141.329] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30) returned 1 [0141.329] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.329] WriteFile (in: hFile=0x100, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24defc8*=0x30, lpOverlapped=0x0) returned 1 [0141.330] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0141.330] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0141.330] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0141.330] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0141.330] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0141.330] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.330] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.330] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.330] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x189be, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x189be, lpOverlapped=0x0) returned 1 [0141.332] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x189c0, dwBufLen=0x189c0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x189c0) returned 1 [0141.333] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.333] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x189c0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x189c0, lpOverlapped=0x0) returned 1 [0141.333] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.333] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x18a84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.333] SetEndOfFile (hFile=0x100) returned 1 [0141.336] GetProcessHeap () returned 0x4e0000 [0141.336] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0141.336] GetProcessHeap () returned 0x4e0000 [0141.336] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0141.336] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0141.337] CloseHandle (hObject=0x100) returned 1 [0141.337] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x211, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AXIS.INF", cAlternateFileName="")) returned 1 [0141.337] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.338] GetProcessHeap () returned 0x4e0000 [0141.338] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0141.338] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0141.338] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0141.338] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xf, lpOverlapped=0x0) returned 1 [0141.340] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.340] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.340] GetProcessHeap () returned 0x4e0000 [0141.340] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0141.340] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30) returned 1 [0141.340] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.340] WriteFile (in: hFile=0x100, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24defc8*=0x30, lpOverlapped=0x0) returned 1 [0141.340] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0141.340] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0141.340] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0141.340] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0141.340] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0141.341] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.341] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.341] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.341] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x211, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x211, lpOverlapped=0x0) returned 1 [0141.341] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x220, dwBufLen=0x220 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x220) returned 1 [0141.341] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.341] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x220, lpOverlapped=0x0) returned 1 [0141.341] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.341] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x2e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.341] SetEndOfFile (hFile=0x100) returned 1 [0141.343] GetProcessHeap () returned 0x4e0000 [0141.343] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0141.343] GetProcessHeap () returned 0x4e0000 [0141.343] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0141.343] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0141.346] CloseHandle (hObject=0x100) returned 1 [0141.346] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0xb20, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0141.346] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.346] GetProcessHeap () returned 0x4e0000 [0141.346] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0141.346] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0141.346] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0141.347] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.347] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.347] GetProcessHeap () returned 0x4e0000 [0141.347] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0141.347] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0141.347] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.347] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0141.348] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0141.349] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0141.349] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0141.349] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0141.349] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0141.349] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.349] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.349] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.349] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb20, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xb20, lpOverlapped=0x0) returned 1 [0141.349] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xb20, dwBufLen=0xb20 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xb20) returned 1 [0141.349] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.349] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xb20, lpOverlapped=0x0) returned 1 [0141.349] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.349] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xbf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.349] SetEndOfFile (hFile=0x100) returned 1 [0141.351] GetProcessHeap () returned 0x4e0000 [0141.351] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0141.351] GetProcessHeap () returned 0x4e0000 [0141.351] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0141.351] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0141.352] CloseHandle (hObject=0x100) returned 1 [0141.352] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x8864, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0141.352] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.352] GetProcessHeap () returned 0x4e0000 [0141.352] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0141.353] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0141.353] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0141.353] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xc, lpOverlapped=0x0) returned 1 [0141.354] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.354] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.354] GetProcessHeap () returned 0x4e0000 [0141.354] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0141.354] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0141.354] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.354] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0141.355] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0141.355] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0141.355] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0141.355] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0141.355] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0141.355] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.355] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.355] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.355] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x8864, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x8864, lpOverlapped=0x0) returned 1 [0141.356] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x8870, dwBufLen=0x8870 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x8870) returned 1 [0141.356] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.356] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x8870, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x8870, lpOverlapped=0x0) returned 1 [0141.357] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.357] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x8944, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.357] SetEndOfFile (hFile=0x100) returned 1 [0141.359] GetProcessHeap () returned 0x4e0000 [0141.359] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0141.359] GetProcessHeap () returned 0x4e0000 [0141.359] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0141.359] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0141.360] CloseHandle (hObject=0x100) returned 1 [0141.360] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x8864, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0141.360] GetProcessHeap () returned 0x4e0000 [0141.360] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0141.360] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0141.360] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df020 | out: pbData=0x4f53d8, pdwDataLen=0x24df020) returned 1 [0141.360] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.360] GetProcessHeap () returned 0x4e0000 [0141.360] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0141.360] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0141.360] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df020 | out: pbData=0x4f5420, pdwDataLen=0x24df020) returned 1 [0141.360] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.360] GetProcessHeap () returned 0x4e0000 [0141.360] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5273b0 [0141.360] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0141.360] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5273b0, pdwDataLen=0x24df020 | out: pbData=0x5273b0, pdwDataLen=0x24df020) returned 1 [0141.360] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.360] wsprintfW (in: param_1=0x24ddffc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\readme-warning.txt") returned 79 [0141.360] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.361] WriteFile (in: hFile=0x100, lpBuffer=0x5273b0*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddff8, lpOverlapped=0x0 | out: lpBuffer=0x5273b0*, lpNumberOfBytesWritten=0x24ddff8*=0x6c3, lpOverlapped=0x0) returned 1 [0141.362] CloseHandle (hObject=0x100) returned 1 [0141.362] GetProcessHeap () returned 0x4e0000 [0141.362] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273b0 | out: hHeap=0x4e0000) returned 1 [0141.362] GetProcessHeap () returned 0x4e0000 [0141.362] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0141.362] GetProcessHeap () returned 0x4e0000 [0141.362] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0141.362] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0141.363] GetProcessHeap () returned 0x4e0000 [0141.363] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0141.363] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BLENDS", cAlternateFileName="")) returned 1 [0141.363] GetProcessHeap () returned 0x4e0000 [0141.363] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8e) returned 0x524ea0 [0141.363] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0141.367] GetProcessHeap () returned 0x4e0000 [0141.367] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x524ea0 | out: hHeap=0x4e0000) returned 1 [0141.367] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0141.367] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe32f2700, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe32f2700, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x10db7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BLENDS.ELM", cAlternateFileName="")) returned 1 [0141.368] GetProcessHeap () returned 0x4e0000 [0141.368] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x290) returned 0x527118 [0141.368] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.368] GetProcessHeap () returned 0x4e0000 [0141.368] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0141.368] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0141.368] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0141.368] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x9, lpOverlapped=0x0) returned 1 [0141.371] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.371] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.371] GetProcessHeap () returned 0x4e0000 [0141.371] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0141.371] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30) returned 1 [0141.371] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.371] WriteFile (in: hFile=0x100, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24defc8*=0x30, lpOverlapped=0x0) returned 1 [0141.371] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0141.371] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0141.371] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0141.371] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0141.371] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0141.372] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.372] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.372] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.372] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x10db7, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x10db7, lpOverlapped=0x0) returned 1 [0141.373] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x10dc0, dwBufLen=0x10dc0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x10dc0) returned 1 [0141.374] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.374] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x10dc0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x10dc0, lpOverlapped=0x0) returned 1 [0141.375] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.375] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x10e84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.375] SetEndOfFile (hFile=0x100) returned 1 [0141.378] GetProcessHeap () returned 0x4e0000 [0141.378] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0141.378] GetProcessHeap () returned 0x4e0000 [0141.378] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0141.378] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0141.379] CloseHandle (hObject=0x100) returned 1 [0141.379] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb59ad00, ftCreationTime.dwHighDateTime=0x1c4d794, ftLastAccessTime.dwLowDateTime=0x5f729350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcb59ad00, ftLastWriteTime.dwHighDateTime=0x1c4d794, nFileSizeHigh=0x0, nFileSizeLow=0x216, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BLENDS.INF", cAlternateFileName="")) returned 1 [0141.379] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.381] GetProcessHeap () returned 0x4e0000 [0141.381] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0141.381] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0141.381] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0141.381] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xa, lpOverlapped=0x0) returned 1 [0141.383] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.383] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.383] GetProcessHeap () returned 0x4e0000 [0141.383] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0141.383] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30) returned 1 [0141.383] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.383] WriteFile (in: hFile=0x100, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24defc8*=0x30, lpOverlapped=0x0) returned 1 [0141.383] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0141.383] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0141.383] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0141.383] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0141.384] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0141.384] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.384] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.384] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.384] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x216, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x216, lpOverlapped=0x0) returned 1 [0141.384] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x220, dwBufLen=0x220 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x220) returned 1 [0141.384] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.384] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x220, lpOverlapped=0x0) returned 1 [0141.384] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.384] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x2e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.384] SetEndOfFile (hFile=0x100) returned 1 [0141.387] GetProcessHeap () returned 0x4e0000 [0141.387] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0141.387] GetProcessHeap () returned 0x4e0000 [0141.387] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0141.387] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0141.390] CloseHandle (hObject=0x100) returned 1 [0141.390] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6d2cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x885, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0141.390] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.392] GetProcessHeap () returned 0x4e0000 [0141.392] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0141.392] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0141.392] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0141.392] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xb, lpOverlapped=0x0) returned 1 [0141.394] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.394] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.394] GetProcessHeap () returned 0x4e0000 [0141.394] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0141.394] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0141.394] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.394] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0141.394] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0141.395] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0141.395] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0141.395] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0141.395] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0141.395] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.395] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.395] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.395] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x885, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x885, lpOverlapped=0x0) returned 1 [0141.395] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x890, dwBufLen=0x890 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x890) returned 1 [0141.395] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.395] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x890, lpOverlapped=0x0) returned 1 [0141.395] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.395] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x964, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.396] SetEndOfFile (hFile=0x100) returned 1 [0141.398] GetProcessHeap () returned 0x4e0000 [0141.398] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0141.398] GetProcessHeap () returned 0x4e0000 [0141.398] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0141.398] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0141.420] CloseHandle (hObject=0x100) returned 1 [0141.420] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5093, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0141.420] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.420] GetProcessHeap () returned 0x4e0000 [0141.420] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0141.420] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0141.420] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0141.421] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xd, lpOverlapped=0x0) returned 1 [0141.441] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.441] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.442] GetProcessHeap () returned 0x4e0000 [0141.442] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0141.442] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0141.442] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.442] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0141.442] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0141.442] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0141.442] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0141.442] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0141.442] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0141.442] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.443] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.443] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.443] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5093, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x5093, lpOverlapped=0x0) returned 1 [0141.444] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x50a0, dwBufLen=0x50a0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x50a0) returned 1 [0141.444] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.444] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x50a0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x50a0, lpOverlapped=0x0) returned 1 [0141.444] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.444] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x5174, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.444] SetEndOfFile (hFile=0x100) returned 1 [0141.447] GetProcessHeap () returned 0x4e0000 [0141.447] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0141.447] GetProcessHeap () returned 0x4e0000 [0141.447] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0141.447] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0141.448] CloseHandle (hObject=0x100) returned 1 [0141.448] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5093, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0141.448] GetProcessHeap () returned 0x4e0000 [0141.449] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0141.449] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0141.449] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df020 | out: pbData=0x4f53d8, pdwDataLen=0x24df020) returned 1 [0141.449] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.449] GetProcessHeap () returned 0x4e0000 [0141.449] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0141.449] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0141.449] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df020 | out: pbData=0x4f5420, pdwDataLen=0x24df020) returned 1 [0141.449] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.449] GetProcessHeap () returned 0x4e0000 [0141.449] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5273b0 [0141.449] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0141.449] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5273b0, pdwDataLen=0x24df020 | out: pbData=0x5273b0, pdwDataLen=0x24df020) returned 1 [0141.449] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.449] wsprintfW (in: param_1=0x24ddffc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\readme-warning.txt") returned 81 [0141.449] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.450] WriteFile (in: hFile=0x100, lpBuffer=0x5273b0*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddff8, lpOverlapped=0x0 | out: lpBuffer=0x5273b0*, lpNumberOfBytesWritten=0x24ddff8*=0x6c3, lpOverlapped=0x0) returned 1 [0141.451] CloseHandle (hObject=0x100) returned 1 [0141.451] GetProcessHeap () returned 0x4e0000 [0141.451] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273b0 | out: hHeap=0x4e0000) returned 1 [0141.451] GetProcessHeap () returned 0x4e0000 [0141.451] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0141.451] GetProcessHeap () returned 0x4e0000 [0141.451] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0141.451] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0141.451] GetProcessHeap () returned 0x4e0000 [0141.451] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0141.451] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BLUECALM", cAlternateFileName="")) returned 1 [0141.451] GetProcessHeap () returned 0x4e0000 [0141.451] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x92) returned 0x4fa058 [0141.451] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0141.452] GetProcessHeap () returned 0x4e0000 [0141.452] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0141.452] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0141.452] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6c2ae00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5f775610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe6c2ae00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xc2ba, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BLUECALM.ELM", cAlternateFileName="")) returned 1 [0141.452] GetProcessHeap () returned 0x4e0000 [0141.452] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x294) returned 0x527118 [0141.452] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.452] GetProcessHeap () returned 0x4e0000 [0141.452] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0141.452] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0141.452] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0141.453] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x6, lpOverlapped=0x0) returned 1 [0141.455] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.455] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.455] GetProcessHeap () returned 0x4e0000 [0141.455] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0141.455] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0141.455] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.455] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0141.455] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0141.455] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0141.455] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0141.455] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0141.455] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0141.456] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.456] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.456] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.456] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xc2ba, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xc2ba, lpOverlapped=0x0) returned 1 [0141.457] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc2c0, dwBufLen=0xc2c0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc2c0) returned 1 [0141.458] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.458] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc2c0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xc2c0, lpOverlapped=0x0) returned 1 [0141.458] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.458] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xc394, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.458] SetEndOfFile (hFile=0x100) returned 1 [0141.461] GetProcessHeap () returned 0x4e0000 [0141.461] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0141.461] GetProcessHeap () returned 0x4e0000 [0141.461] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0141.461] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0141.462] CloseHandle (hObject=0x100) returned 1 [0141.462] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x227, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BLUECALM.INF", cAlternateFileName="")) returned 1 [0141.462] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.463] GetProcessHeap () returned 0x4e0000 [0141.463] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0141.463] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0141.463] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0141.463] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x9, lpOverlapped=0x0) returned 1 [0141.464] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.465] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.465] GetProcessHeap () returned 0x4e0000 [0141.465] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0141.465] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0141.465] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.465] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0141.465] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0141.465] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0141.465] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0141.465] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0141.465] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0141.465] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.466] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.466] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.466] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x227, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x227, lpOverlapped=0x0) returned 1 [0141.466] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x230, dwBufLen=0x230 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x230) returned 1 [0141.466] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.466] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x230, lpOverlapped=0x0) returned 1 [0141.466] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.466] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x304, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.466] SetEndOfFile (hFile=0x100) returned 1 [0141.468] GetProcessHeap () returned 0x4e0000 [0141.469] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0141.469] GetProcessHeap () returned 0x4e0000 [0141.469] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0141.469] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0141.471] CloseHandle (hObject=0x100) returned 1 [0141.471] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6d2cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x618, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0141.471] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.471] GetProcessHeap () returned 0x4e0000 [0141.471] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0141.472] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0141.472] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0141.472] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0141.473] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.473] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.473] GetProcessHeap () returned 0x4e0000 [0141.473] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0141.473] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0141.473] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.473] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0141.474] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0141.474] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0141.474] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0141.474] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0141.474] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0141.474] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.474] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.474] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.474] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x618, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x618, lpOverlapped=0x0) returned 1 [0141.474] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x620, dwBufLen=0x620 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x620) returned 1 [0141.474] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.474] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x620, lpOverlapped=0x0) returned 1 [0141.474] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.474] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x6f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.474] SetEndOfFile (hFile=0x100) returned 1 [0141.476] GetProcessHeap () returned 0x4e0000 [0141.476] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0141.476] GetProcessHeap () returned 0x4e0000 [0141.476] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0141.476] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0141.477] CloseHandle (hObject=0x100) returned 1 [0141.477] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x80f1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0141.477] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.477] GetProcessHeap () returned 0x4e0000 [0141.477] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0141.477] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0141.478] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0141.478] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xf, lpOverlapped=0x0) returned 1 [0141.479] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.479] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.479] GetProcessHeap () returned 0x4e0000 [0141.479] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0141.479] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0141.479] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.479] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0141.479] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0141.480] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0141.480] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0141.480] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0141.480] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0141.480] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.480] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.480] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.480] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x80f1, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x80f1, lpOverlapped=0x0) returned 1 [0141.481] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x8100, dwBufLen=0x8100 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x8100) returned 1 [0141.481] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.481] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x8100, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x8100, lpOverlapped=0x0) returned 1 [0141.481] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.481] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x81d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.482] SetEndOfFile (hFile=0x100) returned 1 [0141.484] GetProcessHeap () returned 0x4e0000 [0141.484] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0141.484] GetProcessHeap () returned 0x4e0000 [0141.484] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0141.484] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0141.484] CloseHandle (hObject=0x100) returned 1 [0141.485] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x80f1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0141.485] GetProcessHeap () returned 0x4e0000 [0141.485] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0141.485] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0141.485] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df020 | out: pbData=0x4f53d8, pdwDataLen=0x24df020) returned 1 [0141.485] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.485] GetProcessHeap () returned 0x4e0000 [0141.485] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0141.485] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0141.485] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df020 | out: pbData=0x4f5420, pdwDataLen=0x24df020) returned 1 [0141.485] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.485] GetProcessHeap () returned 0x4e0000 [0141.485] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5273b8 [0141.485] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0141.485] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5273b8, pdwDataLen=0x24df020 | out: pbData=0x5273b8, pdwDataLen=0x24df020) returned 1 [0141.485] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.485] wsprintfW (in: param_1=0x24ddffc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\readme-warning.txt") returned 83 [0141.485] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.486] WriteFile (in: hFile=0x100, lpBuffer=0x5273b8*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddff8, lpOverlapped=0x0 | out: lpBuffer=0x5273b8*, lpNumberOfBytesWritten=0x24ddff8*=0x6c3, lpOverlapped=0x0) returned 1 [0141.486] CloseHandle (hObject=0x100) returned 1 [0141.487] GetProcessHeap () returned 0x4e0000 [0141.487] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273b8 | out: hHeap=0x4e0000) returned 1 [0141.487] GetProcessHeap () returned 0x4e0000 [0141.487] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0141.487] GetProcessHeap () returned 0x4e0000 [0141.487] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0141.487] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0141.487] GetProcessHeap () returned 0x4e0000 [0141.487] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0141.487] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BLUEPRNT", cAlternateFileName="")) returned 1 [0141.487] GetProcessHeap () returned 0x4e0000 [0141.487] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x92) returned 0x4fa058 [0141.487] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0141.488] GetProcessHeap () returned 0x4e0000 [0141.488] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0141.488] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0141.488] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7f3db00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe7f3db00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xda86, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BLUEPRNT.ELM", cAlternateFileName="")) returned 1 [0141.488] GetProcessHeap () returned 0x4e0000 [0141.488] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x294) returned 0x527118 [0141.488] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.488] GetProcessHeap () returned 0x4e0000 [0141.488] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0141.488] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0141.489] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0141.489] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xa, lpOverlapped=0x0) returned 1 [0141.490] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.490] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.490] GetProcessHeap () returned 0x4e0000 [0141.490] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0141.491] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0141.491] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.491] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0141.491] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0141.491] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0141.491] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0141.491] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0141.491] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0141.491] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.491] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.491] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.491] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xda86, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xda86, lpOverlapped=0x0) returned 1 [0141.492] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xda90, dwBufLen=0xda90 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xda90) returned 1 [0141.493] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.493] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xda90, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xda90, lpOverlapped=0x0) returned 1 [0141.493] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.493] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xdb64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.493] SetEndOfFile (hFile=0x100) returned 1 [0141.496] GetProcessHeap () returned 0x4e0000 [0141.496] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0141.496] GetProcessHeap () returned 0x4e0000 [0141.496] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0141.496] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0141.497] CloseHandle (hObject=0x100) returned 1 [0141.497] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5fbc5df0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x225, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BLUEPRNT.INF", cAlternateFileName="")) returned 1 [0141.497] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.498] GetProcessHeap () returned 0x4e0000 [0141.498] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0141.498] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0141.498] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0141.498] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xb, lpOverlapped=0x0) returned 1 [0141.499] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.499] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.499] GetProcessHeap () returned 0x4e0000 [0141.499] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0141.499] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0141.499] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.499] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0141.499] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0141.499] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0141.500] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0141.500] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0141.500] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0141.500] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.500] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.500] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.500] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x225, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x225, lpOverlapped=0x0) returned 1 [0141.500] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x230, dwBufLen=0x230 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x230) returned 1 [0141.500] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.500] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x230, lpOverlapped=0x0) returned 1 [0141.500] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.500] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x304, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.500] SetEndOfFile (hFile=0x100) returned 1 [0141.503] GetProcessHeap () returned 0x4e0000 [0141.503] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0141.503] GetProcessHeap () returned 0x4e0000 [0141.503] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0141.503] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0141.505] CloseHandle (hObject=0x100) returned 1 [0141.505] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x785, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0141.505] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.506] GetProcessHeap () returned 0x4e0000 [0141.506] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0141.506] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0141.506] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0141.506] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xb, lpOverlapped=0x0) returned 1 [0141.507] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.507] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.507] GetProcessHeap () returned 0x4e0000 [0141.508] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0141.508] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0141.508] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.508] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0141.508] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0141.508] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0141.508] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0141.508] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0141.508] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0141.508] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.508] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.508] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.508] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x785, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x785, lpOverlapped=0x0) returned 1 [0141.508] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x790, dwBufLen=0x790 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x790) returned 1 [0141.508] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.508] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x790, lpOverlapped=0x0) returned 1 [0141.508] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.508] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x864, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.508] SetEndOfFile (hFile=0x100) returned 1 [0141.510] GetProcessHeap () returned 0x4e0000 [0141.510] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0141.511] GetProcessHeap () returned 0x4e0000 [0141.511] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0141.511] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0141.511] CloseHandle (hObject=0x100) returned 1 [0141.511] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6b0f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0141.511] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.513] GetProcessHeap () returned 0x4e0000 [0141.513] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0141.513] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0141.513] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0141.513] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x1, lpOverlapped=0x0) returned 1 [0141.515] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.515] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.515] GetProcessHeap () returned 0x4e0000 [0141.515] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0141.515] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0141.515] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.515] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0141.515] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0141.515] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0141.516] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0141.516] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0141.516] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0141.516] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.516] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.516] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.516] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x6b0f, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x6b0f, lpOverlapped=0x0) returned 1 [0141.517] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x6b10, dwBufLen=0x6b10 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x6b10) returned 1 [0141.518] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.518] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6b10, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x6b10, lpOverlapped=0x0) returned 1 [0141.518] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.518] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x6be4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.518] SetEndOfFile (hFile=0x100) returned 1 [0141.521] GetProcessHeap () returned 0x4e0000 [0141.521] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0141.521] GetProcessHeap () returned 0x4e0000 [0141.521] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0141.521] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0141.522] CloseHandle (hObject=0x100) returned 1 [0141.522] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6b0f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0141.522] GetProcessHeap () returned 0x4e0000 [0141.522] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0141.523] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0141.523] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df020 | out: pbData=0x4f53d8, pdwDataLen=0x24df020) returned 1 [0141.523] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.523] GetProcessHeap () returned 0x4e0000 [0141.523] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0141.523] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0141.523] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df020 | out: pbData=0x4f5420, pdwDataLen=0x24df020) returned 1 [0141.523] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.523] GetProcessHeap () returned 0x4e0000 [0141.523] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5273b8 [0141.523] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0141.524] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5273b8, pdwDataLen=0x24df020 | out: pbData=0x5273b8, pdwDataLen=0x24df020) returned 1 [0141.524] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.524] wsprintfW (in: param_1=0x24ddffc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\readme-warning.txt") returned 83 [0141.524] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.524] WriteFile (in: hFile=0x100, lpBuffer=0x5273b8*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddff8, lpOverlapped=0x0 | out: lpBuffer=0x5273b8*, lpNumberOfBytesWritten=0x24ddff8*=0x6c3, lpOverlapped=0x0) returned 1 [0141.527] CloseHandle (hObject=0x100) returned 1 [0141.527] GetProcessHeap () returned 0x4e0000 [0141.527] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273b8 | out: hHeap=0x4e0000) returned 1 [0141.527] GetProcessHeap () returned 0x4e0000 [0141.527] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0141.527] GetProcessHeap () returned 0x4e0000 [0141.527] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0141.527] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0141.527] GetProcessHeap () returned 0x4e0000 [0141.527] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0141.527] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BOLDSTRI", cAlternateFileName="")) returned 1 [0141.527] GetProcessHeap () returned 0x4e0000 [0141.527] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x92) returned 0x4fa058 [0141.527] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0141.528] GetProcessHeap () returned 0x4e0000 [0141.528] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0141.528] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0141.528] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9250800, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe9250800, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xeafa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BOLDSTRI.ELM", cAlternateFileName="")) returned 1 [0141.528] GetProcessHeap () returned 0x4e0000 [0141.528] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x294) returned 0x527118 [0141.529] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.529] GetProcessHeap () returned 0x4e0000 [0141.529] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0141.529] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0141.529] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0141.529] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x6, lpOverlapped=0x0) returned 1 [0141.530] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.530] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.530] GetProcessHeap () returned 0x4e0000 [0141.531] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0141.531] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0141.531] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.531] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0141.531] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0141.531] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0141.531] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0141.531] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0141.531] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0141.531] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.531] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.531] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.531] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xeafa, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xeafa, lpOverlapped=0x0) returned 1 [0141.532] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xeb00, dwBufLen=0xeb00 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xeb00) returned 1 [0141.533] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.533] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xeb00, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xeb00, lpOverlapped=0x0) returned 1 [0141.533] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.533] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xebd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.533] SetEndOfFile (hFile=0x100) returned 1 [0141.536] GetProcessHeap () returned 0x4e0000 [0141.536] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0141.536] GetProcessHeap () returned 0x4e0000 [0141.536] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0141.536] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0141.537] CloseHandle (hObject=0x100) returned 1 [0141.537] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x254, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BOLDSTRI.INF", cAlternateFileName="")) returned 1 [0141.537] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.537] GetProcessHeap () returned 0x4e0000 [0141.537] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0141.537] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0141.537] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0141.537] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xc, lpOverlapped=0x0) returned 1 [0141.539] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.539] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.539] GetProcessHeap () returned 0x4e0000 [0141.539] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0141.539] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0141.539] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.539] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0141.539] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0141.539] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0141.539] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0141.539] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0141.539] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0141.540] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.540] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.540] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.540] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x254, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x254, lpOverlapped=0x0) returned 1 [0141.540] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x260, dwBufLen=0x260 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x260) returned 1 [0141.540] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.540] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x260, lpOverlapped=0x0) returned 1 [0141.540] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.540] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x334, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.540] SetEndOfFile (hFile=0x100) returned 1 [0141.542] GetProcessHeap () returned 0x4e0000 [0141.542] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0141.542] GetProcessHeap () returned 0x4e0000 [0141.542] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0141.542] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0141.545] CloseHandle (hObject=0x100) returned 1 [0141.545] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xd97, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0141.545] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.546] GetProcessHeap () returned 0x4e0000 [0141.546] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0141.546] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0141.546] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0141.546] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x9, lpOverlapped=0x0) returned 1 [0141.548] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.548] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.548] GetProcessHeap () returned 0x4e0000 [0141.548] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0141.548] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0141.548] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.548] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0141.548] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0141.548] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0141.548] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0141.548] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0141.548] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0141.549] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.549] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.549] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.549] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xd97, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xd97, lpOverlapped=0x0) returned 1 [0141.549] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xda0, dwBufLen=0xda0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xda0) returned 1 [0141.549] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.549] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xda0, lpOverlapped=0x0) returned 1 [0141.549] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.549] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xe74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.549] SetEndOfFile (hFile=0x100) returned 1 [0141.551] GetProcessHeap () returned 0x4e0000 [0141.551] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0141.551] GetProcessHeap () returned 0x4e0000 [0141.551] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0141.551] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0141.555] CloseHandle (hObject=0x100) returned 1 [0141.555] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7c5d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0141.555] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.555] GetProcessHeap () returned 0x4e0000 [0141.555] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0141.555] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0141.556] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0141.556] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x3, lpOverlapped=0x0) returned 1 [0141.558] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.558] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.558] GetProcessHeap () returned 0x4e0000 [0141.558] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0141.558] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0141.558] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.558] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0141.558] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0141.558] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0141.558] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0141.558] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0141.558] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0141.558] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.558] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.559] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.559] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7c5d, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x7c5d, lpOverlapped=0x0) returned 1 [0141.563] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x7c60, dwBufLen=0x7c60 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x7c60) returned 1 [0141.563] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.563] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7c60, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x7c60, lpOverlapped=0x0) returned 1 [0141.563] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.563] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x7d34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.563] SetEndOfFile (hFile=0x100) returned 1 [0141.566] GetProcessHeap () returned 0x4e0000 [0141.566] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0141.566] GetProcessHeap () returned 0x4e0000 [0141.566] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0141.566] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0141.567] CloseHandle (hObject=0x100) returned 1 [0141.568] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7c5d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0141.568] GetProcessHeap () returned 0x4e0000 [0141.568] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0141.568] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0141.568] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df020 | out: pbData=0x4f53d8, pdwDataLen=0x24df020) returned 1 [0141.568] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.568] GetProcessHeap () returned 0x4e0000 [0141.568] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0141.568] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0141.568] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df020 | out: pbData=0x4f5420, pdwDataLen=0x24df020) returned 1 [0141.568] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.568] GetProcessHeap () returned 0x4e0000 [0141.568] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5273b8 [0141.568] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0141.568] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5273b8, pdwDataLen=0x24df020 | out: pbData=0x5273b8, pdwDataLen=0x24df020) returned 1 [0141.568] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.568] wsprintfW (in: param_1=0x24ddffc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\readme-warning.txt") returned 83 [0141.568] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.569] WriteFile (in: hFile=0x100, lpBuffer=0x5273b8*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddff8, lpOverlapped=0x0 | out: lpBuffer=0x5273b8*, lpNumberOfBytesWritten=0x24ddff8*=0x6c3, lpOverlapped=0x0) returned 1 [0141.571] CloseHandle (hObject=0x100) returned 1 [0141.571] GetProcessHeap () returned 0x4e0000 [0141.571] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273b8 | out: hHeap=0x4e0000) returned 1 [0141.571] GetProcessHeap () returned 0x4e0000 [0141.571] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0141.571] GetProcessHeap () returned 0x4e0000 [0141.571] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0141.571] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0141.571] GetProcessHeap () returned 0x4e0000 [0141.571] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0141.572] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BREEZE", cAlternateFileName="")) returned 1 [0141.572] GetProcessHeap () returned 0x4e0000 [0141.572] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8e) returned 0x524ea0 [0141.572] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0141.573] GetProcessHeap () returned 0x4e0000 [0141.573] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x524ea0 | out: hHeap=0x4e0000) returned 1 [0141.573] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0141.573] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea563500, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a61ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xea563500, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x1a537, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BREEZE.ELM", cAlternateFileName="")) returned 1 [0141.573] GetProcessHeap () returned 0x4e0000 [0141.573] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x290) returned 0x527118 [0141.573] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.573] GetProcessHeap () returned 0x4e0000 [0141.573] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0141.573] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0141.573] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0141.574] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x9, lpOverlapped=0x0) returned 1 [0141.576] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.576] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.576] GetProcessHeap () returned 0x4e0000 [0141.576] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0141.576] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30) returned 1 [0141.576] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.576] WriteFile (in: hFile=0x100, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24defc8*=0x30, lpOverlapped=0x0) returned 1 [0141.576] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0141.576] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0141.576] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0141.576] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0141.576] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0141.577] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.577] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.577] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.577] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1a537, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x1a537, lpOverlapped=0x0) returned 1 [0141.579] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1a540, dwBufLen=0x1a540 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1a540) returned 1 [0141.580] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.580] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1a540, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x1a540, lpOverlapped=0x0) returned 1 [0141.580] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.580] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1a604, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.581] SetEndOfFile (hFile=0x100) returned 1 [0141.584] GetProcessHeap () returned 0x4e0000 [0141.584] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0141.584] GetProcessHeap () returned 0x4e0000 [0141.584] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0141.584] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0141.585] CloseHandle (hObject=0x100) returned 1 [0141.585] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6003c730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1c2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BREEZE.INF", cAlternateFileName="")) returned 1 [0141.585] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.618] GetProcessHeap () returned 0x4e0000 [0141.618] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0141.619] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0141.619] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0141.619] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xe, lpOverlapped=0x0) returned 1 [0141.620] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.620] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.620] GetProcessHeap () returned 0x4e0000 [0141.620] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0141.621] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30) returned 1 [0141.621] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.621] WriteFile (in: hFile=0x100, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24defc8*=0x30, lpOverlapped=0x0) returned 1 [0141.621] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0141.621] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0141.621] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0141.621] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0141.621] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0141.621] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.621] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.621] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.621] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1c2, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x1c2, lpOverlapped=0x0) returned 1 [0141.621] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1d0) returned 1 [0141.622] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.622] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x1d0, lpOverlapped=0x0) returned 1 [0141.622] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.622] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x294, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.622] SetEndOfFile (hFile=0x100) returned 1 [0141.624] GetProcessHeap () returned 0x4e0000 [0141.624] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0141.624] GetProcessHeap () returned 0x4e0000 [0141.624] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0141.625] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0141.630] CloseHandle (hObject=0x100) returned 1 [0141.630] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xaa2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0141.630] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.631] GetProcessHeap () returned 0x4e0000 [0141.631] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0141.631] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0141.631] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0141.631] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xe, lpOverlapped=0x0) returned 1 [0141.634] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.634] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.634] GetProcessHeap () returned 0x4e0000 [0141.634] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0141.634] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0141.634] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.634] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0141.634] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0141.634] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0141.634] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0141.634] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0141.634] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0141.635] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.635] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.635] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.635] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xaa2, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xaa2, lpOverlapped=0x0) returned 1 [0141.635] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xab0, dwBufLen=0xab0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xab0) returned 1 [0141.635] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.635] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xab0, lpOverlapped=0x0) returned 1 [0141.635] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.635] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xb84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.635] SetEndOfFile (hFile=0x100) returned 1 [0141.638] GetProcessHeap () returned 0x4e0000 [0141.638] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0141.638] GetProcessHeap () returned 0x4e0000 [0141.638] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0141.638] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0141.639] CloseHandle (hObject=0x100) returned 1 [0141.639] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa90c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0141.639] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.640] GetProcessHeap () returned 0x4e0000 [0141.640] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0141.640] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0141.640] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0141.640] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0141.642] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.642] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.642] GetProcessHeap () returned 0x4e0000 [0141.642] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0141.642] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0141.643] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.643] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0141.643] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0141.643] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0141.643] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0141.643] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0141.643] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0141.643] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.643] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.643] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.643] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xa90c, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xa90c, lpOverlapped=0x0) returned 1 [0141.645] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xa910, dwBufLen=0xa910 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xa910) returned 1 [0141.645] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.645] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xa910, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xa910, lpOverlapped=0x0) returned 1 [0141.645] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.645] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xa9e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.646] SetEndOfFile (hFile=0x100) returned 1 [0141.649] GetProcessHeap () returned 0x4e0000 [0141.649] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0141.649] GetProcessHeap () returned 0x4e0000 [0141.649] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0141.649] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0141.650] CloseHandle (hObject=0x100) returned 1 [0141.650] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa90c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0141.650] GetProcessHeap () returned 0x4e0000 [0141.650] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0141.650] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0141.650] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df020 | out: pbData=0x4f53d8, pdwDataLen=0x24df020) returned 1 [0141.650] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.650] GetProcessHeap () returned 0x4e0000 [0141.650] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0141.650] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0141.650] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df020 | out: pbData=0x4f5420, pdwDataLen=0x24df020) returned 1 [0141.650] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.650] GetProcessHeap () returned 0x4e0000 [0141.650] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5273b0 [0141.650] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0141.650] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5273b0, pdwDataLen=0x24df020 | out: pbData=0x5273b0, pdwDataLen=0x24df020) returned 1 [0141.650] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.651] wsprintfW (in: param_1=0x24ddffc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\readme-warning.txt") returned 81 [0141.651] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.651] WriteFile (in: hFile=0x100, lpBuffer=0x5273b0*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddff8, lpOverlapped=0x0 | out: lpBuffer=0x5273b0*, lpNumberOfBytesWritten=0x24ddff8*=0x6c3, lpOverlapped=0x0) returned 1 [0141.652] CloseHandle (hObject=0x100) returned 1 [0141.653] GetProcessHeap () returned 0x4e0000 [0141.653] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273b0 | out: hHeap=0x4e0000) returned 1 [0141.653] GetProcessHeap () returned 0x4e0000 [0141.653] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0141.653] GetProcessHeap () returned 0x4e0000 [0141.653] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0141.653] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0141.653] GetProcessHeap () returned 0x4e0000 [0141.653] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0141.653] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CANYON", cAlternateFileName="")) returned 1 [0141.653] GetProcessHeap () returned 0x4e0000 [0141.653] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8e) returned 0x524ea0 [0141.653] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0141.654] GetProcessHeap () returned 0x4e0000 [0141.654] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x524ea0 | out: hHeap=0x4e0000) returned 1 [0141.654] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0141.654] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb876200, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51c2ab50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb876200, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xaec9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CANYON.ELM", cAlternateFileName="")) returned 1 [0141.654] GetProcessHeap () returned 0x4e0000 [0141.654] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x290) returned 0x527118 [0141.654] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.656] GetProcessHeap () returned 0x4e0000 [0141.656] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0141.656] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0141.656] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0141.656] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x7, lpOverlapped=0x0) returned 1 [0141.658] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.658] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.658] GetProcessHeap () returned 0x4e0000 [0141.658] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0141.659] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30) returned 1 [0141.659] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.659] WriteFile (in: hFile=0x100, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24defc8*=0x30, lpOverlapped=0x0) returned 1 [0141.659] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0141.659] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0141.659] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0141.659] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0141.659] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0141.659] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.659] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.659] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.659] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xaec9, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xaec9, lpOverlapped=0x0) returned 1 [0141.661] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xaed0, dwBufLen=0xaed0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xaed0) returned 1 [0141.661] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.661] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xaed0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xaed0, lpOverlapped=0x0) returned 1 [0141.661] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.662] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xaf94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.662] SetEndOfFile (hFile=0x100) returned 1 [0141.665] GetProcessHeap () returned 0x4e0000 [0141.665] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0141.665] GetProcessHeap () returned 0x4e0000 [0141.665] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0141.665] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0141.666] CloseHandle (hObject=0x100) returned 1 [0141.666] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x603362b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1d1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CANYON.INF", cAlternateFileName="")) returned 1 [0141.666] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.667] GetProcessHeap () returned 0x4e0000 [0141.667] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0141.668] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0141.668] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0141.668] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xf, lpOverlapped=0x0) returned 1 [0141.669] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.670] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.670] GetProcessHeap () returned 0x4e0000 [0141.670] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0141.670] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30) returned 1 [0141.670] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.670] WriteFile (in: hFile=0x100, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24defc8*=0x30, lpOverlapped=0x0) returned 1 [0141.670] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0141.670] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0141.670] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0141.670] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0141.670] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0141.670] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.670] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.670] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.671] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1d1, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x1d1, lpOverlapped=0x0) returned 1 [0141.671] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1e0) returned 1 [0141.671] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.671] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x1e0, lpOverlapped=0x0) returned 1 [0141.671] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.671] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x2a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.671] SetEndOfFile (hFile=0x100) returned 1 [0141.674] GetProcessHeap () returned 0x4e0000 [0141.674] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0141.674] GetProcessHeap () returned 0x4e0000 [0141.674] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0141.674] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0141.677] CloseHandle (hObject=0x100) returned 1 [0141.678] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3b1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0141.678] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.678] GetProcessHeap () returned 0x4e0000 [0141.678] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0141.678] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0141.678] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0141.678] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xf, lpOverlapped=0x0) returned 1 [0141.681] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.681] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.681] GetProcessHeap () returned 0x4e0000 [0141.681] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0141.681] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0141.681] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.681] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0141.681] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0141.681] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0141.681] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0141.681] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0141.681] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0141.681] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.682] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.682] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.682] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3b1, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x3b1, lpOverlapped=0x0) returned 1 [0141.682] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x3c0, dwBufLen=0x3c0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x3c0) returned 1 [0141.682] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.682] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x3c0, lpOverlapped=0x0) returned 1 [0141.682] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.682] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.682] SetEndOfFile (hFile=0x100) returned 1 [0141.685] GetProcessHeap () returned 0x4e0000 [0141.685] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0141.685] GetProcessHeap () returned 0x4e0000 [0141.685] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0141.685] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0141.685] CloseHandle (hObject=0x100) returned 1 [0141.686] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7f5f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0141.686] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.686] GetProcessHeap () returned 0x4e0000 [0141.686] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0141.686] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0141.686] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0141.686] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x1, lpOverlapped=0x0) returned 1 [0141.688] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.688] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.688] GetProcessHeap () returned 0x4e0000 [0141.688] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0141.688] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0141.689] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.689] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0141.689] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0141.689] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0141.689] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0141.689] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0141.689] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0141.689] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.689] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.689] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.690] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7f5f, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x7f5f, lpOverlapped=0x0) returned 1 [0141.693] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x7f60, dwBufLen=0x7f60 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x7f60) returned 1 [0141.693] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.693] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7f60, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x7f60, lpOverlapped=0x0) returned 1 [0141.693] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.694] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x8034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.694] SetEndOfFile (hFile=0x100) returned 1 [0141.697] GetProcessHeap () returned 0x4e0000 [0141.697] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0141.697] GetProcessHeap () returned 0x4e0000 [0141.697] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0141.697] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0141.698] CloseHandle (hObject=0x100) returned 1 [0141.698] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7f5f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0141.698] GetProcessHeap () returned 0x4e0000 [0141.698] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0141.698] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0141.698] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df020 | out: pbData=0x4f53d8, pdwDataLen=0x24df020) returned 1 [0141.698] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.698] GetProcessHeap () returned 0x4e0000 [0141.698] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0141.698] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0141.698] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df020 | out: pbData=0x4f5420, pdwDataLen=0x24df020) returned 1 [0141.698] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.698] GetProcessHeap () returned 0x4e0000 [0141.698] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5273b0 [0141.698] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0141.699] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5273b0, pdwDataLen=0x24df020 | out: pbData=0x5273b0, pdwDataLen=0x24df020) returned 1 [0141.699] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.699] wsprintfW (in: param_1=0x24ddffc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\readme-warning.txt") returned 81 [0141.699] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.700] WriteFile (in: hFile=0x100, lpBuffer=0x5273b0*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddff8, lpOverlapped=0x0 | out: lpBuffer=0x5273b0*, lpNumberOfBytesWritten=0x24ddff8*=0x6c3, lpOverlapped=0x0) returned 1 [0141.701] CloseHandle (hObject=0x100) returned 1 [0141.701] GetProcessHeap () returned 0x4e0000 [0141.701] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273b0 | out: hHeap=0x4e0000) returned 1 [0141.701] GetProcessHeap () returned 0x4e0000 [0141.701] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0141.701] GetProcessHeap () returned 0x4e0000 [0141.701] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0141.701] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0141.702] GetProcessHeap () returned 0x4e0000 [0141.702] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0141.702] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CAPSULES", cAlternateFileName="")) returned 1 [0141.702] GetProcessHeap () returned 0x4e0000 [0141.702] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x92) returned 0x4fa058 [0141.702] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0141.702] GetProcessHeap () returned 0x4e0000 [0141.702] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0141.702] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0141.702] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecb88f00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x603362b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xecb88f00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xe1ba, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CAPSULES.ELM", cAlternateFileName="")) returned 1 [0141.702] GetProcessHeap () returned 0x4e0000 [0141.702] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x294) returned 0x527118 [0141.702] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.704] GetProcessHeap () returned 0x4e0000 [0141.704] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0141.704] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0141.704] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0141.704] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x6, lpOverlapped=0x0) returned 1 [0141.706] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.706] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.706] GetProcessHeap () returned 0x4e0000 [0141.706] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0141.706] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0141.706] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.706] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0141.706] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0141.706] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0141.706] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0141.706] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0141.706] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0141.707] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.707] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.707] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.707] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xe1ba, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xe1ba, lpOverlapped=0x0) returned 1 [0141.708] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xe1c0, dwBufLen=0xe1c0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xe1c0) returned 1 [0141.709] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.709] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe1c0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xe1c0, lpOverlapped=0x0) returned 1 [0141.710] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.710] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xe294, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.710] SetEndOfFile (hFile=0x100) returned 1 [0141.713] GetProcessHeap () returned 0x4e0000 [0141.713] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0141.713] GetProcessHeap () returned 0x4e0000 [0141.713] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0141.713] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0141.714] CloseHandle (hObject=0x100) returned 1 [0141.714] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf86a7300, ftCreationTime.dwHighDateTime=0x1c47827, ftLastAccessTime.dwLowDateTime=0x51c2ab50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf86a7300, ftLastWriteTime.dwHighDateTime=0x1c47827, nFileSizeHigh=0x0, nFileSizeLow=0x1f5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CAPSULES.INF", cAlternateFileName="")) returned 1 [0141.714] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.715] GetProcessHeap () returned 0x4e0000 [0141.715] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0141.715] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0141.715] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0141.715] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xb, lpOverlapped=0x0) returned 1 [0141.717] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.717] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.717] GetProcessHeap () returned 0x4e0000 [0141.717] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0141.717] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0141.717] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.717] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0141.717] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0141.717] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0141.717] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0141.717] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0141.718] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0141.718] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.718] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.718] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.718] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1f5, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x1f5, lpOverlapped=0x0) returned 1 [0141.718] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x200, dwBufLen=0x200 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x200) returned 1 [0141.718] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.718] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x200, lpOverlapped=0x0) returned 1 [0141.718] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.718] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x2d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.718] SetEndOfFile (hFile=0x100) returned 1 [0141.721] GetProcessHeap () returned 0x4e0000 [0141.721] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0141.721] GetProcessHeap () returned 0x4e0000 [0141.721] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0141.721] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.inf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0141.724] CloseHandle (hObject=0x100) returned 1 [0141.724] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7fc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0141.724] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.725] GetProcessHeap () returned 0x4e0000 [0141.725] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0141.725] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0141.725] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0141.725] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0141.741] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.741] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.741] GetProcessHeap () returned 0x4e0000 [0141.741] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0141.741] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0141.741] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.741] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0141.742] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0141.742] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0141.742] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0141.742] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0141.743] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0141.743] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.743] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.743] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.743] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7fc, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x7fc, lpOverlapped=0x0) returned 1 [0141.743] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x800, dwBufLen=0x800 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x800) returned 1 [0141.743] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.743] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x800, lpOverlapped=0x0) returned 1 [0141.743] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.743] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x8d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.743] SetEndOfFile (hFile=0x100) returned 1 [0141.746] GetProcessHeap () returned 0x4e0000 [0141.746] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0141.746] GetProcessHeap () returned 0x4e0000 [0141.746] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0141.746] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0141.747] CloseHandle (hObject=0x100) returned 1 [0141.747] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x74e5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0141.747] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.747] GetProcessHeap () returned 0x4e0000 [0141.747] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0141.748] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0141.748] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0141.748] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xb, lpOverlapped=0x0) returned 1 [0141.750] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.750] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.750] GetProcessHeap () returned 0x4e0000 [0141.750] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0141.750] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0141.750] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.750] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0141.750] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0141.750] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0141.750] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0141.750] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0141.750] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0141.751] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.751] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.751] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.751] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x74e5, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x74e5, lpOverlapped=0x0) returned 1 [0141.752] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x74f0, dwBufLen=0x74f0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x74f0) returned 1 [0141.752] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.752] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x74f0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x74f0, lpOverlapped=0x0) returned 1 [0141.752] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.752] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x75c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.753] SetEndOfFile (hFile=0x100) returned 1 [0141.755] GetProcessHeap () returned 0x4e0000 [0141.755] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0141.755] GetProcessHeap () returned 0x4e0000 [0141.755] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0141.756] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0141.756] CloseHandle (hObject=0x100) returned 1 [0141.757] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x74e5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0141.757] GetProcessHeap () returned 0x4e0000 [0141.757] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0141.757] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0141.757] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df020 | out: pbData=0x4f53d8, pdwDataLen=0x24df020) returned 1 [0141.757] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.757] GetProcessHeap () returned 0x4e0000 [0141.757] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0141.757] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0141.757] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df020 | out: pbData=0x4f5420, pdwDataLen=0x24df020) returned 1 [0141.757] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.757] GetProcessHeap () returned 0x4e0000 [0141.757] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5273b8 [0141.757] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0141.757] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5273b8, pdwDataLen=0x24df020 | out: pbData=0x5273b8, pdwDataLen=0x24df020) returned 1 [0141.757] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.757] wsprintfW (in: param_1=0x24ddffc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\readme-warning.txt") returned 83 [0141.758] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.758] WriteFile (in: hFile=0x100, lpBuffer=0x5273b8*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddff8, lpOverlapped=0x0 | out: lpBuffer=0x5273b8*, lpNumberOfBytesWritten=0x24ddff8*=0x6c3, lpOverlapped=0x0) returned 1 [0141.759] CloseHandle (hObject=0x100) returned 1 [0141.759] GetProcessHeap () returned 0x4e0000 [0141.759] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273b8 | out: hHeap=0x4e0000) returned 1 [0141.759] GetProcessHeap () returned 0x4e0000 [0141.760] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0141.760] GetProcessHeap () returned 0x4e0000 [0141.760] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0141.760] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0141.760] GetProcessHeap () returned 0x4e0000 [0141.760] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0141.760] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CASCADE", cAlternateFileName="")) returned 1 [0141.760] GetProcessHeap () returned 0x4e0000 [0141.760] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x90) returned 0x524ea0 [0141.760] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0141.761] GetProcessHeap () returned 0x4e0000 [0141.761] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x524ea0 | out: hHeap=0x4e0000) returned 1 [0141.761] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0141.761] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xede9bc00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xede9bc00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xba44, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CASCADE.ELM", cAlternateFileName="")) returned 1 [0141.761] GetProcessHeap () returned 0x4e0000 [0141.761] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x292) returned 0x527118 [0141.761] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.762] GetProcessHeap () returned 0x4e0000 [0141.762] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0141.762] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0141.762] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0141.762] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xc, lpOverlapped=0x0) returned 1 [0141.764] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.764] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.764] GetProcessHeap () returned 0x4e0000 [0141.764] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0141.765] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0141.765] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.765] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0141.765] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0141.765] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0141.765] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0141.765] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0141.765] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0141.765] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.765] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.765] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.765] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xba44, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xba44, lpOverlapped=0x0) returned 1 [0141.767] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xba50, dwBufLen=0xba50 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xba50) returned 1 [0141.767] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.767] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xba50, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xba50, lpOverlapped=0x0) returned 1 [0141.768] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.768] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xbb24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.768] SetEndOfFile (hFile=0x100) returned 1 [0141.771] GetProcessHeap () returned 0x4e0000 [0141.771] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0141.771] GetProcessHeap () returned 0x4e0000 [0141.771] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0141.771] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.elm.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0141.772] CloseHandle (hObject=0x100) returned 1 [0141.772] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x262, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CASCADE.INF", cAlternateFileName="")) returned 1 [0141.772] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.772] GetProcessHeap () returned 0x4e0000 [0141.772] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0141.772] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0141.772] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0141.772] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xe, lpOverlapped=0x0) returned 1 [0141.774] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.774] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.774] GetProcessHeap () returned 0x4e0000 [0141.774] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0141.774] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0141.774] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.774] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0141.774] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0141.775] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0141.775] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0141.775] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0141.775] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0141.775] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.775] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.775] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.775] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x262, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x262, lpOverlapped=0x0) returned 1 [0141.775] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x270, dwBufLen=0x270 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x270) returned 1 [0141.775] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.775] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x270, lpOverlapped=0x0) returned 1 [0141.776] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.776] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x344, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.776] SetEndOfFile (hFile=0x100) returned 1 [0141.778] GetProcessHeap () returned 0x4e0000 [0141.778] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0141.778] GetProcessHeap () returned 0x4e0000 [0141.778] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0141.778] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.inf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0141.781] CloseHandle (hObject=0x100) returned 1 [0141.781] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x553, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0141.781] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.782] GetProcessHeap () returned 0x4e0000 [0141.782] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0141.782] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0141.782] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0141.782] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xd, lpOverlapped=0x0) returned 1 [0141.784] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.784] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.784] GetProcessHeap () returned 0x4e0000 [0141.784] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0141.784] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0141.784] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.784] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0141.784] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0141.784] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0141.785] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0141.785] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0141.785] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0141.785] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.785] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.785] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.785] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x553, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x553, lpOverlapped=0x0) returned 1 [0141.785] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x560, dwBufLen=0x560 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x560) returned 1 [0141.785] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.785] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x560, lpOverlapped=0x0) returned 1 [0141.785] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.785] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x634, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.785] SetEndOfFile (hFile=0x100) returned 1 [0141.788] GetProcessHeap () returned 0x4e0000 [0141.788] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0141.788] GetProcessHeap () returned 0x4e0000 [0141.788] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0141.788] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0141.789] CloseHandle (hObject=0x100) returned 1 [0141.789] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4f93, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0141.790] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.790] GetProcessHeap () returned 0x4e0000 [0141.790] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0141.790] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0141.790] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0141.790] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xd, lpOverlapped=0x0) returned 1 [0141.792] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.792] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.792] GetProcessHeap () returned 0x4e0000 [0141.792] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0141.792] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0141.792] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.793] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0141.793] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0141.793] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0141.793] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0141.793] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0141.793] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0141.793] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.793] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.793] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.793] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4f93, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x4f93, lpOverlapped=0x0) returned 1 [0141.795] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x4fa0, dwBufLen=0x4fa0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x4fa0) returned 1 [0141.795] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.795] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4fa0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x4fa0, lpOverlapped=0x0) returned 1 [0141.795] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.795] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x5074, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.795] SetEndOfFile (hFile=0x100) returned 1 [0141.798] GetProcessHeap () returned 0x4e0000 [0141.798] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0141.798] GetProcessHeap () returned 0x4e0000 [0141.798] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0141.798] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0141.799] CloseHandle (hObject=0x100) returned 1 [0141.799] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4f93, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0141.799] GetProcessHeap () returned 0x4e0000 [0141.799] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0141.799] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0141.799] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df020 | out: pbData=0x4f53d8, pdwDataLen=0x24df020) returned 1 [0141.799] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.799] GetProcessHeap () returned 0x4e0000 [0141.799] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0141.800] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0141.800] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df020 | out: pbData=0x4f5420, pdwDataLen=0x24df020) returned 1 [0141.800] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.800] GetProcessHeap () returned 0x4e0000 [0141.800] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5273b8 [0141.800] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0141.800] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5273b8, pdwDataLen=0x24df020 | out: pbData=0x5273b8, pdwDataLen=0x24df020) returned 1 [0141.800] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.800] wsprintfW (in: param_1=0x24ddffc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\readme-warning.txt") returned 82 [0141.800] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.800] WriteFile (in: hFile=0x100, lpBuffer=0x5273b8*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddff8, lpOverlapped=0x0 | out: lpBuffer=0x5273b8*, lpNumberOfBytesWritten=0x24ddff8*=0x6c3, lpOverlapped=0x0) returned 1 [0141.802] CloseHandle (hObject=0x100) returned 1 [0141.802] GetProcessHeap () returned 0x4e0000 [0141.802] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273b8 | out: hHeap=0x4e0000) returned 1 [0141.802] GetProcessHeap () returned 0x4e0000 [0141.802] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0141.802] GetProcessHeap () returned 0x4e0000 [0141.802] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0141.802] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0141.802] GetProcessHeap () returned 0x4e0000 [0141.802] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0141.802] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="COMPASS", cAlternateFileName="")) returned 1 [0141.802] GetProcessHeap () returned 0x4e0000 [0141.802] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x90) returned 0x524ea0 [0141.802] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0141.817] GetProcessHeap () returned 0x4e0000 [0141.817] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x524ea0 | out: hHeap=0x4e0000) returned 1 [0141.817] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0141.817] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf17d4300, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x6041aaf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf17d4300, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xd613, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="COMPASS.ELM", cAlternateFileName="")) returned 1 [0141.817] GetProcessHeap () returned 0x4e0000 [0141.817] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x292) returned 0x527118 [0141.817] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.818] GetProcessHeap () returned 0x4e0000 [0141.818] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0141.818] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0141.818] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0141.819] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xd, lpOverlapped=0x0) returned 1 [0141.822] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.822] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.823] GetProcessHeap () returned 0x4e0000 [0141.823] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0141.823] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0141.823] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.823] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0141.823] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0141.823] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0141.823] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0141.823] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0141.823] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0141.823] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.823] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.823] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.823] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xd613, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xd613, lpOverlapped=0x0) returned 1 [0141.824] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xd620, dwBufLen=0xd620 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xd620) returned 1 [0141.825] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.825] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xd620, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xd620, lpOverlapped=0x0) returned 1 [0141.825] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.825] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xd6f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.825] SetEndOfFile (hFile=0x100) returned 1 [0141.828] GetProcessHeap () returned 0x4e0000 [0141.828] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0141.828] GetProcessHeap () returned 0x4e0000 [0141.828] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0141.828] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.elm.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0141.829] CloseHandle (hObject=0x100) returned 1 [0141.829] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="COMPASS.INF", cAlternateFileName="")) returned 1 [0141.829] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.829] GetProcessHeap () returned 0x4e0000 [0141.829] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0141.829] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0141.829] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0141.829] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xa, lpOverlapped=0x0) returned 1 [0141.831] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.831] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.831] GetProcessHeap () returned 0x4e0000 [0141.831] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0141.831] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0141.831] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.831] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0141.831] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0141.831] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0141.831] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0141.831] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0141.831] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0141.831] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.831] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.832] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.832] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1e6, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x1e6, lpOverlapped=0x0) returned 1 [0141.832] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1f0) returned 1 [0141.832] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.832] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x1f0, lpOverlapped=0x0) returned 1 [0141.832] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.832] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x2c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.832] SetEndOfFile (hFile=0x100) returned 1 [0141.834] GetProcessHeap () returned 0x4e0000 [0141.834] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0141.834] GetProcessHeap () returned 0x4e0000 [0141.834] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0141.834] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0141.837] CloseHandle (hObject=0x100) returned 1 [0141.837] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x50d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0141.837] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.837] GetProcessHeap () returned 0x4e0000 [0141.837] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0141.837] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0141.837] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0141.837] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x3, lpOverlapped=0x0) returned 1 [0141.839] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.839] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.839] GetProcessHeap () returned 0x4e0000 [0141.839] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0141.839] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0141.839] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.839] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0141.839] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0141.839] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0141.839] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0141.840] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0141.840] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0141.840] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.840] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.840] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.840] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x50d, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x50d, lpOverlapped=0x0) returned 1 [0141.840] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x510, dwBufLen=0x510 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x510) returned 1 [0141.840] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.840] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x510, lpOverlapped=0x0) returned 1 [0141.840] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.840] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x5e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.840] SetEndOfFile (hFile=0x100) returned 1 [0141.842] GetProcessHeap () returned 0x4e0000 [0141.842] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0141.842] GetProcessHeap () returned 0x4e0000 [0141.842] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0141.842] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0141.843] CloseHandle (hObject=0x100) returned 1 [0141.843] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x505f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0141.843] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.843] GetProcessHeap () returned 0x4e0000 [0141.843] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0141.843] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0141.843] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0141.843] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x1, lpOverlapped=0x0) returned 1 [0141.845] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.845] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.845] GetProcessHeap () returned 0x4e0000 [0141.845] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0141.845] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0141.845] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.845] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0141.846] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0141.846] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0141.846] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0141.846] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0141.846] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0141.846] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.846] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.846] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.846] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x505f, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x505f, lpOverlapped=0x0) returned 1 [0141.847] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x5060, dwBufLen=0x5060 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x5060) returned 1 [0141.847] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.847] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5060, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x5060, lpOverlapped=0x0) returned 1 [0141.847] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.847] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x5134, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.847] SetEndOfFile (hFile=0x100) returned 1 [0141.849] GetProcessHeap () returned 0x4e0000 [0141.849] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0141.849] GetProcessHeap () returned 0x4e0000 [0141.849] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0141.849] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0141.850] CloseHandle (hObject=0x100) returned 1 [0141.850] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x505f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0141.850] GetProcessHeap () returned 0x4e0000 [0141.850] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0141.850] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0141.850] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df020 | out: pbData=0x4f53d8, pdwDataLen=0x24df020) returned 1 [0141.850] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.850] GetProcessHeap () returned 0x4e0000 [0141.850] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0141.851] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0141.851] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df020 | out: pbData=0x4f5420, pdwDataLen=0x24df020) returned 1 [0141.851] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.851] GetProcessHeap () returned 0x4e0000 [0141.851] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5273b8 [0141.851] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0141.851] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5273b8, pdwDataLen=0x24df020 | out: pbData=0x5273b8, pdwDataLen=0x24df020) returned 1 [0141.851] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.851] wsprintfW (in: param_1=0x24ddffc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\readme-warning.txt") returned 82 [0141.851] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.851] WriteFile (in: hFile=0x100, lpBuffer=0x5273b8*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddff8, lpOverlapped=0x0 | out: lpBuffer=0x5273b8*, lpNumberOfBytesWritten=0x24ddff8*=0x6c3, lpOverlapped=0x0) returned 1 [0141.852] CloseHandle (hObject=0x100) returned 1 [0141.852] GetProcessHeap () returned 0x4e0000 [0141.852] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273b8 | out: hHeap=0x4e0000) returned 1 [0141.852] GetProcessHeap () returned 0x4e0000 [0141.852] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0141.852] GetProcessHeap () returned 0x4e0000 [0141.852] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0141.852] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0141.853] GetProcessHeap () returned 0x4e0000 [0141.853] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0141.853] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CONCRETE", cAlternateFileName="")) returned 1 [0141.853] GetProcessHeap () returned 0x4e0000 [0141.853] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x92) returned 0x4fa058 [0141.853] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0141.853] GetProcessHeap () returned 0x4e0000 [0141.853] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0141.853] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0141.853] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2ae7000, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2ae7000, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb1d8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CONCRETE.ELM", cAlternateFileName="")) returned 1 [0141.853] GetProcessHeap () returned 0x4e0000 [0141.853] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x294) returned 0x527118 [0141.853] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.854] GetProcessHeap () returned 0x4e0000 [0141.854] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0141.854] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0141.854] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0141.854] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0141.856] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.856] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.856] GetProcessHeap () returned 0x4e0000 [0141.856] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0141.856] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0141.856] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.856] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0141.856] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0141.857] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0141.857] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0141.857] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0141.857] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0141.857] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.857] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.857] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.857] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb1d8, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xb1d8, lpOverlapped=0x0) returned 1 [0141.858] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xb1e0, dwBufLen=0xb1e0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xb1e0) returned 1 [0141.859] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.859] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xb1e0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xb1e0, lpOverlapped=0x0) returned 1 [0141.859] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.859] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xb2b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.859] SetEndOfFile (hFile=0x100) returned 1 [0141.862] GetProcessHeap () returned 0x4e0000 [0141.862] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0141.862] GetProcessHeap () returned 0x4e0000 [0141.862] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0141.862] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0141.862] CloseHandle (hObject=0x100) returned 1 [0141.862] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CONCRETE.INF", cAlternateFileName="")) returned 1 [0141.862] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.863] GetProcessHeap () returned 0x4e0000 [0141.863] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0141.863] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0141.863] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0141.863] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.863] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.863] GetProcessHeap () returned 0x4e0000 [0141.863] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0141.863] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0141.863] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.863] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0141.865] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0141.865] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0141.865] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0141.865] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0141.865] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0141.865] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.865] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.865] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.865] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x1e0, lpOverlapped=0x0) returned 1 [0141.865] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1e0) returned 1 [0141.865] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.865] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x1e0, lpOverlapped=0x0) returned 1 [0141.865] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.865] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x2b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.865] SetEndOfFile (hFile=0x100) returned 1 [0141.868] GetProcessHeap () returned 0x4e0000 [0141.868] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0141.868] GetProcessHeap () returned 0x4e0000 [0141.868] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0141.868] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0141.871] CloseHandle (hObject=0x100) returned 1 [0141.871] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x507, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0141.871] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.871] GetProcessHeap () returned 0x4e0000 [0141.871] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0141.871] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0141.871] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0141.871] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x9, lpOverlapped=0x0) returned 1 [0141.880] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.880] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.880] GetProcessHeap () returned 0x4e0000 [0141.880] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0141.880] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0141.880] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.880] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0141.880] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0141.880] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0141.880] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0141.880] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0141.880] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0141.881] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.881] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.881] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.881] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x507, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x507, lpOverlapped=0x0) returned 1 [0141.881] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x510, dwBufLen=0x510 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x510) returned 1 [0141.881] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.881] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x510, lpOverlapped=0x0) returned 1 [0141.881] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.881] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x5e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.881] SetEndOfFile (hFile=0x100) returned 1 [0141.883] GetProcessHeap () returned 0x4e0000 [0141.883] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0141.883] GetProcessHeap () returned 0x4e0000 [0141.883] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0141.883] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0141.884] CloseHandle (hObject=0x100) returned 1 [0141.884] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6fb3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0141.884] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.884] GetProcessHeap () returned 0x4e0000 [0141.884] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0141.884] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0141.884] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0141.884] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xd, lpOverlapped=0x0) returned 1 [0141.888] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.888] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.888] GetProcessHeap () returned 0x4e0000 [0141.888] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0141.888] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0141.888] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.888] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0141.888] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0141.888] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0141.888] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0141.888] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0141.888] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0141.889] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.889] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.889] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.889] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x6fb3, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x6fb3, lpOverlapped=0x0) returned 1 [0141.890] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x6fc0, dwBufLen=0x6fc0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x6fc0) returned 1 [0141.890] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.890] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6fc0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x6fc0, lpOverlapped=0x0) returned 1 [0141.890] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.890] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x7094, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.890] SetEndOfFile (hFile=0x100) returned 1 [0141.893] GetProcessHeap () returned 0x4e0000 [0141.893] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0141.893] GetProcessHeap () returned 0x4e0000 [0141.893] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0141.893] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0141.894] CloseHandle (hObject=0x100) returned 1 [0141.894] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6fb3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0141.894] GetProcessHeap () returned 0x4e0000 [0141.894] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0141.894] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0141.894] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df020 | out: pbData=0x4f53d8, pdwDataLen=0x24df020) returned 1 [0141.894] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.894] GetProcessHeap () returned 0x4e0000 [0141.894] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0141.894] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0141.894] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df020 | out: pbData=0x4f5420, pdwDataLen=0x24df020) returned 1 [0141.894] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.894] GetProcessHeap () returned 0x4e0000 [0141.894] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5273b8 [0141.894] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0141.894] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5273b8, pdwDataLen=0x24df020 | out: pbData=0x5273b8, pdwDataLen=0x24df020) returned 1 [0141.895] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.895] wsprintfW (in: param_1=0x24ddffc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\readme-warning.txt") returned 83 [0141.895] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.896] WriteFile (in: hFile=0x100, lpBuffer=0x5273b8*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddff8, lpOverlapped=0x0 | out: lpBuffer=0x5273b8*, lpNumberOfBytesWritten=0x24ddff8*=0x6c3, lpOverlapped=0x0) returned 1 [0141.897] CloseHandle (hObject=0x100) returned 1 [0141.897] GetProcessHeap () returned 0x4e0000 [0141.897] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273b8 | out: hHeap=0x4e0000) returned 1 [0141.897] GetProcessHeap () returned 0x4e0000 [0141.897] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0141.897] GetProcessHeap () returned 0x4e0000 [0141.897] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0141.897] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0141.897] GetProcessHeap () returned 0x4e0000 [0141.897] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0141.897] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DEEPBLUE", cAlternateFileName="")) returned 1 [0141.897] GetProcessHeap () returned 0x4e0000 [0141.897] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x92) returned 0x4fa058 [0141.897] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0141.898] GetProcessHeap () returned 0x4e0000 [0141.898] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0141.898] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0141.898] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf641f700, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf641f700, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x116dc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DEEPBLUE.ELM", cAlternateFileName="")) returned 1 [0141.898] GetProcessHeap () returned 0x4e0000 [0141.898] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x294) returned 0x527118 [0141.898] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.899] GetProcessHeap () returned 0x4e0000 [0141.899] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0141.899] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0141.899] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0141.899] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0141.901] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.901] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.901] GetProcessHeap () returned 0x4e0000 [0141.901] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0141.901] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0141.901] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.901] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0141.901] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0141.901] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0141.901] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0141.901] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0141.901] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0141.902] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.902] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.902] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.902] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x116dc, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x116dc, lpOverlapped=0x0) returned 1 [0141.903] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x116e0, dwBufLen=0x116e0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x116e0) returned 1 [0141.904] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.904] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x116e0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x116e0, lpOverlapped=0x0) returned 1 [0141.904] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.904] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x117b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.904] SetEndOfFile (hFile=0x100) returned 1 [0141.907] GetProcessHeap () returned 0x4e0000 [0141.907] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0141.907] GetProcessHeap () returned 0x4e0000 [0141.907] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0141.907] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0141.908] CloseHandle (hObject=0x100) returned 1 [0141.908] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x239, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DEEPBLUE.INF", cAlternateFileName="")) returned 1 [0141.908] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.908] GetProcessHeap () returned 0x4e0000 [0141.908] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0141.908] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0141.908] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0141.908] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x7, lpOverlapped=0x0) returned 1 [0141.910] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.910] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.910] GetProcessHeap () returned 0x4e0000 [0141.910] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0141.910] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0141.910] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.910] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0141.910] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0141.910] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0141.910] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0141.910] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0141.910] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0141.911] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.911] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.911] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.911] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x239, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x239, lpOverlapped=0x0) returned 1 [0141.911] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x240, dwBufLen=0x240 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x240) returned 1 [0141.911] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.911] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x240, lpOverlapped=0x0) returned 1 [0141.911] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.911] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.911] SetEndOfFile (hFile=0x100) returned 1 [0141.916] GetProcessHeap () returned 0x4e0000 [0141.916] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0141.916] GetProcessHeap () returned 0x4e0000 [0141.916] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0141.916] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0141.919] CloseHandle (hObject=0x100) returned 1 [0141.919] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xf75, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0141.919] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.920] GetProcessHeap () returned 0x4e0000 [0141.920] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0141.920] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0141.920] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0141.920] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xb, lpOverlapped=0x0) returned 1 [0141.961] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.962] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.962] GetProcessHeap () returned 0x4e0000 [0141.962] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0141.962] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0141.962] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.962] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0141.962] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0141.962] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0141.962] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0141.962] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0141.963] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0141.963] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.963] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.963] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.963] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xf75, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xf75, lpOverlapped=0x0) returned 1 [0141.963] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xf80, dwBufLen=0xf80 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xf80) returned 1 [0141.963] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.963] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xf80, lpOverlapped=0x0) returned 1 [0141.963] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.963] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1054, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.963] SetEndOfFile (hFile=0x100) returned 1 [0141.966] GetProcessHeap () returned 0x4e0000 [0141.966] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0141.966] GetProcessHeap () returned 0x4e0000 [0141.966] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0141.966] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0141.967] CloseHandle (hObject=0x100) returned 1 [0141.967] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x81fd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0141.967] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.972] GetProcessHeap () returned 0x4e0000 [0141.972] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0141.973] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0141.973] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0141.973] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x3, lpOverlapped=0x0) returned 1 [0141.975] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.975] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.975] GetProcessHeap () returned 0x4e0000 [0141.975] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0141.975] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0141.975] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.975] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0141.975] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0141.975] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0141.975] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0141.975] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0141.976] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0141.976] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.976] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.976] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.976] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x81fd, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x81fd, lpOverlapped=0x0) returned 1 [0141.977] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x8200, dwBufLen=0x8200 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x8200) returned 1 [0141.977] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.977] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x8200, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x8200, lpOverlapped=0x0) returned 1 [0141.978] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.978] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x82d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.978] SetEndOfFile (hFile=0x100) returned 1 [0141.981] GetProcessHeap () returned 0x4e0000 [0141.981] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0141.981] GetProcessHeap () returned 0x4e0000 [0141.981] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0141.981] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0141.982] CloseHandle (hObject=0x100) returned 1 [0141.982] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x81fd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0141.982] GetProcessHeap () returned 0x4e0000 [0141.982] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0141.982] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0141.982] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df020 | out: pbData=0x4f53d8, pdwDataLen=0x24df020) returned 1 [0141.982] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.982] GetProcessHeap () returned 0x4e0000 [0141.982] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0141.982] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0141.982] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df020 | out: pbData=0x4f5420, pdwDataLen=0x24df020) returned 1 [0141.982] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.982] GetProcessHeap () returned 0x4e0000 [0141.983] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5273b8 [0141.983] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0141.983] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5273b8, pdwDataLen=0x24df020 | out: pbData=0x5273b8, pdwDataLen=0x24df020) returned 1 [0141.983] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.983] wsprintfW (in: param_1=0x24ddffc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\readme-warning.txt") returned 83 [0141.983] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.983] WriteFile (in: hFile=0x100, lpBuffer=0x5273b8*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddff8, lpOverlapped=0x0 | out: lpBuffer=0x5273b8*, lpNumberOfBytesWritten=0x24ddff8*=0x6c3, lpOverlapped=0x0) returned 1 [0141.985] CloseHandle (hObject=0x100) returned 1 [0141.985] GetProcessHeap () returned 0x4e0000 [0141.985] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273b8 | out: hHeap=0x4e0000) returned 1 [0141.985] GetProcessHeap () returned 0x4e0000 [0141.985] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0141.985] GetProcessHeap () returned 0x4e0000 [0141.985] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0141.985] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0141.985] GetProcessHeap () returned 0x4e0000 [0141.985] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0141.985] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ECHO", cAlternateFileName="")) returned 1 [0141.985] GetProcessHeap () returned 0x4e0000 [0141.985] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8a) returned 0x524ea0 [0141.985] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0141.987] GetProcessHeap () returned 0x4e0000 [0141.987] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x524ea0 | out: hHeap=0x4e0000) returned 1 [0141.987] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0141.987] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8a45100, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf8a45100, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb0ce, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ECHO.ELM", cAlternateFileName="")) returned 1 [0141.987] GetProcessHeap () returned 0x4e0000 [0141.987] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x28c) returned 0x527118 [0141.987] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.988] GetProcessHeap () returned 0x4e0000 [0141.988] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0141.988] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0141.988] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0141.988] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x2, lpOverlapped=0x0) returned 1 [0141.990] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.990] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.990] GetProcessHeap () returned 0x4e0000 [0141.990] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0141.991] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30) returned 1 [0141.991] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.991] WriteFile (in: hFile=0x100, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24defc8*=0x30, lpOverlapped=0x0) returned 1 [0141.991] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0141.991] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0141.991] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0141.991] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0141.992] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0141.992] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0141.992] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0141.992] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.992] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb0ce, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xb0ce, lpOverlapped=0x0) returned 1 [0141.993] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xb0d0, dwBufLen=0xb0d0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xb0d0) returned 1 [0141.994] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.994] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xb0d0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xb0d0, lpOverlapped=0x0) returned 1 [0141.994] CryptDestroyKey (hKey=0x522fd8) returned 1 [0141.994] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xb194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.994] SetEndOfFile (hFile=0x100) returned 1 [0141.997] GetProcessHeap () returned 0x4e0000 [0141.997] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0141.997] GetProcessHeap () returned 0x4e0000 [0141.997] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0141.997] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0141.998] CloseHandle (hObject=0x100) returned 1 [0141.998] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x608b7590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ECHO.INF", cAlternateFileName="")) returned 1 [0141.998] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0141.999] GetProcessHeap () returned 0x4e0000 [0141.999] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0141.999] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0141.999] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0141.999] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x9, lpOverlapped=0x0) returned 1 [0142.001] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.001] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.001] GetProcessHeap () returned 0x4e0000 [0142.001] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0142.001] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30) returned 1 [0142.001] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.001] WriteFile (in: hFile=0x100, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24defc8*=0x30, lpOverlapped=0x0) returned 1 [0142.001] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0142.001] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0142.001] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0142.001] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0142.001] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.002] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.002] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.002] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.002] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1f7, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x1f7, lpOverlapped=0x0) returned 1 [0142.002] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x200, dwBufLen=0x200 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x200) returned 1 [0142.002] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.002] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x200, lpOverlapped=0x0) returned 1 [0142.002] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.002] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x2c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.002] SetEndOfFile (hFile=0x100) returned 1 [0142.005] GetProcessHeap () returned 0x4e0000 [0142.005] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0142.005] GetProcessHeap () returned 0x4e0000 [0142.005] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0142.005] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0142.009] CloseHandle (hObject=0x100) returned 1 [0142.010] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5ad, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0142.010] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.010] GetProcessHeap () returned 0x4e0000 [0142.010] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0142.010] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0142.010] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0142.010] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x3, lpOverlapped=0x0) returned 1 [0142.030] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.030] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.030] GetProcessHeap () returned 0x4e0000 [0142.030] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0142.030] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0142.030] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.030] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0142.031] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0142.031] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0142.031] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0142.031] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0142.031] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.031] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.031] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.031] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.031] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5ad, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x5ad, lpOverlapped=0x0) returned 1 [0142.031] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x5b0) returned 1 [0142.031] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.031] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x5b0, lpOverlapped=0x0) returned 1 [0142.032] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.032] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.032] SetEndOfFile (hFile=0x100) returned 1 [0142.034] GetProcessHeap () returned 0x4e0000 [0142.034] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0142.034] GetProcessHeap () returned 0x4e0000 [0142.035] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0142.035] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0142.036] CloseHandle (hObject=0x100) returned 1 [0142.036] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6212, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0142.036] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.036] GetProcessHeap () returned 0x4e0000 [0142.036] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0142.036] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0142.036] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0142.036] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xe, lpOverlapped=0x0) returned 1 [0142.038] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.038] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.038] GetProcessHeap () returned 0x4e0000 [0142.039] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0142.039] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0142.039] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.039] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0142.039] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0142.039] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0142.039] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0142.039] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0142.039] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.039] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.039] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.039] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.039] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x6212, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x6212, lpOverlapped=0x0) returned 1 [0142.040] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x6220, dwBufLen=0x6220 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x6220) returned 1 [0142.041] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.041] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6220, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x6220, lpOverlapped=0x0) returned 1 [0142.041] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.041] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x62f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.041] SetEndOfFile (hFile=0x100) returned 1 [0142.044] GetProcessHeap () returned 0x4e0000 [0142.044] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0142.044] GetProcessHeap () returned 0x4e0000 [0142.044] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0142.044] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0142.045] CloseHandle (hObject=0x100) returned 1 [0142.045] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6212, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0142.045] GetProcessHeap () returned 0x4e0000 [0142.045] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0142.045] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0142.045] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df020 | out: pbData=0x4f53d8, pdwDataLen=0x24df020) returned 1 [0142.045] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.045] GetProcessHeap () returned 0x4e0000 [0142.045] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0142.046] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0142.046] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df020 | out: pbData=0x4f5420, pdwDataLen=0x24df020) returned 1 [0142.046] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.046] GetProcessHeap () returned 0x4e0000 [0142.046] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5273b0 [0142.046] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0142.046] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5273b0, pdwDataLen=0x24df020 | out: pbData=0x5273b0, pdwDataLen=0x24df020) returned 1 [0142.046] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.046] wsprintfW (in: param_1=0x24ddffc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\readme-warning.txt") returned 79 [0142.046] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.046] WriteFile (in: hFile=0x100, lpBuffer=0x5273b0*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddff8, lpOverlapped=0x0 | out: lpBuffer=0x5273b0*, lpNumberOfBytesWritten=0x24ddff8*=0x6c3, lpOverlapped=0x0) returned 1 [0142.048] CloseHandle (hObject=0x100) returned 1 [0142.048] GetProcessHeap () returned 0x4e0000 [0142.048] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273b0 | out: hHeap=0x4e0000) returned 1 [0142.048] GetProcessHeap () returned 0x4e0000 [0142.048] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0142.048] GetProcessHeap () returned 0x4e0000 [0142.048] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0142.048] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0142.048] GetProcessHeap () returned 0x4e0000 [0142.048] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0142.048] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ECLIPSE", cAlternateFileName="")) returned 1 [0142.048] GetProcessHeap () returned 0x4e0000 [0142.048] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x90) returned 0x524ea0 [0142.048] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0142.061] GetProcessHeap () returned 0x4e0000 [0142.061] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x524ea0 | out: hHeap=0x4e0000) returned 1 [0142.061] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0142.061] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9d57e00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51eb22b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9d57e00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x1cf31, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ECLIPSE.ELM", cAlternateFileName="")) returned 1 [0142.061] GetProcessHeap () returned 0x4e0000 [0142.061] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x292) returned 0x527118 [0142.061] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.062] GetProcessHeap () returned 0x4e0000 [0142.062] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0142.062] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0142.062] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0142.062] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xf, lpOverlapped=0x0) returned 1 [0142.064] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.064] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.064] GetProcessHeap () returned 0x4e0000 [0142.064] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0142.064] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0142.064] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.064] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0142.065] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0142.065] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0142.065] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0142.065] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0142.065] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.065] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.065] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.065] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.065] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1cf31, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x1cf31, lpOverlapped=0x0) returned 1 [0142.067] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1cf40, dwBufLen=0x1cf40 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1cf40) returned 1 [0142.069] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.069] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1cf40, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x1cf40, lpOverlapped=0x0) returned 1 [0142.069] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.069] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1d014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.070] SetEndOfFile (hFile=0x100) returned 1 [0142.073] GetProcessHeap () returned 0x4e0000 [0142.073] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0142.073] GetProcessHeap () returned 0x4e0000 [0142.073] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0142.073] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0142.074] CloseHandle (hObject=0x100) returned 1 [0142.074] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x608b7590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x253, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ECLIPSE.INF", cAlternateFileName="")) returned 1 [0142.074] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.075] GetProcessHeap () returned 0x4e0000 [0142.075] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0142.076] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0142.076] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0142.076] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xd, lpOverlapped=0x0) returned 1 [0142.077] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.077] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.077] GetProcessHeap () returned 0x4e0000 [0142.077] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0142.078] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0142.078] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.078] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0142.078] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0142.078] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0142.078] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0142.078] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0142.078] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.079] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.079] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.079] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.079] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x253, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x253, lpOverlapped=0x0) returned 1 [0142.079] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x260, dwBufLen=0x260 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x260) returned 1 [0142.079] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.079] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x260, lpOverlapped=0x0) returned 1 [0142.079] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.079] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x334, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.079] SetEndOfFile (hFile=0x100) returned 1 [0142.084] GetProcessHeap () returned 0x4e0000 [0142.084] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0142.084] GetProcessHeap () returned 0x4e0000 [0142.084] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0142.084] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.inf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0142.087] CloseHandle (hObject=0x100) returned 1 [0142.087] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0142.088] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.089] GetProcessHeap () returned 0x4e0000 [0142.089] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0142.089] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0142.089] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0142.089] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xd, lpOverlapped=0x0) returned 1 [0142.093] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.093] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.093] GetProcessHeap () returned 0x4e0000 [0142.093] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0142.093] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0142.094] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.094] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0142.094] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0142.094] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0142.094] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0142.094] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0142.094] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.094] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.094] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.094] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.094] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x543, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x543, lpOverlapped=0x0) returned 1 [0142.094] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x550, dwBufLen=0x550 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x550) returned 1 [0142.094] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.095] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x550, lpOverlapped=0x0) returned 1 [0142.095] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.095] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x624, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.095] SetEndOfFile (hFile=0x100) returned 1 [0142.098] GetProcessHeap () returned 0x4e0000 [0142.098] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0142.098] GetProcessHeap () returned 0x4e0000 [0142.098] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0142.098] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0142.099] CloseHandle (hObject=0x100) returned 1 [0142.099] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7e93, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0142.099] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.099] GetProcessHeap () returned 0x4e0000 [0142.099] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0142.100] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0142.100] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0142.100] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xd, lpOverlapped=0x0) returned 1 [0142.102] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.102] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.102] GetProcessHeap () returned 0x4e0000 [0142.102] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0142.102] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0142.102] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.102] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0142.102] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0142.103] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0142.103] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0142.103] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0142.103] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.103] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.103] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.103] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.103] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7e93, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x7e93, lpOverlapped=0x0) returned 1 [0142.104] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x7ea0, dwBufLen=0x7ea0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x7ea0) returned 1 [0142.104] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.105] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7ea0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x7ea0, lpOverlapped=0x0) returned 1 [0142.105] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.105] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x7f74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.105] SetEndOfFile (hFile=0x100) returned 1 [0142.108] GetProcessHeap () returned 0x4e0000 [0142.108] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0142.108] GetProcessHeap () returned 0x4e0000 [0142.108] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0142.108] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0142.109] CloseHandle (hObject=0x100) returned 1 [0142.109] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7e93, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0142.109] GetProcessHeap () returned 0x4e0000 [0142.109] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0142.109] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0142.109] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df020 | out: pbData=0x4f53d8, pdwDataLen=0x24df020) returned 1 [0142.109] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.109] GetProcessHeap () returned 0x4e0000 [0142.110] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0142.110] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0142.110] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df020 | out: pbData=0x4f5420, pdwDataLen=0x24df020) returned 1 [0142.110] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.110] GetProcessHeap () returned 0x4e0000 [0142.110] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5273b8 [0142.110] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0142.110] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5273b8, pdwDataLen=0x24df020 | out: pbData=0x5273b8, pdwDataLen=0x24df020) returned 1 [0142.110] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.110] wsprintfW (in: param_1=0x24ddffc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\readme-warning.txt") returned 82 [0142.110] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.111] WriteFile (in: hFile=0x100, lpBuffer=0x5273b8*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddff8, lpOverlapped=0x0 | out: lpBuffer=0x5273b8*, lpNumberOfBytesWritten=0x24ddff8*=0x6c3, lpOverlapped=0x0) returned 1 [0142.113] CloseHandle (hObject=0x100) returned 1 [0142.113] GetProcessHeap () returned 0x4e0000 [0142.113] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273b8 | out: hHeap=0x4e0000) returned 1 [0142.113] GetProcessHeap () returned 0x4e0000 [0142.113] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0142.113] GetProcessHeap () returned 0x4e0000 [0142.113] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0142.113] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0142.113] GetProcessHeap () returned 0x4e0000 [0142.113] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0142.113] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EDGE", cAlternateFileName="")) returned 1 [0142.113] GetProcessHeap () returned 0x4e0000 [0142.113] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8a) returned 0x524ea0 [0142.113] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0142.119] GetProcessHeap () returned 0x4e0000 [0142.119] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x524ea0 | out: hHeap=0x4e0000) returned 1 [0142.119] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0142.119] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb06ab00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51f70990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfb06ab00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb8f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EDGE.ELM", cAlternateFileName="")) returned 1 [0142.119] GetProcessHeap () returned 0x4e0000 [0142.119] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x28c) returned 0x527118 [0142.119] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.120] GetProcessHeap () returned 0x4e0000 [0142.120] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0142.120] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0142.120] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0142.120] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.123] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.123] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.123] GetProcessHeap () returned 0x4e0000 [0142.123] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0142.123] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30) returned 1 [0142.123] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.123] WriteFile (in: hFile=0x100, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24defc8*=0x30, lpOverlapped=0x0) returned 1 [0142.123] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0142.123] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0142.123] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0142.123] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0142.123] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.123] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.123] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.124] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.124] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb8f8, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xb8f8, lpOverlapped=0x0) returned 1 [0142.125] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xb900, dwBufLen=0xb900 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xb900) returned 1 [0142.126] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.126] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xb900, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xb900, lpOverlapped=0x0) returned 1 [0142.126] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.126] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xb9c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.126] SetEndOfFile (hFile=0x100) returned 1 [0142.129] GetProcessHeap () returned 0x4e0000 [0142.129] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0142.129] GetProcessHeap () returned 0x4e0000 [0142.129] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0142.129] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.elm.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0142.130] CloseHandle (hObject=0x100) returned 1 [0142.130] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51f70990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x211, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EDGE.INF", cAlternateFileName="")) returned 1 [0142.130] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.130] GetProcessHeap () returned 0x4e0000 [0142.130] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0142.130] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0142.131] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0142.131] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xf, lpOverlapped=0x0) returned 1 [0142.132] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.132] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.132] GetProcessHeap () returned 0x4e0000 [0142.132] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0142.132] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30) returned 1 [0142.132] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.132] WriteFile (in: hFile=0x100, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24defc8*=0x30, lpOverlapped=0x0) returned 1 [0142.133] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0142.133] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0142.133] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0142.133] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0142.133] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.133] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.133] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.133] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.133] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x211, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x211, lpOverlapped=0x0) returned 1 [0142.133] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x220, dwBufLen=0x220 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x220) returned 1 [0142.133] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.134] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x220, lpOverlapped=0x0) returned 1 [0142.134] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.134] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x2e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.134] SetEndOfFile (hFile=0x100) returned 1 [0142.136] GetProcessHeap () returned 0x4e0000 [0142.136] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0142.136] GetProcessHeap () returned 0x4e0000 [0142.136] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0142.137] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.inf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0142.139] CloseHandle (hObject=0x100) returned 1 [0142.139] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0142.139] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.139] GetProcessHeap () returned 0x4e0000 [0142.140] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0142.140] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0142.140] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0142.140] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xd, lpOverlapped=0x0) returned 1 [0142.156] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.156] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.156] GetProcessHeap () returned 0x4e0000 [0142.156] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0142.156] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0142.156] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.156] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0142.156] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0142.157] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0142.157] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0142.157] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0142.157] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.157] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.157] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.157] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.157] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x543, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x543, lpOverlapped=0x0) returned 1 [0142.157] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x550, dwBufLen=0x550 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x550) returned 1 [0142.157] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.157] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x550, lpOverlapped=0x0) returned 1 [0142.157] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.157] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x624, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.158] SetEndOfFile (hFile=0x100) returned 1 [0142.160] GetProcessHeap () returned 0x4e0000 [0142.160] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0142.160] GetProcessHeap () returned 0x4e0000 [0142.160] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0142.160] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0142.161] CloseHandle (hObject=0x100) returned 1 [0142.162] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6722, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0142.162] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.162] GetProcessHeap () returned 0x4e0000 [0142.162] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0142.162] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0142.162] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0142.162] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xe, lpOverlapped=0x0) returned 1 [0142.165] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.165] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.165] GetProcessHeap () returned 0x4e0000 [0142.165] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0142.165] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0142.165] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.165] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0142.165] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0142.165] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0142.166] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0142.166] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0142.166] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.166] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.166] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.166] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.166] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x6722, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x6722, lpOverlapped=0x0) returned 1 [0142.167] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x6730, dwBufLen=0x6730 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x6730) returned 1 [0142.167] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.168] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6730, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x6730, lpOverlapped=0x0) returned 1 [0142.168] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.168] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x6804, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.168] SetEndOfFile (hFile=0x100) returned 1 [0142.171] GetProcessHeap () returned 0x4e0000 [0142.171] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0142.171] GetProcessHeap () returned 0x4e0000 [0142.171] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0142.171] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0142.172] CloseHandle (hObject=0x100) returned 1 [0142.172] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6722, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0142.172] GetProcessHeap () returned 0x4e0000 [0142.172] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0142.172] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0142.172] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df020 | out: pbData=0x4f53d8, pdwDataLen=0x24df020) returned 1 [0142.172] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.172] GetProcessHeap () returned 0x4e0000 [0142.172] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0142.172] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0142.172] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df020 | out: pbData=0x4f5420, pdwDataLen=0x24df020) returned 1 [0142.172] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.172] GetProcessHeap () returned 0x4e0000 [0142.172] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5273b0 [0142.173] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0142.173] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5273b0, pdwDataLen=0x24df020 | out: pbData=0x5273b0, pdwDataLen=0x24df020) returned 1 [0142.173] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.173] wsprintfW (in: param_1=0x24ddffc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\readme-warning.txt") returned 79 [0142.173] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.173] WriteFile (in: hFile=0x100, lpBuffer=0x5273b0*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddff8, lpOverlapped=0x0 | out: lpBuffer=0x5273b0*, lpNumberOfBytesWritten=0x24ddff8*=0x6c3, lpOverlapped=0x0) returned 1 [0142.174] CloseHandle (hObject=0x100) returned 1 [0142.175] GetProcessHeap () returned 0x4e0000 [0142.175] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273b0 | out: hHeap=0x4e0000) returned 1 [0142.175] GetProcessHeap () returned 0x4e0000 [0142.175] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0142.175] GetProcessHeap () returned 0x4e0000 [0142.175] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0142.175] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0142.175] GetProcessHeap () returned 0x4e0000 [0142.175] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0142.175] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EVRGREEN", cAlternateFileName="")) returned 1 [0142.175] GetProcessHeap () returned 0x4e0000 [0142.175] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x92) returned 0x4fa058 [0142.175] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0142.176] GetProcessHeap () returned 0x4e0000 [0142.176] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0142.177] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0142.177] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc37d800, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x52008f10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc37d800, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x12dee, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EVRGREEN.ELM", cAlternateFileName="")) returned 1 [0142.177] GetProcessHeap () returned 0x4e0000 [0142.177] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x294) returned 0x527118 [0142.177] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.177] GetProcessHeap () returned 0x4e0000 [0142.177] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0142.177] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0142.177] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0142.177] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x2, lpOverlapped=0x0) returned 1 [0142.183] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.183] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.183] GetProcessHeap () returned 0x4e0000 [0142.183] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0142.183] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0142.183] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.183] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0142.184] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0142.184] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0142.184] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0142.184] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0142.184] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.184] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.184] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.184] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.184] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x12dee, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x12dee, lpOverlapped=0x0) returned 1 [0142.186] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x12df0, dwBufLen=0x12df0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x12df0) returned 1 [0142.187] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.187] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x12df0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x12df0, lpOverlapped=0x0) returned 1 [0142.187] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.187] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x12ec4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.187] SetEndOfFile (hFile=0x100) returned 1 [0142.190] GetProcessHeap () returned 0x4e0000 [0142.190] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0142.190] GetProcessHeap () returned 0x4e0000 [0142.190] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0142.190] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.elm.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0142.191] CloseHandle (hObject=0x100) returned 1 [0142.192] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6099bdd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x223, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EVRGREEN.INF", cAlternateFileName="")) returned 1 [0142.192] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.193] GetProcessHeap () returned 0x4e0000 [0142.193] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0142.193] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0142.193] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0142.193] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xd, lpOverlapped=0x0) returned 1 [0142.195] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.195] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.195] GetProcessHeap () returned 0x4e0000 [0142.195] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0142.195] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0142.195] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.195] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0142.195] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0142.195] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0142.195] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0142.195] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0142.195] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.196] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.196] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.196] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.196] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x223, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x223, lpOverlapped=0x0) returned 1 [0142.196] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x230, dwBufLen=0x230 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x230) returned 1 [0142.196] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.196] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x230, lpOverlapped=0x0) returned 1 [0142.196] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.196] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x304, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.196] SetEndOfFile (hFile=0x100) returned 1 [0142.199] GetProcessHeap () returned 0x4e0000 [0142.199] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0142.199] GetProcessHeap () returned 0x4e0000 [0142.199] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0142.199] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0142.201] CloseHandle (hObject=0x100) returned 1 [0142.201] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x54a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0142.202] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.202] GetProcessHeap () returned 0x4e0000 [0142.202] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0142.202] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0142.202] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0142.202] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x6, lpOverlapped=0x0) returned 1 [0142.204] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.204] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.204] GetProcessHeap () returned 0x4e0000 [0142.204] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0142.204] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0142.204] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.204] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0142.205] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0142.205] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0142.205] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0142.205] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0142.205] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.205] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.205] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.205] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.205] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x54a, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x54a, lpOverlapped=0x0) returned 1 [0142.205] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x550, dwBufLen=0x550 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x550) returned 1 [0142.205] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.205] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x550, lpOverlapped=0x0) returned 1 [0142.206] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.206] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x624, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.206] SetEndOfFile (hFile=0x100) returned 1 [0142.208] GetProcessHeap () returned 0x4e0000 [0142.208] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0142.208] GetProcessHeap () returned 0x4e0000 [0142.208] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0142.208] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0142.209] CloseHandle (hObject=0x100) returned 1 [0142.210] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7eb1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0142.210] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.210] GetProcessHeap () returned 0x4e0000 [0142.210] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0142.210] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0142.210] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0142.210] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xf, lpOverlapped=0x0) returned 1 [0142.213] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.213] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.213] GetProcessHeap () returned 0x4e0000 [0142.213] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0142.213] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0142.213] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.213] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0142.213] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0142.213] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0142.214] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0142.214] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0142.214] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.214] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.214] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.214] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.214] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7eb1, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x7eb1, lpOverlapped=0x0) returned 1 [0142.215] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x7ec0, dwBufLen=0x7ec0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x7ec0) returned 1 [0142.215] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.215] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7ec0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x7ec0, lpOverlapped=0x0) returned 1 [0142.216] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.216] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x7f94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.216] SetEndOfFile (hFile=0x100) returned 1 [0142.219] GetProcessHeap () returned 0x4e0000 [0142.219] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0142.219] GetProcessHeap () returned 0x4e0000 [0142.219] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0142.219] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0142.220] CloseHandle (hObject=0x100) returned 1 [0142.220] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7eb1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0142.220] GetProcessHeap () returned 0x4e0000 [0142.220] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0142.220] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0142.220] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df020 | out: pbData=0x4f53d8, pdwDataLen=0x24df020) returned 1 [0142.220] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.220] GetProcessHeap () returned 0x4e0000 [0142.220] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0142.220] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0142.220] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df020 | out: pbData=0x4f5420, pdwDataLen=0x24df020) returned 1 [0142.220] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.220] GetProcessHeap () returned 0x4e0000 [0142.220] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5273b8 [0142.221] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0142.221] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5273b8, pdwDataLen=0x24df020 | out: pbData=0x5273b8, pdwDataLen=0x24df020) returned 1 [0142.221] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.221] wsprintfW (in: param_1=0x24ddffc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\readme-warning.txt") returned 83 [0142.221] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.221] WriteFile (in: hFile=0x100, lpBuffer=0x5273b8*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddff8, lpOverlapped=0x0 | out: lpBuffer=0x5273b8*, lpNumberOfBytesWritten=0x24ddff8*=0x6c3, lpOverlapped=0x0) returned 1 [0142.222] CloseHandle (hObject=0x100) returned 1 [0142.223] GetProcessHeap () returned 0x4e0000 [0142.223] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273b8 | out: hHeap=0x4e0000) returned 1 [0142.223] GetProcessHeap () returned 0x4e0000 [0142.223] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0142.223] GetProcessHeap () returned 0x4e0000 [0142.223] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0142.223] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0142.223] GetProcessHeap () returned 0x4e0000 [0142.223] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0142.223] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EXPEDITN", cAlternateFileName="")) returned 1 [0142.223] GetProcessHeap () returned 0x4e0000 [0142.223] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x92) returned 0x4fa058 [0142.223] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0142.223] GetProcessHeap () returned 0x4e0000 [0142.224] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0142.224] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0142.224] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd690500, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd690500, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x19539, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EXPEDITN.ELM", cAlternateFileName="")) returned 1 [0142.224] GetProcessHeap () returned 0x4e0000 [0142.224] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x294) returned 0x527118 [0142.224] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.224] GetProcessHeap () returned 0x4e0000 [0142.224] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0142.224] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0142.224] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0142.224] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x7, lpOverlapped=0x0) returned 1 [0142.227] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.227] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.227] GetProcessHeap () returned 0x4e0000 [0142.227] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0142.227] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0142.227] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.227] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0142.227] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0142.228] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0142.228] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0142.228] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0142.228] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.228] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.228] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.228] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.228] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x19539, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x19539, lpOverlapped=0x0) returned 1 [0142.233] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x19540, dwBufLen=0x19540 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x19540) returned 1 [0142.234] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.234] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x19540, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x19540, lpOverlapped=0x0) returned 1 [0142.234] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.234] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x19614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.234] SetEndOfFile (hFile=0x100) returned 1 [0142.238] GetProcessHeap () returned 0x4e0000 [0142.238] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0142.238] GetProcessHeap () returned 0x4e0000 [0142.238] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0142.238] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0142.239] CloseHandle (hObject=0x100) returned 1 [0142.239] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x255, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EXPEDITN.INF", cAlternateFileName="")) returned 1 [0142.239] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.240] GetProcessHeap () returned 0x4e0000 [0142.240] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0142.240] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0142.240] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0142.241] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xb, lpOverlapped=0x0) returned 1 [0142.243] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.243] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.243] GetProcessHeap () returned 0x4e0000 [0142.243] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0142.243] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0142.243] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.243] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0142.243] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0142.243] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0142.243] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0142.243] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0142.243] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.244] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.244] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.244] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.244] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x255, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x255, lpOverlapped=0x0) returned 1 [0142.244] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x260, dwBufLen=0x260 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x260) returned 1 [0142.244] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.244] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x260, lpOverlapped=0x0) returned 1 [0142.244] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.244] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x334, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.244] SetEndOfFile (hFile=0x100) returned 1 [0142.247] GetProcessHeap () returned 0x4e0000 [0142.247] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0142.247] GetProcessHeap () returned 0x4e0000 [0142.247] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0142.247] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.inf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0142.250] CloseHandle (hObject=0x100) returned 1 [0142.250] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0142.250] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.250] GetProcessHeap () returned 0x4e0000 [0142.250] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0142.250] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0142.250] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0142.250] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.250] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.250] GetProcessHeap () returned 0x4e0000 [0142.250] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0142.251] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0142.251] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.251] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0142.255] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0142.255] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0142.255] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0142.255] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0142.255] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.256] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.256] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.256] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.256] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1400, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x1400, lpOverlapped=0x0) returned 1 [0142.257] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1400, dwBufLen=0x1400 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1400) returned 1 [0142.257] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.257] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1400, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x1400, lpOverlapped=0x0) returned 1 [0142.257] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.257] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x14d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.257] SetEndOfFile (hFile=0x100) returned 1 [0142.260] GetProcessHeap () returned 0x4e0000 [0142.260] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0142.260] GetProcessHeap () returned 0x4e0000 [0142.260] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0142.260] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0142.261] CloseHandle (hObject=0x100) returned 1 [0142.261] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xed34, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0142.261] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.262] GetProcessHeap () returned 0x4e0000 [0142.262] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0142.262] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0142.262] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0142.262] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xc, lpOverlapped=0x0) returned 1 [0142.264] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.265] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.265] GetProcessHeap () returned 0x4e0000 [0142.265] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0142.265] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0142.265] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.265] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0142.265] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0142.265] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0142.265] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0142.265] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0142.265] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.265] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.265] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.265] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.265] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xed34, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xed34, lpOverlapped=0x0) returned 1 [0142.267] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xed40, dwBufLen=0xed40 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xed40) returned 1 [0142.267] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.267] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xed40, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xed40, lpOverlapped=0x0) returned 1 [0142.268] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.268] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xee14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.268] SetEndOfFile (hFile=0x100) returned 1 [0142.271] GetProcessHeap () returned 0x4e0000 [0142.271] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0142.271] GetProcessHeap () returned 0x4e0000 [0142.271] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0142.271] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0142.272] CloseHandle (hObject=0x100) returned 1 [0142.272] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xed34, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0142.272] GetProcessHeap () returned 0x4e0000 [0142.272] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0142.273] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0142.273] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df020 | out: pbData=0x4f53d8, pdwDataLen=0x24df020) returned 1 [0142.273] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.273] GetProcessHeap () returned 0x4e0000 [0142.273] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0142.273] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0142.273] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df020 | out: pbData=0x4f5420, pdwDataLen=0x24df020) returned 1 [0142.273] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.273] GetProcessHeap () returned 0x4e0000 [0142.273] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5273b8 [0142.273] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0142.273] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5273b8, pdwDataLen=0x24df020 | out: pbData=0x5273b8, pdwDataLen=0x24df020) returned 1 [0142.273] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.273] wsprintfW (in: param_1=0x24ddffc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\readme-warning.txt") returned 83 [0142.273] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.274] WriteFile (in: hFile=0x100, lpBuffer=0x5273b8*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddff8, lpOverlapped=0x0 | out: lpBuffer=0x5273b8*, lpNumberOfBytesWritten=0x24ddff8*=0x6c3, lpOverlapped=0x0) returned 1 [0142.275] CloseHandle (hObject=0x100) returned 1 [0142.275] GetProcessHeap () returned 0x4e0000 [0142.275] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273b8 | out: hHeap=0x4e0000) returned 1 [0142.275] GetProcessHeap () returned 0x4e0000 [0142.275] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0142.275] GetProcessHeap () returned 0x4e0000 [0142.275] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0142.275] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0142.275] GetProcessHeap () returned 0x4e0000 [0142.275] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0142.275] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ICE", cAlternateFileName="")) returned 1 [0142.276] GetProcessHeap () returned 0x4e0000 [0142.276] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x88) returned 0x4fa058 [0142.276] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0142.278] GetProcessHeap () returned 0x4e0000 [0142.278] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0142.278] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0142.278] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35ee600, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35ee600, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x109d0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ICE.ELM", cAlternateFileName="")) returned 1 [0142.278] GetProcessHeap () returned 0x4e0000 [0142.278] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x28a) returned 0x527118 [0142.278] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.280] GetProcessHeap () returned 0x4e0000 [0142.280] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0142.280] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0142.280] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0142.280] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.280] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.280] GetProcessHeap () returned 0x4e0000 [0142.280] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0142.281] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30) returned 1 [0142.281] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.281] WriteFile (in: hFile=0x100, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24defc8*=0x30, lpOverlapped=0x0) returned 1 [0142.283] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0142.283] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0142.283] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0142.283] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0142.283] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.284] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.284] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.284] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.284] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x109d0, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x109d0, lpOverlapped=0x0) returned 1 [0142.285] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x109d0, dwBufLen=0x109d0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x109d0) returned 1 [0142.286] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.286] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x109d0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x109d0, lpOverlapped=0x0) returned 1 [0142.286] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.286] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x10a94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.287] SetEndOfFile (hFile=0x100) returned 1 [0142.290] GetProcessHeap () returned 0x4e0000 [0142.290] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0142.290] GetProcessHeap () returned 0x4e0000 [0142.290] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0142.290] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0142.291] CloseHandle (hObject=0x100) returned 1 [0142.291] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1ad, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ICE.INF", cAlternateFileName="")) returned 1 [0142.291] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.292] GetProcessHeap () returned 0x4e0000 [0142.292] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0142.292] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0142.292] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0142.292] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x3, lpOverlapped=0x0) returned 1 [0142.294] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.294] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.294] GetProcessHeap () returned 0x4e0000 [0142.294] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0142.294] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30) returned 1 [0142.294] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.294] WriteFile (in: hFile=0x100, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24defc8*=0x30, lpOverlapped=0x0) returned 1 [0142.294] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0142.294] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0142.294] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0142.294] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0142.295] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.295] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.295] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.295] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.295] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1ad, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x1ad, lpOverlapped=0x0) returned 1 [0142.295] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1b0, dwBufLen=0x1b0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1b0) returned 1 [0142.295] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.295] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1b0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x1b0, lpOverlapped=0x0) returned 1 [0142.295] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.295] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x274, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.295] SetEndOfFile (hFile=0x100) returned 1 [0142.298] GetProcessHeap () returned 0x4e0000 [0142.298] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0142.298] GetProcessHeap () returned 0x4e0000 [0142.298] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0142.298] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0142.302] CloseHandle (hObject=0x100) returned 1 [0142.302] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0142.302] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.303] GetProcessHeap () returned 0x4e0000 [0142.303] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0142.303] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0142.303] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0142.303] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.305] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.305] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.305] GetProcessHeap () returned 0x4e0000 [0142.305] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0142.305] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0142.305] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.305] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0142.305] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0142.306] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0142.306] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0142.306] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0142.306] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.306] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.306] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.306] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.306] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x9f8, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x9f8, lpOverlapped=0x0) returned 1 [0142.306] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xa00, dwBufLen=0xa00 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xa00) returned 1 [0142.306] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.306] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xa00, lpOverlapped=0x0) returned 1 [0142.306] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.306] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.307] SetEndOfFile (hFile=0x100) returned 1 [0142.309] GetProcessHeap () returned 0x4e0000 [0142.309] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0142.309] GetProcessHeap () returned 0x4e0000 [0142.309] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0142.309] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0142.310] CloseHandle (hObject=0x100) returned 1 [0142.311] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4981, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0142.311] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.311] GetProcessHeap () returned 0x4e0000 [0142.311] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0142.311] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0142.311] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0142.311] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xf, lpOverlapped=0x0) returned 1 [0142.313] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.313] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.313] GetProcessHeap () returned 0x4e0000 [0142.313] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0142.313] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0142.313] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.313] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0142.313] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0142.314] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0142.314] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0142.314] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0142.314] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.314] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.314] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.314] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.314] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4981, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x4981, lpOverlapped=0x0) returned 1 [0142.315] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x4990, dwBufLen=0x4990 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x4990) returned 1 [0142.315] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.315] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4990, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x4990, lpOverlapped=0x0) returned 1 [0142.315] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.315] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x4a64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.316] SetEndOfFile (hFile=0x100) returned 1 [0142.318] GetProcessHeap () returned 0x4e0000 [0142.318] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0142.318] GetProcessHeap () returned 0x4e0000 [0142.318] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0142.318] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0142.320] CloseHandle (hObject=0x100) returned 1 [0142.320] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4981, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0142.320] GetProcessHeap () returned 0x4e0000 [0142.320] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0142.320] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0142.321] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df020 | out: pbData=0x4f53d8, pdwDataLen=0x24df020) returned 1 [0142.321] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.321] GetProcessHeap () returned 0x4e0000 [0142.321] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0142.321] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0142.321] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df020 | out: pbData=0x4f5420, pdwDataLen=0x24df020) returned 1 [0142.321] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.321] GetProcessHeap () returned 0x4e0000 [0142.321] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5273b0 [0142.321] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0142.321] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5273b0, pdwDataLen=0x24df020 | out: pbData=0x5273b0, pdwDataLen=0x24df020) returned 1 [0142.321] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.321] wsprintfW (in: param_1=0x24ddffc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\readme-warning.txt") returned 78 [0142.321] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.322] WriteFile (in: hFile=0x100, lpBuffer=0x5273b0*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddff8, lpOverlapped=0x0 | out: lpBuffer=0x5273b0*, lpNumberOfBytesWritten=0x24ddff8*=0x6c3, lpOverlapped=0x0) returned 1 [0142.323] CloseHandle (hObject=0x100) returned 1 [0142.324] GetProcessHeap () returned 0x4e0000 [0142.324] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273b0 | out: hHeap=0x4e0000) returned 1 [0142.324] GetProcessHeap () returned 0x4e0000 [0142.324] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0142.324] GetProcessHeap () returned 0x4e0000 [0142.324] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0142.324] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0142.324] GetProcessHeap () returned 0x4e0000 [0142.324] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0142.324] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="INDUST", cAlternateFileName="")) returned 1 [0142.324] GetProcessHeap () returned 0x4e0000 [0142.324] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8e) returned 0x524ea0 [0142.324] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0142.326] GetProcessHeap () returned 0x4e0000 [0142.326] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x524ea0 | out: hHeap=0x4e0000) returned 1 [0142.326] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0142.326] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4901300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x539538d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4901300, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x184e9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="INDUST.ELM", cAlternateFileName="")) returned 1 [0142.326] GetProcessHeap () returned 0x4e0000 [0142.326] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x290) returned 0x527118 [0142.326] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.327] GetProcessHeap () returned 0x4e0000 [0142.327] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0142.327] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0142.327] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0142.327] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x7, lpOverlapped=0x0) returned 1 [0142.329] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.329] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.329] GetProcessHeap () returned 0x4e0000 [0142.329] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0142.329] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30) returned 1 [0142.330] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.330] WriteFile (in: hFile=0x100, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24defc8*=0x30, lpOverlapped=0x0) returned 1 [0142.330] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0142.330] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0142.330] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0142.330] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0142.330] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.330] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.330] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.330] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.330] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x184e9, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x184e9, lpOverlapped=0x0) returned 1 [0142.332] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x184f0, dwBufLen=0x184f0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x184f0) returned 1 [0142.334] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.334] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x184f0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x184f0, lpOverlapped=0x0) returned 1 [0142.334] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.334] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x185b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.334] SetEndOfFile (hFile=0x100) returned 1 [0142.341] GetProcessHeap () returned 0x4e0000 [0142.341] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0142.341] GetProcessHeap () returned 0x4e0000 [0142.341] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0142.341] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0142.342] CloseHandle (hObject=0x100) returned 1 [0142.342] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x225, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="INDUST.INF", cAlternateFileName="")) returned 1 [0142.342] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.343] GetProcessHeap () returned 0x4e0000 [0142.343] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0142.343] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0142.343] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0142.343] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xb, lpOverlapped=0x0) returned 1 [0142.345] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.345] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.345] GetProcessHeap () returned 0x4e0000 [0142.345] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0142.345] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30) returned 1 [0142.345] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.345] WriteFile (in: hFile=0x100, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24defc8*=0x30, lpOverlapped=0x0) returned 1 [0142.345] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0142.346] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0142.346] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0142.346] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0142.346] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.346] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.346] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.346] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.346] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x225, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x225, lpOverlapped=0x0) returned 1 [0142.346] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x230, dwBufLen=0x230 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x230) returned 1 [0142.346] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.346] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x230, lpOverlapped=0x0) returned 1 [0142.346] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.347] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x2f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.347] SetEndOfFile (hFile=0x100) returned 1 [0142.349] GetProcessHeap () returned 0x4e0000 [0142.349] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0142.349] GetProcessHeap () returned 0x4e0000 [0142.349] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0142.349] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.inf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0142.352] CloseHandle (hObject=0x100) returned 1 [0142.352] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x143b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0142.352] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.352] GetProcessHeap () returned 0x4e0000 [0142.352] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0142.352] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0142.352] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0142.353] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x5, lpOverlapped=0x0) returned 1 [0142.361] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.361] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.361] GetProcessHeap () returned 0x4e0000 [0142.361] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0142.361] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0142.361] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.361] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0142.361] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0142.361] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0142.361] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0142.361] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0142.362] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.362] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.362] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.362] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.362] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x143b, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x143b, lpOverlapped=0x0) returned 1 [0142.363] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1440, dwBufLen=0x1440 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1440) returned 1 [0142.363] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.363] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x1440, lpOverlapped=0x0) returned 1 [0142.363] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.363] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1514, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.363] SetEndOfFile (hFile=0x100) returned 1 [0142.367] GetProcessHeap () returned 0x4e0000 [0142.367] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0142.367] GetProcessHeap () returned 0x4e0000 [0142.367] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0142.367] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0142.368] CloseHandle (hObject=0x100) returned 1 [0142.368] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8317, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0142.368] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.368] GetProcessHeap () returned 0x4e0000 [0142.368] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0142.368] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0142.368] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0142.368] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x9, lpOverlapped=0x0) returned 1 [0142.371] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.371] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.371] GetProcessHeap () returned 0x4e0000 [0142.371] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0142.371] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0142.371] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.371] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0142.371] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0142.371] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0142.371] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0142.371] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0142.371] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.371] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.372] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.372] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.372] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x8317, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x8317, lpOverlapped=0x0) returned 1 [0142.373] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x8320, dwBufLen=0x8320 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x8320) returned 1 [0142.373] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.373] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x8320, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x8320, lpOverlapped=0x0) returned 1 [0142.374] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.374] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x83f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.374] SetEndOfFile (hFile=0x100) returned 1 [0142.376] GetProcessHeap () returned 0x4e0000 [0142.377] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0142.377] GetProcessHeap () returned 0x4e0000 [0142.377] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0142.377] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0142.377] CloseHandle (hObject=0x100) returned 1 [0142.378] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8317, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0142.378] GetProcessHeap () returned 0x4e0000 [0142.378] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0142.378] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0142.378] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df020 | out: pbData=0x4f53d8, pdwDataLen=0x24df020) returned 1 [0142.378] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.378] GetProcessHeap () returned 0x4e0000 [0142.378] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0142.378] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0142.378] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df020 | out: pbData=0x4f5420, pdwDataLen=0x24df020) returned 1 [0142.378] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.378] GetProcessHeap () returned 0x4e0000 [0142.378] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5273b0 [0142.378] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0142.378] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5273b0, pdwDataLen=0x24df020 | out: pbData=0x5273b0, pdwDataLen=0x24df020) returned 1 [0142.379] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.379] wsprintfW (in: param_1=0x24ddffc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\readme-warning.txt") returned 81 [0142.379] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.379] WriteFile (in: hFile=0x100, lpBuffer=0x5273b0*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddff8, lpOverlapped=0x0 | out: lpBuffer=0x5273b0*, lpNumberOfBytesWritten=0x24ddff8*=0x6c3, lpOverlapped=0x0) returned 1 [0142.380] CloseHandle (hObject=0x100) returned 1 [0142.381] GetProcessHeap () returned 0x4e0000 [0142.381] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273b0 | out: hHeap=0x4e0000) returned 1 [0142.381] GetProcessHeap () returned 0x4e0000 [0142.381] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0142.381] GetProcessHeap () returned 0x4e0000 [0142.381] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0142.381] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0142.381] GetProcessHeap () returned 0x4e0000 [0142.381] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0142.381] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IRIS", cAlternateFileName="")) returned 1 [0142.381] GetProcessHeap () returned 0x4e0000 [0142.381] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8a) returned 0x524ea0 [0142.381] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0142.381] GetProcessHeap () returned 0x4e0000 [0142.382] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x524ea0 | out: hHeap=0x4e0000) returned 1 [0142.382] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0142.382] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f26d00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f26d00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1015d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IRIS.ELM", cAlternateFileName="")) returned 1 [0142.382] GetProcessHeap () returned 0x4e0000 [0142.382] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x28c) returned 0x527118 [0142.382] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.383] GetProcessHeap () returned 0x4e0000 [0142.383] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0142.383] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0142.383] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0142.383] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x3, lpOverlapped=0x0) returned 1 [0142.385] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.385] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.385] GetProcessHeap () returned 0x4e0000 [0142.385] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0142.385] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30) returned 1 [0142.385] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.385] WriteFile (in: hFile=0x100, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24defc8*=0x30, lpOverlapped=0x0) returned 1 [0142.385] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0142.386] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0142.386] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0142.386] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0142.386] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.386] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.386] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.386] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.386] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1015d, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x1015d, lpOverlapped=0x0) returned 1 [0142.388] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x10160, dwBufLen=0x10160 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x10160) returned 1 [0142.388] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.389] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x10160, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x10160, lpOverlapped=0x0) returned 1 [0142.389] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.389] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x10224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.389] SetEndOfFile (hFile=0x100) returned 1 [0142.392] GetProcessHeap () returned 0x4e0000 [0142.392] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0142.392] GetProcessHeap () returned 0x4e0000 [0142.392] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0142.392] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0142.393] CloseHandle (hObject=0x100) returned 1 [0142.393] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1ce, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IRIS.INF", cAlternateFileName="")) returned 1 [0142.393] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.393] GetProcessHeap () returned 0x4e0000 [0142.394] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0142.394] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0142.394] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0142.394] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x2, lpOverlapped=0x0) returned 1 [0142.395] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.395] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.395] GetProcessHeap () returned 0x4e0000 [0142.395] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0142.395] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30) returned 1 [0142.395] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.396] WriteFile (in: hFile=0x100, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24defc8*=0x30, lpOverlapped=0x0) returned 1 [0142.396] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0142.396] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0142.396] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0142.396] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0142.396] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.396] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.396] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.396] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.396] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1ce, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x1ce, lpOverlapped=0x0) returned 1 [0142.396] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1d0) returned 1 [0142.396] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.396] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x1d0, lpOverlapped=0x0) returned 1 [0142.397] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.410] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x294, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.410] SetEndOfFile (hFile=0x100) returned 1 [0142.413] GetProcessHeap () returned 0x4e0000 [0142.413] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0142.413] GetProcessHeap () returned 0x4e0000 [0142.413] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0142.413] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.inf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0142.530] CloseHandle (hObject=0x100) returned 1 [0142.530] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9ac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0142.530] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.531] GetProcessHeap () returned 0x4e0000 [0142.531] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0142.531] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0142.531] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0142.532] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0142.534] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.534] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.534] GetProcessHeap () returned 0x4e0000 [0142.534] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0142.534] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0142.534] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.534] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0142.534] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0142.534] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0142.534] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0142.534] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0142.534] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.535] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.535] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.535] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.535] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x9ac, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x9ac, lpOverlapped=0x0) returned 1 [0142.535] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x9b0, dwBufLen=0x9b0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x9b0) returned 1 [0142.535] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.535] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x9b0, lpOverlapped=0x0) returned 1 [0142.535] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.535] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xa84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.535] SetEndOfFile (hFile=0x100) returned 1 [0142.538] GetProcessHeap () returned 0x4e0000 [0142.538] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0142.538] GetProcessHeap () returned 0x4e0000 [0142.538] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0142.538] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0142.539] CloseHandle (hObject=0x100) returned 1 [0142.539] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c1d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0142.539] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.539] GetProcessHeap () returned 0x4e0000 [0142.540] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0142.540] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0142.540] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0142.540] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x3, lpOverlapped=0x0) returned 1 [0142.542] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.542] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.542] GetProcessHeap () returned 0x4e0000 [0142.542] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0142.542] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0142.542] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.542] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0142.542] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0142.542] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0142.542] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0142.542] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0142.542] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.542] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.542] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.542] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.543] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4c1d, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x4c1d, lpOverlapped=0x0) returned 1 [0142.543] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x4c20, dwBufLen=0x4c20 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x4c20) returned 1 [0142.544] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.544] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4c20, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x4c20, lpOverlapped=0x0) returned 1 [0142.544] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.544] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x4cf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.544] SetEndOfFile (hFile=0x100) returned 1 [0142.547] GetProcessHeap () returned 0x4e0000 [0142.547] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0142.547] GetProcessHeap () returned 0x4e0000 [0142.547] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0142.547] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0142.548] CloseHandle (hObject=0x100) returned 1 [0142.548] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c1d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0142.548] GetProcessHeap () returned 0x4e0000 [0142.548] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0142.548] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0142.548] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df020 | out: pbData=0x4f53d8, pdwDataLen=0x24df020) returned 1 [0142.548] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.548] GetProcessHeap () returned 0x4e0000 [0142.548] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0142.548] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0142.548] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df020 | out: pbData=0x4f5420, pdwDataLen=0x24df020) returned 1 [0142.548] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.548] GetProcessHeap () returned 0x4e0000 [0142.548] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5273b0 [0142.548] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0142.548] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5273b0, pdwDataLen=0x24df020 | out: pbData=0x5273b0, pdwDataLen=0x24df020) returned 1 [0142.549] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.549] wsprintfW (in: param_1=0x24ddffc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\readme-warning.txt") returned 79 [0142.549] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.549] WriteFile (in: hFile=0x100, lpBuffer=0x5273b0*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddff8, lpOverlapped=0x0 | out: lpBuffer=0x5273b0*, lpNumberOfBytesWritten=0x24ddff8*=0x6c3, lpOverlapped=0x0) returned 1 [0142.550] CloseHandle (hObject=0x100) returned 1 [0142.551] GetProcessHeap () returned 0x4e0000 [0142.551] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273b0 | out: hHeap=0x4e0000) returned 1 [0142.551] GetProcessHeap () returned 0x4e0000 [0142.551] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0142.551] GetProcessHeap () returned 0x4e0000 [0142.551] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0142.551] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0142.551] GetProcessHeap () returned 0x4e0000 [0142.551] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0142.551] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="JOURNAL", cAlternateFileName="")) returned 1 [0142.551] GetProcessHeap () returned 0x4e0000 [0142.551] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x90) returned 0x524ea0 [0142.551] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0142.555] GetProcessHeap () returned 0x4e0000 [0142.555] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x524ea0 | out: hHeap=0x4e0000) returned 1 [0142.555] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0142.555] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8239a00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8239a00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xba32, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="JOURNAL.ELM", cAlternateFileName="")) returned 1 [0142.555] GetProcessHeap () returned 0x4e0000 [0142.555] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x292) returned 0x527118 [0142.555] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.556] GetProcessHeap () returned 0x4e0000 [0142.556] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0142.556] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0142.556] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0142.556] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xe, lpOverlapped=0x0) returned 1 [0142.558] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.559] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.559] GetProcessHeap () returned 0x4e0000 [0142.559] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0142.559] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0142.559] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.559] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0142.559] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0142.559] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0142.559] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0142.559] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0142.559] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.559] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.559] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.559] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.559] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xba32, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xba32, lpOverlapped=0x0) returned 1 [0142.561] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xba40, dwBufLen=0xba40 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xba40) returned 1 [0142.561] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.562] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xba40, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xba40, lpOverlapped=0x0) returned 1 [0142.562] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.562] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xbb14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.562] SetEndOfFile (hFile=0x100) returned 1 [0142.565] GetProcessHeap () returned 0x4e0000 [0142.565] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0142.565] GetProcessHeap () returned 0x4e0000 [0142.565] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0142.565] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0142.566] CloseHandle (hObject=0x100) returned 1 [0142.566] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x567e4730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="JOURNAL.INF", cAlternateFileName="")) returned 1 [0142.566] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.567] GetProcessHeap () returned 0x4e0000 [0142.567] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0142.567] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0142.567] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0142.567] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xd, lpOverlapped=0x0) returned 1 [0142.569] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.569] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.569] GetProcessHeap () returned 0x4e0000 [0142.569] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0142.569] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0142.569] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.569] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0142.569] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0142.569] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0142.569] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0142.570] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0142.570] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.570] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.570] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.570] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.570] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1f3, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x1f3, lpOverlapped=0x0) returned 1 [0142.570] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x200, dwBufLen=0x200 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x200) returned 1 [0142.570] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.570] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x200, lpOverlapped=0x0) returned 1 [0142.570] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.570] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x2d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.570] SetEndOfFile (hFile=0x100) returned 1 [0142.573] GetProcessHeap () returned 0x4e0000 [0142.573] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0142.573] GetProcessHeap () returned 0x4e0000 [0142.573] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0142.573] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.inf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0142.576] CloseHandle (hObject=0x100) returned 1 [0142.577] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4d0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0142.577] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.577] GetProcessHeap () returned 0x4e0000 [0142.577] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0142.577] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0142.577] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0142.577] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.577] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.577] GetProcessHeap () returned 0x4e0000 [0142.577] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0142.577] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0142.577] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.577] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0142.580] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0142.580] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0142.580] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0142.580] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0142.580] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.580] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.580] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.580] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.580] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4d0, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x4d0, lpOverlapped=0x0) returned 1 [0142.580] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x4d0, dwBufLen=0x4d0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x4d0) returned 1 [0142.580] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.581] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x4d0, lpOverlapped=0x0) returned 1 [0142.581] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.581] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x5a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.581] SetEndOfFile (hFile=0x100) returned 1 [0142.583] GetProcessHeap () returned 0x4e0000 [0142.583] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0142.583] GetProcessHeap () returned 0x4e0000 [0142.583] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0142.584] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0142.585] CloseHandle (hObject=0x100) returned 1 [0142.585] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x47ed, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0142.585] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.585] GetProcessHeap () returned 0x4e0000 [0142.585] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0142.585] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0142.585] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0142.585] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x3, lpOverlapped=0x0) returned 1 [0142.587] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.588] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.588] GetProcessHeap () returned 0x4e0000 [0142.588] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0142.588] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0142.588] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.588] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0142.588] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0142.588] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0142.588] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0142.588] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0142.588] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.588] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.588] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.588] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.589] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x47ed, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x47ed, lpOverlapped=0x0) returned 1 [0142.590] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x47f0, dwBufLen=0x47f0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x47f0) returned 1 [0142.590] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.590] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x47f0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x47f0, lpOverlapped=0x0) returned 1 [0142.590] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.590] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x48c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.590] SetEndOfFile (hFile=0x100) returned 1 [0142.593] GetProcessHeap () returned 0x4e0000 [0142.593] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0142.593] GetProcessHeap () returned 0x4e0000 [0142.593] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0142.593] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0142.594] CloseHandle (hObject=0x100) returned 1 [0142.594] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x47ed, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0142.594] GetProcessHeap () returned 0x4e0000 [0142.594] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0142.594] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0142.594] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df020 | out: pbData=0x4f53d8, pdwDataLen=0x24df020) returned 1 [0142.595] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.595] GetProcessHeap () returned 0x4e0000 [0142.595] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0142.595] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0142.595] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df020 | out: pbData=0x4f5420, pdwDataLen=0x24df020) returned 1 [0142.595] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.595] GetProcessHeap () returned 0x4e0000 [0142.595] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5273b8 [0142.595] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0142.595] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5273b8, pdwDataLen=0x24df020 | out: pbData=0x5273b8, pdwDataLen=0x24df020) returned 1 [0142.595] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.595] wsprintfW (in: param_1=0x24ddffc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\readme-warning.txt") returned 82 [0142.595] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.596] WriteFile (in: hFile=0x100, lpBuffer=0x5273b8*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddff8, lpOverlapped=0x0 | out: lpBuffer=0x5273b8*, lpNumberOfBytesWritten=0x24ddff8*=0x6c3, lpOverlapped=0x0) returned 1 [0142.597] CloseHandle (hObject=0x100) returned 1 [0142.597] GetProcessHeap () returned 0x4e0000 [0142.597] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273b8 | out: hHeap=0x4e0000) returned 1 [0142.597] GetProcessHeap () returned 0x4e0000 [0142.597] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0142.597] GetProcessHeap () returned 0x4e0000 [0142.597] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0142.597] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0142.597] GetProcessHeap () returned 0x4e0000 [0142.597] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0142.597] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LAYERS", cAlternateFileName="")) returned 1 [0142.597] GetProcessHeap () returned 0x4e0000 [0142.597] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8e) returned 0x524ea0 [0142.598] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0142.599] GetProcessHeap () returned 0x4e0000 [0142.599] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x524ea0 | out: hHeap=0x4e0000) returned 1 [0142.599] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0142.599] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x954c700, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x567e4730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x954c700, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe743, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LAYERS.ELM", cAlternateFileName="")) returned 1 [0142.599] GetProcessHeap () returned 0x4e0000 [0142.599] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x290) returned 0x527118 [0142.599] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.599] GetProcessHeap () returned 0x4e0000 [0142.599] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0142.599] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0142.600] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0142.600] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xd, lpOverlapped=0x0) returned 1 [0142.603] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.603] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.603] GetProcessHeap () returned 0x4e0000 [0142.603] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0142.603] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30) returned 1 [0142.603] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.603] WriteFile (in: hFile=0x100, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24defc8*=0x30, lpOverlapped=0x0) returned 1 [0142.604] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0142.604] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0142.604] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0142.604] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0142.604] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.604] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.604] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.604] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.604] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xe743, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xe743, lpOverlapped=0x0) returned 1 [0142.606] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xe750, dwBufLen=0xe750 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xe750) returned 1 [0142.607] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.607] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe750, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xe750, lpOverlapped=0x0) returned 1 [0142.607] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.607] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xe814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.607] SetEndOfFile (hFile=0x100) returned 1 [0142.610] GetProcessHeap () returned 0x4e0000 [0142.610] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0142.610] GetProcessHeap () returned 0x4e0000 [0142.610] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0142.610] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0142.611] CloseHandle (hObject=0x100) returned 1 [0142.611] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x215, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LAYERS.INF", cAlternateFileName="")) returned 1 [0142.611] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.612] GetProcessHeap () returned 0x4e0000 [0142.612] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0142.612] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0142.613] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0142.613] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xb, lpOverlapped=0x0) returned 1 [0142.614] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.614] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.614] GetProcessHeap () returned 0x4e0000 [0142.614] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0142.614] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30) returned 1 [0142.614] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.614] WriteFile (in: hFile=0x100, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24defc8*=0x30, lpOverlapped=0x0) returned 1 [0142.615] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0142.615] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0142.615] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0142.615] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0142.615] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.615] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.615] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.615] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.615] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x215, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x215, lpOverlapped=0x0) returned 1 [0142.615] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x220, dwBufLen=0x220 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x220) returned 1 [0142.615] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.615] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x220, lpOverlapped=0x0) returned 1 [0142.616] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.616] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x2e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.616] SetEndOfFile (hFile=0x100) returned 1 [0142.618] GetProcessHeap () returned 0x4e0000 [0142.618] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0142.618] GetProcessHeap () returned 0x4e0000 [0142.618] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0142.619] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.inf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0142.621] CloseHandle (hObject=0x100) returned 1 [0142.621] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x67b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0142.621] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.622] GetProcessHeap () returned 0x4e0000 [0142.622] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0142.622] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0142.622] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0142.622] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x5, lpOverlapped=0x0) returned 1 [0142.627] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.627] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.627] GetProcessHeap () returned 0x4e0000 [0142.627] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0142.627] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0142.627] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.627] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0142.627] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0142.628] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0142.628] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0142.628] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0142.628] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.628] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.628] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.628] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.628] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x67b, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x67b, lpOverlapped=0x0) returned 1 [0142.628] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x680, dwBufLen=0x680 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x680) returned 1 [0142.628] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.628] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x680, lpOverlapped=0x0) returned 1 [0142.629] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.629] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x754, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.629] SetEndOfFile (hFile=0x100) returned 1 [0142.632] GetProcessHeap () returned 0x4e0000 [0142.632] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0142.632] GetProcessHeap () returned 0x4e0000 [0142.632] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0142.632] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0142.633] CloseHandle (hObject=0x100) returned 1 [0142.633] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xaf32, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0142.633] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.634] GetProcessHeap () returned 0x4e0000 [0142.634] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0142.634] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0142.634] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0142.634] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xe, lpOverlapped=0x0) returned 1 [0142.636] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.636] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.636] GetProcessHeap () returned 0x4e0000 [0142.636] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0142.636] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0142.636] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.636] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0142.637] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0142.637] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0142.637] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0142.637] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0142.637] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.637] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.637] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.637] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.637] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xaf32, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xaf32, lpOverlapped=0x0) returned 1 [0142.639] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xaf40, dwBufLen=0xaf40 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xaf40) returned 1 [0142.639] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.639] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xaf40, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xaf40, lpOverlapped=0x0) returned 1 [0142.640] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.640] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xb014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.640] SetEndOfFile (hFile=0x100) returned 1 [0142.643] GetProcessHeap () returned 0x4e0000 [0142.643] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0142.643] GetProcessHeap () returned 0x4e0000 [0142.643] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0142.643] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0142.644] CloseHandle (hObject=0x100) returned 1 [0142.644] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xaf32, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0142.644] GetProcessHeap () returned 0x4e0000 [0142.644] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0142.645] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0142.645] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df020 | out: pbData=0x4f53d8, pdwDataLen=0x24df020) returned 1 [0142.645] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.645] GetProcessHeap () returned 0x4e0000 [0142.645] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0142.645] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0142.645] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df020 | out: pbData=0x4f5420, pdwDataLen=0x24df020) returned 1 [0142.645] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.645] GetProcessHeap () returned 0x4e0000 [0142.645] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5273b0 [0142.645] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0142.645] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5273b0, pdwDataLen=0x24df020 | out: pbData=0x5273b0, pdwDataLen=0x24df020) returned 1 [0142.645] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.645] wsprintfW (in: param_1=0x24ddffc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\readme-warning.txt") returned 81 [0142.645] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.647] WriteFile (in: hFile=0x100, lpBuffer=0x5273b0*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddff8, lpOverlapped=0x0 | out: lpBuffer=0x5273b0*, lpNumberOfBytesWritten=0x24ddff8*=0x6c3, lpOverlapped=0x0) returned 1 [0142.648] CloseHandle (hObject=0x100) returned 1 [0142.648] GetProcessHeap () returned 0x4e0000 [0142.649] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273b0 | out: hHeap=0x4e0000) returned 1 [0142.649] GetProcessHeap () returned 0x4e0000 [0142.649] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0142.649] GetProcessHeap () returned 0x4e0000 [0142.649] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0142.649] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0142.649] GetProcessHeap () returned 0x4e0000 [0142.649] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0142.649] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LEVEL", cAlternateFileName="")) returned 1 [0142.649] GetProcessHeap () returned 0x4e0000 [0142.649] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8c) returned 0x524ea0 [0142.649] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0142.649] GetProcessHeap () returned 0x4e0000 [0142.650] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x524ea0 | out: hHeap=0x4e0000) returned 1 [0142.650] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0142.650] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa85f400, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa85f400, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe2ec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LEVEL.ELM", cAlternateFileName="")) returned 1 [0142.650] GetProcessHeap () returned 0x4e0000 [0142.650] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x28e) returned 0x527118 [0142.650] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.651] GetProcessHeap () returned 0x4e0000 [0142.651] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0142.651] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0142.651] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0142.651] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0142.654] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.654] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.654] GetProcessHeap () returned 0x4e0000 [0142.654] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0142.654] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30) returned 1 [0142.654] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.654] WriteFile (in: hFile=0x100, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24defc8*=0x30, lpOverlapped=0x0) returned 1 [0142.654] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0142.654] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0142.654] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0142.654] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0142.654] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.655] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.655] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.655] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.655] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xe2ec, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xe2ec, lpOverlapped=0x0) returned 1 [0142.656] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xe2f0, dwBufLen=0xe2f0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xe2f0) returned 1 [0142.657] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.657] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe2f0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xe2f0, lpOverlapped=0x0) returned 1 [0142.658] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.658] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xe3b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.658] SetEndOfFile (hFile=0x100) returned 1 [0142.661] GetProcessHeap () returned 0x4e0000 [0142.661] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0142.661] GetProcessHeap () returned 0x4e0000 [0142.661] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0142.661] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.elm.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0142.662] CloseHandle (hObject=0x100) returned 1 [0142.662] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x20e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LEVEL.INF", cAlternateFileName="")) returned 1 [0142.663] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.663] GetProcessHeap () returned 0x4e0000 [0142.663] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0142.663] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0142.663] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0142.663] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x2, lpOverlapped=0x0) returned 1 [0142.665] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.665] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.665] GetProcessHeap () returned 0x4e0000 [0142.665] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0142.665] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30) returned 1 [0142.665] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.665] WriteFile (in: hFile=0x100, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24defc8*=0x30, lpOverlapped=0x0) returned 1 [0142.665] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0142.665] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0142.665] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0142.666] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0142.666] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.666] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.666] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.666] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.666] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x20e, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x20e, lpOverlapped=0x0) returned 1 [0142.666] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x210, dwBufLen=0x210 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x210) returned 1 [0142.666] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.666] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x210, lpOverlapped=0x0) returned 1 [0142.666] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.666] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x2d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.667] SetEndOfFile (hFile=0x100) returned 1 [0142.669] GetProcessHeap () returned 0x4e0000 [0142.669] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0142.669] GetProcessHeap () returned 0x4e0000 [0142.669] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0142.669] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.inf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0142.680] CloseHandle (hObject=0x100) returned 1 [0142.680] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0142.681] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.682] GetProcessHeap () returned 0x4e0000 [0142.682] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0142.682] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0142.682] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0142.682] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xd, lpOverlapped=0x0) returned 1 [0142.685] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.685] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.685] GetProcessHeap () returned 0x4e0000 [0142.685] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0142.685] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0142.685] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.685] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0142.685] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0142.685] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0142.685] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0142.685] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0142.686] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.686] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.686] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.686] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.686] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x563, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x563, lpOverlapped=0x0) returned 1 [0142.686] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x570, dwBufLen=0x570 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x570) returned 1 [0142.686] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.686] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x570, lpOverlapped=0x0) returned 1 [0142.686] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.686] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x644, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.686] SetEndOfFile (hFile=0x100) returned 1 [0142.689] GetProcessHeap () returned 0x4e0000 [0142.689] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0142.689] GetProcessHeap () returned 0x4e0000 [0142.689] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0142.689] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0142.690] CloseHandle (hObject=0x100) returned 1 [0142.690] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbbf3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0142.690] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.691] GetProcessHeap () returned 0x4e0000 [0142.691] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0142.691] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0142.691] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0142.691] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xd, lpOverlapped=0x0) returned 1 [0142.694] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.694] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.694] GetProcessHeap () returned 0x4e0000 [0142.694] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0142.694] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0142.694] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.694] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0142.694] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0142.694] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0142.694] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0142.694] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0142.694] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.694] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.694] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.695] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.695] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xbbf3, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xbbf3, lpOverlapped=0x0) returned 1 [0142.696] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xbc00, dwBufLen=0xbc00 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xbc00) returned 1 [0142.696] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.696] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xbc00, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xbc00, lpOverlapped=0x0) returned 1 [0142.697] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.697] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xbcd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.697] SetEndOfFile (hFile=0x100) returned 1 [0142.700] GetProcessHeap () returned 0x4e0000 [0142.700] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0142.700] GetProcessHeap () returned 0x4e0000 [0142.700] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0142.700] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0142.702] CloseHandle (hObject=0x100) returned 1 [0142.702] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbbf3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0142.702] GetProcessHeap () returned 0x4e0000 [0142.702] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0142.702] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0142.702] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df020 | out: pbData=0x4f53d8, pdwDataLen=0x24df020) returned 1 [0142.702] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.702] GetProcessHeap () returned 0x4e0000 [0142.702] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0142.702] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0142.702] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df020 | out: pbData=0x4f5420, pdwDataLen=0x24df020) returned 1 [0142.702] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.702] GetProcessHeap () returned 0x4e0000 [0142.702] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5273b0 [0142.702] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0142.702] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5273b0, pdwDataLen=0x24df020 | out: pbData=0x5273b0, pdwDataLen=0x24df020) returned 1 [0142.702] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.703] wsprintfW (in: param_1=0x24ddffc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\readme-warning.txt") returned 80 [0142.703] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.703] WriteFile (in: hFile=0x100, lpBuffer=0x5273b0*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddff8, lpOverlapped=0x0 | out: lpBuffer=0x5273b0*, lpNumberOfBytesWritten=0x24ddff8*=0x6c3, lpOverlapped=0x0) returned 1 [0142.704] CloseHandle (hObject=0x100) returned 1 [0142.705] GetProcessHeap () returned 0x4e0000 [0142.705] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273b0 | out: hHeap=0x4e0000) returned 1 [0142.705] GetProcessHeap () returned 0x4e0000 [0142.705] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0142.705] GetProcessHeap () returned 0x4e0000 [0142.705] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0142.705] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0142.705] GetProcessHeap () returned 0x4e0000 [0142.705] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0142.705] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NETWORK", cAlternateFileName="")) returned 1 [0142.705] GetProcessHeap () returned 0x4e0000 [0142.705] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x90) returned 0x524ea0 [0142.705] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0142.706] GetProcessHeap () returned 0x4e0000 [0142.706] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x524ea0 | out: hHeap=0x4e0000) returned 1 [0142.706] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0142.706] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x107bd500, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x107bd500, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xc649, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NETWORK.ELM", cAlternateFileName="")) returned 1 [0142.706] GetProcessHeap () returned 0x4e0000 [0142.706] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x292) returned 0x527118 [0142.706] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.706] GetProcessHeap () returned 0x4e0000 [0142.706] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0142.706] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0142.706] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0142.707] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x7, lpOverlapped=0x0) returned 1 [0142.712] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.712] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.712] GetProcessHeap () returned 0x4e0000 [0142.712] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0142.712] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0142.712] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.712] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0142.713] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0142.713] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0142.713] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0142.713] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0142.713] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.713] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.713] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.713] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.713] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xc649, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xc649, lpOverlapped=0x0) returned 1 [0142.715] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc650, dwBufLen=0xc650 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc650) returned 1 [0142.715] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.715] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc650, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xc650, lpOverlapped=0x0) returned 1 [0142.716] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.716] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xc724, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.716] SetEndOfFile (hFile=0x100) returned 1 [0142.719] GetProcessHeap () returned 0x4e0000 [0142.719] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0142.719] GetProcessHeap () returned 0x4e0000 [0142.719] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0142.719] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.elm.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0142.720] CloseHandle (hObject=0x100) returned 1 [0142.720] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x249, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NETWORK.INF", cAlternateFileName="")) returned 1 [0142.720] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.724] GetProcessHeap () returned 0x4e0000 [0142.724] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0142.724] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0142.724] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0142.724] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x7, lpOverlapped=0x0) returned 1 [0142.726] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.726] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.726] GetProcessHeap () returned 0x4e0000 [0142.726] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0142.726] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0142.726] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.726] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0142.727] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0142.727] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0142.727] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0142.727] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0142.727] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.727] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.727] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.727] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.727] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x249, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x249, lpOverlapped=0x0) returned 1 [0142.727] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x250, dwBufLen=0x250 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x250) returned 1 [0142.727] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.728] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x250, lpOverlapped=0x0) returned 1 [0142.728] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.728] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x324, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.728] SetEndOfFile (hFile=0x100) returned 1 [0142.731] GetProcessHeap () returned 0x4e0000 [0142.731] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0142.731] GetProcessHeap () returned 0x4e0000 [0142.731] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0142.731] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.inf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0142.735] CloseHandle (hObject=0x100) returned 1 [0142.736] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x554, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0142.736] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.736] GetProcessHeap () returned 0x4e0000 [0142.736] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0142.736] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0142.736] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0142.736] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xc, lpOverlapped=0x0) returned 1 [0142.739] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.739] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.739] GetProcessHeap () returned 0x4e0000 [0142.739] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0142.739] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0142.739] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.739] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0142.739] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0142.739] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0142.739] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0142.739] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0142.739] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.739] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.740] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.740] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.740] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x554, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x554, lpOverlapped=0x0) returned 1 [0142.740] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x560, dwBufLen=0x560 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x560) returned 1 [0142.740] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.740] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x560, lpOverlapped=0x0) returned 1 [0142.740] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.740] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x634, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.740] SetEndOfFile (hFile=0x100) returned 1 [0142.743] GetProcessHeap () returned 0x4e0000 [0142.743] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0142.743] GetProcessHeap () returned 0x4e0000 [0142.743] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0142.743] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0142.744] CloseHandle (hObject=0x100) returned 1 [0142.744] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2d35, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0142.744] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.745] GetProcessHeap () returned 0x4e0000 [0142.745] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0142.745] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0142.745] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0142.745] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xb, lpOverlapped=0x0) returned 1 [0142.747] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.747] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.747] GetProcessHeap () returned 0x4e0000 [0142.747] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0142.747] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0142.747] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.748] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0142.748] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0142.748] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0142.748] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0142.748] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0142.748] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.748] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.748] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.748] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.748] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2d35, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x2d35, lpOverlapped=0x0) returned 1 [0142.749] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x2d40, dwBufLen=0x2d40 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x2d40) returned 1 [0142.750] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.750] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x2d40, lpOverlapped=0x0) returned 1 [0142.750] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.750] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x2e14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.750] SetEndOfFile (hFile=0x100) returned 1 [0142.753] GetProcessHeap () returned 0x4e0000 [0142.753] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0142.753] GetProcessHeap () returned 0x4e0000 [0142.753] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0142.753] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0142.754] CloseHandle (hObject=0x100) returned 1 [0142.754] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2d35, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0142.755] GetProcessHeap () returned 0x4e0000 [0142.755] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0142.755] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0142.755] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df020 | out: pbData=0x4f53d8, pdwDataLen=0x24df020) returned 1 [0142.755] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.755] GetProcessHeap () returned 0x4e0000 [0142.755] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0142.755] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0142.755] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df020 | out: pbData=0x4f5420, pdwDataLen=0x24df020) returned 1 [0142.755] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.755] GetProcessHeap () returned 0x4e0000 [0142.755] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5273b8 [0142.755] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0142.755] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5273b8, pdwDataLen=0x24df020 | out: pbData=0x5273b8, pdwDataLen=0x24df020) returned 1 [0142.755] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.755] wsprintfW (in: param_1=0x24ddffc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\readme-warning.txt") returned 82 [0142.755] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.756] WriteFile (in: hFile=0x100, lpBuffer=0x5273b8*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddff8, lpOverlapped=0x0 | out: lpBuffer=0x5273b8*, lpNumberOfBytesWritten=0x24ddff8*=0x6c3, lpOverlapped=0x0) returned 1 [0142.769] CloseHandle (hObject=0x100) returned 1 [0142.769] GetProcessHeap () returned 0x4e0000 [0142.769] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273b8 | out: hHeap=0x4e0000) returned 1 [0142.769] GetProcessHeap () returned 0x4e0000 [0142.769] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0142.769] GetProcessHeap () returned 0x4e0000 [0142.769] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0142.769] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0142.770] GetProcessHeap () returned 0x4e0000 [0142.770] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0142.770] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PAPYRUS", cAlternateFileName="")) returned 1 [0142.770] GetProcessHeap () returned 0x4e0000 [0142.770] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x90) returned 0x524ea0 [0142.770] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0142.779] GetProcessHeap () returned 0x4e0000 [0142.779] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x524ea0 | out: hHeap=0x4e0000) returned 1 [0142.779] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0142.779] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x140f5c00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x140f5c00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x166d5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PAPYRUS.ELM", cAlternateFileName="")) returned 1 [0142.779] GetProcessHeap () returned 0x4e0000 [0142.779] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x292) returned 0x527118 [0142.780] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.780] GetProcessHeap () returned 0x4e0000 [0142.780] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0142.780] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0142.780] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0142.780] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xb, lpOverlapped=0x0) returned 1 [0142.783] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.783] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.783] GetProcessHeap () returned 0x4e0000 [0142.783] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0142.783] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0142.783] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.783] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0142.783] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0142.783] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0142.783] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0142.783] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0142.783] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.783] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.784] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.784] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.784] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x166d5, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x166d5, lpOverlapped=0x0) returned 1 [0142.785] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x166e0, dwBufLen=0x166e0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x166e0) returned 1 [0142.786] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.786] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x166e0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x166e0, lpOverlapped=0x0) returned 1 [0142.787] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.787] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x167b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.787] SetEndOfFile (hFile=0x100) returned 1 [0142.791] GetProcessHeap () returned 0x4e0000 [0142.791] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0142.791] GetProcessHeap () returned 0x4e0000 [0142.791] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0142.791] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0142.792] CloseHandle (hObject=0x100) returned 1 [0142.792] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PAPYRUS.INF", cAlternateFileName="")) returned 1 [0142.792] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.793] GetProcessHeap () returned 0x4e0000 [0142.793] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0142.794] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0142.794] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0142.794] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xc, lpOverlapped=0x0) returned 1 [0142.798] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.798] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.798] GetProcessHeap () returned 0x4e0000 [0142.798] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0142.798] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0142.798] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.798] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0142.798] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0142.798] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0142.798] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0142.798] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0142.798] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.798] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.798] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.798] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.798] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1f4, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x1f4, lpOverlapped=0x0) returned 1 [0142.799] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x200, dwBufLen=0x200 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x200) returned 1 [0142.799] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.799] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x200, lpOverlapped=0x0) returned 1 [0142.799] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.799] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x2d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.799] SetEndOfFile (hFile=0x100) returned 1 [0142.801] GetProcessHeap () returned 0x4e0000 [0142.801] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0142.801] GetProcessHeap () returned 0x4e0000 [0142.801] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0142.801] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.inf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0142.804] CloseHandle (hObject=0x100) returned 1 [0142.804] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa0e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0142.804] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.804] GetProcessHeap () returned 0x4e0000 [0142.804] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0142.804] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0142.804] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0142.804] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x2, lpOverlapped=0x0) returned 1 [0142.806] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.806] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.806] GetProcessHeap () returned 0x4e0000 [0142.806] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0142.806] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0142.806] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.806] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0142.806] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0142.806] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0142.806] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0142.806] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0142.807] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.807] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.807] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.807] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.807] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xa0e, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xa0e, lpOverlapped=0x0) returned 1 [0142.807] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xa10, dwBufLen=0xa10 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xa10) returned 1 [0142.807] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.807] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xa10, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xa10, lpOverlapped=0x0) returned 1 [0142.807] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.807] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xae4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.807] SetEndOfFile (hFile=0x100) returned 1 [0142.809] GetProcessHeap () returned 0x4e0000 [0142.809] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0142.809] GetProcessHeap () returned 0x4e0000 [0142.809] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0142.809] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0142.810] CloseHandle (hObject=0x100) returned 1 [0142.810] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9240, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0142.810] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.810] GetProcessHeap () returned 0x4e0000 [0142.810] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0142.810] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0142.810] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0142.811] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.811] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.811] GetProcessHeap () returned 0x4e0000 [0142.811] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0142.811] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0142.811] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.811] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0142.812] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0142.813] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0142.813] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0142.813] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0142.813] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.813] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.813] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.813] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.813] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x9240, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x9240, lpOverlapped=0x0) returned 1 [0142.814] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x9240, dwBufLen=0x9240 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x9240) returned 1 [0142.814] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.814] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x9240, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x9240, lpOverlapped=0x0) returned 1 [0142.815] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.815] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x9314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.815] SetEndOfFile (hFile=0x100) returned 1 [0142.818] GetProcessHeap () returned 0x4e0000 [0142.818] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0142.818] GetProcessHeap () returned 0x4e0000 [0142.818] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0142.818] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0142.819] CloseHandle (hObject=0x100) returned 1 [0142.819] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9240, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0142.819] GetProcessHeap () returned 0x4e0000 [0142.819] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0142.819] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0142.819] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df020 | out: pbData=0x4f53d8, pdwDataLen=0x24df020) returned 1 [0142.819] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.819] GetProcessHeap () returned 0x4e0000 [0142.819] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0142.820] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0142.820] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df020 | out: pbData=0x4f5420, pdwDataLen=0x24df020) returned 1 [0142.820] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.820] GetProcessHeap () returned 0x4e0000 [0142.820] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5273b8 [0142.820] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0142.820] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5273b8, pdwDataLen=0x24df020 | out: pbData=0x5273b8, pdwDataLen=0x24df020) returned 1 [0142.820] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.820] wsprintfW (in: param_1=0x24ddffc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\readme-warning.txt") returned 82 [0142.820] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.821] WriteFile (in: hFile=0x100, lpBuffer=0x5273b8*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddff8, lpOverlapped=0x0 | out: lpBuffer=0x5273b8*, lpNumberOfBytesWritten=0x24ddff8*=0x6c3, lpOverlapped=0x0) returned 1 [0142.823] CloseHandle (hObject=0x100) returned 1 [0142.823] GetProcessHeap () returned 0x4e0000 [0142.823] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273b8 | out: hHeap=0x4e0000) returned 1 [0142.823] GetProcessHeap () returned 0x4e0000 [0142.823] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0142.823] GetProcessHeap () returned 0x4e0000 [0142.823] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0142.823] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0142.823] GetProcessHeap () returned 0x4e0000 [0142.823] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0142.823] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PIXEL", cAlternateFileName="")) returned 1 [0142.823] GetProcessHeap () returned 0x4e0000 [0142.823] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8c) returned 0x524ea0 [0142.823] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0142.824] GetProcessHeap () returned 0x4e0000 [0142.824] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x524ea0 | out: hHeap=0x4e0000) returned 1 [0142.824] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0142.824] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17a2e300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6cf07e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17a2e300, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xd0e5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PIXEL.ELM", cAlternateFileName="")) returned 1 [0142.824] GetProcessHeap () returned 0x4e0000 [0142.824] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x28e) returned 0x527118 [0142.824] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.825] GetProcessHeap () returned 0x4e0000 [0142.825] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0142.825] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0142.825] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0142.825] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xb, lpOverlapped=0x0) returned 1 [0142.829] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.829] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.829] GetProcessHeap () returned 0x4e0000 [0142.829] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0142.830] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30) returned 1 [0142.830] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.830] WriteFile (in: hFile=0x100, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24defc8*=0x30, lpOverlapped=0x0) returned 1 [0142.830] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0142.830] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0142.830] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0142.830] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0142.830] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.830] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.830] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.830] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.830] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xd0e5, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xd0e5, lpOverlapped=0x0) returned 1 [0142.839] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xd0f0, dwBufLen=0xd0f0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xd0f0) returned 1 [0142.839] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.839] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xd0f0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xd0f0, lpOverlapped=0x0) returned 1 [0142.840] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.840] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xd1b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.840] SetEndOfFile (hFile=0x100) returned 1 [0142.842] GetProcessHeap () returned 0x4e0000 [0142.842] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0142.842] GetProcessHeap () returned 0x4e0000 [0142.842] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0142.842] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.elm.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0142.843] CloseHandle (hObject=0x100) returned 1 [0142.843] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a44b570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x21b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PIXEL.INF", cAlternateFileName="")) returned 1 [0142.843] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.843] GetProcessHeap () returned 0x4e0000 [0142.843] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0142.843] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0142.843] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0142.843] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x5, lpOverlapped=0x0) returned 1 [0142.845] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.845] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.845] GetProcessHeap () returned 0x4e0000 [0142.845] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0142.845] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30) returned 1 [0142.845] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.845] WriteFile (in: hFile=0x100, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24defc8*=0x30, lpOverlapped=0x0) returned 1 [0142.845] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0142.845] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0142.845] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0142.845] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0142.845] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.845] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.846] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.846] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.846] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x21b, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x21b, lpOverlapped=0x0) returned 1 [0142.846] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x220, dwBufLen=0x220 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x220) returned 1 [0142.846] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.846] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x220, lpOverlapped=0x0) returned 1 [0142.846] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.846] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x2e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.846] SetEndOfFile (hFile=0x100) returned 1 [0142.848] GetProcessHeap () returned 0x4e0000 [0142.848] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0142.848] GetProcessHeap () returned 0x4e0000 [0142.848] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0142.848] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.inf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0142.850] CloseHandle (hObject=0x100) returned 1 [0142.851] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x639, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0142.851] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.851] GetProcessHeap () returned 0x4e0000 [0142.851] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0142.851] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0142.851] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0142.851] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x7, lpOverlapped=0x0) returned 1 [0142.853] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.853] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.853] GetProcessHeap () returned 0x4e0000 [0142.853] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0142.853] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0142.853] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.853] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0142.853] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0142.853] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0142.853] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0142.853] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0142.854] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.854] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.854] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.854] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.854] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x639, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x639, lpOverlapped=0x0) returned 1 [0142.854] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x640, dwBufLen=0x640 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x640) returned 1 [0142.854] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.854] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x640, lpOverlapped=0x0) returned 1 [0142.854] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.854] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.854] SetEndOfFile (hFile=0x100) returned 1 [0142.856] GetProcessHeap () returned 0x4e0000 [0142.856] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0142.856] GetProcessHeap () returned 0x4e0000 [0142.856] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0142.856] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0142.857] CloseHandle (hObject=0x100) returned 1 [0142.857] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x54f1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0142.857] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.858] GetProcessHeap () returned 0x4e0000 [0142.858] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0142.858] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0142.858] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0142.858] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xf, lpOverlapped=0x0) returned 1 [0142.860] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.860] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.860] GetProcessHeap () returned 0x4e0000 [0142.860] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0142.860] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0142.860] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.860] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0142.860] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0142.860] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0142.860] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0142.860] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0142.860] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.861] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.861] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.861] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.861] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x54f1, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x54f1, lpOverlapped=0x0) returned 1 [0142.863] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x5500, dwBufLen=0x5500 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x5500) returned 1 [0142.864] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.864] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5500, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x5500, lpOverlapped=0x0) returned 1 [0142.864] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.864] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x55d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.864] SetEndOfFile (hFile=0x100) returned 1 [0142.866] GetProcessHeap () returned 0x4e0000 [0142.866] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0142.866] GetProcessHeap () returned 0x4e0000 [0142.866] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0142.866] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0142.867] CloseHandle (hObject=0x100) returned 1 [0142.867] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x54f1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0142.867] GetProcessHeap () returned 0x4e0000 [0142.867] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0142.867] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0142.867] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df020 | out: pbData=0x4f53d8, pdwDataLen=0x24df020) returned 1 [0142.867] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.867] GetProcessHeap () returned 0x4e0000 [0142.867] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0142.867] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0142.867] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df020 | out: pbData=0x4f5420, pdwDataLen=0x24df020) returned 1 [0142.867] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.867] GetProcessHeap () returned 0x4e0000 [0142.867] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5273b0 [0142.867] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0142.867] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5273b0, pdwDataLen=0x24df020 | out: pbData=0x5273b0, pdwDataLen=0x24df020) returned 1 [0142.867] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.868] wsprintfW (in: param_1=0x24ddffc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\readme-warning.txt") returned 80 [0142.868] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.868] WriteFile (in: hFile=0x100, lpBuffer=0x5273b0*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddff8, lpOverlapped=0x0 | out: lpBuffer=0x5273b0*, lpNumberOfBytesWritten=0x24ddff8*=0x6c3, lpOverlapped=0x0) returned 1 [0142.869] CloseHandle (hObject=0x100) returned 1 [0142.869] GetProcessHeap () returned 0x4e0000 [0142.869] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273b0 | out: hHeap=0x4e0000) returned 1 [0142.869] GetProcessHeap () returned 0x4e0000 [0142.869] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0142.869] GetProcessHeap () returned 0x4e0000 [0142.869] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0142.869] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0142.870] GetProcessHeap () returned 0x4e0000 [0142.870] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0142.870] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PROFILE", cAlternateFileName="")) returned 1 [0142.870] GetProcessHeap () returned 0x4e0000 [0142.870] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x90) returned 0x524ea0 [0142.870] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0142.870] GetProcessHeap () returned 0x4e0000 [0142.870] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x524ea0 | out: hHeap=0x4e0000) returned 1 [0142.870] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0142.870] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x53b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0142.870] GetProcessHeap () returned 0x4e0000 [0142.870] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x292) returned 0x527118 [0142.870] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.871] GetProcessHeap () returned 0x4e0000 [0142.871] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0142.871] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0142.871] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0142.871] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x5, lpOverlapped=0x0) returned 1 [0142.873] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.873] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.873] GetProcessHeap () returned 0x4e0000 [0142.873] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0142.873] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0142.873] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.873] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0142.873] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0142.873] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0142.873] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0142.873] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0142.873] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.874] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.874] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.874] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.874] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x53b, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x53b, lpOverlapped=0x0) returned 1 [0142.874] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x540, dwBufLen=0x540 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x540) returned 1 [0142.874] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.874] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x540, lpOverlapped=0x0) returned 1 [0142.874] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.874] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.874] SetEndOfFile (hFile=0x100) returned 1 [0142.876] GetProcessHeap () returned 0x4e0000 [0142.876] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0142.876] GetProcessHeap () returned 0x4e0000 [0142.876] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0142.876] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0142.877] CloseHandle (hObject=0x100) returned 1 [0142.877] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a053d00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1a053d00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xb20e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PROFILE.ELM", cAlternateFileName="")) returned 1 [0142.877] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.878] GetProcessHeap () returned 0x4e0000 [0142.878] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0142.878] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0142.878] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0142.878] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x2, lpOverlapped=0x0) returned 1 [0142.880] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.880] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.880] GetProcessHeap () returned 0x4e0000 [0142.880] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0142.880] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0142.880] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.880] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0142.880] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0142.880] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0142.880] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0142.880] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0142.880] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.881] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.881] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.881] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.881] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb20e, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xb20e, lpOverlapped=0x0) returned 1 [0142.882] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xb210, dwBufLen=0xb210 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xb210) returned 1 [0142.883] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.883] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xb210, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xb210, lpOverlapped=0x0) returned 1 [0142.883] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.883] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xb2e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.883] SetEndOfFile (hFile=0x100) returned 1 [0142.885] GetProcessHeap () returned 0x4e0000 [0142.885] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0142.885] GetProcessHeap () returned 0x4e0000 [0142.885] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0142.885] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.elm.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0142.888] CloseHandle (hObject=0x100) returned 1 [0142.888] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x24b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PROFILE.INF", cAlternateFileName="")) returned 1 [0142.888] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.888] GetProcessHeap () returned 0x4e0000 [0142.888] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0142.888] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0142.889] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0142.889] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x5, lpOverlapped=0x0) returned 1 [0142.890] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.890] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.890] GetProcessHeap () returned 0x4e0000 [0142.890] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0142.890] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0142.890] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.890] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0142.890] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0142.890] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0142.890] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0142.890] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0142.891] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.891] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.891] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.891] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.891] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x24b, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x24b, lpOverlapped=0x0) returned 1 [0142.891] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x250, dwBufLen=0x250 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x250) returned 1 [0142.891] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.891] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x250, lpOverlapped=0x0) returned 1 [0142.891] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.891] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x324, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.891] SetEndOfFile (hFile=0x100) returned 1 [0142.893] GetProcessHeap () returned 0x4e0000 [0142.893] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0142.893] GetProcessHeap () returned 0x4e0000 [0142.893] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0142.893] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.inf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0142.894] CloseHandle (hObject=0x100) returned 1 [0142.894] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4162, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0142.894] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.894] GetProcessHeap () returned 0x4e0000 [0142.894] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0142.894] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0142.894] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0142.894] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xe, lpOverlapped=0x0) returned 1 [0142.896] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.896] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.896] GetProcessHeap () returned 0x4e0000 [0142.896] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0142.897] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0142.897] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.897] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0142.897] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0142.897] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0142.897] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0142.897] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0142.897] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.897] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.897] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.897] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.897] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4162, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x4162, lpOverlapped=0x0) returned 1 [0142.898] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x4170, dwBufLen=0x4170 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x4170) returned 1 [0142.898] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.898] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4170, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x4170, lpOverlapped=0x0) returned 1 [0142.898] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.898] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x4244, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.898] SetEndOfFile (hFile=0x100) returned 1 [0142.900] GetProcessHeap () returned 0x4e0000 [0142.900] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0142.900] GetProcessHeap () returned 0x4e0000 [0142.900] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0142.900] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0142.901] CloseHandle (hObject=0x100) returned 1 [0142.901] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4162, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0142.901] GetProcessHeap () returned 0x4e0000 [0142.901] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0142.901] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0142.901] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df020 | out: pbData=0x4f53d8, pdwDataLen=0x24df020) returned 1 [0142.901] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.901] GetProcessHeap () returned 0x4e0000 [0142.902] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0142.902] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0142.902] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df020 | out: pbData=0x4f5420, pdwDataLen=0x24df020) returned 1 [0142.902] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.902] GetProcessHeap () returned 0x4e0000 [0142.902] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5273b8 [0142.902] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0142.902] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5273b8, pdwDataLen=0x24df020 | out: pbData=0x5273b8, pdwDataLen=0x24df020) returned 1 [0142.902] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.902] wsprintfW (in: param_1=0x24ddffc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\readme-warning.txt") returned 82 [0142.902] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.902] WriteFile (in: hFile=0x100, lpBuffer=0x5273b8*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddff8, lpOverlapped=0x0 | out: lpBuffer=0x5273b8*, lpNumberOfBytesWritten=0x24ddff8*=0x6c3, lpOverlapped=0x0) returned 1 [0142.903] CloseHandle (hObject=0x100) returned 1 [0142.903] GetProcessHeap () returned 0x4e0000 [0142.903] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273b8 | out: hHeap=0x4e0000) returned 1 [0142.903] GetProcessHeap () returned 0x4e0000 [0142.903] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0142.903] GetProcessHeap () returned 0x4e0000 [0142.903] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0142.903] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0142.904] GetProcessHeap () returned 0x4e0000 [0142.904] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0142.904] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="QUAD", cAlternateFileName="")) returned 1 [0142.904] GetProcessHeap () returned 0x4e0000 [0142.904] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8a) returned 0x524ea0 [0142.904] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0142.904] GetProcessHeap () returned 0x4e0000 [0142.904] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x524ea0 | out: hHeap=0x4e0000) returned 1 [0142.904] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0142.904] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x59f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0142.904] GetProcessHeap () returned 0x4e0000 [0142.904] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x28c) returned 0x527118 [0142.904] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.904] GetProcessHeap () returned 0x4e0000 [0142.904] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0142.905] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0142.905] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0142.905] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x1, lpOverlapped=0x0) returned 1 [0142.908] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.908] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.909] GetProcessHeap () returned 0x4e0000 [0142.909] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0142.909] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0142.909] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.909] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0142.909] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0142.909] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0142.909] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0142.909] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0142.909] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.909] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.909] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.909] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.909] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x59f, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x59f, lpOverlapped=0x0) returned 1 [0142.909] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x5a0, dwBufLen=0x5a0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x5a0) returned 1 [0142.909] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.909] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x5a0, lpOverlapped=0x0) returned 1 [0142.909] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.909] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x674, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.910] SetEndOfFile (hFile=0x100) returned 1 [0142.912] GetProcessHeap () returned 0x4e0000 [0142.912] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0142.912] GetProcessHeap () returned 0x4e0000 [0142.912] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0142.912] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0142.912] CloseHandle (hObject=0x100) returned 1 [0142.913] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b366a00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a8037d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b366a00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xbba7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="QUAD.ELM", cAlternateFileName="")) returned 1 [0142.913] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.913] GetProcessHeap () returned 0x4e0000 [0142.913] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0142.914] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0142.914] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0142.914] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x9, lpOverlapped=0x0) returned 1 [0142.915] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.915] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.915] GetProcessHeap () returned 0x4e0000 [0142.915] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0142.915] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30) returned 1 [0142.915] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.915] WriteFile (in: hFile=0x100, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24defc8*=0x30, lpOverlapped=0x0) returned 1 [0142.915] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0142.916] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0142.916] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0142.916] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0142.916] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.916] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.916] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.916] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.916] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xbba7, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xbba7, lpOverlapped=0x0) returned 1 [0142.917] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xbbb0, dwBufLen=0xbbb0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xbbb0) returned 1 [0142.918] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.918] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xbbb0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xbbb0, lpOverlapped=0x0) returned 1 [0142.918] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.918] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xbc74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.918] SetEndOfFile (hFile=0x100) returned 1 [0142.920] GetProcessHeap () returned 0x4e0000 [0142.920] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0142.920] GetProcessHeap () returned 0x4e0000 [0142.920] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0142.920] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.elm.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0142.922] CloseHandle (hObject=0x100) returned 1 [0142.922] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="QUAD.INF", cAlternateFileName="")) returned 1 [0142.923] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.923] GetProcessHeap () returned 0x4e0000 [0142.923] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0142.923] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0142.923] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0142.923] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.925] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.925] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.925] GetProcessHeap () returned 0x4e0000 [0142.925] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0142.925] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30) returned 1 [0142.925] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.925] WriteFile (in: hFile=0x100, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24defc8*=0x30, lpOverlapped=0x0) returned 1 [0142.925] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0142.925] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0142.925] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0142.925] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0142.925] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.926] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.926] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.926] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.926] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x258, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x258, lpOverlapped=0x0) returned 1 [0142.926] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x260, dwBufLen=0x260 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x260) returned 1 [0142.926] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.926] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x260, lpOverlapped=0x0) returned 1 [0142.926] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.926] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x324, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.926] SetEndOfFile (hFile=0x100) returned 1 [0142.928] GetProcessHeap () returned 0x4e0000 [0142.928] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0142.928] GetProcessHeap () returned 0x4e0000 [0142.928] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0142.928] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.inf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0142.929] CloseHandle (hObject=0x100) returned 1 [0142.929] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x90f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0142.929] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.929] GetProcessHeap () returned 0x4e0000 [0142.929] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0142.929] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0142.929] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0142.929] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.931] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.931] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.931] GetProcessHeap () returned 0x4e0000 [0142.931] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0142.931] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0142.931] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.931] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0142.931] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0142.931] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0142.931] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0142.931] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0142.931] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.932] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.932] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.932] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.932] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x90f8, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x90f8, lpOverlapped=0x0) returned 1 [0142.933] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x9100, dwBufLen=0x9100 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x9100) returned 1 [0142.933] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.933] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x9100, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x9100, lpOverlapped=0x0) returned 1 [0142.933] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.933] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x91d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.933] SetEndOfFile (hFile=0x100) returned 1 [0142.935] GetProcessHeap () returned 0x4e0000 [0142.935] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0142.936] GetProcessHeap () returned 0x4e0000 [0142.936] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0142.936] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0142.936] CloseHandle (hObject=0x100) returned 1 [0142.936] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x90f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0142.936] GetProcessHeap () returned 0x4e0000 [0142.936] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0142.936] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0142.936] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df020 | out: pbData=0x4f53d8, pdwDataLen=0x24df020) returned 1 [0142.936] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.936] GetProcessHeap () returned 0x4e0000 [0142.937] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0142.937] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0142.937] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df020 | out: pbData=0x4f5420, pdwDataLen=0x24df020) returned 1 [0142.937] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.937] GetProcessHeap () returned 0x4e0000 [0142.937] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5273b0 [0142.937] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0142.937] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5273b0, pdwDataLen=0x24df020 | out: pbData=0x5273b0, pdwDataLen=0x24df020) returned 1 [0142.937] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.937] wsprintfW (in: param_1=0x24ddffc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\readme-warning.txt") returned 79 [0142.937] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.938] WriteFile (in: hFile=0x100, lpBuffer=0x5273b0*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddff8, lpOverlapped=0x0 | out: lpBuffer=0x5273b0*, lpNumberOfBytesWritten=0x24ddff8*=0x6c3, lpOverlapped=0x0) returned 1 [0142.939] CloseHandle (hObject=0x100) returned 1 [0142.939] GetProcessHeap () returned 0x4e0000 [0142.939] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273b0 | out: hHeap=0x4e0000) returned 1 [0142.939] GetProcessHeap () returned 0x4e0000 [0142.939] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0142.939] GetProcessHeap () returned 0x4e0000 [0142.939] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0142.939] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0142.939] GetProcessHeap () returned 0x4e0000 [0142.939] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0142.939] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RADIAL", cAlternateFileName="")) returned 1 [0142.940] GetProcessHeap () returned 0x4e0000 [0142.940] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8e) returned 0x524ea0 [0142.940] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0142.941] GetProcessHeap () returned 0x4e0000 [0142.941] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x524ea0 | out: hHeap=0x4e0000) returned 1 [0142.941] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0142.941] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x682, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0142.941] GetProcessHeap () returned 0x4e0000 [0142.941] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x290) returned 0x527118 [0142.941] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.942] GetProcessHeap () returned 0x4e0000 [0142.942] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0142.942] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0142.942] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0142.942] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xe, lpOverlapped=0x0) returned 1 [0142.944] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.944] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.944] GetProcessHeap () returned 0x4e0000 [0142.944] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0142.944] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0142.944] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.944] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0142.944] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0142.944] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0142.944] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0142.944] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0142.944] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.944] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.945] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.945] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.945] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x682, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x682, lpOverlapped=0x0) returned 1 [0142.945] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x690, dwBufLen=0x690 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x690) returned 1 [0142.945] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.945] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x690, lpOverlapped=0x0) returned 1 [0142.945] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.945] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x764, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.945] SetEndOfFile (hFile=0x100) returned 1 [0142.947] GetProcessHeap () returned 0x4e0000 [0142.947] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0142.947] GetProcessHeap () returned 0x4e0000 [0142.947] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0142.947] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0142.948] CloseHandle (hObject=0x100) returned 1 [0142.948] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c679700, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a829930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c679700, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xb75e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RADIAL.ELM", cAlternateFileName="")) returned 1 [0142.948] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.949] GetProcessHeap () returned 0x4e0000 [0142.949] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0142.949] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0142.949] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0142.949] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x2, lpOverlapped=0x0) returned 1 [0142.951] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.951] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.951] GetProcessHeap () returned 0x4e0000 [0142.951] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0142.951] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30) returned 1 [0142.951] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.951] WriteFile (in: hFile=0x100, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24defc8*=0x30, lpOverlapped=0x0) returned 1 [0142.951] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0142.951] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0142.951] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0142.951] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0142.951] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.951] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.951] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.951] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.951] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb75e, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xb75e, lpOverlapped=0x0) returned 1 [0142.952] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xb760, dwBufLen=0xb760 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xb760) returned 1 [0142.953] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.953] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xb760, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xb760, lpOverlapped=0x0) returned 1 [0142.953] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.953] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xb824, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.953] SetEndOfFile (hFile=0x100) returned 1 [0142.956] GetProcessHeap () returned 0x4e0000 [0142.956] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0142.956] GetProcessHeap () returned 0x4e0000 [0142.956] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0142.956] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.elm.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0142.959] CloseHandle (hObject=0x100) returned 1 [0142.959] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x24a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RADIAL.INF", cAlternateFileName="")) returned 1 [0142.959] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.959] GetProcessHeap () returned 0x4e0000 [0142.959] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0142.959] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0142.959] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0142.959] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x6, lpOverlapped=0x0) returned 1 [0142.960] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.961] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.961] GetProcessHeap () returned 0x4e0000 [0142.961] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0142.961] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30) returned 1 [0142.961] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.961] WriteFile (in: hFile=0x100, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24defc8*=0x30, lpOverlapped=0x0) returned 1 [0142.961] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0142.961] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0142.961] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0142.961] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0142.961] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.961] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.961] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.961] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.961] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x24a, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x24a, lpOverlapped=0x0) returned 1 [0142.961] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x250, dwBufLen=0x250 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x250) returned 1 [0142.961] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.962] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x250, lpOverlapped=0x0) returned 1 [0142.962] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.962] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.962] SetEndOfFile (hFile=0x100) returned 1 [0142.964] GetProcessHeap () returned 0x4e0000 [0142.964] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0142.964] GetProcessHeap () returned 0x4e0000 [0142.964] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0142.964] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.inf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0142.964] CloseHandle (hObject=0x100) returned 1 [0142.965] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c6b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0142.965] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.965] GetProcessHeap () returned 0x4e0000 [0142.965] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0142.965] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0142.965] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0142.965] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x5, lpOverlapped=0x0) returned 1 [0142.967] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.967] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.967] GetProcessHeap () returned 0x4e0000 [0142.967] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0142.967] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0142.967] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.967] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0142.967] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0142.967] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0142.967] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0142.967] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0142.967] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.967] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.967] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.967] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.967] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4c6b, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x4c6b, lpOverlapped=0x0) returned 1 [0142.968] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x4c70, dwBufLen=0x4c70 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x4c70) returned 1 [0142.968] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.968] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4c70, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x4c70, lpOverlapped=0x0) returned 1 [0142.968] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.969] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x4d44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.969] SetEndOfFile (hFile=0x100) returned 1 [0142.971] GetProcessHeap () returned 0x4e0000 [0142.971] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0142.971] GetProcessHeap () returned 0x4e0000 [0142.971] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0142.971] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0142.972] CloseHandle (hObject=0x100) returned 1 [0142.972] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c6b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0142.972] GetProcessHeap () returned 0x4e0000 [0142.972] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0142.972] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0142.972] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df020 | out: pbData=0x4f53d8, pdwDataLen=0x24df020) returned 1 [0142.972] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.972] GetProcessHeap () returned 0x4e0000 [0142.972] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0142.972] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0142.972] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df020 | out: pbData=0x4f5420, pdwDataLen=0x24df020) returned 1 [0142.972] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.972] GetProcessHeap () returned 0x4e0000 [0142.972] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5273b0 [0142.972] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0142.972] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5273b0, pdwDataLen=0x24df020 | out: pbData=0x5273b0, pdwDataLen=0x24df020) returned 1 [0142.972] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.973] wsprintfW (in: param_1=0x24ddffc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\readme-warning.txt") returned 81 [0142.973] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.980] WriteFile (in: hFile=0x100, lpBuffer=0x5273b0*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddff8, lpOverlapped=0x0 | out: lpBuffer=0x5273b0*, lpNumberOfBytesWritten=0x24ddff8*=0x6c3, lpOverlapped=0x0) returned 1 [0142.981] CloseHandle (hObject=0x100) returned 1 [0142.981] GetProcessHeap () returned 0x4e0000 [0142.981] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273b0 | out: hHeap=0x4e0000) returned 1 [0142.981] GetProcessHeap () returned 0x4e0000 [0142.981] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0142.981] GetProcessHeap () returned 0x4e0000 [0142.981] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0142.981] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0142.981] GetProcessHeap () returned 0x4e0000 [0142.981] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0142.981] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="REFINED", cAlternateFileName="")) returned 1 [0142.981] GetProcessHeap () returned 0x4e0000 [0142.982] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x90) returned 0x524ea0 [0142.982] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0142.982] GetProcessHeap () returned 0x4e0000 [0142.982] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x524ea0 | out: hHeap=0x4e0000) returned 1 [0142.982] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0142.982] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x58f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0142.982] GetProcessHeap () returned 0x4e0000 [0142.982] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x292) returned 0x527118 [0142.982] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.982] GetProcessHeap () returned 0x4e0000 [0142.982] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0142.982] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0142.982] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0142.983] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x1, lpOverlapped=0x0) returned 1 [0142.984] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.984] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.984] GetProcessHeap () returned 0x4e0000 [0142.984] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0142.984] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0142.984] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.984] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0142.984] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0142.985] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0142.985] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0142.985] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0142.985] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.985] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.985] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.985] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.985] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x58f, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x58f, lpOverlapped=0x0) returned 1 [0142.985] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x590, dwBufLen=0x590 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x590) returned 1 [0142.985] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.985] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x590, lpOverlapped=0x0) returned 1 [0142.985] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.985] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x664, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.985] SetEndOfFile (hFile=0x100) returned 1 [0142.987] GetProcessHeap () returned 0x4e0000 [0142.987] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0142.987] GetProcessHeap () returned 0x4e0000 [0142.987] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0142.987] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0142.988] CloseHandle (hObject=0x100) returned 1 [0142.988] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ec9f100, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ec9f100, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xb30e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="REFINED.ELM", cAlternateFileName="")) returned 1 [0142.988] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0142.989] GetProcessHeap () returned 0x4e0000 [0142.989] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0142.989] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0142.989] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0142.989] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x2, lpOverlapped=0x0) returned 1 [0142.993] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.993] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.993] GetProcessHeap () returned 0x4e0000 [0142.993] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0142.993] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0142.993] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.993] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0142.993] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0142.993] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0142.993] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0142.993] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0142.994] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0142.994] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0142.994] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0142.994] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.994] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb30e, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xb30e, lpOverlapped=0x0) returned 1 [0142.995] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xb310, dwBufLen=0xb310 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xb310) returned 1 [0142.995] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.995] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xb310, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xb310, lpOverlapped=0x0) returned 1 [0142.995] CryptDestroyKey (hKey=0x522fd8) returned 1 [0142.995] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xb3e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.995] SetEndOfFile (hFile=0x100) returned 1 [0142.998] GetProcessHeap () returned 0x4e0000 [0142.998] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0142.998] GetProcessHeap () returned 0x4e0000 [0142.998] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0142.998] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.elm.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0143.001] CloseHandle (hObject=0x100) returned 1 [0143.001] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a84fa90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x24a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="REFINED.INF", cAlternateFileName="")) returned 1 [0143.001] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.001] GetProcessHeap () returned 0x4e0000 [0143.001] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0143.001] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0143.001] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0143.001] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x6, lpOverlapped=0x0) returned 1 [0143.003] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.003] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.003] GetProcessHeap () returned 0x4e0000 [0143.003] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0143.003] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0143.003] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.003] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0143.003] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0143.003] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0143.003] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0143.003] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0143.003] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0143.004] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.004] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.004] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.004] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x24a, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x24a, lpOverlapped=0x0) returned 1 [0143.004] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x250, dwBufLen=0x250 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x250) returned 1 [0143.004] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.004] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x250, lpOverlapped=0x0) returned 1 [0143.004] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.004] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x324, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.004] SetEndOfFile (hFile=0x100) returned 1 [0143.006] GetProcessHeap () returned 0x4e0000 [0143.006] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0143.006] GetProcessHeap () returned 0x4e0000 [0143.006] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0143.006] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.inf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0143.007] CloseHandle (hObject=0x100) returned 1 [0143.007] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3d79, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0143.007] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.008] GetProcessHeap () returned 0x4e0000 [0143.008] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0143.008] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0143.008] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0143.008] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x7, lpOverlapped=0x0) returned 1 [0143.010] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.010] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.010] GetProcessHeap () returned 0x4e0000 [0143.010] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0143.010] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0143.010] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.010] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0143.010] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0143.010] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0143.010] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0143.010] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0143.010] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0143.010] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.010] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.010] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.010] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3d79, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x3d79, lpOverlapped=0x0) returned 1 [0143.011] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x3d80, dwBufLen=0x3d80 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x3d80) returned 1 [0143.012] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.012] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x3d80, lpOverlapped=0x0) returned 1 [0143.012] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.012] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x3e54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.012] SetEndOfFile (hFile=0x100) returned 1 [0143.014] GetProcessHeap () returned 0x4e0000 [0143.014] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0143.014] GetProcessHeap () returned 0x4e0000 [0143.014] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0143.014] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0143.015] CloseHandle (hObject=0x100) returned 1 [0143.015] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3d79, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0143.015] GetProcessHeap () returned 0x4e0000 [0143.015] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0143.016] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0143.016] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df020 | out: pbData=0x4f53d8, pdwDataLen=0x24df020) returned 1 [0143.016] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.016] GetProcessHeap () returned 0x4e0000 [0143.016] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0143.016] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0143.016] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df020 | out: pbData=0x4f5420, pdwDataLen=0x24df020) returned 1 [0143.016] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.016] GetProcessHeap () returned 0x4e0000 [0143.016] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5273b8 [0143.016] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0143.016] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5273b8, pdwDataLen=0x24df020 | out: pbData=0x5273b8, pdwDataLen=0x24df020) returned 1 [0143.016] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.016] wsprintfW (in: param_1=0x24ddffc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\readme-warning.txt") returned 82 [0143.016] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.017] WriteFile (in: hFile=0x100, lpBuffer=0x5273b8*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddff8, lpOverlapped=0x0 | out: lpBuffer=0x5273b8*, lpNumberOfBytesWritten=0x24ddff8*=0x6c3, lpOverlapped=0x0) returned 1 [0143.018] CloseHandle (hObject=0x100) returned 1 [0143.018] GetProcessHeap () returned 0x4e0000 [0143.018] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273b8 | out: hHeap=0x4e0000) returned 1 [0143.018] GetProcessHeap () returned 0x4e0000 [0143.018] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0143.018] GetProcessHeap () returned 0x4e0000 [0143.018] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0143.018] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0143.018] GetProcessHeap () returned 0x4e0000 [0143.018] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0143.018] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RICEPAPR", cAlternateFileName="")) returned 1 [0143.018] GetProcessHeap () returned 0x4e0000 [0143.018] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x92) returned 0x4fa058 [0143.018] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0143.019] GetProcessHeap () returned 0x4e0000 [0143.019] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0143.019] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0143.019] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xf82, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0143.019] GetProcessHeap () returned 0x4e0000 [0143.019] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x294) returned 0x527118 [0143.020] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.020] GetProcessHeap () returned 0x4e0000 [0143.020] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0143.020] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0143.020] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0143.020] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xe, lpOverlapped=0x0) returned 1 [0143.022] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.022] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.022] GetProcessHeap () returned 0x4e0000 [0143.022] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0143.022] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0143.022] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.022] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0143.022] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0143.022] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0143.022] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0143.023] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0143.023] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0143.023] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.023] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.023] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.023] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xf82, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xf82, lpOverlapped=0x0) returned 1 [0143.023] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xf90, dwBufLen=0xf90 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xf90) returned 1 [0143.023] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.023] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xf90, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xf90, lpOverlapped=0x0) returned 1 [0143.023] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.023] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1064, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.023] SetEndOfFile (hFile=0x100) returned 1 [0143.025] GetProcessHeap () returned 0x4e0000 [0143.025] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0143.025] GetProcessHeap () returned 0x4e0000 [0143.025] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0143.025] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0143.026] CloseHandle (hObject=0x100) returned 1 [0143.026] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ffb1e00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ffb1e00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1205e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RICEPAPR.ELM", cAlternateFileName="")) returned 1 [0143.026] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.027] GetProcessHeap () returned 0x4e0000 [0143.027] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0143.027] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0143.027] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0143.027] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x2, lpOverlapped=0x0) returned 1 [0143.029] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.029] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.029] GetProcessHeap () returned 0x4e0000 [0143.029] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0143.029] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0143.029] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.029] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0143.029] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0143.029] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0143.029] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0143.030] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0143.030] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0143.030] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.030] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.030] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.030] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1205e, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x1205e, lpOverlapped=0x0) returned 1 [0143.031] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x12060, dwBufLen=0x12060 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x12060) returned 1 [0143.032] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.032] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x12060, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x12060, lpOverlapped=0x0) returned 1 [0143.032] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.032] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x12134, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.032] SetEndOfFile (hFile=0x100) returned 1 [0143.035] GetProcessHeap () returned 0x4e0000 [0143.035] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0143.035] GetProcessHeap () returned 0x4e0000 [0143.035] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0143.035] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.elm.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0143.038] CloseHandle (hObject=0x100) returned 1 [0143.038] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x239, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RICEPAPR.INF", cAlternateFileName="")) returned 1 [0143.038] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.039] GetProcessHeap () returned 0x4e0000 [0143.039] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0143.039] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0143.039] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0143.039] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x7, lpOverlapped=0x0) returned 1 [0143.040] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.040] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.040] GetProcessHeap () returned 0x4e0000 [0143.040] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0143.040] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0143.040] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.040] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0143.040] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0143.040] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0143.040] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0143.041] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0143.041] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0143.041] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.041] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.041] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.041] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x239, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x239, lpOverlapped=0x0) returned 1 [0143.041] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x240, dwBufLen=0x240 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x240) returned 1 [0143.041] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.041] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x240, lpOverlapped=0x0) returned 1 [0143.041] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.041] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.041] SetEndOfFile (hFile=0x100) returned 1 [0143.043] GetProcessHeap () returned 0x4e0000 [0143.043] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0143.043] GetProcessHeap () returned 0x4e0000 [0143.043] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0143.043] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.inf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0143.044] CloseHandle (hObject=0x100) returned 1 [0143.044] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xcf7b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0143.044] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.045] GetProcessHeap () returned 0x4e0000 [0143.045] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0143.045] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0143.045] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0143.045] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x5, lpOverlapped=0x0) returned 1 [0143.047] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.047] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.047] GetProcessHeap () returned 0x4e0000 [0143.047] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0143.047] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0143.047] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.047] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0143.047] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0143.047] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0143.047] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0143.047] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0143.047] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0143.047] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.047] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.047] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.048] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xcf7b, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xcf7b, lpOverlapped=0x0) returned 1 [0143.049] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xcf80, dwBufLen=0xcf80 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xcf80) returned 1 [0143.049] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.049] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xcf80, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xcf80, lpOverlapped=0x0) returned 1 [0143.049] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.049] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xd054, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.050] SetEndOfFile (hFile=0x100) returned 1 [0143.054] GetProcessHeap () returned 0x4e0000 [0143.054] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0143.054] GetProcessHeap () returned 0x4e0000 [0143.055] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0143.055] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0143.055] CloseHandle (hObject=0x100) returned 1 [0143.055] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xcf7b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0143.056] GetProcessHeap () returned 0x4e0000 [0143.056] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0143.056] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0143.056] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df020 | out: pbData=0x4f53d8, pdwDataLen=0x24df020) returned 1 [0143.056] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.056] GetProcessHeap () returned 0x4e0000 [0143.056] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0143.056] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0143.056] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df020 | out: pbData=0x4f5420, pdwDataLen=0x24df020) returned 1 [0143.056] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.056] GetProcessHeap () returned 0x4e0000 [0143.056] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5273b8 [0143.056] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0143.056] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5273b8, pdwDataLen=0x24df020 | out: pbData=0x5273b8, pdwDataLen=0x24df020) returned 1 [0143.056] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.056] wsprintfW (in: param_1=0x24ddffc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\readme-warning.txt") returned 83 [0143.056] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.056] WriteFile (in: hFile=0x100, lpBuffer=0x5273b8*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddff8, lpOverlapped=0x0 | out: lpBuffer=0x5273b8*, lpNumberOfBytesWritten=0x24ddff8*=0x6c3, lpOverlapped=0x0) returned 1 [0143.058] CloseHandle (hObject=0x100) returned 1 [0143.058] GetProcessHeap () returned 0x4e0000 [0143.058] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273b8 | out: hHeap=0x4e0000) returned 1 [0143.058] GetProcessHeap () returned 0x4e0000 [0143.058] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0143.058] GetProcessHeap () returned 0x4e0000 [0143.058] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0143.059] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0143.059] GetProcessHeap () returned 0x4e0000 [0143.059] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0143.059] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RIPPLE", cAlternateFileName="")) returned 1 [0143.059] GetProcessHeap () returned 0x4e0000 [0143.059] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8e) returned 0x524ea0 [0143.059] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0143.059] GetProcessHeap () returned 0x4e0000 [0143.059] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x524ea0 | out: hHeap=0x4e0000) returned 1 [0143.059] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0143.059] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa2c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0143.059] GetProcessHeap () returned 0x4e0000 [0143.059] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x290) returned 0x527118 [0143.059] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.060] GetProcessHeap () returned 0x4e0000 [0143.060] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0143.060] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0143.060] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0143.060] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0143.071] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.071] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.071] GetProcessHeap () returned 0x4e0000 [0143.071] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0143.071] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0143.071] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.071] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0143.071] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0143.071] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0143.071] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0143.071] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0143.071] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0143.071] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.071] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.071] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.071] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xa2c, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xa2c, lpOverlapped=0x0) returned 1 [0143.071] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xa30, dwBufLen=0xa30 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xa30) returned 1 [0143.072] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.072] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xa30, lpOverlapped=0x0) returned 1 [0143.072] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.072] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xb04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.072] SetEndOfFile (hFile=0x100) returned 1 [0143.074] GetProcessHeap () returned 0x4e0000 [0143.074] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0143.074] GetProcessHeap () returned 0x4e0000 [0143.074] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0143.074] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0143.075] CloseHandle (hObject=0x100) returned 1 [0143.075] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x212c4b00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d2019f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x212c4b00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x101e0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RIPPLE.ELM", cAlternateFileName="")) returned 1 [0143.075] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.075] GetProcessHeap () returned 0x4e0000 [0143.075] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0143.076] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0143.076] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0143.076] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.076] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.076] GetProcessHeap () returned 0x4e0000 [0143.076] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0143.076] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30) returned 1 [0143.076] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.076] WriteFile (in: hFile=0x100, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24defc8*=0x30, lpOverlapped=0x0) returned 1 [0143.078] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0143.078] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0143.078] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0143.078] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0143.078] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0143.078] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.078] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.078] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.078] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x101e0, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x101e0, lpOverlapped=0x0) returned 1 [0143.080] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x101e0, dwBufLen=0x101e0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x101e0) returned 1 [0143.080] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.080] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x101e0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x101e0, lpOverlapped=0x0) returned 1 [0143.081] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.081] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x102a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.081] SetEndOfFile (hFile=0x100) returned 1 [0143.083] GetProcessHeap () returned 0x4e0000 [0143.083] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0143.083] GetProcessHeap () returned 0x4e0000 [0143.083] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0143.083] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0143.086] CloseHandle (hObject=0x100) returned 1 [0143.086] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RIPPLE.INF", cAlternateFileName="")) returned 1 [0143.086] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.086] GetProcessHeap () returned 0x4e0000 [0143.086] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0143.087] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0143.087] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0143.087] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x9, lpOverlapped=0x0) returned 1 [0143.088] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.088] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.088] GetProcessHeap () returned 0x4e0000 [0143.088] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0143.088] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30) returned 1 [0143.088] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.088] WriteFile (in: hFile=0x100, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24defc8*=0x30, lpOverlapped=0x0) returned 1 [0143.088] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0143.088] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0143.089] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0143.089] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0143.089] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0143.089] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.089] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.089] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.089] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1e7, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x1e7, lpOverlapped=0x0) returned 1 [0143.089] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1f0) returned 1 [0143.089] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.089] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x1f0, lpOverlapped=0x0) returned 1 [0143.089] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.089] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x2b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.089] SetEndOfFile (hFile=0x100) returned 1 [0143.091] GetProcessHeap () returned 0x4e0000 [0143.092] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0143.092] GetProcessHeap () returned 0x4e0000 [0143.092] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0143.092] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.inf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0143.093] CloseHandle (hObject=0x100) returned 1 [0143.093] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7ce7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0143.093] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.094] GetProcessHeap () returned 0x4e0000 [0143.094] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0143.094] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0143.094] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0143.094] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x9, lpOverlapped=0x0) returned 1 [0143.096] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.096] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.096] GetProcessHeap () returned 0x4e0000 [0143.096] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0143.096] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0143.097] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.097] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0143.097] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0143.097] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0143.097] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0143.097] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0143.097] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0143.097] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.097] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.097] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.097] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7ce7, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x7ce7, lpOverlapped=0x0) returned 1 [0143.098] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x7cf0, dwBufLen=0x7cf0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x7cf0) returned 1 [0143.099] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.099] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x7cf0, lpOverlapped=0x0) returned 1 [0143.099] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.099] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x7dc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.099] SetEndOfFile (hFile=0x100) returned 1 [0143.102] GetProcessHeap () returned 0x4e0000 [0143.102] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0143.102] GetProcessHeap () returned 0x4e0000 [0143.102] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0143.102] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0143.102] CloseHandle (hObject=0x100) returned 1 [0143.103] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7ce7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0143.103] GetProcessHeap () returned 0x4e0000 [0143.103] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0143.103] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0143.103] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df020 | out: pbData=0x4f53d8, pdwDataLen=0x24df020) returned 1 [0143.103] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.103] GetProcessHeap () returned 0x4e0000 [0143.103] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0143.103] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0143.103] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df020 | out: pbData=0x4f5420, pdwDataLen=0x24df020) returned 1 [0143.103] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.103] GetProcessHeap () returned 0x4e0000 [0143.103] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5273b0 [0143.103] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0143.103] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5273b0, pdwDataLen=0x24df020 | out: pbData=0x5273b0, pdwDataLen=0x24df020) returned 1 [0143.103] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.103] wsprintfW (in: param_1=0x24ddffc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\readme-warning.txt") returned 81 [0143.103] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.104] WriteFile (in: hFile=0x100, lpBuffer=0x5273b0*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddff8, lpOverlapped=0x0 | out: lpBuffer=0x5273b0*, lpNumberOfBytesWritten=0x24ddff8*=0x6c3, lpOverlapped=0x0) returned 1 [0143.105] CloseHandle (hObject=0x100) returned 1 [0143.105] GetProcessHeap () returned 0x4e0000 [0143.105] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273b0 | out: hHeap=0x4e0000) returned 1 [0143.105] GetProcessHeap () returned 0x4e0000 [0143.105] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0143.105] GetProcessHeap () returned 0x4e0000 [0143.105] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0143.105] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0143.106] GetProcessHeap () returned 0x4e0000 [0143.106] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0143.106] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RMNSQUE", cAlternateFileName="")) returned 1 [0143.106] GetProcessHeap () returned 0x4e0000 [0143.106] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x90) returned 0x524ea0 [0143.106] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0143.106] GetProcessHeap () returned 0x4e0000 [0143.106] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x524ea0 | out: hHeap=0x4e0000) returned 1 [0143.106] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0143.106] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0143.106] GetProcessHeap () returned 0x4e0000 [0143.106] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x292) returned 0x527118 [0143.106] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.106] GetProcessHeap () returned 0x4e0000 [0143.106] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0143.106] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0143.106] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0143.107] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xc, lpOverlapped=0x0) returned 1 [0143.108] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.108] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.108] GetProcessHeap () returned 0x4e0000 [0143.108] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0143.108] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0143.108] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.108] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0143.109] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0143.109] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0143.109] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0143.109] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0143.109] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0143.109] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.109] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.109] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.109] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1004, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x1004, lpOverlapped=0x0) returned 1 [0143.110] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1010, dwBufLen=0x1010 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1010) returned 1 [0143.110] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.110] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x1010, lpOverlapped=0x0) returned 1 [0143.110] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.110] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x10e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.110] SetEndOfFile (hFile=0x100) returned 1 [0143.112] GetProcessHeap () returned 0x4e0000 [0143.112] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0143.112] GetProcessHeap () returned 0x4e0000 [0143.112] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0143.112] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0143.113] CloseHandle (hObject=0x100) returned 1 [0143.113] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x225d7800, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d2019f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x225d7800, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x11e37, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RMNSQUE.ELM", cAlternateFileName="")) returned 1 [0143.113] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.113] GetProcessHeap () returned 0x4e0000 [0143.113] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0143.113] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0143.113] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0143.113] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x9, lpOverlapped=0x0) returned 1 [0143.115] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.115] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.115] GetProcessHeap () returned 0x4e0000 [0143.115] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0143.115] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0143.115] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.115] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0143.115] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0143.116] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0143.116] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0143.116] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0143.116] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0143.116] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.116] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.116] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.116] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x11e37, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x11e37, lpOverlapped=0x0) returned 1 [0143.117] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x11e40, dwBufLen=0x11e40 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x11e40) returned 1 [0143.118] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.118] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x11e40, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x11e40, lpOverlapped=0x0) returned 1 [0143.118] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.118] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x11f14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.118] SetEndOfFile (hFile=0x100) returned 1 [0143.121] GetProcessHeap () returned 0x4e0000 [0143.121] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0143.121] GetProcessHeap () returned 0x4e0000 [0143.121] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0143.121] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0143.123] CloseHandle (hObject=0x100) returned 1 [0143.123] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x265, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RMNSQUE.INF", cAlternateFileName="")) returned 1 [0143.123] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.126] GetProcessHeap () returned 0x4e0000 [0143.126] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0143.126] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0143.126] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0143.126] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xb, lpOverlapped=0x0) returned 1 [0143.128] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.128] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.128] GetProcessHeap () returned 0x4e0000 [0143.128] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0143.128] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0143.128] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.128] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0143.128] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0143.128] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0143.128] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0143.128] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0143.128] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0143.128] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.128] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.128] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.128] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x265, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x265, lpOverlapped=0x0) returned 1 [0143.128] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x270, dwBufLen=0x270 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x270) returned 1 [0143.128] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.129] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x270, lpOverlapped=0x0) returned 1 [0143.129] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.129] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x344, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.129] SetEndOfFile (hFile=0x100) returned 1 [0143.131] GetProcessHeap () returned 0x4e0000 [0143.131] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0143.131] GetProcessHeap () returned 0x4e0000 [0143.131] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0143.131] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.inf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0143.132] CloseHandle (hObject=0x100) returned 1 [0143.132] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbb5a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0143.132] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.132] GetProcessHeap () returned 0x4e0000 [0143.132] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0143.132] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0143.132] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0143.132] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x6, lpOverlapped=0x0) returned 1 [0143.134] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.134] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.134] GetProcessHeap () returned 0x4e0000 [0143.134] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0143.134] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0143.134] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.134] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0143.134] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0143.134] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0143.134] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0143.134] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0143.135] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0143.135] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.135] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.135] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.135] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xbb5a, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xbb5a, lpOverlapped=0x0) returned 1 [0143.136] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xbb60, dwBufLen=0xbb60 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xbb60) returned 1 [0143.136] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.136] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xbb60, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xbb60, lpOverlapped=0x0) returned 1 [0143.137] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.137] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xbc34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.137] SetEndOfFile (hFile=0x100) returned 1 [0143.139] GetProcessHeap () returned 0x4e0000 [0143.139] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0143.139] GetProcessHeap () returned 0x4e0000 [0143.139] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0143.139] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0143.140] CloseHandle (hObject=0x100) returned 1 [0143.140] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbb5a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0143.140] GetProcessHeap () returned 0x4e0000 [0143.140] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0143.140] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0143.140] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df020 | out: pbData=0x4f53d8, pdwDataLen=0x24df020) returned 1 [0143.140] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.140] GetProcessHeap () returned 0x4e0000 [0143.140] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0143.140] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0143.140] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df020 | out: pbData=0x4f5420, pdwDataLen=0x24df020) returned 1 [0143.140] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.140] GetProcessHeap () returned 0x4e0000 [0143.140] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5273b8 [0143.140] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0143.140] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5273b8, pdwDataLen=0x24df020 | out: pbData=0x5273b8, pdwDataLen=0x24df020) returned 1 [0143.140] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.140] wsprintfW (in: param_1=0x24ddffc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\readme-warning.txt") returned 82 [0143.140] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.142] WriteFile (in: hFile=0x100, lpBuffer=0x5273b8*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddff8, lpOverlapped=0x0 | out: lpBuffer=0x5273b8*, lpNumberOfBytesWritten=0x24ddff8*=0x6c3, lpOverlapped=0x0) returned 1 [0143.143] CloseHandle (hObject=0x100) returned 1 [0143.143] GetProcessHeap () returned 0x4e0000 [0143.143] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273b8 | out: hHeap=0x4e0000) returned 1 [0143.143] GetProcessHeap () returned 0x4e0000 [0143.143] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0143.143] GetProcessHeap () returned 0x4e0000 [0143.143] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0143.143] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0143.143] GetProcessHeap () returned 0x4e0000 [0143.143] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0143.143] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SATIN", cAlternateFileName="")) returned 1 [0143.143] GetProcessHeap () returned 0x4e0000 [0143.143] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8c) returned 0x524ea0 [0143.143] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0143.144] GetProcessHeap () returned 0x4e0000 [0143.144] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x524ea0 | out: hHeap=0x4e0000) returned 1 [0143.144] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0143.144] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xe1b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0143.144] GetProcessHeap () returned 0x4e0000 [0143.144] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x28e) returned 0x527118 [0143.144] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.145] GetProcessHeap () returned 0x4e0000 [0143.145] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0143.145] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0143.145] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0143.145] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x5, lpOverlapped=0x0) returned 1 [0143.147] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.147] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.147] GetProcessHeap () returned 0x4e0000 [0143.147] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0143.147] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0143.147] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.147] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0143.147] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0143.147] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0143.147] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0143.147] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0143.147] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0143.147] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.147] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.147] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.148] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xe1b, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xe1b, lpOverlapped=0x0) returned 1 [0143.148] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xe20, dwBufLen=0xe20 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xe20) returned 1 [0143.148] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.148] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xe20, lpOverlapped=0x0) returned 1 [0143.148] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.148] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.148] SetEndOfFile (hFile=0x100) returned 1 [0143.150] GetProcessHeap () returned 0x4e0000 [0143.150] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0143.150] GetProcessHeap () returned 0x4e0000 [0143.150] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0143.150] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0143.151] CloseHandle (hObject=0x100) returned 1 [0143.151] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24bfd200, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x24bfd200, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1936f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SATIN.ELM", cAlternateFileName="")) returned 1 [0143.151] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.152] GetProcessHeap () returned 0x4e0000 [0143.152] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0143.152] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0143.152] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0143.152] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x1, lpOverlapped=0x0) returned 1 [0143.154] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.154] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.154] GetProcessHeap () returned 0x4e0000 [0143.154] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0143.154] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30) returned 1 [0143.154] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.154] WriteFile (in: hFile=0x100, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24defc8*=0x30, lpOverlapped=0x0) returned 1 [0143.154] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0143.154] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0143.154] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0143.154] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0143.154] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0143.154] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.154] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.154] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.154] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1936f, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x1936f, lpOverlapped=0x0) returned 1 [0143.156] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x19370, dwBufLen=0x19370 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x19370) returned 1 [0143.157] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.157] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x19370, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x19370, lpOverlapped=0x0) returned 1 [0143.157] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.157] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x19434, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.157] SetEndOfFile (hFile=0x100) returned 1 [0143.160] GetProcessHeap () returned 0x4e0000 [0143.160] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0143.160] GetProcessHeap () returned 0x4e0000 [0143.160] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0143.160] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.elm.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0143.162] CloseHandle (hObject=0x100) returned 1 [0143.162] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1c8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SATIN.INF", cAlternateFileName="")) returned 1 [0143.162] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.163] GetProcessHeap () returned 0x4e0000 [0143.163] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0143.163] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0143.163] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0143.163] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0143.164] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.164] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.164] GetProcessHeap () returned 0x4e0000 [0143.164] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0143.164] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30) returned 1 [0143.164] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.164] WriteFile (in: hFile=0x100, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24defc8*=0x30, lpOverlapped=0x0) returned 1 [0143.165] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0143.165] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0143.165] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0143.165] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0143.165] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0143.165] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.165] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.165] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.165] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1c8, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x1c8, lpOverlapped=0x0) returned 1 [0143.165] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1d0) returned 1 [0143.165] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.165] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x1d0, lpOverlapped=0x0) returned 1 [0143.165] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.165] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x294, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.165] SetEndOfFile (hFile=0x100) returned 1 [0143.167] GetProcessHeap () returned 0x4e0000 [0143.167] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0143.167] GetProcessHeap () returned 0x4e0000 [0143.167] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0143.167] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.inf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0143.169] CloseHandle (hObject=0x100) returned 1 [0143.169] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8573, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0143.169] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.169] GetProcessHeap () returned 0x4e0000 [0143.169] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0143.169] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0143.169] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0143.169] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xd, lpOverlapped=0x0) returned 1 [0143.178] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.178] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.178] GetProcessHeap () returned 0x4e0000 [0143.178] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0143.178] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0143.178] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.178] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0143.178] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0143.178] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0143.178] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0143.178] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0143.178] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0143.178] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.178] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.178] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.178] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x8573, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x8573, lpOverlapped=0x0) returned 1 [0143.180] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x8580, dwBufLen=0x8580 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x8580) returned 1 [0143.180] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.180] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x8580, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x8580, lpOverlapped=0x0) returned 1 [0143.180] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.180] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x8654, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.180] SetEndOfFile (hFile=0x100) returned 1 [0143.182] GetProcessHeap () returned 0x4e0000 [0143.182] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0143.182] GetProcessHeap () returned 0x4e0000 [0143.182] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0143.182] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0143.183] CloseHandle (hObject=0x100) returned 1 [0143.183] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8573, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0143.183] GetProcessHeap () returned 0x4e0000 [0143.183] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0143.183] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0143.183] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df020 | out: pbData=0x4f53d8, pdwDataLen=0x24df020) returned 1 [0143.183] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.184] GetProcessHeap () returned 0x4e0000 [0143.184] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0143.184] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0143.184] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df020 | out: pbData=0x4f5420, pdwDataLen=0x24df020) returned 1 [0143.184] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.184] GetProcessHeap () returned 0x4e0000 [0143.184] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5273b0 [0143.184] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0143.184] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5273b0, pdwDataLen=0x24df020 | out: pbData=0x5273b0, pdwDataLen=0x24df020) returned 1 [0143.184] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.184] wsprintfW (in: param_1=0x24ddffc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\readme-warning.txt") returned 80 [0143.184] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.184] WriteFile (in: hFile=0x100, lpBuffer=0x5273b0*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddff8, lpOverlapped=0x0 | out: lpBuffer=0x5273b0*, lpNumberOfBytesWritten=0x24ddff8*=0x6c3, lpOverlapped=0x0) returned 1 [0143.185] CloseHandle (hObject=0x100) returned 1 [0143.185] GetProcessHeap () returned 0x4e0000 [0143.186] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273b0 | out: hHeap=0x4e0000) returned 1 [0143.186] GetProcessHeap () returned 0x4e0000 [0143.186] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0143.186] GetProcessHeap () returned 0x4e0000 [0143.186] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0143.186] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0143.186] GetProcessHeap () returned 0x4e0000 [0143.186] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0143.186] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SKY", cAlternateFileName="")) returned 1 [0143.186] GetProcessHeap () returned 0x4e0000 [0143.186] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x88) returned 0x4fa058 [0143.186] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0143.187] GetProcessHeap () returned 0x4e0000 [0143.187] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0143.187] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0143.187] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3a9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0143.187] GetProcessHeap () returned 0x4e0000 [0143.187] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x28a) returned 0x527118 [0143.187] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.188] GetProcessHeap () returned 0x4e0000 [0143.188] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0143.188] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0143.188] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0143.188] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x7, lpOverlapped=0x0) returned 1 [0143.191] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.191] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.191] GetProcessHeap () returned 0x4e0000 [0143.191] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0143.191] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0143.191] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.191] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0143.191] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0143.191] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0143.192] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0143.192] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0143.192] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0143.192] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.192] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.192] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.192] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3a9, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x3a9, lpOverlapped=0x0) returned 1 [0143.192] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x3b0, dwBufLen=0x3b0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x3b0) returned 1 [0143.192] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.192] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x3b0, lpOverlapped=0x0) returned 1 [0143.192] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.192] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x484, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.192] SetEndOfFile (hFile=0x100) returned 1 [0143.194] GetProcessHeap () returned 0x4e0000 [0143.194] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0143.194] GetProcessHeap () returned 0x4e0000 [0143.194] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0143.195] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0143.195] CloseHandle (hObject=0x100) returned 1 [0143.195] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25f0ff00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x25f0ff00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1413d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SKY.ELM", cAlternateFileName="")) returned 1 [0143.195] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.196] GetProcessHeap () returned 0x4e0000 [0143.196] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0143.196] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0143.196] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0143.196] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x3, lpOverlapped=0x0) returned 1 [0143.199] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.199] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.199] GetProcessHeap () returned 0x4e0000 [0143.199] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0143.199] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30) returned 1 [0143.199] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.199] WriteFile (in: hFile=0x100, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24defc8*=0x30, lpOverlapped=0x0) returned 1 [0143.199] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0143.199] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0143.199] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0143.199] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0143.199] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0143.199] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.200] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.200] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.200] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1413d, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x1413d, lpOverlapped=0x0) returned 1 [0143.202] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x14140, dwBufLen=0x14140 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x14140) returned 1 [0143.203] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.203] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x14140, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x14140, lpOverlapped=0x0) returned 1 [0143.203] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.203] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x14204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.203] SetEndOfFile (hFile=0x100) returned 1 [0143.206] GetProcessHeap () returned 0x4e0000 [0143.206] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0143.206] GetProcessHeap () returned 0x4e0000 [0143.206] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0143.206] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.elm.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0143.208] CloseHandle (hObject=0x100) returned 1 [0143.208] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SKY.INF", cAlternateFileName="")) returned 1 [0143.209] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.209] GetProcessHeap () returned 0x4e0000 [0143.209] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0143.209] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0143.209] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0143.209] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0143.210] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.210] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.210] GetProcessHeap () returned 0x4e0000 [0143.210] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0143.210] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30) returned 1 [0143.210] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.210] WriteFile (in: hFile=0x100, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24defc8*=0x30, lpOverlapped=0x0) returned 1 [0143.210] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0143.211] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0143.211] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0143.211] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0143.211] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0143.211] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.211] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.211] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.211] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1bc, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x1bc, lpOverlapped=0x0) returned 1 [0143.211] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1c0, dwBufLen=0x1c0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1c0) returned 1 [0143.211] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.211] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1c0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x1c0, lpOverlapped=0x0) returned 1 [0143.211] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.211] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x284, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.211] SetEndOfFile (hFile=0x100) returned 1 [0143.213] GetProcessHeap () returned 0x4e0000 [0143.213] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0143.213] GetProcessHeap () returned 0x4e0000 [0143.213] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0143.213] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.inf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0143.215] CloseHandle (hObject=0x100) returned 1 [0143.215] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7279, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0143.215] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.215] GetProcessHeap () returned 0x4e0000 [0143.216] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0143.216] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0143.216] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0143.216] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x7, lpOverlapped=0x0) returned 1 [0143.217] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.217] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.217] GetProcessHeap () returned 0x4e0000 [0143.217] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0143.217] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0143.217] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.217] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0143.217] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0143.217] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0143.218] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0143.218] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0143.218] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0143.218] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.218] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.218] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.218] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7279, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x7279, lpOverlapped=0x0) returned 1 [0143.219] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x7280, dwBufLen=0x7280 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x7280) returned 1 [0143.219] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.219] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7280, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x7280, lpOverlapped=0x0) returned 1 [0143.219] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.219] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x7354, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.219] SetEndOfFile (hFile=0x100) returned 1 [0143.221] GetProcessHeap () returned 0x4e0000 [0143.221] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0143.221] GetProcessHeap () returned 0x4e0000 [0143.221] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0143.222] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0143.222] CloseHandle (hObject=0x100) returned 1 [0143.222] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7279, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0143.222] GetProcessHeap () returned 0x4e0000 [0143.222] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0143.222] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0143.222] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df020 | out: pbData=0x4f53d8, pdwDataLen=0x24df020) returned 1 [0143.222] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.222] GetProcessHeap () returned 0x4e0000 [0143.222] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0143.222] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0143.223] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df020 | out: pbData=0x4f5420, pdwDataLen=0x24df020) returned 1 [0143.223] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.223] GetProcessHeap () returned 0x4e0000 [0143.223] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5273b0 [0143.223] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0143.223] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5273b0, pdwDataLen=0x24df020 | out: pbData=0x5273b0, pdwDataLen=0x24df020) returned 1 [0143.223] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.223] wsprintfW (in: param_1=0x24ddffc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\readme-warning.txt") returned 78 [0143.223] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.223] WriteFile (in: hFile=0x100, lpBuffer=0x5273b0*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddff8, lpOverlapped=0x0 | out: lpBuffer=0x5273b0*, lpNumberOfBytesWritten=0x24ddff8*=0x6c3, lpOverlapped=0x0) returned 1 [0143.224] CloseHandle (hObject=0x100) returned 1 [0143.225] GetProcessHeap () returned 0x4e0000 [0143.225] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273b0 | out: hHeap=0x4e0000) returned 1 [0143.225] GetProcessHeap () returned 0x4e0000 [0143.225] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0143.225] GetProcessHeap () returned 0x4e0000 [0143.225] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0143.225] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0143.225] GetProcessHeap () returned 0x4e0000 [0143.225] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0143.225] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SLATE", cAlternateFileName="")) returned 1 [0143.225] GetProcessHeap () returned 0x4e0000 [0143.225] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8c) returned 0x524ea0 [0143.225] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0143.238] GetProcessHeap () returned 0x4e0000 [0143.239] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x524ea0 | out: hHeap=0x4e0000) returned 1 [0143.239] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0143.239] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3f1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0143.239] GetProcessHeap () returned 0x4e0000 [0143.239] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x28e) returned 0x527118 [0143.239] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.240] GetProcessHeap () returned 0x4e0000 [0143.240] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0143.240] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0143.240] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0143.240] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xf, lpOverlapped=0x0) returned 1 [0143.244] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.244] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.244] GetProcessHeap () returned 0x4e0000 [0143.244] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0143.244] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0143.244] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.244] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0143.245] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0143.245] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0143.245] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0143.245] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0143.245] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0143.245] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.245] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.245] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.245] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3f1, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x3f1, lpOverlapped=0x0) returned 1 [0143.245] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x400, dwBufLen=0x400 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x400) returned 1 [0143.245] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.245] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x400, lpOverlapped=0x0) returned 1 [0143.245] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.245] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x4d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.245] SetEndOfFile (hFile=0x100) returned 1 [0143.247] GetProcessHeap () returned 0x4e0000 [0143.247] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0143.247] GetProcessHeap () returned 0x4e0000 [0143.247] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0143.247] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0143.248] CloseHandle (hObject=0x100) returned 1 [0143.248] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27222c00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x27222c00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SLATE.ELM", cAlternateFileName="")) returned 1 [0143.248] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.249] GetProcessHeap () returned 0x4e0000 [0143.249] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0143.249] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0143.249] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0143.249] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.249] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.249] GetProcessHeap () returned 0x4e0000 [0143.249] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0143.249] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30) returned 1 [0143.249] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.249] WriteFile (in: hFile=0x100, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24defc8*=0x30, lpOverlapped=0x0) returned 1 [0143.251] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0143.251] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0143.251] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0143.252] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0143.252] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0143.252] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.252] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.252] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.252] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x14c40, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x14c40, lpOverlapped=0x0) returned 1 [0143.257] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x14c40, dwBufLen=0x14c40 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x14c40) returned 1 [0143.257] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.257] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x14c40, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x14c40, lpOverlapped=0x0) returned 1 [0143.258] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.258] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x14d04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.258] SetEndOfFile (hFile=0x100) returned 1 [0143.260] GetProcessHeap () returned 0x4e0000 [0143.260] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0143.260] GetProcessHeap () returned 0x4e0000 [0143.260] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0143.260] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.elm.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0143.263] CloseHandle (hObject=0x100) returned 1 [0143.263] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SLATE.INF", cAlternateFileName="")) returned 1 [0143.263] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.264] GetProcessHeap () returned 0x4e0000 [0143.264] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0143.264] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0143.264] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0143.264] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xc, lpOverlapped=0x0) returned 1 [0143.265] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.265] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.265] GetProcessHeap () returned 0x4e0000 [0143.265] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0143.265] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30) returned 1 [0143.266] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.266] WriteFile (in: hFile=0x100, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24defc8*=0x30, lpOverlapped=0x0) returned 1 [0143.266] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0143.266] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0143.266] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0143.266] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0143.266] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0143.266] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.266] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.266] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.266] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1f4, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x1f4, lpOverlapped=0x0) returned 1 [0143.266] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x200, dwBufLen=0x200 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x200) returned 1 [0143.266] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.266] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x200, lpOverlapped=0x0) returned 1 [0143.266] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.266] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x2c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.266] SetEndOfFile (hFile=0x100) returned 1 [0143.269] GetProcessHeap () returned 0x4e0000 [0143.269] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0143.269] GetProcessHeap () returned 0x4e0000 [0143.269] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0143.269] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.inf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0143.270] CloseHandle (hObject=0x100) returned 1 [0143.270] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6a29, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0143.270] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.271] GetProcessHeap () returned 0x4e0000 [0143.271] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0143.271] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0143.271] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0143.271] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x7, lpOverlapped=0x0) returned 1 [0143.274] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.274] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.274] GetProcessHeap () returned 0x4e0000 [0143.275] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0143.275] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0143.275] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.275] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0143.275] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0143.275] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0143.275] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0143.275] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0143.275] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0143.275] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.275] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.275] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.275] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x6a29, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x6a29, lpOverlapped=0x0) returned 1 [0143.276] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x6a30, dwBufLen=0x6a30 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x6a30) returned 1 [0143.277] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.277] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6a30, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x6a30, lpOverlapped=0x0) returned 1 [0143.277] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.277] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x6b04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.277] SetEndOfFile (hFile=0x100) returned 1 [0143.279] GetProcessHeap () returned 0x4e0000 [0143.280] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0143.280] GetProcessHeap () returned 0x4e0000 [0143.280] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0143.280] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0143.280] CloseHandle (hObject=0x100) returned 1 [0143.280] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6a29, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0143.280] GetProcessHeap () returned 0x4e0000 [0143.281] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0143.281] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0143.281] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df020 | out: pbData=0x4f53d8, pdwDataLen=0x24df020) returned 1 [0143.281] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.281] GetProcessHeap () returned 0x4e0000 [0143.281] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0143.281] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0143.281] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df020 | out: pbData=0x4f5420, pdwDataLen=0x24df020) returned 1 [0143.281] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.281] GetProcessHeap () returned 0x4e0000 [0143.281] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5273b0 [0143.281] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0143.281] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5273b0, pdwDataLen=0x24df020 | out: pbData=0x5273b0, pdwDataLen=0x24df020) returned 1 [0143.281] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.281] wsprintfW (in: param_1=0x24ddffc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\readme-warning.txt") returned 80 [0143.281] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.282] WriteFile (in: hFile=0x100, lpBuffer=0x5273b0*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddff8, lpOverlapped=0x0 | out: lpBuffer=0x5273b0*, lpNumberOfBytesWritten=0x24ddff8*=0x6c3, lpOverlapped=0x0) returned 1 [0143.283] CloseHandle (hObject=0x100) returned 1 [0143.284] GetProcessHeap () returned 0x4e0000 [0143.284] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273b0 | out: hHeap=0x4e0000) returned 1 [0143.284] GetProcessHeap () returned 0x4e0000 [0143.284] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0143.284] GetProcessHeap () returned 0x4e0000 [0143.284] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0143.284] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0143.284] GetProcessHeap () returned 0x4e0000 [0143.284] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0143.284] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SONORA", cAlternateFileName="")) returned 1 [0143.284] GetProcessHeap () returned 0x4e0000 [0143.284] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8e) returned 0x524ea0 [0143.284] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0143.299] GetProcessHeap () returned 0x4e0000 [0143.299] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x524ea0 | out: hHeap=0x4e0000) returned 1 [0143.299] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0143.299] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8a1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0143.299] GetProcessHeap () returned 0x4e0000 [0143.299] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x290) returned 0x527118 [0143.300] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.300] GetProcessHeap () returned 0x4e0000 [0143.300] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0143.300] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0143.300] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0143.300] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xf, lpOverlapped=0x0) returned 1 [0143.302] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.302] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.302] GetProcessHeap () returned 0x4e0000 [0143.302] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0143.302] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0143.302] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.302] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0143.302] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0143.302] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0143.303] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0143.303] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0143.303] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0143.303] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.303] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.303] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.303] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x8a1, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x8a1, lpOverlapped=0x0) returned 1 [0143.303] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x8b0, dwBufLen=0x8b0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x8b0) returned 1 [0143.303] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.303] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x8b0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x8b0, lpOverlapped=0x0) returned 1 [0143.303] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.303] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x984, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.303] SetEndOfFile (hFile=0x100) returned 1 [0143.305] GetProcessHeap () returned 0x4e0000 [0143.305] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0143.305] GetProcessHeap () returned 0x4e0000 [0143.306] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0143.306] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0143.306] CloseHandle (hObject=0x100) returned 1 [0143.306] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28535900, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x28535900, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xd59f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SONORA.ELM", cAlternateFileName="")) returned 1 [0143.306] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.308] GetProcessHeap () returned 0x4e0000 [0143.308] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0143.309] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0143.309] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0143.309] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x1, lpOverlapped=0x0) returned 1 [0143.311] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.312] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.312] GetProcessHeap () returned 0x4e0000 [0143.312] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0143.312] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30) returned 1 [0143.312] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.312] WriteFile (in: hFile=0x100, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24defc8*=0x30, lpOverlapped=0x0) returned 1 [0143.312] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0143.312] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0143.312] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0143.312] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0143.312] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0143.312] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.312] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.312] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.312] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xd59f, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xd59f, lpOverlapped=0x0) returned 1 [0143.315] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xd5a0, dwBufLen=0xd5a0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xd5a0) returned 1 [0143.315] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.315] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xd5a0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xd5a0, lpOverlapped=0x0) returned 1 [0143.315] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.315] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xd664, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.315] SetEndOfFile (hFile=0x100) returned 1 [0143.318] GetProcessHeap () returned 0x4e0000 [0143.318] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0143.318] GetProcessHeap () returned 0x4e0000 [0143.318] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0143.319] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.elm.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0143.323] CloseHandle (hObject=0x100) returned 1 [0143.323] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SONORA.INF", cAlternateFileName="")) returned 1 [0143.323] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.323] GetProcessHeap () returned 0x4e0000 [0143.323] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0143.323] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0143.323] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0143.324] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xc, lpOverlapped=0x0) returned 1 [0143.325] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.325] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.325] GetProcessHeap () returned 0x4e0000 [0143.325] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0143.325] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30) returned 1 [0143.325] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.325] WriteFile (in: hFile=0x100, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24defc8*=0x30, lpOverlapped=0x0) returned 1 [0143.325] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0143.325] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0143.325] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0143.325] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0143.325] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0143.325] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.325] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.325] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.325] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1e4, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x1e4, lpOverlapped=0x0) returned 1 [0143.326] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1f0) returned 1 [0143.326] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.326] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x1f0, lpOverlapped=0x0) returned 1 [0143.326] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.326] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x2b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.326] SetEndOfFile (hFile=0x100) returned 1 [0143.328] GetProcessHeap () returned 0x4e0000 [0143.328] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0143.328] GetProcessHeap () returned 0x4e0000 [0143.328] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0143.328] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.inf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0143.330] CloseHandle (hObject=0x100) returned 1 [0143.331] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5534, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0143.331] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.331] GetProcessHeap () returned 0x4e0000 [0143.331] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0143.331] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0143.331] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0143.331] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xc, lpOverlapped=0x0) returned 1 [0143.333] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.333] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.333] GetProcessHeap () returned 0x4e0000 [0143.333] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0143.333] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0143.333] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.333] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0143.333] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0143.333] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0143.333] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0143.333] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0143.334] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0143.334] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.334] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.334] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.334] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5534, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x5534, lpOverlapped=0x0) returned 1 [0143.335] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x5540, dwBufLen=0x5540 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x5540) returned 1 [0143.335] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.335] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5540, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x5540, lpOverlapped=0x0) returned 1 [0143.335] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.335] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x5614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.335] SetEndOfFile (hFile=0x100) returned 1 [0143.337] GetProcessHeap () returned 0x4e0000 [0143.337] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0143.337] GetProcessHeap () returned 0x4e0000 [0143.337] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0143.337] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0143.338] CloseHandle (hObject=0x100) returned 1 [0143.338] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5534, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0143.338] GetProcessHeap () returned 0x4e0000 [0143.338] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0143.338] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0143.338] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df020 | out: pbData=0x4f53d8, pdwDataLen=0x24df020) returned 1 [0143.338] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.338] GetProcessHeap () returned 0x4e0000 [0143.338] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0143.338] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0143.338] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df020 | out: pbData=0x4f5420, pdwDataLen=0x24df020) returned 1 [0143.338] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.338] GetProcessHeap () returned 0x4e0000 [0143.339] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5273b0 [0143.339] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0143.339] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5273b0, pdwDataLen=0x24df020 | out: pbData=0x5273b0, pdwDataLen=0x24df020) returned 1 [0143.339] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.339] wsprintfW (in: param_1=0x24ddffc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\readme-warning.txt") returned 81 [0143.339] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.339] WriteFile (in: hFile=0x100, lpBuffer=0x5273b0*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddff8, lpOverlapped=0x0 | out: lpBuffer=0x5273b0*, lpNumberOfBytesWritten=0x24ddff8*=0x6c3, lpOverlapped=0x0) returned 1 [0143.340] CloseHandle (hObject=0x100) returned 1 [0143.340] GetProcessHeap () returned 0x4e0000 [0143.340] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273b0 | out: hHeap=0x4e0000) returned 1 [0143.340] GetProcessHeap () returned 0x4e0000 [0143.340] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0143.340] GetProcessHeap () returned 0x4e0000 [0143.340] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0143.340] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0143.341] GetProcessHeap () returned 0x4e0000 [0143.341] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0143.341] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SPRING", cAlternateFileName="")) returned 1 [0143.341] GetProcessHeap () returned 0x4e0000 [0143.341] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8e) returned 0x524ea0 [0143.341] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0143.341] GetProcessHeap () returned 0x4e0000 [0143.341] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x524ea0 | out: hHeap=0x4e0000) returned 1 [0143.341] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0143.341] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9df, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0143.341] GetProcessHeap () returned 0x4e0000 [0143.341] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x290) returned 0x527118 [0143.341] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.341] GetProcessHeap () returned 0x4e0000 [0143.341] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0143.341] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0143.341] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0143.342] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x1, lpOverlapped=0x0) returned 1 [0143.343] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.343] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.343] GetProcessHeap () returned 0x4e0000 [0143.343] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0143.343] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0143.343] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.343] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0143.343] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0143.344] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0143.344] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0143.344] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0143.344] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0143.344] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.344] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.344] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.344] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x9df, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x9df, lpOverlapped=0x0) returned 1 [0143.344] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x9e0, dwBufLen=0x9e0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x9e0) returned 1 [0143.344] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.344] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x9e0, lpOverlapped=0x0) returned 1 [0143.345] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.345] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xab4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.345] SetEndOfFile (hFile=0x100) returned 1 [0143.347] GetProcessHeap () returned 0x4e0000 [0143.347] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0143.347] GetProcessHeap () returned 0x4e0000 [0143.347] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0143.347] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0143.348] CloseHandle (hObject=0x100) returned 1 [0143.348] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ab5b300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5ab49610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2ab5b300, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x10af1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SPRING.ELM", cAlternateFileName="")) returned 1 [0143.348] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.349] GetProcessHeap () returned 0x4e0000 [0143.349] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0143.349] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0143.349] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0143.349] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xf, lpOverlapped=0x0) returned 1 [0143.351] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.351] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.351] GetProcessHeap () returned 0x4e0000 [0143.351] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0143.351] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30) returned 1 [0143.351] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.351] WriteFile (in: hFile=0x100, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24defc8*=0x30, lpOverlapped=0x0) returned 1 [0143.351] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0143.351] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0143.351] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0143.351] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0143.351] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0143.351] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.351] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.351] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.351] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x10af1, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x10af1, lpOverlapped=0x0) returned 1 [0143.354] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x10b00, dwBufLen=0x10b00 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x10b00) returned 1 [0143.354] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.354] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x10b00, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x10b00, lpOverlapped=0x0) returned 1 [0143.355] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.355] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x10bc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.355] SetEndOfFile (hFile=0x100) returned 1 [0143.357] GetProcessHeap () returned 0x4e0000 [0143.357] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0143.357] GetProcessHeap () returned 0x4e0000 [0143.357] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0143.357] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.elm.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0143.360] CloseHandle (hObject=0x100) returned 1 [0143.360] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1d2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SPRING.INF", cAlternateFileName="")) returned 1 [0143.360] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.361] GetProcessHeap () returned 0x4e0000 [0143.361] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0143.361] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0143.361] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0143.361] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xe, lpOverlapped=0x0) returned 1 [0143.362] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.362] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.362] GetProcessHeap () returned 0x4e0000 [0143.362] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0143.362] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30) returned 1 [0143.362] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.362] WriteFile (in: hFile=0x100, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24defc8*=0x30, lpOverlapped=0x0) returned 1 [0143.362] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0143.362] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0143.362] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0143.365] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0143.365] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0143.365] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.365] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.365] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.365] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1d2, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x1d2, lpOverlapped=0x0) returned 1 [0143.365] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1e0) returned 1 [0143.365] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.365] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x1e0, lpOverlapped=0x0) returned 1 [0143.366] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.366] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x2a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.366] SetEndOfFile (hFile=0x100) returned 1 [0143.368] GetProcessHeap () returned 0x4e0000 [0143.368] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0143.368] GetProcessHeap () returned 0x4e0000 [0143.368] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0143.368] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.inf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0143.369] CloseHandle (hObject=0x100) returned 1 [0143.369] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c45, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0143.369] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.370] GetProcessHeap () returned 0x4e0000 [0143.370] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0143.370] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0143.370] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0143.370] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xb, lpOverlapped=0x0) returned 1 [0143.380] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.380] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.380] GetProcessHeap () returned 0x4e0000 [0143.380] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0143.381] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0143.381] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.381] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0143.381] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0143.381] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0143.381] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0143.381] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0143.381] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0143.381] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.381] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.381] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.381] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4c45, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x4c45, lpOverlapped=0x0) returned 1 [0143.383] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x4c50, dwBufLen=0x4c50 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x4c50) returned 1 [0143.383] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.383] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4c50, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x4c50, lpOverlapped=0x0) returned 1 [0143.383] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.383] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x4d24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.383] SetEndOfFile (hFile=0x100) returned 1 [0143.385] GetProcessHeap () returned 0x4e0000 [0143.385] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0143.385] GetProcessHeap () returned 0x4e0000 [0143.385] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0143.385] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0143.386] CloseHandle (hObject=0x100) returned 1 [0143.386] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c45, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0143.386] GetProcessHeap () returned 0x4e0000 [0143.386] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0143.387] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0143.387] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df020 | out: pbData=0x4f53d8, pdwDataLen=0x24df020) returned 1 [0143.387] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.387] GetProcessHeap () returned 0x4e0000 [0143.387] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0143.387] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0143.387] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df020 | out: pbData=0x4f5420, pdwDataLen=0x24df020) returned 1 [0143.387] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.387] GetProcessHeap () returned 0x4e0000 [0143.387] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5273b0 [0143.387] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0143.387] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5273b0, pdwDataLen=0x24df020 | out: pbData=0x5273b0, pdwDataLen=0x24df020) returned 1 [0143.387] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.387] wsprintfW (in: param_1=0x24ddffc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\readme-warning.txt") returned 81 [0143.387] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.387] WriteFile (in: hFile=0x100, lpBuffer=0x5273b0*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddff8, lpOverlapped=0x0 | out: lpBuffer=0x5273b0*, lpNumberOfBytesWritten=0x24ddff8*=0x6c3, lpOverlapped=0x0) returned 1 [0143.388] CloseHandle (hObject=0x100) returned 1 [0143.388] GetProcessHeap () returned 0x4e0000 [0143.389] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273b0 | out: hHeap=0x4e0000) returned 1 [0143.389] GetProcessHeap () returned 0x4e0000 [0143.389] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0143.389] GetProcessHeap () returned 0x4e0000 [0143.389] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0143.389] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0143.389] GetProcessHeap () returned 0x4e0000 [0143.389] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0143.389] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="STRTEDGE", cAlternateFileName="")) returned 1 [0143.389] GetProcessHeap () returned 0x4e0000 [0143.389] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x92) returned 0x4fa058 [0143.389] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0143.390] GetProcessHeap () returned 0x4e0000 [0143.390] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0143.390] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0143.390] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6c9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0143.390] GetProcessHeap () returned 0x4e0000 [0143.390] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x294) returned 0x527118 [0143.390] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.390] GetProcessHeap () returned 0x4e0000 [0143.390] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0143.390] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0143.390] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0143.391] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x7, lpOverlapped=0x0) returned 1 [0143.392] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.392] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.392] GetProcessHeap () returned 0x4e0000 [0143.392] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0143.392] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0143.392] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.392] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0143.392] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0143.392] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0143.393] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0143.393] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0143.393] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0143.393] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.393] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.393] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.393] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x6c9, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x6c9, lpOverlapped=0x0) returned 1 [0143.393] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x6d0, dwBufLen=0x6d0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x6d0) returned 1 [0143.393] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.393] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x6d0, lpOverlapped=0x0) returned 1 [0143.393] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.393] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x7a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.393] SetEndOfFile (hFile=0x100) returned 1 [0143.396] GetProcessHeap () returned 0x4e0000 [0143.396] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0143.396] GetProcessHeap () returned 0x4e0000 [0143.396] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0143.396] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0143.397] CloseHandle (hObject=0x100) returned 1 [0143.397] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d180d00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2d180d00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe232, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="STRTEDGE.ELM", cAlternateFileName="")) returned 1 [0143.397] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.397] GetProcessHeap () returned 0x4e0000 [0143.397] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0143.397] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0143.397] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0143.397] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xe, lpOverlapped=0x0) returned 1 [0143.399] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.399] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.399] GetProcessHeap () returned 0x4e0000 [0143.399] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0143.399] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0143.399] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.399] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0143.399] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0143.399] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0143.399] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0143.399] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0143.400] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0143.400] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.400] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.400] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.400] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xe232, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xe232, lpOverlapped=0x0) returned 1 [0143.401] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xe240, dwBufLen=0xe240 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xe240) returned 1 [0143.402] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.402] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe240, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xe240, lpOverlapped=0x0) returned 1 [0143.402] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.402] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xe314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.402] SetEndOfFile (hFile=0x100) returned 1 [0143.404] GetProcessHeap () returned 0x4e0000 [0143.404] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0143.404] GetProcessHeap () returned 0x4e0000 [0143.404] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0143.404] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0143.407] CloseHandle (hObject=0x100) returned 1 [0143.407] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x271, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="STRTEDGE.INF", cAlternateFileName="")) returned 1 [0143.407] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.408] GetProcessHeap () returned 0x4e0000 [0143.408] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0143.408] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0143.408] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0143.408] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xf, lpOverlapped=0x0) returned 1 [0143.409] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.409] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.409] GetProcessHeap () returned 0x4e0000 [0143.409] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0143.409] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0143.409] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.409] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0143.410] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0143.410] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0143.410] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0143.410] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0143.410] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0143.410] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.410] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.410] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.410] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x271, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x271, lpOverlapped=0x0) returned 1 [0143.410] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x280, dwBufLen=0x280 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x280) returned 1 [0143.410] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.410] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x280, lpOverlapped=0x0) returned 1 [0143.410] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.410] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x354, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.410] SetEndOfFile (hFile=0x100) returned 1 [0143.422] GetProcessHeap () returned 0x4e0000 [0143.422] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0143.422] GetProcessHeap () returned 0x4e0000 [0143.422] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0143.422] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.inf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0143.423] CloseHandle (hObject=0x100) returned 1 [0143.423] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x82c7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0143.423] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.424] GetProcessHeap () returned 0x4e0000 [0143.424] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0143.424] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0143.424] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0143.424] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x9, lpOverlapped=0x0) returned 1 [0143.426] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.426] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.426] GetProcessHeap () returned 0x4e0000 [0143.426] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0143.426] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0143.426] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.426] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0143.426] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0143.427] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0143.427] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0143.427] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0143.427] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0143.427] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.427] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.427] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.427] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x82c7, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x82c7, lpOverlapped=0x0) returned 1 [0143.445] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x82d0, dwBufLen=0x82d0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x82d0) returned 1 [0143.445] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.445] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x82d0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x82d0, lpOverlapped=0x0) returned 1 [0143.445] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.445] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x83a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.445] SetEndOfFile (hFile=0x100) returned 1 [0143.448] GetProcessHeap () returned 0x4e0000 [0143.448] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0143.448] GetProcessHeap () returned 0x4e0000 [0143.448] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0143.448] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0143.449] CloseHandle (hObject=0x100) returned 1 [0143.449] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x82c7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0143.449] GetProcessHeap () returned 0x4e0000 [0143.450] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0143.450] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0143.450] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df020 | out: pbData=0x4f53d8, pdwDataLen=0x24df020) returned 1 [0143.450] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.450] GetProcessHeap () returned 0x4e0000 [0143.450] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0143.450] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0143.450] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df020 | out: pbData=0x4f5420, pdwDataLen=0x24df020) returned 1 [0143.450] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.450] GetProcessHeap () returned 0x4e0000 [0143.450] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5273b8 [0143.450] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0143.450] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5273b8, pdwDataLen=0x24df020 | out: pbData=0x5273b8, pdwDataLen=0x24df020) returned 1 [0143.450] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.450] wsprintfW (in: param_1=0x24ddffc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\readme-warning.txt") returned 83 [0143.450] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.452] WriteFile (in: hFile=0x100, lpBuffer=0x5273b8*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddff8, lpOverlapped=0x0 | out: lpBuffer=0x5273b8*, lpNumberOfBytesWritten=0x24ddff8*=0x6c3, lpOverlapped=0x0) returned 1 [0143.453] CloseHandle (hObject=0x100) returned 1 [0143.453] GetProcessHeap () returned 0x4e0000 [0143.453] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273b8 | out: hHeap=0x4e0000) returned 1 [0143.453] GetProcessHeap () returned 0x4e0000 [0143.453] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0143.453] GetProcessHeap () returned 0x4e0000 [0143.453] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0143.453] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0143.453] GetProcessHeap () returned 0x4e0000 [0143.453] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0143.453] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="STUDIO", cAlternateFileName="")) returned 1 [0143.453] GetProcessHeap () returned 0x4e0000 [0143.453] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8e) returned 0x524ea0 [0143.453] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0143.454] GetProcessHeap () returned 0x4e0000 [0143.454] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x524ea0 | out: hHeap=0x4e0000) returned 1 [0143.454] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0143.454] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x68b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0143.454] GetProcessHeap () returned 0x4e0000 [0143.454] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x290) returned 0x527118 [0143.454] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.455] GetProcessHeap () returned 0x4e0000 [0143.455] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0143.455] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0143.455] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0143.455] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x5, lpOverlapped=0x0) returned 1 [0143.457] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.457] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.457] GetProcessHeap () returned 0x4e0000 [0143.457] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0143.457] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0143.457] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.457] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0143.457] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0143.457] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0143.457] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0143.457] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0143.457] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0143.457] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.457] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.457] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.457] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x68b, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x68b, lpOverlapped=0x0) returned 1 [0143.457] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x690, dwBufLen=0x690 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x690) returned 1 [0143.457] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.458] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x690, lpOverlapped=0x0) returned 1 [0143.458] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.458] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x764, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.458] SetEndOfFile (hFile=0x100) returned 1 [0143.460] GetProcessHeap () returned 0x4e0000 [0143.460] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0143.460] GetProcessHeap () returned 0x4e0000 [0143.460] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0143.460] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0143.461] CloseHandle (hObject=0x100) returned 1 [0143.461] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e493a00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5ac7a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2e493a00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xbfed, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="STUDIO.ELM", cAlternateFileName="")) returned 1 [0143.461] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.462] GetProcessHeap () returned 0x4e0000 [0143.462] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0143.462] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0143.462] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0143.462] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x3, lpOverlapped=0x0) returned 1 [0143.464] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.464] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.464] GetProcessHeap () returned 0x4e0000 [0143.464] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0143.464] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30) returned 1 [0143.464] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.464] WriteFile (in: hFile=0x100, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24defc8*=0x30, lpOverlapped=0x0) returned 1 [0143.464] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0143.464] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0143.464] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0143.464] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0143.464] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0143.464] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.464] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.464] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.465] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xbfed, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xbfed, lpOverlapped=0x0) returned 1 [0143.466] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xbff0, dwBufLen=0xbff0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xbff0) returned 1 [0143.466] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.466] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xbff0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xbff0, lpOverlapped=0x0) returned 1 [0143.466] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.466] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xc0b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.466] SetEndOfFile (hFile=0x100) returned 1 [0143.469] GetProcessHeap () returned 0x4e0000 [0143.469] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0143.469] GetProcessHeap () returned 0x4e0000 [0143.469] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0143.469] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.elm.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0143.471] CloseHandle (hObject=0x100) returned 1 [0143.471] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="STUDIO.INF", cAlternateFileName="")) returned 1 [0143.471] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.472] GetProcessHeap () returned 0x4e0000 [0143.472] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0143.472] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0143.472] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0143.472] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xe, lpOverlapped=0x0) returned 1 [0143.475] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.475] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.475] GetProcessHeap () returned 0x4e0000 [0143.475] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0143.475] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30) returned 1 [0143.475] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.475] WriteFile (in: hFile=0x100, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24defc8*=0x30, lpOverlapped=0x0) returned 1 [0143.475] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0143.475] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0143.475] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0143.475] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0143.476] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0143.476] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.476] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.476] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.476] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x242, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x242, lpOverlapped=0x0) returned 1 [0143.476] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x250, dwBufLen=0x250 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x250) returned 1 [0143.476] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.476] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x250, lpOverlapped=0x0) returned 1 [0143.476] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.476] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.476] SetEndOfFile (hFile=0x100) returned 1 [0143.478] GetProcessHeap () returned 0x4e0000 [0143.478] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0143.478] GetProcessHeap () returned 0x4e0000 [0143.478] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0143.478] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.inf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0143.479] CloseHandle (hObject=0x100) returned 1 [0143.479] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x47cc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0143.479] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.479] GetProcessHeap () returned 0x4e0000 [0143.479] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0143.480] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0143.480] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0143.480] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0143.483] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.484] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.484] GetProcessHeap () returned 0x4e0000 [0143.484] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0143.484] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0143.484] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.484] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0143.484] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0143.484] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0143.484] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0143.484] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0143.484] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0143.484] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.484] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.485] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.485] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x47cc, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x47cc, lpOverlapped=0x0) returned 1 [0143.486] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x47d0, dwBufLen=0x47d0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x47d0) returned 1 [0143.486] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.486] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x47d0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x47d0, lpOverlapped=0x0) returned 1 [0143.486] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.486] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x48a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.486] SetEndOfFile (hFile=0x100) returned 1 [0143.489] GetProcessHeap () returned 0x4e0000 [0143.489] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0143.489] GetProcessHeap () returned 0x4e0000 [0143.489] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0143.490] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0143.490] CloseHandle (hObject=0x100) returned 1 [0143.491] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x47cc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0143.491] GetProcessHeap () returned 0x4e0000 [0143.491] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0143.491] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0143.491] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df020 | out: pbData=0x4f53d8, pdwDataLen=0x24df020) returned 1 [0143.491] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.491] GetProcessHeap () returned 0x4e0000 [0143.491] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0143.491] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0143.491] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df020 | out: pbData=0x4f5420, pdwDataLen=0x24df020) returned 1 [0143.491] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.491] GetProcessHeap () returned 0x4e0000 [0143.491] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5273b0 [0143.491] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0143.491] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5273b0, pdwDataLen=0x24df020 | out: pbData=0x5273b0, pdwDataLen=0x24df020) returned 1 [0143.491] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.491] wsprintfW (in: param_1=0x24ddffc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\readme-warning.txt") returned 81 [0143.492] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.492] WriteFile (in: hFile=0x100, lpBuffer=0x5273b0*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddff8, lpOverlapped=0x0 | out: lpBuffer=0x5273b0*, lpNumberOfBytesWritten=0x24ddff8*=0x6c3, lpOverlapped=0x0) returned 1 [0143.493] CloseHandle (hObject=0x100) returned 1 [0143.493] GetProcessHeap () returned 0x4e0000 [0143.493] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273b0 | out: hHeap=0x4e0000) returned 1 [0143.493] GetProcessHeap () returned 0x4e0000 [0143.493] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0143.494] GetProcessHeap () returned 0x4e0000 [0143.494] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0143.494] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0143.494] GetProcessHeap () returned 0x4e0000 [0143.494] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0143.494] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SUMIPNTG", cAlternateFileName="")) returned 1 [0143.494] GetProcessHeap () returned 0x4e0000 [0143.494] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x92) returned 0x4fa058 [0143.494] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0143.494] GetProcessHeap () returned 0x4e0000 [0143.494] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0143.494] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0143.494] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x137f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0143.494] GetProcessHeap () returned 0x4e0000 [0143.494] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x294) returned 0x527118 [0143.495] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.495] GetProcessHeap () returned 0x4e0000 [0143.495] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0143.495] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0143.495] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0143.495] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x1, lpOverlapped=0x0) returned 1 [0143.497] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.497] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.497] GetProcessHeap () returned 0x4e0000 [0143.497] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0143.497] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0143.497] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.497] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0143.498] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0143.498] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0143.498] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0143.498] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0143.498] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0143.498] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.498] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.498] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.498] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x137f, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x137f, lpOverlapped=0x0) returned 1 [0143.499] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1380, dwBufLen=0x1380 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1380) returned 1 [0143.499] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.499] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x1380, lpOverlapped=0x0) returned 1 [0143.500] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.500] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1454, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.500] SetEndOfFile (hFile=0x100) returned 1 [0143.502] GetProcessHeap () returned 0x4e0000 [0143.502] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0143.502] GetProcessHeap () returned 0x4e0000 [0143.502] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0143.503] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0143.503] CloseHandle (hObject=0x100) returned 1 [0143.504] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7a6700, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f7a6700, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x19e14, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SUMIPNTG.ELM", cAlternateFileName="")) returned 1 [0143.504] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.505] GetProcessHeap () returned 0x4e0000 [0143.505] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0143.505] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0143.505] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0143.505] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xc, lpOverlapped=0x0) returned 1 [0143.507] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.507] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.507] GetProcessHeap () returned 0x4e0000 [0143.507] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0143.507] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0143.507] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.507] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0143.508] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0143.508] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0143.508] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0143.508] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0143.508] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0143.508] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.508] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.508] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.508] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x19e14, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x19e14, lpOverlapped=0x0) returned 1 [0143.510] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x19e20, dwBufLen=0x19e20 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x19e20) returned 1 [0143.512] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.512] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x19e20, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x19e20, lpOverlapped=0x0) returned 1 [0143.512] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.512] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x19ef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.512] SetEndOfFile (hFile=0x100) returned 1 [0143.516] GetProcessHeap () returned 0x4e0000 [0143.516] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0143.516] GetProcessHeap () returned 0x4e0000 [0143.516] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0143.516] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.elm.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0143.519] CloseHandle (hObject=0x100) returned 1 [0143.519] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x22b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SUMIPNTG.INF", cAlternateFileName="")) returned 1 [0143.519] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.520] GetProcessHeap () returned 0x4e0000 [0143.520] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0143.520] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0143.520] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0143.520] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x5, lpOverlapped=0x0) returned 1 [0143.522] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.522] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.522] GetProcessHeap () returned 0x4e0000 [0143.522] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0143.522] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0143.522] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.522] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0143.522] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0143.522] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0143.522] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0143.522] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0143.522] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0143.522] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.522] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.523] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.523] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x22b, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x22b, lpOverlapped=0x0) returned 1 [0143.523] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x230, dwBufLen=0x230 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x230) returned 1 [0143.523] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.523] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x230, lpOverlapped=0x0) returned 1 [0143.523] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.523] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x304, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.523] SetEndOfFile (hFile=0x100) returned 1 [0143.525] GetProcessHeap () returned 0x4e0000 [0143.525] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0143.525] GetProcessHeap () returned 0x4e0000 [0143.525] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0143.526] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.inf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0143.527] CloseHandle (hObject=0x100) returned 1 [0143.527] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xad0e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0143.527] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.527] GetProcessHeap () returned 0x4e0000 [0143.527] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0143.527] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0143.527] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0143.527] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x2, lpOverlapped=0x0) returned 1 [0143.529] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.529] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.529] GetProcessHeap () returned 0x4e0000 [0143.529] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0143.529] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0143.529] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.529] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0143.529] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0143.530] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0143.530] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0143.530] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0143.530] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0143.530] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.530] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.530] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.530] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xad0e, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xad0e, lpOverlapped=0x0) returned 1 [0143.531] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xad10, dwBufLen=0xad10 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xad10) returned 1 [0143.532] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.532] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xad10, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xad10, lpOverlapped=0x0) returned 1 [0143.532] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.532] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xade4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.532] SetEndOfFile (hFile=0x100) returned 1 [0143.534] GetProcessHeap () returned 0x4e0000 [0143.534] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0143.534] GetProcessHeap () returned 0x4e0000 [0143.534] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0143.534] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0143.535] CloseHandle (hObject=0x100) returned 1 [0143.535] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xad0e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0143.535] GetProcessHeap () returned 0x4e0000 [0143.535] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0143.535] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0143.535] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df020 | out: pbData=0x4f53d8, pdwDataLen=0x24df020) returned 1 [0143.535] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.535] GetProcessHeap () returned 0x4e0000 [0143.536] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0143.536] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0143.536] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df020 | out: pbData=0x4f5420, pdwDataLen=0x24df020) returned 1 [0143.536] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.536] GetProcessHeap () returned 0x4e0000 [0143.536] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5273b8 [0143.536] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0143.536] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5273b8, pdwDataLen=0x24df020 | out: pbData=0x5273b8, pdwDataLen=0x24df020) returned 1 [0143.536] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.536] wsprintfW (in: param_1=0x24ddffc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\readme-warning.txt") returned 83 [0143.536] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.537] WriteFile (in: hFile=0x100, lpBuffer=0x5273b8*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddff8, lpOverlapped=0x0 | out: lpBuffer=0x5273b8*, lpNumberOfBytesWritten=0x24ddff8*=0x6c3, lpOverlapped=0x0) returned 1 [0143.537] CloseHandle (hObject=0x100) returned 1 [0143.538] GetProcessHeap () returned 0x4e0000 [0143.538] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273b8 | out: hHeap=0x4e0000) returned 1 [0143.538] GetProcessHeap () returned 0x4e0000 [0143.538] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0143.538] GetProcessHeap () returned 0x4e0000 [0143.538] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0143.538] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0143.538] GetProcessHeap () returned 0x4e0000 [0143.538] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0143.538] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc24e4f00, ftCreationTime.dwHighDateTime=0x1c06b0e, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc24e4f00, ftLastWriteTime.dwHighDateTime=0x1c06b0e, nFileSizeHigh=0x0, nFileSizeLow=0x1c6c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THEMES.INF", cAlternateFileName="")) returned 1 [0143.538] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\themes.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0143.538] GetProcessHeap () returned 0x4e0000 [0143.538] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0143.538] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0143.538] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0143.539] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0143.540] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0143.540] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.540] GetProcessHeap () returned 0x4e0000 [0143.540] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0143.540] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0143.540] CryptDestroyKey (hKey=0x522f98) returned 1 [0143.540] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0143.540] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0143.541] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0143.541] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0143.541] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0143.541] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0143.541] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0143.541] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.541] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.541] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1c6c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1c6c, lpOverlapped=0x0) returned 1 [0143.542] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1c70, dwBufLen=0x1c70 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1c70) returned 1 [0143.542] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.542] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1c70, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1c70, lpOverlapped=0x0) returned 1 [0143.542] CryptDestroyKey (hKey=0x522f98) returned 1 [0143.542] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1d34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.542] SetEndOfFile (hFile=0xdc) returned 1 [0143.544] GetProcessHeap () returned 0x4e0000 [0143.544] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0143.544] GetProcessHeap () returned 0x4e0000 [0143.544] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0143.544] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\themes.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\themes.inf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0143.545] CloseHandle (hObject=0xdc) returned 1 [0143.545] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WATER", cAlternateFileName="")) returned 1 [0143.545] GetProcessHeap () returned 0x4e0000 [0143.545] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8c) returned 0x524ea0 [0143.545] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24df164, dwReserved1=0x77c7389e, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0143.545] GetProcessHeap () returned 0x4e0000 [0143.545] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x524ea0 | out: hHeap=0x4e0000) returned 1 [0143.545] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24df164, dwReserved1=0x77c7389e, cFileName="..", cAlternateFileName="")) returned 1 [0143.545] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa6c, dwReserved0=0x24df164, dwReserved1=0x77c7389e, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0143.545] GetProcessHeap () returned 0x4e0000 [0143.545] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x28e) returned 0x527118 [0143.545] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.546] GetProcessHeap () returned 0x4e0000 [0143.546] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0143.546] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0143.546] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0143.546] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0143.548] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.548] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.548] GetProcessHeap () returned 0x4e0000 [0143.548] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0143.548] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0143.548] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.548] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0143.548] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0143.548] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0143.548] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0143.548] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0143.548] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0143.548] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.548] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.548] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.548] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xa6c, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xa6c, lpOverlapped=0x0) returned 1 [0143.548] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xa70, dwBufLen=0xa70 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xa70) returned 1 [0143.548] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.549] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xa70, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xa70, lpOverlapped=0x0) returned 1 [0143.549] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.549] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xb44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.549] SetEndOfFile (hFile=0x100) returned 1 [0143.551] GetProcessHeap () returned 0x4e0000 [0143.551] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0143.551] GetProcessHeap () returned 0x4e0000 [0143.551] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0143.551] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0143.551] CloseHandle (hObject=0x100) returned 1 [0143.552] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa5d5, dwReserved0=0x24df164, dwReserved1=0x77c7389e, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0143.552] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.552] GetProcessHeap () returned 0x4e0000 [0143.552] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0143.552] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0143.552] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0143.552] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xb, lpOverlapped=0x0) returned 1 [0143.554] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.554] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.554] GetProcessHeap () returned 0x4e0000 [0143.554] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0143.554] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0143.554] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.554] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0143.554] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0143.554] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0143.554] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0143.554] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0143.554] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0143.554] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.554] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.554] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.555] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xa5d5, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xa5d5, lpOverlapped=0x0) returned 1 [0143.556] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xa5e0, dwBufLen=0xa5e0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xa5e0) returned 1 [0143.556] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.556] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xa5e0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xa5e0, lpOverlapped=0x0) returned 1 [0143.556] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.556] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xa6b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.556] SetEndOfFile (hFile=0x100) returned 1 [0143.559] GetProcessHeap () returned 0x4e0000 [0143.559] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0143.559] GetProcessHeap () returned 0x4e0000 [0143.559] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0143.559] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0143.561] CloseHandle (hObject=0x100) returned 1 [0143.561] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36a17500, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x36a17500, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x101cc, dwReserved0=0x24df164, dwReserved1=0x77c7389e, cFileName="WATER.ELM", cAlternateFileName="")) returned 1 [0143.561] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.562] GetProcessHeap () returned 0x4e0000 [0143.562] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0143.562] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0143.562] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0143.562] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0143.564] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.564] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.564] GetProcessHeap () returned 0x4e0000 [0143.564] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0143.564] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30) returned 1 [0143.564] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.564] WriteFile (in: hFile=0x100, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24defc8*=0x30, lpOverlapped=0x0) returned 1 [0143.564] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0143.564] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0143.564] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0143.564] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0143.564] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0143.564] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.564] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.564] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.564] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x101cc, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x101cc, lpOverlapped=0x0) returned 1 [0143.566] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x101d0, dwBufLen=0x101d0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x101d0) returned 1 [0143.566] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.566] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x101d0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x101d0, lpOverlapped=0x0) returned 1 [0143.567] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.567] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x10294, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.567] SetEndOfFile (hFile=0x100) returned 1 [0143.569] GetProcessHeap () returned 0x4e0000 [0143.569] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0143.569] GetProcessHeap () returned 0x4e0000 [0143.569] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0143.569] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0143.570] CloseHandle (hObject=0x100) returned 1 [0143.570] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1a1, dwReserved0=0x24df164, dwReserved1=0x77c7389e, cFileName="WATER.INF", cAlternateFileName="")) returned 1 [0143.570] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.571] GetProcessHeap () returned 0x4e0000 [0143.571] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0143.571] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0143.571] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0143.571] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xf, lpOverlapped=0x0) returned 1 [0143.573] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.573] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.573] GetProcessHeap () returned 0x4e0000 [0143.573] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0143.573] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30) returned 1 [0143.573] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.573] WriteFile (in: hFile=0x100, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24defc8*=0x30, lpOverlapped=0x0) returned 1 [0143.573] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0143.573] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0143.573] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0143.573] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0143.573] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0143.573] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.573] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.573] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.573] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1a1, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x1a1, lpOverlapped=0x0) returned 1 [0143.573] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1b0, dwBufLen=0x1b0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1b0) returned 1 [0143.573] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.573] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1b0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x1b0, lpOverlapped=0x0) returned 1 [0143.574] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.574] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x274, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.574] SetEndOfFile (hFile=0x100) returned 1 [0143.576] GetProcessHeap () returned 0x4e0000 [0143.576] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0143.576] GetProcessHeap () returned 0x4e0000 [0143.576] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0143.576] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0143.577] CloseHandle (hObject=0x100) returned 1 [0143.578] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1a1, dwReserved0=0x24df164, dwReserved1=0x77c7389e, cFileName="WATER.INF", cAlternateFileName="")) returned 0 [0143.578] GetProcessHeap () returned 0x4e0000 [0143.578] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0143.578] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0143.578] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df020 | out: pbData=0x4f53d8, pdwDataLen=0x24df020) returned 1 [0143.578] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.578] GetProcessHeap () returned 0x4e0000 [0143.578] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0143.578] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0143.578] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df020 | out: pbData=0x4f5420, pdwDataLen=0x24df020) returned 1 [0143.578] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.578] GetProcessHeap () returned 0x4e0000 [0143.578] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5273b0 [0143.578] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0143.578] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5273b0, pdwDataLen=0x24df020 | out: pbData=0x5273b0, pdwDataLen=0x24df020) returned 1 [0143.578] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.578] wsprintfW (in: param_1=0x24ddffc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\readme-warning.txt") returned 80 [0143.578] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.579] WriteFile (in: hFile=0x100, lpBuffer=0x5273b0*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddff8, lpOverlapped=0x0 | out: lpBuffer=0x5273b0*, lpNumberOfBytesWritten=0x24ddff8*=0x6c3, lpOverlapped=0x0) returned 1 [0143.580] CloseHandle (hObject=0x100) returned 1 [0143.580] GetProcessHeap () returned 0x4e0000 [0143.580] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273b0 | out: hHeap=0x4e0000) returned 1 [0143.580] GetProcessHeap () returned 0x4e0000 [0143.580] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0143.580] GetProcessHeap () returned 0x4e0000 [0143.580] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0143.580] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0143.581] GetProcessHeap () returned 0x4e0000 [0143.581] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0143.581] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WATERMAR", cAlternateFileName="")) returned 1 [0143.581] GetProcessHeap () returned 0x4e0000 [0143.581] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x92) returned 0x4fa058 [0143.581] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24df164, dwReserved1=0x77c7389e, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0143.581] GetProcessHeap () returned 0x4e0000 [0143.581] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0143.581] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24df164, dwReserved1=0x77c7389e, cFileName="..", cAlternateFileName="")) returned 1 [0143.581] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x623, dwReserved0=0x24df164, dwReserved1=0x77c7389e, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0143.581] GetProcessHeap () returned 0x4e0000 [0143.581] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x294) returned 0x527118 [0143.581] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.582] GetProcessHeap () returned 0x4e0000 [0143.582] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0143.582] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0143.582] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0143.583] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xd, lpOverlapped=0x0) returned 1 [0143.584] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.584] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.584] GetProcessHeap () returned 0x4e0000 [0143.584] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0143.584] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0143.585] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.585] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0143.585] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0143.585] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0143.585] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0143.585] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0143.585] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0143.585] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.585] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.585] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.585] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x623, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x623, lpOverlapped=0x0) returned 1 [0143.585] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x630, dwBufLen=0x630 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x630) returned 1 [0143.585] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.585] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x630, lpOverlapped=0x0) returned 1 [0143.585] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.585] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x704, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.585] SetEndOfFile (hFile=0x100) returned 1 [0143.587] GetProcessHeap () returned 0x4e0000 [0143.587] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0143.587] GetProcessHeap () returned 0x4e0000 [0143.587] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0143.588] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0143.588] CloseHandle (hObject=0x100) returned 1 [0143.588] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x75da, dwReserved0=0x24df164, dwReserved1=0x77c7389e, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0143.588] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.589] GetProcessHeap () returned 0x4e0000 [0143.589] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0143.589] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0143.589] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0143.589] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x6, lpOverlapped=0x0) returned 1 [0143.591] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.591] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.591] GetProcessHeap () returned 0x4e0000 [0143.591] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0143.591] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0143.591] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.591] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0143.591] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0143.591] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0143.592] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0143.592] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0143.592] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0143.592] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.592] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.592] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.592] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x75da, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x75da, lpOverlapped=0x0) returned 1 [0143.593] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x75e0, dwBufLen=0x75e0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x75e0) returned 1 [0143.593] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.593] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x75e0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x75e0, lpOverlapped=0x0) returned 1 [0143.593] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.593] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x76b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.593] SetEndOfFile (hFile=0x100) returned 1 [0143.596] GetProcessHeap () returned 0x4e0000 [0143.596] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0143.596] GetProcessHeap () returned 0x4e0000 [0143.596] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0143.596] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0143.598] CloseHandle (hObject=0x100) returned 1 [0143.598] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37d2a200, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x37d2a200, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xbfc6, dwReserved0=0x24df164, dwReserved1=0x77c7389e, cFileName="WATERMAR.ELM", cAlternateFileName="")) returned 1 [0143.599] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.599] GetProcessHeap () returned 0x4e0000 [0143.599] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0143.599] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0143.599] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0143.599] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xa, lpOverlapped=0x0) returned 1 [0143.601] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.601] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.601] GetProcessHeap () returned 0x4e0000 [0143.601] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0143.601] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0143.601] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.601] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0143.602] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0143.602] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0143.602] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0143.602] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0143.602] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0143.602] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.602] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.602] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.602] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xbfc6, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xbfc6, lpOverlapped=0x0) returned 1 [0143.603] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xbfd0, dwBufLen=0xbfd0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xbfd0) returned 1 [0143.604] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.604] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xbfd0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xbfd0, lpOverlapped=0x0) returned 1 [0143.604] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.604] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xc0a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.604] SetEndOfFile (hFile=0x100) returned 1 [0143.607] GetProcessHeap () returned 0x4e0000 [0143.607] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0143.607] GetProcessHeap () returned 0x4e0000 [0143.607] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0143.607] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0143.608] CloseHandle (hObject=0x100) returned 1 [0143.608] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2ab, dwReserved0=0x24df164, dwReserved1=0x77c7389e, cFileName="WATERMAR.INF", cAlternateFileName="")) returned 1 [0143.608] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.608] GetProcessHeap () returned 0x4e0000 [0143.608] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0143.608] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0143.608] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0143.609] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x5, lpOverlapped=0x0) returned 1 [0143.610] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.610] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.610] GetProcessHeap () returned 0x4e0000 [0143.610] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0143.610] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0143.610] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.610] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0143.610] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0143.610] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0143.610] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0143.611] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0143.611] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0143.611] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.611] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.611] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.611] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2ab, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x2ab, lpOverlapped=0x0) returned 1 [0143.611] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x2b0, dwBufLen=0x2b0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x2b0) returned 1 [0143.611] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.611] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x2b0, lpOverlapped=0x0) returned 1 [0143.611] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.611] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x384, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.611] SetEndOfFile (hFile=0x100) returned 1 [0143.613] GetProcessHeap () returned 0x4e0000 [0143.613] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0143.613] GetProcessHeap () returned 0x4e0000 [0143.614] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0143.614] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.inf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0143.614] CloseHandle (hObject=0x100) returned 1 [0143.614] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2ab, dwReserved0=0x24df164, dwReserved1=0x77c7389e, cFileName="WATERMAR.INF", cAlternateFileName="")) returned 0 [0143.615] GetProcessHeap () returned 0x4e0000 [0143.615] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0143.615] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0143.615] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df020 | out: pbData=0x4f53d8, pdwDataLen=0x24df020) returned 1 [0143.615] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.615] GetProcessHeap () returned 0x4e0000 [0143.615] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0143.615] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0143.615] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df020 | out: pbData=0x4f5420, pdwDataLen=0x24df020) returned 1 [0143.615] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.615] GetProcessHeap () returned 0x4e0000 [0143.615] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5273b8 [0143.615] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0143.615] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5273b8, pdwDataLen=0x24df020 | out: pbData=0x5273b8, pdwDataLen=0x24df020) returned 1 [0143.615] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.615] wsprintfW (in: param_1=0x24ddffc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\readme-warning.txt") returned 83 [0143.615] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.616] WriteFile (in: hFile=0x100, lpBuffer=0x5273b8*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddff8, lpOverlapped=0x0 | out: lpBuffer=0x5273b8*, lpNumberOfBytesWritten=0x24ddff8*=0x6c3, lpOverlapped=0x0) returned 1 [0143.617] CloseHandle (hObject=0x100) returned 1 [0143.617] GetProcessHeap () returned 0x4e0000 [0143.617] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273b8 | out: hHeap=0x4e0000) returned 1 [0143.617] GetProcessHeap () returned 0x4e0000 [0143.617] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0143.617] GetProcessHeap () returned 0x4e0000 [0143.617] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0143.617] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0143.617] GetProcessHeap () returned 0x4e0000 [0143.617] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0143.617] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WATERMAR", cAlternateFileName="")) returned 0 [0143.617] GetProcessHeap () returned 0x4e0000 [0143.617] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0143.617] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df248, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f98) returned 1 [0143.617] CryptDecrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df2b0 | out: pbData=0x4f53d8, pdwDataLen=0x24df2b0) returned 1 [0143.617] CryptDestroyKey (hKey=0x522f98) returned 1 [0143.617] GetProcessHeap () returned 0x4e0000 [0143.618] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0143.618] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df248, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f98) returned 1 [0143.618] CryptDecrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df2b0 | out: pbData=0x4f5420, pdwDataLen=0x24df2b0) returned 1 [0143.618] CryptDestroyKey (hKey=0x522f98) returned 1 [0143.618] GetProcessHeap () returned 0x4e0000 [0143.618] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x527118 [0143.618] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df248, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f98) returned 1 [0143.618] CryptDecrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x527118, pdwDataLen=0x24df2b0 | out: pbData=0x527118, pdwDataLen=0x24df2b0) returned 1 [0143.618] CryptDestroyKey (hKey=0x522f98) returned 1 [0143.618] wsprintfW (in: param_1=0x24de28c, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\readme-warning.txt") returned 74 [0143.618] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0143.618] WriteFile (in: hFile=0xdc, lpBuffer=0x527118*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24de288, lpOverlapped=0x0 | out: lpBuffer=0x527118*, lpNumberOfBytesWritten=0x24de288*=0x6c3, lpOverlapped=0x0) returned 1 [0143.619] CloseHandle (hObject=0xdc) returned 1 [0143.619] GetProcessHeap () returned 0x4e0000 [0143.619] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0143.619] GetProcessHeap () returned 0x4e0000 [0143.619] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0143.619] GetProcessHeap () returned 0x4e0000 [0143.619] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0143.619] FindClose (in: hFindFile=0x522f58 | out: hFindFile=0x522f58) returned 1 [0143.620] GetProcessHeap () returned 0x4e0000 [0143.620] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x526e88 | out: hHeap=0x4e0000) returned 1 [0143.620] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TRANSLAT", cAlternateFileName="")) returned 1 [0143.620] GetProcessHeap () returned 0x4e0000 [0143.620] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x80) returned 0x4fa058 [0143.620] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*.*", lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f58 [0143.621] GetProcessHeap () returned 0x4e0000 [0143.621] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0143.621] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0143.622] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ARFR", cAlternateFileName="")) returned 1 [0143.622] GetProcessHeap () returned 0x4e0000 [0143.622] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x282) returned 0x526e88 [0143.622] GetProcessHeap () returned 0x4e0000 [0143.622] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8a) returned 0x524ea0 [0143.622] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0143.622] GetProcessHeap () returned 0x4e0000 [0143.622] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x524ea0 | out: hHeap=0x4e0000) returned 1 [0143.622] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0143.623] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b324b00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b324b00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x195018, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSB1ARFR.ITS", cAlternateFileName="")) returned 1 [0143.623] GetProcessHeap () returned 0x4e0000 [0143.623] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x28c) returned 0x527118 [0143.623] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.623] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x24defd0 | out: lpFileSize=0x24defd0*=1658904) returned 1 [0143.623] GetProcessHeap () returned 0x4e0000 [0143.623] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0143.623] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0143.623] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.623] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defbc, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defbc*=0x8, lpOverlapped=0x0) returned 1 [0143.625] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defc0 | out: phKey=0x24defc0*=0x522fd8) returned 1 [0143.625] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.625] GetProcessHeap () returned 0x4e0000 [0143.625] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0143.625] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa0*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa0*=0x40) returned 1 [0143.625] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.625] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defbc, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defbc*=0x40, lpOverlapped=0x0) returned 1 [0143.625] WriteFile (in: hFile=0x100, lpBuffer=0x24defc4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defbc, lpOverlapped=0x0 | out: lpBuffer=0x24defc4*, lpNumberOfBytesWritten=0x24defbc*=0x4, lpOverlapped=0x0) returned 1 [0143.625] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defbc, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defbc*=0x10, lpOverlapped=0x0) returned 1 [0143.625] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defbc, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defbc*=0x80, lpOverlapped=0x0) returned 1 [0143.625] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe8 | out: lpNewFilePointer=0x0) returned 1 [0143.625] WriteFile (in: hFile=0x100, lpBuffer=0x24defd8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defbc, lpOverlapped=0x0 | out: lpBuffer=0x24defd8*, lpNumberOfBytesWritten=0x24defbc*=0x8, lpOverlapped=0x0) returned 1 [0143.625] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defc0 | out: phKey=0x24defc0*=0x522fd8) returned 1 [0143.625] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.626] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24def90 | out: lpNewFilePointer=0x0) returned 1 [0143.626] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def84*=0x40000, lpOverlapped=0x0) returned 1 [0143.630] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def8c*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24def8c*=0x40000) returned 1 [0143.634] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.634] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24def88, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def88*=0x40000, lpOverlapped=0x0) returned 1 [0143.635] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1950f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.635] WriteFile (in: hFile=0x100, lpBuffer=0x24def90*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24def88, lpOverlapped=0x0 | out: lpBuffer=0x24def90*, lpNumberOfBytesWritten=0x24def88*=0x8, lpOverlapped=0x0) returned 1 [0143.635] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x87008, lpNewFilePointer=0x0, dwMoveMethod=0x24def90 | out: lpNewFilePointer=0x0) returned 1 [0143.635] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def84*=0x40000, lpOverlapped=0x0) returned 1 [0143.640] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def8c*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24def8c*=0x40000) returned 1 [0143.642] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x87008, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.642] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24def88, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def88*=0x40000, lpOverlapped=0x0) returned 1 [0143.643] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1950f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.643] WriteFile (in: hFile=0x100, lpBuffer=0x24def90*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24def88, lpOverlapped=0x0 | out: lpBuffer=0x24def90*, lpNumberOfBytesWritten=0x24def88*=0x8, lpOverlapped=0x0) returned 1 [0143.643] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x155020, lpNewFilePointer=0x0, dwMoveMethod=0x24def90 | out: lpNewFilePointer=0x0) returned 1 [0143.643] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def84*=0x40000, lpOverlapped=0x0) returned 1 [0143.649] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def8c*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24def8c*=0x40000) returned 1 [0143.651] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x155020, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.651] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24def88, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def88*=0x40000, lpOverlapped=0x0) returned 1 [0143.652] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1950f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.652] WriteFile (in: hFile=0x100, lpBuffer=0x24def90*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24def88, lpOverlapped=0x0 | out: lpBuffer=0x24def90*, lpNumberOfBytesWritten=0x24def88*=0x8, lpOverlapped=0x0) returned 1 [0143.652] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.652] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1950f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.652] SetEndOfFile (hFile=0x100) returned 1 [0143.655] GetProcessHeap () returned 0x4e0000 [0143.655] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0143.655] GetProcessHeap () returned 0x4e0000 [0143.655] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0143.655] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0143.656] CloseHandle (hObject=0x100) returned 1 [0143.656] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b324b00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b324b00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x195018, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSB1ARFR.ITS", cAlternateFileName="")) returned 0 [0143.656] GetProcessHeap () returned 0x4e0000 [0143.656] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0143.656] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0143.656] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df020 | out: pbData=0x4f53d8, pdwDataLen=0x24df020) returned 1 [0143.656] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.656] GetProcessHeap () returned 0x4e0000 [0143.656] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0143.656] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0143.656] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df020 | out: pbData=0x4f5420, pdwDataLen=0x24df020) returned 1 [0143.656] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.657] GetProcessHeap () returned 0x4e0000 [0143.657] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5273b0 [0143.657] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0143.657] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5273b0, pdwDataLen=0x24df020 | out: pbData=0x5273b0, pdwDataLen=0x24df020) returned 1 [0143.657] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.657] wsprintfW (in: param_1=0x24ddffc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\readme-warning.txt") returned 79 [0143.657] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.657] WriteFile (in: hFile=0x100, lpBuffer=0x5273b0*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddff8, lpOverlapped=0x0 | out: lpBuffer=0x5273b0*, lpNumberOfBytesWritten=0x24ddff8*=0x6c3, lpOverlapped=0x0) returned 1 [0143.658] CloseHandle (hObject=0x100) returned 1 [0143.658] GetProcessHeap () returned 0x4e0000 [0143.658] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273b0 | out: hHeap=0x4e0000) returned 1 [0143.658] GetProcessHeap () returned 0x4e0000 [0143.659] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0143.659] GetProcessHeap () returned 0x4e0000 [0143.659] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0143.659] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0143.659] GetProcessHeap () returned 0x4e0000 [0143.659] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0143.659] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ENES", cAlternateFileName="")) returned 1 [0143.659] GetProcessHeap () returned 0x4e0000 [0143.659] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8a) returned 0x524ea0 [0143.659] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0143.660] GetProcessHeap () returned 0x4e0000 [0143.660] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x524ea0 | out: hHeap=0x4e0000) returned 1 [0143.660] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0143.660] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xeed1e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSB1ENES.ITS", cAlternateFileName="")) returned 1 [0143.660] GetProcessHeap () returned 0x4e0000 [0143.660] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x28c) returned 0x527118 [0143.660] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.661] GetProcessHeap () returned 0x4e0000 [0143.661] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0143.661] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0143.661] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0143.661] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x2, lpOverlapped=0x0) returned 1 [0143.663] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.663] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.663] GetProcessHeap () returned 0x4e0000 [0143.663] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0143.663] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0143.663] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.663] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0143.663] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0143.663] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0143.663] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0143.663] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0143.663] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0143.663] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.663] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.663] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.663] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xeed1e, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xeed1e, lpOverlapped=0x0) returned 1 [0143.673] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xeed20, dwBufLen=0xeed20 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xeed20) returned 1 [0143.681] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.681] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xeed20, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xeed20, lpOverlapped=0x0) returned 1 [0143.684] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.684] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xeedf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.684] SetEndOfFile (hFile=0x100) returned 1 [0143.687] GetProcessHeap () returned 0x4e0000 [0143.687] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0143.687] GetProcessHeap () returned 0x4e0000 [0143.687] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0143.687] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0143.688] CloseHandle (hObject=0x100) returned 1 [0143.688] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xeed1e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSB1ENES.ITS", cAlternateFileName="")) returned 0 [0143.688] GetProcessHeap () returned 0x4e0000 [0143.688] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0143.688] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0143.688] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df020 | out: pbData=0x4f53d8, pdwDataLen=0x24df020) returned 1 [0143.688] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.688] GetProcessHeap () returned 0x4e0000 [0143.688] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0143.688] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0143.688] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df020 | out: pbData=0x4f5420, pdwDataLen=0x24df020) returned 1 [0143.688] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.688] GetProcessHeap () returned 0x4e0000 [0143.688] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5273b0 [0143.688] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0143.688] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5273b0, pdwDataLen=0x24df020 | out: pbData=0x5273b0, pdwDataLen=0x24df020) returned 1 [0143.688] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.689] wsprintfW (in: param_1=0x24ddffc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\readme-warning.txt") returned 79 [0143.689] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.689] WriteFile (in: hFile=0x100, lpBuffer=0x5273b0*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddff8, lpOverlapped=0x0 | out: lpBuffer=0x5273b0*, lpNumberOfBytesWritten=0x24ddff8*=0x6c3, lpOverlapped=0x0) returned 1 [0143.690] CloseHandle (hObject=0x100) returned 1 [0143.690] GetProcessHeap () returned 0x4e0000 [0143.690] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273b0 | out: hHeap=0x4e0000) returned 1 [0143.690] GetProcessHeap () returned 0x4e0000 [0143.690] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0143.690] GetProcessHeap () returned 0x4e0000 [0143.690] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0143.690] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0143.690] GetProcessHeap () returned 0x4e0000 [0143.690] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0143.691] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ENFR", cAlternateFileName="")) returned 1 [0143.691] GetProcessHeap () returned 0x4e0000 [0143.691] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8a) returned 0x524ea0 [0143.691] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0143.691] GetProcessHeap () returned 0x4e0000 [0143.691] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x524ea0 | out: hHeap=0x4e0000) returned 1 [0143.691] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0143.691] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xe64da, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSB1ENFR.ITS", cAlternateFileName="")) returned 1 [0143.691] GetProcessHeap () returned 0x4e0000 [0143.691] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x28c) returned 0x527118 [0143.691] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.691] GetProcessHeap () returned 0x4e0000 [0143.691] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0143.691] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0143.691] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0143.692] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x6, lpOverlapped=0x0) returned 1 [0143.694] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.694] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.694] GetProcessHeap () returned 0x4e0000 [0143.694] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0143.694] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0143.694] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.694] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0143.694] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0143.694] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0143.694] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0143.694] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0143.694] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0143.694] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.694] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.694] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.694] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xe64da, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xe64da, lpOverlapped=0x0) returned 1 [0143.704] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xe64e0, dwBufLen=0xe64e0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xe64e0) returned 1 [0143.712] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.712] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe64e0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xe64e0, lpOverlapped=0x0) returned 1 [0143.715] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.715] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xe65b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.715] SetEndOfFile (hFile=0x100) returned 1 [0143.718] GetProcessHeap () returned 0x4e0000 [0143.718] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0143.718] GetProcessHeap () returned 0x4e0000 [0143.718] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0143.718] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0143.719] CloseHandle (hObject=0x100) returned 1 [0143.719] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xe64da, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSB1ENFR.ITS", cAlternateFileName="")) returned 0 [0143.719] GetProcessHeap () returned 0x4e0000 [0143.719] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0143.719] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0143.719] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df020 | out: pbData=0x4f53d8, pdwDataLen=0x24df020) returned 1 [0143.719] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.719] GetProcessHeap () returned 0x4e0000 [0143.719] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0143.719] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0143.719] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df020 | out: pbData=0x4f5420, pdwDataLen=0x24df020) returned 1 [0143.719] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.719] GetProcessHeap () returned 0x4e0000 [0143.719] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5273b0 [0143.719] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0143.719] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5273b0, pdwDataLen=0x24df020 | out: pbData=0x5273b0, pdwDataLen=0x24df020) returned 1 [0143.719] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.719] wsprintfW (in: param_1=0x24ddffc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\readme-warning.txt") returned 79 [0143.719] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.720] WriteFile (in: hFile=0x100, lpBuffer=0x5273b0*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddff8, lpOverlapped=0x0 | out: lpBuffer=0x5273b0*, lpNumberOfBytesWritten=0x24ddff8*=0x6c3, lpOverlapped=0x0) returned 1 [0143.721] CloseHandle (hObject=0x100) returned 1 [0143.724] GetProcessHeap () returned 0x4e0000 [0143.724] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273b0 | out: hHeap=0x4e0000) returned 1 [0143.724] GetProcessHeap () returned 0x4e0000 [0143.724] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0143.724] GetProcessHeap () returned 0x4e0000 [0143.724] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0143.724] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0143.724] GetProcessHeap () returned 0x4e0000 [0143.724] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0143.724] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ESEN", cAlternateFileName="")) returned 1 [0143.724] GetProcessHeap () returned 0x4e0000 [0143.724] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8a) returned 0x524ea0 [0143.724] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0143.724] GetProcessHeap () returned 0x4e0000 [0143.724] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x524ea0 | out: hHeap=0x4e0000) returned 1 [0143.724] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0143.724] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9890c900, ftCreationTime.dwHighDateTime=0x1c82168, ftLastAccessTime.dwLowDateTime=0x54a7f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9890c900, ftLastWriteTime.dwHighDateTime=0x1c82168, nFileSizeHigh=0x0, nFileSizeLow=0x38200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSB1ESEN.DLL", cAlternateFileName="")) returned 1 [0143.724] GetProcessHeap () returned 0x4e0000 [0143.724] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x28c) returned 0x527118 [0143.725] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22595900, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22595900, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xff7f2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSB1ESEN.ITS", cAlternateFileName="")) returned 1 [0143.725] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.725] GetProcessHeap () returned 0x4e0000 [0143.725] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0143.725] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0143.725] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0143.725] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xe, lpOverlapped=0x0) returned 1 [0143.727] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.727] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.727] GetProcessHeap () returned 0x4e0000 [0143.727] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0143.727] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0143.727] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.727] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0143.727] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0143.727] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0143.727] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0143.727] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0143.727] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0143.727] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.727] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.727] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.728] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xff7f2, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xff7f2, lpOverlapped=0x0) returned 1 [0143.738] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xff800, dwBufLen=0xff800 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xff800) returned 1 [0143.747] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.747] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xff800, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xff800, lpOverlapped=0x0) returned 1 [0143.750] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.750] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xff8d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.750] SetEndOfFile (hFile=0x100) returned 1 [0143.753] GetProcessHeap () returned 0x4e0000 [0143.753] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0143.753] GetProcessHeap () returned 0x4e0000 [0143.753] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0143.753] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0143.754] CloseHandle (hObject=0x100) returned 1 [0143.754] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8c79400, ftCreationTime.dwHighDateTime=0x1be6f42, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8c79400, ftLastWriteTime.dwHighDateTime=0x1be6f42, nFileSizeHigh=0x0, nFileSizeLow=0xa5c00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WT61ES.LEX", cAlternateFileName="")) returned 1 [0143.754] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.755] GetProcessHeap () returned 0x4e0000 [0143.755] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0143.755] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0143.755] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0143.755] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.755] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.755] GetProcessHeap () returned 0x4e0000 [0143.755] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0143.755] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30) returned 1 [0143.755] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.755] WriteFile (in: hFile=0x100, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24defc8*=0x30, lpOverlapped=0x0) returned 1 [0143.757] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0143.757] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0143.757] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0143.757] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0143.757] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0143.757] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.757] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.757] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.757] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xa5c00, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xa5c00, lpOverlapped=0x0) returned 1 [0143.765] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xa5c00, dwBufLen=0xa5c00 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xa5c00) returned 1 [0143.770] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.770] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xa5c00, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xa5c00, lpOverlapped=0x0) returned 1 [0143.772] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.772] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xa5cc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.772] SetEndOfFile (hFile=0x100) returned 1 [0143.775] GetProcessHeap () returned 0x4e0000 [0143.775] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0143.775] GetProcessHeap () returned 0x4e0000 [0143.775] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0143.775] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0143.778] CloseHandle (hObject=0x100) returned 1 [0143.778] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8c79400, ftCreationTime.dwHighDateTime=0x1be6f42, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8c79400, ftLastWriteTime.dwHighDateTime=0x1be6f42, nFileSizeHigh=0x0, nFileSizeLow=0xa5c00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WT61ES.LEX", cAlternateFileName="")) returned 0 [0143.778] GetProcessHeap () returned 0x4e0000 [0143.778] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0143.778] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0143.778] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df020 | out: pbData=0x4f53d8, pdwDataLen=0x24df020) returned 1 [0143.778] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.778] GetProcessHeap () returned 0x4e0000 [0143.778] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0143.779] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0143.779] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df020 | out: pbData=0x4f5420, pdwDataLen=0x24df020) returned 1 [0143.779] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.779] GetProcessHeap () returned 0x4e0000 [0143.779] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5273b0 [0143.779] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0143.779] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5273b0, pdwDataLen=0x24df020 | out: pbData=0x5273b0, pdwDataLen=0x24df020) returned 1 [0143.779] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.779] wsprintfW (in: param_1=0x24ddffc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\readme-warning.txt") returned 79 [0143.779] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.780] WriteFile (in: hFile=0x100, lpBuffer=0x5273b0*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddff8, lpOverlapped=0x0 | out: lpBuffer=0x5273b0*, lpNumberOfBytesWritten=0x24ddff8*=0x6c3, lpOverlapped=0x0) returned 1 [0143.781] CloseHandle (hObject=0x100) returned 1 [0143.781] GetProcessHeap () returned 0x4e0000 [0143.781] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273b0 | out: hHeap=0x4e0000) returned 1 [0143.781] GetProcessHeap () returned 0x4e0000 [0143.781] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0143.781] GetProcessHeap () returned 0x4e0000 [0143.781] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0143.781] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0143.781] GetProcessHeap () returned 0x4e0000 [0143.781] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0143.782] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FRAR", cAlternateFileName="")) returned 1 [0143.782] GetProcessHeap () returned 0x4e0000 [0143.782] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8a) returned 0x524ea0 [0143.782] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0143.782] GetProcessHeap () returned 0x4e0000 [0143.782] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x524ea0 | out: hHeap=0x4e0000) returned 1 [0143.782] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0143.782] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21282c00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7588f30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21282c00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x166bae, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSB1FRAR.ITS", cAlternateFileName="")) returned 1 [0143.783] GetProcessHeap () returned 0x4e0000 [0143.783] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x28c) returned 0x527118 [0143.783] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\msb1frar.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.783] GetProcessHeap () returned 0x4e0000 [0143.783] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0143.783] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0143.783] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0143.783] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x2, lpOverlapped=0x0) returned 1 [0143.784] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.784] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.784] GetProcessHeap () returned 0x4e0000 [0143.785] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0143.785] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0143.785] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.785] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0143.785] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0143.785] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0143.785] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0143.785] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0143.786] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0143.786] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.786] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.786] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.786] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x100000, lpOverlapped=0x0) returned 1 [0143.804] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x100000, dwBufLen=0x100000 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x100000) returned 1 [0143.818] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.818] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x100000, lpOverlapped=0x0) returned 1 [0143.821] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x166c84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.821] WriteFile (in: hFile=0x100, lpBuffer=0x24def90*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x24def90*, lpNumberOfBytesWritten=0x24def84*=0x8, lpOverlapped=0x0) returned 1 [0143.821] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.822] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x66bae, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x66bae, lpOverlapped=0x0) returned 1 [0143.833] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x66bb0, dwBufLen=0x66bb0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x66bb0) returned 1 [0143.838] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.838] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x66bb0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x66bb0, lpOverlapped=0x0) returned 1 [0143.840] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.840] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x166c84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.840] SetEndOfFile (hFile=0x100) returned 1 [0143.844] GetProcessHeap () returned 0x4e0000 [0143.844] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0143.844] GetProcessHeap () returned 0x4e0000 [0143.844] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0143.844] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\msb1frar.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\msb1frar.its.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0143.845] CloseHandle (hObject=0x100) returned 1 [0143.845] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21282c00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7588f30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21282c00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x166bae, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSB1FRAR.ITS", cAlternateFileName="")) returned 0 [0143.845] GetProcessHeap () returned 0x4e0000 [0143.846] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0143.846] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0143.846] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df020 | out: pbData=0x4f53d8, pdwDataLen=0x24df020) returned 1 [0143.846] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.846] GetProcessHeap () returned 0x4e0000 [0143.846] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0143.846] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0143.846] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df020 | out: pbData=0x4f5420, pdwDataLen=0x24df020) returned 1 [0143.846] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.846] GetProcessHeap () returned 0x4e0000 [0143.846] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5273b0 [0143.846] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0143.846] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5273b0, pdwDataLen=0x24df020 | out: pbData=0x5273b0, pdwDataLen=0x24df020) returned 1 [0143.846] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.846] wsprintfW (in: param_1=0x24ddffc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\readme-warning.txt") returned 79 [0143.846] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.847] WriteFile (in: hFile=0x100, lpBuffer=0x5273b0*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddff8, lpOverlapped=0x0 | out: lpBuffer=0x5273b0*, lpNumberOfBytesWritten=0x24ddff8*=0x6c3, lpOverlapped=0x0) returned 1 [0143.848] CloseHandle (hObject=0x100) returned 1 [0143.849] GetProcessHeap () returned 0x4e0000 [0143.849] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273b0 | out: hHeap=0x4e0000) returned 1 [0143.849] GetProcessHeap () returned 0x4e0000 [0143.849] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0143.849] GetProcessHeap () returned 0x4e0000 [0143.849] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0143.849] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0143.849] GetProcessHeap () returned 0x4e0000 [0143.849] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0143.849] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FREN", cAlternateFileName="")) returned 1 [0143.849] GetProcessHeap () returned 0x4e0000 [0143.849] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8a) returned 0x524ea0 [0143.849] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0143.850] GetProcessHeap () returned 0x4e0000 [0143.850] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x524ea0 | out: hHeap=0x4e0000) returned 1 [0143.850] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0143.851] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb22e200, ftCreationTime.dwHighDateTime=0x1c82168, ftLastAccessTime.dwLowDateTime=0x753cc70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb22e200, ftLastWriteTime.dwHighDateTime=0x1c82168, nFileSizeHigh=0x0, nFileSizeLow=0x38200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSB1FREN.DLL", cAlternateFileName="")) returned 1 [0143.851] GetProcessHeap () returned 0x4e0000 [0143.851] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x28c) returned 0x527118 [0143.851] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x238a8600, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x753cc70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x238a8600, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xcd2ac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSB1FREN.ITS", cAlternateFileName="")) returned 1 [0143.851] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.851] GetProcessHeap () returned 0x4e0000 [0143.851] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0143.851] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0143.851] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0143.851] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0143.853] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.853] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.853] GetProcessHeap () returned 0x4e0000 [0143.853] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0143.854] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0143.854] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.854] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0143.854] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0143.854] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0143.854] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0143.854] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0143.854] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0143.854] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.854] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.854] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.854] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xcd2ac, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xcd2ac, lpOverlapped=0x0) returned 1 [0143.866] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xcd2b0, dwBufLen=0xcd2b0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xcd2b0) returned 1 [0143.876] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.876] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xcd2b0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xcd2b0, lpOverlapped=0x0) returned 1 [0143.879] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.879] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xcd384, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.879] SetEndOfFile (hFile=0x100) returned 1 [0143.882] GetProcessHeap () returned 0x4e0000 [0143.882] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0143.882] GetProcessHeap () returned 0x4e0000 [0143.882] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0143.883] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.its.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0143.884] CloseHandle (hObject=0x100) returned 1 [0143.884] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d99e900, ftCreationTime.dwHighDateTime=0x1be6f08, ftLastAccessTime.dwLowDateTime=0x79672f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d99e900, ftLastWriteTime.dwHighDateTime=0x1be6f08, nFileSizeHigh=0x0, nFileSizeLow=0x96a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WT61FR.LEX", cAlternateFileName="")) returned 1 [0143.884] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\wt61fr.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.885] GetProcessHeap () returned 0x4e0000 [0143.885] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0143.885] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0143.885] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0143.885] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.885] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.886] GetProcessHeap () returned 0x4e0000 [0143.886] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0143.886] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30) returned 1 [0143.886] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.886] WriteFile (in: hFile=0x100, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24defc8*=0x30, lpOverlapped=0x0) returned 1 [0143.888] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0143.888] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0143.888] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0143.888] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0143.888] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0143.888] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0143.888] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.888] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.889] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x96a00, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x96a00, lpOverlapped=0x0) returned 1 [0143.896] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x96a00, dwBufLen=0x96a00 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x96a00) returned 1 [0143.901] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.901] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x96a00, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x96a00, lpOverlapped=0x0) returned 1 [0143.903] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.903] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x96ac4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.903] SetEndOfFile (hFile=0x100) returned 1 [0143.906] GetProcessHeap () returned 0x4e0000 [0143.906] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0143.906] GetProcessHeap () returned 0x4e0000 [0143.906] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0143.906] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\wt61fr.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\wt61fr.lex.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0143.909] CloseHandle (hObject=0x100) returned 1 [0143.909] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d99e900, ftCreationTime.dwHighDateTime=0x1be6f08, ftLastAccessTime.dwLowDateTime=0x79672f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d99e900, ftLastWriteTime.dwHighDateTime=0x1be6f08, nFileSizeHigh=0x0, nFileSizeLow=0x96a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WT61FR.LEX", cAlternateFileName="")) returned 0 [0143.909] GetProcessHeap () returned 0x4e0000 [0143.909] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0143.909] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0143.909] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df020 | out: pbData=0x4f53d8, pdwDataLen=0x24df020) returned 1 [0143.909] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.909] GetProcessHeap () returned 0x4e0000 [0143.909] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0143.909] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0143.909] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df020 | out: pbData=0x4f5420, pdwDataLen=0x24df020) returned 1 [0143.909] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.909] GetProcessHeap () returned 0x4e0000 [0143.909] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5273b0 [0143.909] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0143.909] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5273b0, pdwDataLen=0x24df020 | out: pbData=0x5273b0, pdwDataLen=0x24df020) returned 1 [0143.909] CryptDestroyKey (hKey=0x522fd8) returned 1 [0143.909] wsprintfW (in: param_1=0x24ddffc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\readme-warning.txt") returned 79 [0143.909] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0143.910] WriteFile (in: hFile=0x100, lpBuffer=0x5273b0*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddff8, lpOverlapped=0x0 | out: lpBuffer=0x5273b0*, lpNumberOfBytesWritten=0x24ddff8*=0x6c3, lpOverlapped=0x0) returned 1 [0143.911] CloseHandle (hObject=0x100) returned 1 [0143.911] GetProcessHeap () returned 0x4e0000 [0143.911] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273b0 | out: hHeap=0x4e0000) returned 1 [0143.911] GetProcessHeap () returned 0x4e0000 [0143.911] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0143.911] GetProcessHeap () returned 0x4e0000 [0143.911] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0143.911] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0143.911] GetProcessHeap () returned 0x4e0000 [0143.911] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0143.911] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd541900, ftCreationTime.dwHighDateTime=0x1c911ec, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd541900, ftLastWriteTime.dwHighDateTime=0x1c911ec, nFileSizeHigh=0x0, nFileSizeLow=0x205b0b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSB1AR.LEX", cAlternateFileName="")) returned 1 [0143.912] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0143.912] GetFileSizeEx (in: hFile=0xdc, lpFileSize=0x24df260 | out: lpFileSize=0x24df260*=2120459) returned 1 [0143.912] GetProcessHeap () returned 0x4e0000 [0143.912] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0143.912] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0143.912] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.912] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24df24c, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df24c*=0x5, lpOverlapped=0x0) returned 1 [0143.914] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df250 | out: phKey=0x24df250*=0x522f98) returned 1 [0143.914] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.914] GetProcessHeap () returned 0x4e0000 [0143.914] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0143.914] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df230*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df230*=0x30) returned 1 [0143.914] CryptDestroyKey (hKey=0x522f98) returned 1 [0143.914] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df24c, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df24c*=0x30, lpOverlapped=0x0) returned 1 [0143.914] WriteFile (in: hFile=0xdc, lpBuffer=0x24df254*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df24c, lpOverlapped=0x0 | out: lpBuffer=0x24df254*, lpNumberOfBytesWritten=0x24df24c*=0x4, lpOverlapped=0x0) returned 1 [0143.914] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df24c, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df24c*=0x10, lpOverlapped=0x0) returned 1 [0143.914] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df24c, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df24c*=0x80, lpOverlapped=0x0) returned 1 [0143.914] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df278 | out: lpNewFilePointer=0x0) returned 1 [0143.914] WriteFile (in: hFile=0xdc, lpBuffer=0x24df268*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df24c, lpOverlapped=0x0 | out: lpBuffer=0x24df268*, lpNumberOfBytesWritten=0x24df24c*=0x8, lpOverlapped=0x0) returned 1 [0143.914] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df250 | out: phKey=0x24df250*=0x522f98) returned 1 [0143.914] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.915] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df220 | out: lpNewFilePointer=0x0) returned 1 [0143.915] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df214*=0x40000, lpOverlapped=0x0) returned 1 [0143.919] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df21c*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df21c*=0x40000) returned 1 [0143.923] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.923] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df218, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df218*=0x40000, lpOverlapped=0x0) returned 1 [0143.924] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x205bd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.924] WriteFile (in: hFile=0xdc, lpBuffer=0x24df220*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df218, lpOverlapped=0x0 | out: lpBuffer=0x24df220*, lpNumberOfBytesWritten=0x24df218*=0x8, lpOverlapped=0x0) returned 1 [0143.924] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xac903, lpNewFilePointer=0x0, dwMoveMethod=0x24df220 | out: lpNewFilePointer=0x0) returned 1 [0143.924] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df214*=0x40000, lpOverlapped=0x0) returned 1 [0143.928] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df21c*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df21c*=0x40000) returned 1 [0143.930] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xac903, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.930] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df218, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df218*=0x40000, lpOverlapped=0x0) returned 1 [0143.931] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x205bd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.931] WriteFile (in: hFile=0xdc, lpBuffer=0x24df220*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df218, lpOverlapped=0x0 | out: lpBuffer=0x24df220*, lpNumberOfBytesWritten=0x24df218*=0x8, lpOverlapped=0x0) returned 1 [0143.931] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1c5b10, lpNewFilePointer=0x0, dwMoveMethod=0x24df220 | out: lpNewFilePointer=0x0) returned 1 [0143.931] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df214*=0x40000, lpOverlapped=0x0) returned 1 [0143.935] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df21c*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df21c*=0x40000) returned 1 [0143.937] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1c5b10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.937] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df218, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df218*=0x40000, lpOverlapped=0x0) returned 1 [0143.938] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x205bd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.938] WriteFile (in: hFile=0xdc, lpBuffer=0x24df220*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df218, lpOverlapped=0x0 | out: lpBuffer=0x24df220*, lpNumberOfBytesWritten=0x24df218*=0x8, lpOverlapped=0x0) returned 1 [0143.938] CryptDestroyKey (hKey=0x522f98) returned 1 [0143.938] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x205bd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.938] SetEndOfFile (hFile=0xdc) returned 1 [0143.940] GetProcessHeap () returned 0x4e0000 [0143.940] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0143.940] GetProcessHeap () returned 0x4e0000 [0143.940] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0143.940] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0143.941] CloseHandle (hObject=0xdc) returned 1 [0143.941] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7780a100, ftCreationTime.dwHighDateTime=0x1c4d75f, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7780a100, ftLastWriteTime.dwHighDateTime=0x1c4d75f, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSB1CACH.LEX", cAlternateFileName="")) returned 1 [0143.942] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0143.942] GetProcessHeap () returned 0x4e0000 [0143.942] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0143.942] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0143.942] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0143.942] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0143.942] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.942] GetProcessHeap () returned 0x4e0000 [0143.942] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0143.942] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0143.942] CryptDestroyKey (hKey=0x522f98) returned 1 [0143.942] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0143.944] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0143.944] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0143.944] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0143.944] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0143.944] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0143.945] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0143.945] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.945] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.945] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x600, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x600, lpOverlapped=0x0) returned 1 [0143.945] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x600, dwBufLen=0x600 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x600) returned 1 [0143.945] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.945] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x600, lpOverlapped=0x0) returned 1 [0143.945] CryptDestroyKey (hKey=0x522f98) returned 1 [0143.945] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.945] SetEndOfFile (hFile=0xdc) returned 1 [0143.947] GetProcessHeap () returned 0x4e0000 [0143.947] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0143.947] GetProcessHeap () returned 0x4e0000 [0143.947] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0143.947] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0143.948] CloseHandle (hObject=0xdc) returned 1 [0143.948] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5c6bc00, ftCreationTime.dwHighDateTime=0x1ca9121, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5c6bc00, ftLastWriteTime.dwHighDateTime=0x1ca9121, nFileSizeHigh=0x0, nFileSizeLow=0x2b990, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSB1CORE.DLL", cAlternateFileName="")) returned 1 [0143.948] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38c6e400, ftCreationTime.dwHighDateTime=0x1ca6d6a, ftLastAccessTime.dwLowDateTime=0x7588f30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x38c6e400, ftLastWriteTime.dwHighDateTime=0x1ca6d6a, nFileSizeHigh=0x0, nFileSizeLow=0x40f70, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSB1STAR.DLL", cAlternateFileName="")) returned 1 [0143.948] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4958f00, ftCreationTime.dwHighDateTime=0x1ca9121, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4958f00, ftLastWriteTime.dwHighDateTime=0x1ca9121, nFileSizeHigh=0x0, nFileSizeLow=0x11390, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSB1XTOR.DLL", cAlternateFileName="")) returned 1 [0143.948] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44a7300, ftCreationTime.dwHighDateTime=0x1c3af23, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb44a7300, ftLastWriteTime.dwHighDateTime=0x1c3af23, nFileSizeHigh=0x0, nFileSizeLow=0x36000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WTSP61MS.DLL", cAlternateFileName="")) returned 1 [0143.949] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44a7300, ftCreationTime.dwHighDateTime=0x1c3af23, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb44a7300, ftLastWriteTime.dwHighDateTime=0x1c3af23, nFileSizeHigh=0x0, nFileSizeLow=0x36000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WTSP61MS.DLL", cAlternateFileName="")) returned 0 [0143.949] GetProcessHeap () returned 0x4e0000 [0143.949] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0143.949] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df248, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f98) returned 1 [0143.949] CryptDecrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df2b0 | out: pbData=0x4f53d8, pdwDataLen=0x24df2b0) returned 1 [0143.949] CryptDestroyKey (hKey=0x522f98) returned 1 [0143.949] GetProcessHeap () returned 0x4e0000 [0143.949] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0143.949] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df248, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f98) returned 1 [0143.949] CryptDecrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df2b0 | out: pbData=0x4f5420, pdwDataLen=0x24df2b0) returned 1 [0143.949] CryptDestroyKey (hKey=0x522f98) returned 1 [0143.949] GetProcessHeap () returned 0x4e0000 [0143.949] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x527118 [0143.949] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df248, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f98) returned 1 [0143.949] CryptDecrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x527118, pdwDataLen=0x24df2b0 | out: pbData=0x527118, pdwDataLen=0x24df2b0) returned 1 [0143.949] CryptDestroyKey (hKey=0x522f98) returned 1 [0143.949] wsprintfW (in: param_1=0x24de28c, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\readme-warning.txt") returned 74 [0143.949] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0143.950] WriteFile (in: hFile=0xdc, lpBuffer=0x527118*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24de288, lpOverlapped=0x0 | out: lpBuffer=0x527118*, lpNumberOfBytesWritten=0x24de288*=0x6c3, lpOverlapped=0x0) returned 1 [0143.951] CloseHandle (hObject=0xdc) returned 1 [0143.951] GetProcessHeap () returned 0x4e0000 [0143.951] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0143.951] GetProcessHeap () returned 0x4e0000 [0143.951] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0143.952] GetProcessHeap () returned 0x4e0000 [0143.952] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0143.952] FindClose (in: hFindFile=0x522f58 | out: hFindFile=0x522f58) returned 1 [0143.952] GetProcessHeap () returned 0x4e0000 [0143.952] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x526e88 | out: hHeap=0x4e0000) returned 1 [0143.952] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Triedit", cAlternateFileName="")) returned 1 [0143.952] GetProcessHeap () returned 0x4e0000 [0143.952] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x7e) returned 0x4fa058 [0143.952] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\*.*", lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f58 [0143.952] GetProcessHeap () returned 0x4e0000 [0143.952] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0143.952] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0143.952] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-US", cAlternateFileName="")) returned 1 [0143.952] GetProcessHeap () returned 0x4e0000 [0143.952] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x280) returned 0x526e88 [0143.952] GetProcessHeap () returned 0x4e0000 [0143.952] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8a) returned 0x524ea0 [0143.952] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0143.953] GetProcessHeap () returned 0x4e0000 [0143.953] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x524ea0 | out: hHeap=0x4e0000) returned 1 [0143.953] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0143.953] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0 [0143.953] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0143.954] GetProcessHeap () returned 0x4e0000 [0143.954] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4e0000) returned 1 [0143.954] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-US", cAlternateFileName="")) returned 0 [0143.954] FindClose (in: hFindFile=0x522f58 | out: hFindFile=0x522f58) returned 1 [0143.954] GetProcessHeap () returned 0x4e0000 [0143.954] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x526e88 | out: hHeap=0x4e0000) returned 1 [0143.954] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VBA", cAlternateFileName="")) returned 1 [0143.954] GetProcessHeap () returned 0x4e0000 [0143.954] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x76) returned 0x4f1b18 [0143.954] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\*.*", lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f58 [0143.955] GetProcessHeap () returned 0x4e0000 [0143.955] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1b18 | out: hHeap=0x4e0000) returned 1 [0143.955] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0143.955] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VBA7", cAlternateFileName="")) returned 1 [0143.955] GetProcessHeap () returned 0x4e0000 [0143.955] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x278) returned 0x526e88 [0143.955] GetProcessHeap () returned 0x4e0000 [0143.955] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x80) returned 0x4fa058 [0143.955] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0143.955] GetProcessHeap () returned 0x4e0000 [0143.955] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0143.955] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0143.955] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 1 [0143.955] GetProcessHeap () returned 0x4e0000 [0143.955] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x282) returned 0x527108 [0143.955] GetProcessHeap () returned 0x4e0000 [0143.956] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8a) returned 0x524ea0 [0143.956] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\*.*", lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522fd8 [0143.957] GetProcessHeap () returned 0x4e0000 [0143.957] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x524ea0 | out: hHeap=0x4e0000) returned 1 [0143.957] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0143.957] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1574f00, ftCreationTime.dwHighDateTime=0x1be23e3, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1574f00, ftLastWriteTime.dwHighDateTime=0x1be23e3, nFileSizeHigh=0x0, nFileSizeLow=0x51a5b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FM20.CHM", cAlternateFileName="")) returned 1 [0143.957] GetProcessHeap () returned 0x4e0000 [0143.957] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x28c) returned 0x527398 [0143.957] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0143.958] GetProcessHeap () returned 0x4e0000 [0143.958] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0143.958] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0143.958] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded50 | out: lpNewFilePointer=0x0) returned 1 [0143.958] WriteFile (in: hFile=0x104, lpBuffer=0x24ded60*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded60*, lpNumberOfBytesWritten=0x24ded38*=0x5, lpOverlapped=0x0) returned 1 [0143.960] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0143.960] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.960] GetProcessHeap () returned 0x4e0000 [0143.960] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0143.960] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24ded18*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24ded18*=0x30) returned 1 [0143.960] CryptDestroyKey (hKey=0x523018) returned 1 [0143.960] WriteFile (in: hFile=0x104, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24ded38*=0x30, lpOverlapped=0x0) returned 1 [0143.960] WriteFile (in: hFile=0x104, lpBuffer=0x24ded40*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded40*, lpNumberOfBytesWritten=0x24ded38*=0x4, lpOverlapped=0x0) returned 1 [0143.960] WriteFile (in: hFile=0x104, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24ded38*=0x10, lpOverlapped=0x0) returned 1 [0143.960] WriteFile (in: hFile=0x104, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24ded38*=0x80, lpOverlapped=0x0) returned 1 [0143.960] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded48 | out: lpNewFilePointer=0x0) returned 1 [0143.960] WriteFile (in: hFile=0x104, lpBuffer=0x24ded58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded58*, lpNumberOfBytesWritten=0x24ded38*=0x8, lpOverlapped=0x0) returned 1 [0143.960] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0143.960] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.960] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.960] ReadFile (in: hFile=0x104, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x51a5b, lpNumberOfBytesRead=0x24decf0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24decf0*=0x51a5b, lpOverlapped=0x0) returned 1 [0143.966] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x51a60, dwBufLen=0x51a60 | out: pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x51a60) returned 1 [0143.968] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.969] WriteFile (in: hFile=0x104, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x51a60, lpNumberOfBytesWritten=0x24decf4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24decf4*=0x51a60, lpOverlapped=0x0) returned 1 [0143.969] CryptDestroyKey (hKey=0x523018) returned 1 [0143.970] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x51b24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.970] SetEndOfFile (hFile=0x104) returned 1 [0143.972] GetProcessHeap () returned 0x4e0000 [0143.972] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0143.972] GetProcessHeap () returned 0x4e0000 [0143.972] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0143.972] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0143.973] CloseHandle (hObject=0x104) returned 1 [0143.973] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6edd8500, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6edd8500, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x1ac96, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VBCN6.CHM", cAlternateFileName="")) returned 1 [0143.974] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0143.974] GetProcessHeap () returned 0x4e0000 [0143.974] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0143.974] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0143.974] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded50 | out: lpNewFilePointer=0x0) returned 1 [0143.974] WriteFile (in: hFile=0x104, lpBuffer=0x24ded60*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded60*, lpNumberOfBytesWritten=0x24ded38*=0xa, lpOverlapped=0x0) returned 1 [0143.976] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0143.976] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.976] GetProcessHeap () returned 0x4e0000 [0143.976] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0143.976] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24ded18*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24ded18*=0x30) returned 1 [0143.976] CryptDestroyKey (hKey=0x523018) returned 1 [0143.976] WriteFile (in: hFile=0x104, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24ded38*=0x30, lpOverlapped=0x0) returned 1 [0143.976] WriteFile (in: hFile=0x104, lpBuffer=0x24ded40*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded40*, lpNumberOfBytesWritten=0x24ded38*=0x4, lpOverlapped=0x0) returned 1 [0143.976] WriteFile (in: hFile=0x104, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24ded38*=0x10, lpOverlapped=0x0) returned 1 [0143.976] WriteFile (in: hFile=0x104, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24ded38*=0x80, lpOverlapped=0x0) returned 1 [0143.976] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded48 | out: lpNewFilePointer=0x0) returned 1 [0143.976] WriteFile (in: hFile=0x104, lpBuffer=0x24ded58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded58*, lpNumberOfBytesWritten=0x24ded38*=0x8, lpOverlapped=0x0) returned 1 [0143.976] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0143.977] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.977] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.977] ReadFile (in: hFile=0x104, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1ac96, lpNumberOfBytesRead=0x24decf0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24decf0*=0x1ac96, lpOverlapped=0x0) returned 1 [0143.979] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x1aca0, dwBufLen=0x1aca0 | out: pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x1aca0) returned 1 [0143.980] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.980] WriteFile (in: hFile=0x104, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1aca0, lpNumberOfBytesWritten=0x24decf4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24decf4*=0x1aca0, lpOverlapped=0x0) returned 1 [0143.980] CryptDestroyKey (hKey=0x523018) returned 1 [0143.980] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x1ad64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.980] SetEndOfFile (hFile=0x104) returned 1 [0143.983] GetProcessHeap () returned 0x4e0000 [0143.983] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0143.983] GetProcessHeap () returned 0x4e0000 [0143.983] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0143.983] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0143.984] CloseHandle (hObject=0x104) returned 1 [0143.984] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f2be900, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5f2be900, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x25d50, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VBE7INTL.DLL", cAlternateFileName="")) returned 1 [0143.984] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d2ba100, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7d2ba100, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x1195f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VBENDF98.CHM", cAlternateFileName="")) returned 1 [0143.984] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0143.985] GetProcessHeap () returned 0x4e0000 [0143.985] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0143.985] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0143.985] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded50 | out: lpNewFilePointer=0x0) returned 1 [0143.985] WriteFile (in: hFile=0x104, lpBuffer=0x24ded60*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded60*, lpNumberOfBytesWritten=0x24ded38*=0x1, lpOverlapped=0x0) returned 1 [0143.987] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0143.987] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.987] GetProcessHeap () returned 0x4e0000 [0143.987] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0143.987] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24ded18*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24ded18*=0x40) returned 1 [0143.987] CryptDestroyKey (hKey=0x523018) returned 1 [0143.987] WriteFile (in: hFile=0x104, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24ded38*=0x40, lpOverlapped=0x0) returned 1 [0143.987] WriteFile (in: hFile=0x104, lpBuffer=0x24ded40*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded40*, lpNumberOfBytesWritten=0x24ded38*=0x4, lpOverlapped=0x0) returned 1 [0143.987] WriteFile (in: hFile=0x104, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24ded38*=0x10, lpOverlapped=0x0) returned 1 [0143.988] WriteFile (in: hFile=0x104, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24ded38*=0x80, lpOverlapped=0x0) returned 1 [0143.988] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded48 | out: lpNewFilePointer=0x0) returned 1 [0143.988] WriteFile (in: hFile=0x104, lpBuffer=0x24ded58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded58*, lpNumberOfBytesWritten=0x24ded38*=0x8, lpOverlapped=0x0) returned 1 [0143.988] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0143.988] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.988] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.988] ReadFile (in: hFile=0x104, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1195f, lpNumberOfBytesRead=0x24decf0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24decf0*=0x1195f, lpOverlapped=0x0) returned 1 [0143.989] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x11960, dwBufLen=0x11960 | out: pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x11960) returned 1 [0143.990] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.990] WriteFile (in: hFile=0x104, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x11960, lpNumberOfBytesWritten=0x24decf4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24decf4*=0x11960, lpOverlapped=0x0) returned 1 [0143.990] CryptDestroyKey (hKey=0x523018) returned 1 [0143.990] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x11a34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.990] SetEndOfFile (hFile=0x104) returned 1 [0143.993] GetProcessHeap () returned 0x4e0000 [0143.993] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0143.993] GetProcessHeap () returned 0x4e0000 [0143.993] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0143.993] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0143.994] CloseHandle (hObject=0x104) returned 1 [0143.994] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8583dc00, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8583dc00, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0xe2aa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VBHW6.CHM", cAlternateFileName="")) returned 1 [0143.994] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0143.995] GetProcessHeap () returned 0x4e0000 [0143.995] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0143.995] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0143.995] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded50 | out: lpNewFilePointer=0x0) returned 1 [0143.995] WriteFile (in: hFile=0x104, lpBuffer=0x24ded60*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded60*, lpNumberOfBytesWritten=0x24ded38*=0x6, lpOverlapped=0x0) returned 1 [0143.997] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0143.997] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.997] GetProcessHeap () returned 0x4e0000 [0143.997] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0143.997] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24ded18*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24ded18*=0x30) returned 1 [0143.997] CryptDestroyKey (hKey=0x523018) returned 1 [0143.997] WriteFile (in: hFile=0x104, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24ded38*=0x30, lpOverlapped=0x0) returned 1 [0143.997] WriteFile (in: hFile=0x104, lpBuffer=0x24ded40*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded40*, lpNumberOfBytesWritten=0x24ded38*=0x4, lpOverlapped=0x0) returned 1 [0143.997] WriteFile (in: hFile=0x104, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24ded38*=0x10, lpOverlapped=0x0) returned 1 [0143.997] WriteFile (in: hFile=0x104, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24ded38*=0x80, lpOverlapped=0x0) returned 1 [0143.997] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded48 | out: lpNewFilePointer=0x0) returned 1 [0143.997] WriteFile (in: hFile=0x104, lpBuffer=0x24ded58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded58*, lpNumberOfBytesWritten=0x24ded38*=0x8, lpOverlapped=0x0) returned 1 [0143.997] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0143.997] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0143.998] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.998] ReadFile (in: hFile=0x104, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xe2aa, lpNumberOfBytesRead=0x24decf0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24decf0*=0xe2aa, lpOverlapped=0x0) returned 1 [0143.999] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24decf8*=0xe2b0, dwBufLen=0xe2b0 | out: pbData=0x22d0020*, pdwDataLen=0x24decf8*=0xe2b0) returned 1 [0144.000] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.000] WriteFile (in: hFile=0x104, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe2b0, lpNumberOfBytesWritten=0x24decf4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24decf4*=0xe2b0, lpOverlapped=0x0) returned 1 [0144.000] CryptDestroyKey (hKey=0x523018) returned 1 [0144.000] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xe374, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.000] SetEndOfFile (hFile=0x104) returned 1 [0144.002] GetProcessHeap () returned 0x4e0000 [0144.002] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0144.002] GetProcessHeap () returned 0x4e0000 [0144.002] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0144.002] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0144.003] CloseHandle (hObject=0x104) returned 1 [0144.003] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x903e7100, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x903e7100, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0xe6b62, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VBLR6.CHM", cAlternateFileName="")) returned 1 [0144.003] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0144.004] GetProcessHeap () returned 0x4e0000 [0144.004] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0144.004] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0144.004] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded50 | out: lpNewFilePointer=0x0) returned 1 [0144.004] WriteFile (in: hFile=0x104, lpBuffer=0x24ded60*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded60*, lpNumberOfBytesWritten=0x24ded38*=0xe, lpOverlapped=0x0) returned 1 [0144.006] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0144.006] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.006] GetProcessHeap () returned 0x4e0000 [0144.006] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0144.006] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24ded18*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24ded18*=0x30) returned 1 [0144.006] CryptDestroyKey (hKey=0x523018) returned 1 [0144.006] WriteFile (in: hFile=0x104, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24ded38*=0x30, lpOverlapped=0x0) returned 1 [0144.006] WriteFile (in: hFile=0x104, lpBuffer=0x24ded40*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded40*, lpNumberOfBytesWritten=0x24ded38*=0x4, lpOverlapped=0x0) returned 1 [0144.006] WriteFile (in: hFile=0x104, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24ded38*=0x10, lpOverlapped=0x0) returned 1 [0144.006] WriteFile (in: hFile=0x104, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24ded38*=0x80, lpOverlapped=0x0) returned 1 [0144.006] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded48 | out: lpNewFilePointer=0x0) returned 1 [0144.006] WriteFile (in: hFile=0x104, lpBuffer=0x24ded58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded58*, lpNumberOfBytesWritten=0x24ded38*=0x8, lpOverlapped=0x0) returned 1 [0144.006] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0144.006] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.007] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.007] ReadFile (in: hFile=0x104, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xe6b62, lpNumberOfBytesRead=0x24decf0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24decf0*=0xe6b62, lpOverlapped=0x0) returned 1 [0144.016] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24decf8*=0xe6b70, dwBufLen=0xe6b70 | out: pbData=0x22d0020*, pdwDataLen=0x24decf8*=0xe6b70) returned 1 [0144.024] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.024] WriteFile (in: hFile=0x104, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe6b70, lpNumberOfBytesWritten=0x24decf4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24decf4*=0xe6b70, lpOverlapped=0x0) returned 1 [0144.027] CryptDestroyKey (hKey=0x523018) returned 1 [0144.027] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xe6c34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.027] SetEndOfFile (hFile=0x104) returned 1 [0144.030] GetProcessHeap () returned 0x4e0000 [0144.030] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0144.030] GetProcessHeap () returned 0x4e0000 [0144.030] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0144.030] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0144.031] CloseHandle (hObject=0x104) returned 1 [0144.031] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9896ac00, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x9896ac00, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x1e434, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VBOB6.CHM", cAlternateFileName="")) returned 1 [0144.031] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0144.031] GetProcessHeap () returned 0x4e0000 [0144.031] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0144.031] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0144.032] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded50 | out: lpNewFilePointer=0x0) returned 1 [0144.032] WriteFile (in: hFile=0x104, lpBuffer=0x24ded60*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded60*, lpNumberOfBytesWritten=0x24ded38*=0xc, lpOverlapped=0x0) returned 1 [0144.033] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0144.033] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.033] GetProcessHeap () returned 0x4e0000 [0144.033] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0144.033] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24ded18*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24ded18*=0x30) returned 1 [0144.033] CryptDestroyKey (hKey=0x523018) returned 1 [0144.033] WriteFile (in: hFile=0x104, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24ded38*=0x30, lpOverlapped=0x0) returned 1 [0144.033] WriteFile (in: hFile=0x104, lpBuffer=0x24ded40*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded40*, lpNumberOfBytesWritten=0x24ded38*=0x4, lpOverlapped=0x0) returned 1 [0144.034] WriteFile (in: hFile=0x104, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24ded38*=0x10, lpOverlapped=0x0) returned 1 [0144.034] WriteFile (in: hFile=0x104, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24ded38*=0x80, lpOverlapped=0x0) returned 1 [0144.034] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded48 | out: lpNewFilePointer=0x0) returned 1 [0144.034] WriteFile (in: hFile=0x104, lpBuffer=0x24ded58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded58*, lpNumberOfBytesWritten=0x24ded38*=0x8, lpOverlapped=0x0) returned 1 [0144.034] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0144.034] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.034] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.034] ReadFile (in: hFile=0x104, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1e434, lpNumberOfBytesRead=0x24decf0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24decf0*=0x1e434, lpOverlapped=0x0) returned 1 [0144.037] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x1e440, dwBufLen=0x1e440 | out: pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x1e440) returned 1 [0144.038] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.038] WriteFile (in: hFile=0x104, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1e440, lpNumberOfBytesWritten=0x24decf4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24decf4*=0x1e440, lpOverlapped=0x0) returned 1 [0144.039] CryptDestroyKey (hKey=0x523018) returned 1 [0144.039] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x1e504, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.039] SetEndOfFile (hFile=0x104) returned 1 [0144.042] GetProcessHeap () returned 0x4e0000 [0144.042] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0144.042] GetProcessHeap () returned 0x4e0000 [0144.042] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0144.042] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0144.043] CloseHandle (hObject=0x104) returned 1 [0144.043] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0eee700, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa0eee700, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x65c96, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VBUI6.CHM", cAlternateFileName="")) returned 1 [0144.043] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0144.044] GetProcessHeap () returned 0x4e0000 [0144.044] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0144.044] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0144.045] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded50 | out: lpNewFilePointer=0x0) returned 1 [0144.045] WriteFile (in: hFile=0x104, lpBuffer=0x24ded60*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded60*, lpNumberOfBytesWritten=0x24ded38*=0xa, lpOverlapped=0x0) returned 1 [0144.046] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0144.046] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.046] GetProcessHeap () returned 0x4e0000 [0144.046] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0144.046] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24ded18*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24ded18*=0x30) returned 1 [0144.046] CryptDestroyKey (hKey=0x523018) returned 1 [0144.046] WriteFile (in: hFile=0x104, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24ded38*=0x30, lpOverlapped=0x0) returned 1 [0144.047] WriteFile (in: hFile=0x104, lpBuffer=0x24ded40*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded40*, lpNumberOfBytesWritten=0x24ded38*=0x4, lpOverlapped=0x0) returned 1 [0144.047] WriteFile (in: hFile=0x104, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24ded38*=0x10, lpOverlapped=0x0) returned 1 [0144.047] WriteFile (in: hFile=0x104, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24ded38*=0x80, lpOverlapped=0x0) returned 1 [0144.047] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded48 | out: lpNewFilePointer=0x0) returned 1 [0144.047] WriteFile (in: hFile=0x104, lpBuffer=0x24ded58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded58*, lpNumberOfBytesWritten=0x24ded38*=0x8, lpOverlapped=0x0) returned 1 [0144.047] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0144.047] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.047] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.047] ReadFile (in: hFile=0x104, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x65c96, lpNumberOfBytesRead=0x24decf0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24decf0*=0x65c96, lpOverlapped=0x0) returned 1 [0144.052] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x65ca0, dwBufLen=0x65ca0 | out: pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x65ca0) returned 1 [0144.055] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.055] WriteFile (in: hFile=0x104, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x65ca0, lpNumberOfBytesWritten=0x24decf4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24decf4*=0x65ca0, lpOverlapped=0x0) returned 1 [0144.057] CryptDestroyKey (hKey=0x523018) returned 1 [0144.057] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x65d64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.057] SetEndOfFile (hFile=0x104) returned 1 [0144.059] GetProcessHeap () returned 0x4e0000 [0144.059] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0144.059] GetProcessHeap () returned 0x4e0000 [0144.060] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0144.060] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0144.060] CloseHandle (hObject=0x104) returned 1 [0144.061] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0eee700, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa0eee700, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x65c96, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VBUI6.CHM", cAlternateFileName="")) returned 0 [0144.061] GetProcessHeap () returned 0x4e0000 [0144.061] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0144.061] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0144.061] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24ded90 | out: pbData=0x4f53d8, pdwDataLen=0x24ded90) returned 1 [0144.061] CryptDestroyKey (hKey=0x523018) returned 1 [0144.061] GetProcessHeap () returned 0x4e0000 [0144.061] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0144.061] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0144.061] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24ded90 | out: pbData=0x4f5420, pdwDataLen=0x24ded90) returned 1 [0144.061] CryptDestroyKey (hKey=0x523018) returned 1 [0144.061] GetProcessHeap () returned 0x4e0000 [0144.061] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x527630 [0144.061] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0144.061] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x527630, pdwDataLen=0x24ded90 | out: pbData=0x527630, pdwDataLen=0x24ded90) returned 1 [0144.061] CryptDestroyKey (hKey=0x523018) returned 1 [0144.061] wsprintfW (in: param_1=0x24ddd6c, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\readme-warning.txt") returned 79 [0144.061] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0144.062] WriteFile (in: hFile=0x104, lpBuffer=0x527630*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddd68, lpOverlapped=0x0 | out: lpBuffer=0x527630*, lpNumberOfBytesWritten=0x24ddd68*=0x6c3, lpOverlapped=0x0) returned 1 [0144.063] CloseHandle (hObject=0x104) returned 1 [0144.063] GetProcessHeap () returned 0x4e0000 [0144.063] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527630 | out: hHeap=0x4e0000) returned 1 [0144.063] GetProcessHeap () returned 0x4e0000 [0144.063] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0144.063] GetProcessHeap () returned 0x4e0000 [0144.063] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0144.063] FindClose (in: hFindFile=0x522fd8 | out: hFindFile=0x522fd8) returned 1 [0144.063] GetProcessHeap () returned 0x4e0000 [0144.063] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527398 | out: hHeap=0x4e0000) returned 1 [0144.063] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56d3ae00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xe2340dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56d3ae00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x381748, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VBE7.DLL", cAlternateFileName="")) returned 1 [0144.063] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56d3ae00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xe2340dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56d3ae00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x381748, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VBE7.DLL", cAlternateFileName="")) returned 0 [0144.063] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0144.063] GetProcessHeap () returned 0x4e0000 [0144.063] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527108 | out: hHeap=0x4e0000) returned 1 [0144.063] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VBA7", cAlternateFileName="")) returned 0 [0144.063] FindClose (in: hFindFile=0x522f58 | out: hFindFile=0x522f58) returned 1 [0144.064] GetProcessHeap () returned 0x4e0000 [0144.064] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x526e88 | out: hHeap=0x4e0000) returned 1 [0144.064] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VC", cAlternateFileName="")) returned 1 [0144.064] GetProcessHeap () returned 0x4e0000 [0144.064] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x74) returned 0x4f1b18 [0144.064] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\*.*", lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f58 [0144.065] GetProcessHeap () returned 0x4e0000 [0144.065] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1b18 | out: hHeap=0x4e0000) returned 1 [0144.065] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0144.065] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9ef3e00, ftCreationTime.dwHighDateTime=0x1cbd033, ftLastAccessTime.dwLowDateTime=0xd2618ca0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xc9ef3e00, ftLastWriteTime.dwHighDateTime=0x1cbd033, nFileSizeHigh=0x0, nFileSizeLow=0xf1b50, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msdia100.dll", cAlternateFileName="")) returned 1 [0144.065] GetProcessHeap () returned 0x4e0000 [0144.065] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x276) returned 0x526e88 [0144.065] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c53c00, ftCreationTime.dwHighDateTime=0x1cbfdf3, ftLastAccessTime.dwLowDateTime=0xbd2c6940, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xc1c53c00, ftLastWriteTime.dwHighDateTime=0x1cbfdf3, nFileSizeHigh=0x0, nFileSizeLow=0xd0d50, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msdia90.dll", cAlternateFileName="")) returned 1 [0144.065] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c53c00, ftCreationTime.dwHighDateTime=0x1cbfdf3, ftLastAccessTime.dwLowDateTime=0xbd2c6940, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xc1c53c00, ftLastWriteTime.dwHighDateTime=0x1cbfdf3, nFileSizeHigh=0x0, nFileSizeLow=0xd0d50, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msdia90.dll", cAlternateFileName="")) returned 0 [0144.065] FindClose (in: hFindFile=0x522f58 | out: hFindFile=0x522f58) returned 1 [0144.065] GetProcessHeap () returned 0x4e0000 [0144.065] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x526e88 | out: hHeap=0x4e0000) returned 1 [0144.065] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VGX", cAlternateFileName="")) returned 1 [0144.065] GetProcessHeap () returned 0x4e0000 [0144.065] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x76) returned 0x4f1b18 [0144.065] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\*.*", lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f58 [0144.065] GetProcessHeap () returned 0x4e0000 [0144.066] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1b18 | out: hHeap=0x4e0000) returned 1 [0144.066] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0144.066] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a7ff6, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xee7a7ff6, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x454d7b80, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x10f200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VGX.dll", cAlternateFileName="")) returned 1 [0144.066] GetProcessHeap () returned 0x4e0000 [0144.066] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x278) returned 0x526e88 [0144.066] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a7ff6, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xee7a7ff6, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x454d7b80, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x10f200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VGX.dll", cAlternateFileName="")) returned 0 [0144.066] FindClose (in: hFindFile=0x522f58 | out: hFindFile=0x522f58) returned 1 [0144.066] GetProcessHeap () returned 0x4e0000 [0144.066] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x526e88 | out: hHeap=0x4e0000) returned 1 [0144.066] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Visio Shared", cAlternateFileName="VISIOS~1")) returned 1 [0144.066] GetProcessHeap () returned 0x4e0000 [0144.066] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x88) returned 0x4fa058 [0144.066] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\*.*", lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f58 [0144.066] GetProcessHeap () returned 0x4e0000 [0144.066] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0144.067] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0144.067] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Fonts", cAlternateFileName="")) returned 1 [0144.067] GetProcessHeap () returned 0x4e0000 [0144.067] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x28a) returned 0x526e88 [0144.067] GetProcessHeap () returned 0x4e0000 [0144.067] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x94) returned 0x4fa058 [0144.067] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0144.069] GetProcessHeap () returned 0x4e0000 [0144.069] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0144.069] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0144.069] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x4f2ea, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BIGFONT.SHX", cAlternateFileName="")) returned 1 [0144.069] GetProcessHeap () returned 0x4e0000 [0144.069] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x296) returned 0x527120 [0144.069] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\bigfont.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0144.069] GetProcessHeap () returned 0x4e0000 [0144.069] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0144.069] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0144.069] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0144.069] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x6, lpOverlapped=0x0) returned 1 [0144.071] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0144.071] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.071] GetProcessHeap () returned 0x4e0000 [0144.071] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0144.071] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0144.071] CryptDestroyKey (hKey=0x522fd8) returned 1 [0144.071] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0144.071] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0144.071] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0144.071] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0144.072] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0144.072] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0144.072] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0144.072] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.072] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.072] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4f2ea, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x4f2ea, lpOverlapped=0x0) returned 1 [0144.076] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x4f2f0, dwBufLen=0x4f2f0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x4f2f0) returned 1 [0144.079] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.079] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4f2f0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x4f2f0, lpOverlapped=0x0) returned 1 [0144.079] CryptDestroyKey (hKey=0x522fd8) returned 1 [0144.080] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x4f3c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.080] SetEndOfFile (hFile=0x100) returned 1 [0144.082] GetProcessHeap () returned 0x4e0000 [0144.082] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0144.082] GetProcessHeap () returned 0x4e0000 [0144.082] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0144.082] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\bigfont.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\bigfont.shx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0144.083] CloseHandle (hObject=0x100) returned 1 [0144.083] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81c076e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xa261d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CHINESET.SHX", cAlternateFileName="")) returned 1 [0144.083] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\chineset.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0144.084] GetProcessHeap () returned 0x4e0000 [0144.084] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0144.084] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0144.084] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0144.084] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x3, lpOverlapped=0x0) returned 1 [0144.086] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0144.086] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.086] GetProcessHeap () returned 0x4e0000 [0144.086] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0144.086] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0144.086] CryptDestroyKey (hKey=0x522fd8) returned 1 [0144.086] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0144.086] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0144.086] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0144.086] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0144.086] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0144.086] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0144.086] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0144.086] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.086] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.086] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xa261d, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xa261d, lpOverlapped=0x0) returned 1 [0144.094] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xa2620, dwBufLen=0xa2620 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xa2620) returned 1 [0144.099] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.099] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xa2620, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xa2620, lpOverlapped=0x0) returned 1 [0144.102] CryptDestroyKey (hKey=0x522fd8) returned 1 [0144.103] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xa26f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.103] SetEndOfFile (hFile=0x100) returned 1 [0144.106] GetProcessHeap () returned 0x4e0000 [0144.106] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0144.106] GetProcessHeap () returned 0x4e0000 [0144.106] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0144.106] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\chineset.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\chineset.shx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0144.107] CloseHandle (hObject=0x100) returned 1 [0144.107] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81eb4fa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x6a9e6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EXTFONT.SHX", cAlternateFileName="")) returned 1 [0144.107] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\extfont.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0144.107] GetProcessHeap () returned 0x4e0000 [0144.107] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0144.107] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0144.107] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0144.107] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xa, lpOverlapped=0x0) returned 1 [0144.110] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0144.110] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.110] GetProcessHeap () returned 0x4e0000 [0144.110] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0144.110] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0144.110] CryptDestroyKey (hKey=0x522fd8) returned 1 [0144.110] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0144.110] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0144.110] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0144.110] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0144.110] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0144.110] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0144.110] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0144.110] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.110] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.110] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x6a9e6, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x6a9e6, lpOverlapped=0x0) returned 1 [0144.115] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x6a9f0, dwBufLen=0x6a9f0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x6a9f0) returned 1 [0144.119] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.119] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6a9f0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x6a9f0, lpOverlapped=0x0) returned 1 [0144.120] CryptDestroyKey (hKey=0x522fd8) returned 1 [0144.120] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x6aac4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.120] SetEndOfFile (hFile=0x100) returned 1 [0144.123] GetProcessHeap () returned 0x4e0000 [0144.123] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0144.123] GetProcessHeap () returned 0x4e0000 [0144.123] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0144.123] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\extfont.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\extfont.shx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0144.124] CloseHandle (hObject=0x100) returned 1 [0144.124] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8207e020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xdc6b9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="GBCBIG.SHX", cAlternateFileName="")) returned 1 [0144.124] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\gbcbig.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0144.125] GetProcessHeap () returned 0x4e0000 [0144.125] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0144.125] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0144.125] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0144.125] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x7, lpOverlapped=0x0) returned 1 [0144.127] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0144.127] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.127] GetProcessHeap () returned 0x4e0000 [0144.127] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0144.127] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30) returned 1 [0144.127] CryptDestroyKey (hKey=0x522fd8) returned 1 [0144.127] WriteFile (in: hFile=0x100, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24defc8*=0x30, lpOverlapped=0x0) returned 1 [0144.127] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0144.127] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0144.127] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0144.127] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0144.127] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0144.127] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0144.127] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.127] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.127] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xdc6b9, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xdc6b9, lpOverlapped=0x0) returned 1 [0144.139] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xdc6c0, dwBufLen=0xdc6c0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xdc6c0) returned 1 [0144.148] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.148] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xdc6c0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xdc6c0, lpOverlapped=0x0) returned 1 [0144.150] CryptDestroyKey (hKey=0x522fd8) returned 1 [0144.150] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xdc784, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.151] SetEndOfFile (hFile=0x100) returned 1 [0144.153] GetProcessHeap () returned 0x4e0000 [0144.153] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0144.153] GetProcessHeap () returned 0x4e0000 [0144.153] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0144.153] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\gbcbig.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\gbcbig.shx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0144.154] CloseHandle (hObject=0x100) returned 1 [0144.155] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2656900, ftCreationTime.dwHighDateTime=0x1c2706c, ftLastAccessTime.dwLowDateTime=0x820ca2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2656900, ftLastWriteTime.dwHighDateTime=0x1c2706c, nFileSizeHigh=0x0, nFileSizeLow=0x2b01, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IC-TXT.SHX", cAlternateFileName="")) returned 1 [0144.155] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\ic-txt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0144.155] GetProcessHeap () returned 0x4e0000 [0144.155] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0144.155] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0144.155] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0144.155] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xf, lpOverlapped=0x0) returned 1 [0144.157] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0144.157] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.157] GetProcessHeap () returned 0x4e0000 [0144.157] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0144.157] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30) returned 1 [0144.157] CryptDestroyKey (hKey=0x522fd8) returned 1 [0144.157] WriteFile (in: hFile=0x100, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24defc8*=0x30, lpOverlapped=0x0) returned 1 [0144.157] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0144.157] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0144.157] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0144.158] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0144.158] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0144.158] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0144.158] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.158] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.158] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2b01, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x2b01, lpOverlapped=0x0) returned 1 [0144.159] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x2b10, dwBufLen=0x2b10 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x2b10) returned 1 [0144.159] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.159] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2b10, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x2b10, lpOverlapped=0x0) returned 1 [0144.159] CryptDestroyKey (hKey=0x522fd8) returned 1 [0144.159] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x2bd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.159] SetEndOfFile (hFile=0x100) returned 1 [0144.161] GetProcessHeap () returned 0x4e0000 [0144.161] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0144.161] GetProcessHeap () returned 0x4e0000 [0144.161] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0144.161] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\ic-txt.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\ic-txt.shx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0144.162] CloseHandle (hObject=0x100) returned 1 [0144.162] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8f60300, ftCreationTime.dwHighDateTime=0x1c324cc, ftLastAccessTime.dwLowDateTime=0x820ca2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc8f60300, ftLastWriteTime.dwHighDateTime=0x1c324cc, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ICAD.FMP", cAlternateFileName="")) returned 1 [0144.162] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\icad.fmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0144.163] GetProcessHeap () returned 0x4e0000 [0144.163] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0144.163] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0144.163] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0144.163] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xa, lpOverlapped=0x0) returned 1 [0144.164] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0144.164] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.164] GetProcessHeap () returned 0x4e0000 [0144.164] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0144.164] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30) returned 1 [0144.164] CryptDestroyKey (hKey=0x522fd8) returned 1 [0144.164] WriteFile (in: hFile=0x100, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24defc8*=0x30, lpOverlapped=0x0) returned 1 [0144.164] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0144.164] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0144.165] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0144.165] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0144.165] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0144.165] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0144.165] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.165] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.165] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x146, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x146, lpOverlapped=0x0) returned 1 [0144.165] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x150, dwBufLen=0x150 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x150) returned 1 [0144.165] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.165] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x150, lpOverlapped=0x0) returned 1 [0144.165] CryptDestroyKey (hKey=0x522fd8) returned 1 [0144.165] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.165] SetEndOfFile (hFile=0x100) returned 1 [0144.167] GetProcessHeap () returned 0x4e0000 [0144.167] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0144.167] GetProcessHeap () returned 0x4e0000 [0144.167] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0144.167] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\icad.fmp"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\icad.fmp.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0144.169] CloseHandle (hObject=0x100) returned 1 [0144.170] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x853f7be0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x369d3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WHGDTXT.SHX", cAlternateFileName="")) returned 1 [0144.170] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0144.170] GetProcessHeap () returned 0x4e0000 [0144.170] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0144.171] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0144.171] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0144.171] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xd, lpOverlapped=0x0) returned 1 [0144.172] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0144.172] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.172] GetProcessHeap () returned 0x4e0000 [0144.172] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0144.172] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0144.172] CryptDestroyKey (hKey=0x522fd8) returned 1 [0144.172] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0144.173] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0144.173] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0144.173] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0144.173] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0144.173] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0144.173] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0144.173] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.173] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.173] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x369d3, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x369d3, lpOverlapped=0x0) returned 1 [0144.176] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x369e0, dwBufLen=0x369e0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x369e0) returned 1 [0144.178] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.178] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x369e0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x369e0, lpOverlapped=0x0) returned 1 [0144.178] CryptDestroyKey (hKey=0x522fd8) returned 1 [0144.178] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x36ab4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.178] SetEndOfFile (hFile=0x100) returned 1 [0144.182] GetProcessHeap () returned 0x4e0000 [0144.182] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0144.182] GetProcessHeap () returned 0x4e0000 [0144.182] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0144.182] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0144.183] CloseHandle (hObject=0x100) returned 1 [0144.183] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x853f7be0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x2fde5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WHGTXT.SHX", cAlternateFileName="")) returned 1 [0144.183] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgtxt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0144.184] GetProcessHeap () returned 0x4e0000 [0144.184] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0144.184] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0144.184] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0144.184] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xb, lpOverlapped=0x0) returned 1 [0144.186] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0144.186] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.186] GetProcessHeap () returned 0x4e0000 [0144.186] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0144.186] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30) returned 1 [0144.186] CryptDestroyKey (hKey=0x522fd8) returned 1 [0144.186] WriteFile (in: hFile=0x100, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24defc8*=0x30, lpOverlapped=0x0) returned 1 [0144.186] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0144.186] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0144.187] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0144.187] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0144.187] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0144.187] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0144.187] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.187] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.187] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2fde5, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x2fde5, lpOverlapped=0x0) returned 1 [0144.189] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x2fdf0, dwBufLen=0x2fdf0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x2fdf0) returned 1 [0144.191] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.191] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2fdf0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x2fdf0, lpOverlapped=0x0) returned 1 [0144.192] CryptDestroyKey (hKey=0x522fd8) returned 1 [0144.192] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x2feb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.192] SetEndOfFile (hFile=0x100) returned 1 [0144.195] GetProcessHeap () returned 0x4e0000 [0144.195] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0144.195] GetProcessHeap () returned 0x4e0000 [0144.195] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0144.195] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgtxt.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgtxt.shx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0144.196] CloseHandle (hObject=0x100) returned 1 [0144.196] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x9e413, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WHTGTXT.SHX", cAlternateFileName="")) returned 1 [0144.196] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0144.196] GetProcessHeap () returned 0x4e0000 [0144.196] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0144.196] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0144.196] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0144.196] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xd, lpOverlapped=0x0) returned 1 [0144.198] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0144.198] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.198] GetProcessHeap () returned 0x4e0000 [0144.198] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0144.198] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0144.198] CryptDestroyKey (hKey=0x522fd8) returned 1 [0144.198] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0144.198] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0144.199] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0144.199] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0144.199] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0144.199] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0144.199] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0144.199] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.199] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.199] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x9e413, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x9e413, lpOverlapped=0x0) returned 1 [0144.206] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x9e420, dwBufLen=0x9e420 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x9e420) returned 1 [0144.212] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.212] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x9e420, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x9e420, lpOverlapped=0x0) returned 1 [0144.214] CryptDestroyKey (hKey=0x522fd8) returned 1 [0144.214] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x9e4f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.214] SetEndOfFile (hFile=0x100) returned 1 [0144.217] GetProcessHeap () returned 0x4e0000 [0144.217] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0144.217] GetProcessHeap () returned 0x4e0000 [0144.217] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0144.217] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0144.218] CloseHandle (hObject=0x100) returned 1 [0144.218] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xdfc98, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WHTMTXT.SHX", cAlternateFileName="")) returned 1 [0144.218] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtmtxt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0144.218] GetProcessHeap () returned 0x4e0000 [0144.218] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0144.218] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0144.218] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0144.218] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0144.220] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0144.220] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.220] GetProcessHeap () returned 0x4e0000 [0144.220] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0144.220] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0144.220] CryptDestroyKey (hKey=0x522fd8) returned 1 [0144.220] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0144.221] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0144.221] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0144.221] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0144.221] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0144.221] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0144.221] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0144.221] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.221] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.221] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xdfc98, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xdfc98, lpOverlapped=0x0) returned 1 [0144.233] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xdfca0, dwBufLen=0xdfca0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xdfca0) returned 1 [0144.243] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.243] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xdfca0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xdfca0, lpOverlapped=0x0) returned 1 [0144.246] CryptDestroyKey (hKey=0x522fd8) returned 1 [0144.246] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xdfd74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.246] SetEndOfFile (hFile=0x100) returned 1 [0144.250] GetProcessHeap () returned 0x4e0000 [0144.250] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0144.250] GetProcessHeap () returned 0x4e0000 [0144.250] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0144.250] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtmtxt.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtmtxt.shx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0144.251] CloseHandle (hObject=0x100) returned 1 [0144.252] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xdfc98, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WHTMTXT.SHX", cAlternateFileName="")) returned 0 [0144.252] GetProcessHeap () returned 0x4e0000 [0144.252] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0144.252] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0144.252] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df020 | out: pbData=0x4f53d8, pdwDataLen=0x24df020) returned 1 [0144.252] CryptDestroyKey (hKey=0x522fd8) returned 1 [0144.252] GetProcessHeap () returned 0x4e0000 [0144.252] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0144.252] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0144.252] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df020 | out: pbData=0x4f5420, pdwDataLen=0x24df020) returned 1 [0144.252] CryptDestroyKey (hKey=0x522fd8) returned 1 [0144.252] GetProcessHeap () returned 0x4e0000 [0144.252] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5273c0 [0144.252] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0144.252] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5273c0, pdwDataLen=0x24df020 | out: pbData=0x5273c0, pdwDataLen=0x24df020) returned 1 [0144.252] CryptDestroyKey (hKey=0x522fd8) returned 1 [0144.252] wsprintfW (in: param_1=0x24ddffc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\readme-warning.txt") returned 84 [0144.252] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0144.253] WriteFile (in: hFile=0x100, lpBuffer=0x5273c0*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddff8, lpOverlapped=0x0 | out: lpBuffer=0x5273c0*, lpNumberOfBytesWritten=0x24ddff8*=0x6c3, lpOverlapped=0x0) returned 1 [0144.254] CloseHandle (hObject=0x100) returned 1 [0144.255] GetProcessHeap () returned 0x4e0000 [0144.255] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273c0 | out: hHeap=0x4e0000) returned 1 [0144.255] GetProcessHeap () returned 0x4e0000 [0144.255] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0144.255] GetProcessHeap () returned 0x4e0000 [0144.255] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0144.255] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0144.255] GetProcessHeap () returned 0x4e0000 [0144.255] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527120 | out: hHeap=0x4e0000) returned 1 [0144.255] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Fonts", cAlternateFileName="")) returned 0 [0144.255] FindClose (in: hFindFile=0x522f58 | out: hFindFile=0x522f58) returned 1 [0144.255] GetProcessHeap () returned 0x4e0000 [0144.255] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x526e88 | out: hHeap=0x4e0000) returned 1 [0144.255] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTO", cAlternateFileName="")) returned 1 [0144.255] GetProcessHeap () returned 0x4e0000 [0144.256] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x78) returned 0x4f1b18 [0144.256] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\*.*", lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f58 [0144.257] GetProcessHeap () returned 0x4e0000 [0144.257] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1b18 | out: hHeap=0x4e0000) returned 1 [0144.257] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0144.257] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="10.0", cAlternateFileName="")) returned 1 [0144.257] GetProcessHeap () returned 0x4e0000 [0144.257] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x27a) returned 0x526e88 [0144.257] GetProcessHeap () returned 0x4e0000 [0144.257] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x82) returned 0x4fa058 [0144.257] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0144.260] GetProcessHeap () returned 0x4e0000 [0144.260] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0144.260] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0144.260] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 1 [0144.260] GetProcessHeap () returned 0x4e0000 [0144.260] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x284) returned 0x527110 [0144.260] GetProcessHeap () returned 0x4e0000 [0144.260] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8c) returned 0x524ea0 [0144.260] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\*.*", lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522fd8 [0144.261] GetProcessHeap () returned 0x4e0000 [0144.261] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x524ea0 | out: hHeap=0x4e0000) returned 1 [0144.261] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0144.261] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd5024ea0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x2760, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTOInstallerUI.dll", cAlternateFileName="VSTOIN~1.DLL")) returned 1 [0144.261] GetProcessHeap () returned 0x4e0000 [0144.261] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x28e) returned 0x5273a0 [0144.261] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTOLoaderUI.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 1 [0144.261] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTOLoaderUI.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 0 [0144.261] FindClose (in: hFindFile=0x522fd8 | out: hFindFile=0x522fd8) returned 1 [0144.262] GetProcessHeap () returned 0x4e0000 [0144.262] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273a0 | out: hHeap=0x4e0000) returned 1 [0144.262] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc251dc00, ftCreationTime.dwHighDateTime=0x1cab7c7, ftLastAccessTime.dwLowDateTime=0x5e4b68d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc251dc00, ftLastWriteTime.dwHighDateTime=0x1cab7c7, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTOInstaller.config", cAlternateFileName="VSTOIN~1.CON")) returned 1 [0144.262] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0144.263] GetProcessHeap () returned 0x4e0000 [0144.263] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0144.263] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0144.263] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0144.263] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0144.266] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0144.266] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.266] GetProcessHeap () returned 0x4e0000 [0144.266] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x50) returned 0x4fd470 [0144.266] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fd470*, pdwDataLen=0x24defa8*=0x50, dwBufLen=0x50 | out: pbData=0x4fd470*, pdwDataLen=0x24defa8*=0x50) returned 1 [0144.266] CryptDestroyKey (hKey=0x522fd8) returned 1 [0144.266] WriteFile (in: hFile=0x100, lpBuffer=0x4fd470*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd470*, lpNumberOfBytesWritten=0x24defc8*=0x50, lpOverlapped=0x0) returned 1 [0144.266] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0144.266] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0144.266] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0144.266] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0144.267] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0144.267] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0144.267] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.267] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.267] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2cc, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x2cc, lpOverlapped=0x0) returned 1 [0144.267] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x2d0) returned 1 [0144.267] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.267] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x2d0, lpOverlapped=0x0) returned 1 [0144.267] CryptDestroyKey (hKey=0x522fd8) returned 1 [0144.267] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x3b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.267] SetEndOfFile (hFile=0x100) returned 1 [0144.270] GetProcessHeap () returned 0x4e0000 [0144.270] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fd470 | out: hHeap=0x4e0000) returned 1 [0144.270] GetProcessHeap () returned 0x4e0000 [0144.270] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0144.270] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0144.271] CloseHandle (hObject=0x100) returned 1 [0144.271] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6d27ac0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x18558, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTOInstaller.exe", cAlternateFileName="VSTOIN~1.EXE")) returned 1 [0144.271] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x5e950, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTOLoader.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 1 [0144.271] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd51096e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0xbb68, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTOMessageProvider.dll", cAlternateFileName="VSTOME~1.DLL")) returned 1 [0144.271] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd51096e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0xbb68, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTOMessageProvider.dll", cAlternateFileName="VSTOME~1.DLL")) returned 0 [0144.272] GetProcessHeap () returned 0x4e0000 [0144.272] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0144.272] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0144.272] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df020 | out: pbData=0x4f53d8, pdwDataLen=0x24df020) returned 1 [0144.272] CryptDestroyKey (hKey=0x522fd8) returned 1 [0144.272] GetProcessHeap () returned 0x4e0000 [0144.272] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0144.272] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0144.272] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df020 | out: pbData=0x4f5420, pdwDataLen=0x24df020) returned 1 [0144.272] CryptDestroyKey (hKey=0x522fd8) returned 1 [0144.272] GetProcessHeap () returned 0x4e0000 [0144.272] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x5273a0 [0144.272] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0144.272] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5273a0, pdwDataLen=0x24df020 | out: pbData=0x5273a0, pdwDataLen=0x24df020) returned 1 [0144.272] CryptDestroyKey (hKey=0x522fd8) returned 1 [0144.272] wsprintfW (in: param_1=0x24ddffc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\readme-warning.txt") returned 75 [0144.272] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0144.274] WriteFile (in: hFile=0x100, lpBuffer=0x5273a0*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddff8, lpOverlapped=0x0 | out: lpBuffer=0x5273a0*, lpNumberOfBytesWritten=0x24ddff8*=0x6c3, lpOverlapped=0x0) returned 1 [0144.275] CloseHandle (hObject=0x100) returned 1 [0144.275] GetProcessHeap () returned 0x4e0000 [0144.275] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273a0 | out: hHeap=0x4e0000) returned 1 [0144.275] GetProcessHeap () returned 0x4e0000 [0144.275] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0144.275] GetProcessHeap () returned 0x4e0000 [0144.275] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0144.275] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0144.276] GetProcessHeap () returned 0x4e0000 [0144.276] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527110 | out: hHeap=0x4e0000) returned 1 [0144.276] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x2d148, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vstoee.dll", cAlternateFileName="")) returned 1 [0144.276] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6c693e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x3f50, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vstoee100.tlb", cAlternateFileName="VSTOEE~1.TLB")) returned 1 [0144.276] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0144.276] GetProcessHeap () returned 0x4e0000 [0144.276] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0144.276] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0144.276] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0144.276] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0144.276] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.276] GetProcessHeap () returned 0x4e0000 [0144.277] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0144.277] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0144.277] CryptDestroyKey (hKey=0x522f98) returned 1 [0144.277] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0144.279] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0144.279] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0144.280] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0144.280] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0144.280] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0144.280] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0144.280] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.280] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.280] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3f50, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3f50, lpOverlapped=0x0) returned 1 [0144.281] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3f50, dwBufLen=0x3f50 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3f50) returned 1 [0144.282] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.282] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3f50, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3f50, lpOverlapped=0x0) returned 1 [0144.282] CryptDestroyKey (hKey=0x522f98) returned 1 [0144.282] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4024, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.282] SetEndOfFile (hFile=0xdc) returned 1 [0144.285] GetProcessHeap () returned 0x4e0000 [0144.285] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0144.285] GetProcessHeap () returned 0x4e0000 [0144.285] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0144.286] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0144.286] CloseHandle (hObject=0xdc) returned 1 [0144.286] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6c8f540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x5550, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vstoee90.tlb", cAlternateFileName="")) returned 1 [0144.286] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0144.288] GetProcessHeap () returned 0x4e0000 [0144.288] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0144.288] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0144.288] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0144.288] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0144.288] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.288] GetProcessHeap () returned 0x4e0000 [0144.288] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0144.288] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0144.288] CryptDestroyKey (hKey=0x522f98) returned 1 [0144.288] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0144.290] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0144.290] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0144.290] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0144.290] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0144.291] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0144.291] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0144.291] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.291] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.291] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5550, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x5550, lpOverlapped=0x0) returned 1 [0144.292] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5550, dwBufLen=0x5550 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5550) returned 1 [0144.292] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.292] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5550, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5550, lpOverlapped=0x0) returned 1 [0144.292] CryptDestroyKey (hKey=0x522f98) returned 1 [0144.292] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5624, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.292] SetEndOfFile (hFile=0xdc) returned 1 [0144.295] GetProcessHeap () returned 0x4e0000 [0144.296] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0144.296] GetProcessHeap () returned 0x4e0000 [0144.296] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0144.296] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0144.300] CloseHandle (hObject=0xdc) returned 1 [0144.301] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6c8f540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x5550, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vstoee90.tlb", cAlternateFileName="")) returned 0 [0144.301] GetProcessHeap () returned 0x4e0000 [0144.301] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0144.301] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df248, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f98) returned 1 [0144.301] CryptDecrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df2b0 | out: pbData=0x4f53d8, pdwDataLen=0x24df2b0) returned 1 [0144.301] CryptDestroyKey (hKey=0x522f98) returned 1 [0144.301] GetProcessHeap () returned 0x4e0000 [0144.301] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0144.301] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df248, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f98) returned 1 [0144.301] CryptDecrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df2b0 | out: pbData=0x4f5420, pdwDataLen=0x24df2b0) returned 1 [0144.301] CryptDestroyKey (hKey=0x522f98) returned 1 [0144.301] GetProcessHeap () returned 0x4e0000 [0144.301] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x527110 [0144.301] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df248, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f98) returned 1 [0144.301] CryptDecrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x527110, pdwDataLen=0x24df2b0 | out: pbData=0x527110, pdwDataLen=0x24df2b0) returned 1 [0144.301] CryptDestroyKey (hKey=0x522f98) returned 1 [0144.301] wsprintfW (in: param_1=0x24de28c, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\readme-warning.txt") returned 70 [0144.301] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0144.302] WriteFile (in: hFile=0xdc, lpBuffer=0x527110*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24de288, lpOverlapped=0x0 | out: lpBuffer=0x527110*, lpNumberOfBytesWritten=0x24de288*=0x6c3, lpOverlapped=0x0) returned 1 [0144.303] CloseHandle (hObject=0xdc) returned 1 [0144.303] GetProcessHeap () returned 0x4e0000 [0144.303] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527110 | out: hHeap=0x4e0000) returned 1 [0144.303] GetProcessHeap () returned 0x4e0000 [0144.304] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0144.304] GetProcessHeap () returned 0x4e0000 [0144.304] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0144.304] FindClose (in: hFindFile=0x522f58 | out: hFindFile=0x522f58) returned 1 [0144.304] GetProcessHeap () returned 0x4e0000 [0144.304] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x526e88 | out: hHeap=0x4e0000) returned 1 [0144.304] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Web Folders", cAlternateFileName="WEBFOL~1")) returned 1 [0144.304] GetProcessHeap () returned 0x4e0000 [0144.304] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x86) returned 0x4fa058 [0144.304] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\*.*", lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f58 [0144.305] GetProcessHeap () returned 0x4e0000 [0144.305] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0144.305] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0144.305] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 1 [0144.305] GetProcessHeap () returned 0x4e0000 [0144.306] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x288) returned 0x526e88 [0144.306] GetProcessHeap () returned 0x4e0000 [0144.306] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x90) returned 0x524ea0 [0144.306] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0144.306] GetProcessHeap () returned 0x4e0000 [0144.306] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x524ea0 | out: hHeap=0x4e0000) returned 1 [0144.306] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0144.306] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbca8c600, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbca8c600, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x2988, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSOSVINT.DLL", cAlternateFileName="")) returned 1 [0144.306] GetProcessHeap () returned 0x4e0000 [0144.306] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x292) returned 0x527118 [0144.306] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbca8c600, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbca8c600, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x2988, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSOSVINT.DLL", cAlternateFileName="")) returned 0 [0144.306] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0144.306] GetProcessHeap () returned 0x4e0000 [0144.306] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527118 | out: hHeap=0x4e0000) returned 1 [0144.306] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdd9f300, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbdd9f300, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xaf88, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSOSV.DLL", cAlternateFileName="")) returned 1 [0144.306] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdd9f300, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbdd9f300, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xaf88, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSOSV.DLL", cAlternateFileName="")) returned 0 [0144.307] FindClose (in: hFindFile=0x522f58 | out: hFindFile=0x522f58) returned 1 [0144.307] GetProcessHeap () returned 0x4e0000 [0144.307] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x526e88 | out: hHeap=0x4e0000) returned 1 [0144.307] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 1 [0144.307] GetProcessHeap () returned 0x4e0000 [0144.307] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x9a) returned 0x4fa058 [0144.307] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\*.*", lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f58 [0144.308] GetProcessHeap () returned 0x4e0000 [0144.308] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0144.308] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0144.308] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="14", cAlternateFileName="")) returned 1 [0144.308] GetProcessHeap () returned 0x4e0000 [0144.308] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x29c) returned 0x526e88 [0144.308] GetProcessHeap () returned 0x4e0000 [0144.308] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa0) returned 0x4fa058 [0144.308] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0144.309] GetProcessHeap () returned 0x4e0000 [0144.309] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0144.309] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0144.309] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BIN", cAlternateFileName="")) returned 1 [0144.309] GetProcessHeap () returned 0x4e0000 [0144.309] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2a2) returned 0x527130 [0144.309] GetProcessHeap () returned 0x4e0000 [0144.309] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa8) returned 0x4fa058 [0144.309] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\*.*", lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522fd8 [0144.310] GetProcessHeap () returned 0x4e0000 [0144.310] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0144.310] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0144.310] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 1 [0144.310] GetProcessHeap () returned 0x4e0000 [0144.310] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2aa) returned 0x5273e0 [0144.310] GetProcessHeap () returned 0x4e0000 [0144.310] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xb2) returned 0x4fa058 [0144.310] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\*.*", lpFindFileData=0x24deb30 | out: lpFindFileData=0x24deb30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x523018 [0144.310] GetProcessHeap () returned 0x4e0000 [0144.310] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0144.310] FindNextFileW (in: hFindFile=0x523018, lpFindFileData=0x24deb30 | out: lpFindFileData=0x24deb30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0144.311] FindNextFileW (in: hFindFile=0x523018, lpFindFileData=0x24deb30 | out: lpFindFileData=0x24deb30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870ca400, ftCreationTime.dwHighDateTime=0x1cac036, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x870ca400, ftLastWriteTime.dwHighDateTime=0x1cac036, nFileSizeHigh=0x0, nFileSizeLow=0x296a5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FPEXT.MSG", cAlternateFileName="")) returned 1 [0144.311] GetProcessHeap () returned 0x4e0000 [0144.311] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2b4) returned 0x527698 [0144.311] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0144.311] GetProcessHeap () returned 0x4e0000 [0144.311] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0144.311] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0144.311] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24deac0 | out: lpNewFilePointer=0x0) returned 1 [0144.311] WriteFile (in: hFile=0x124, lpBuffer=0x24dead0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24deaa8, lpOverlapped=0x0 | out: lpBuffer=0x24dead0*, lpNumberOfBytesWritten=0x24deaa8*=0xb, lpOverlapped=0x0) returned 1 [0144.314] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24deaac | out: phKey=0x24deaac*=0x523058) returned 1 [0144.314] CryptSetKeyParam (hKey=0x523058, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.314] GetProcessHeap () returned 0x4e0000 [0144.314] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0144.314] CryptEncrypt (in: hKey=0x523058, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24dea88*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24dea88*=0x30) returned 1 [0144.314] CryptDestroyKey (hKey=0x523058) returned 1 [0144.314] WriteFile (in: hFile=0x124, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24deaa8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24deaa8*=0x30, lpOverlapped=0x0) returned 1 [0144.314] WriteFile (in: hFile=0x124, lpBuffer=0x24deab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24deaa8, lpOverlapped=0x0 | out: lpBuffer=0x24deab0*, lpNumberOfBytesWritten=0x24deaa8*=0x4, lpOverlapped=0x0) returned 1 [0144.314] WriteFile (in: hFile=0x124, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24deaa8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24deaa8*=0x10, lpOverlapped=0x0) returned 1 [0144.314] WriteFile (in: hFile=0x124, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24deaa8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24deaa8*=0x80, lpOverlapped=0x0) returned 1 [0144.314] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24deab8 | out: lpNewFilePointer=0x0) returned 1 [0144.315] WriteFile (in: hFile=0x124, lpBuffer=0x24deac8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24deaa8, lpOverlapped=0x0 | out: lpBuffer=0x24deac8*, lpNumberOfBytesWritten=0x24deaa8*=0x8, lpOverlapped=0x0) returned 1 [0144.315] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24deaac | out: phKey=0x24deaac*=0x523058) returned 1 [0144.315] CryptSetKeyParam (hKey=0x523058, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.315] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.315] ReadFile (in: hFile=0x124, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x296a5, lpNumberOfBytesRead=0x24dea60, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24dea60*=0x296a5, lpOverlapped=0x0) returned 1 [0144.317] CryptEncrypt (in: hKey=0x523058, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24dea68*=0x296b0, dwBufLen=0x296b0 | out: pbData=0x22d0020*, pdwDataLen=0x24dea68*=0x296b0) returned 1 [0144.319] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.319] WriteFile (in: hFile=0x124, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x296b0, lpNumberOfBytesWritten=0x24dea64, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24dea64*=0x296b0, lpOverlapped=0x0) returned 1 [0144.320] CryptDestroyKey (hKey=0x523058) returned 1 [0144.320] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x29774, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.320] SetEndOfFile (hFile=0x124) returned 1 [0144.324] GetProcessHeap () returned 0x4e0000 [0144.324] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0144.324] GetProcessHeap () returned 0x4e0000 [0144.324] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0144.324] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0144.325] CloseHandle (hObject=0x124) returned 1 [0144.326] FindNextFileW (in: hFindFile=0x523018, lpFindFileData=0x24deb30 | out: lpFindFileData=0x24deb30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870ca400, ftCreationTime.dwHighDateTime=0x1cac036, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x870ca400, ftLastWriteTime.dwHighDateTime=0x1cac036, nFileSizeHigh=0x0, nFileSizeLow=0x296a5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FPEXT.MSG", cAlternateFileName="")) returned 0 [0144.326] GetProcessHeap () returned 0x4e0000 [0144.326] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0144.326] CryptImportKey (in: hProv=0x4f0590, pbData=0x24dea98, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523058) returned 1 [0144.326] CryptDecrypt (in: hKey=0x523058, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24deb00 | out: pbData=0x4f53d8, pdwDataLen=0x24deb00) returned 1 [0144.326] CryptDestroyKey (hKey=0x523058) returned 1 [0144.326] GetProcessHeap () returned 0x4e0000 [0144.326] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0144.326] CryptImportKey (in: hProv=0x4f0590, pbData=0x24dea98, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523058) returned 1 [0144.326] CryptDecrypt (in: hKey=0x523058, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24deb00 | out: pbData=0x4f5420, pdwDataLen=0x24deb00) returned 1 [0144.326] CryptDestroyKey (hKey=0x523058) returned 1 [0144.326] GetProcessHeap () returned 0x4e0000 [0144.326] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x527958 [0144.326] CryptImportKey (in: hProv=0x4f0590, pbData=0x24dea98, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523058) returned 1 [0144.326] CryptDecrypt (in: hKey=0x523058, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x527958, pdwDataLen=0x24deb00 | out: pbData=0x527958, pdwDataLen=0x24deb00) returned 1 [0144.326] CryptDestroyKey (hKey=0x523058) returned 1 [0144.326] wsprintfW (in: param_1=0x24ddadc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\readme-warning.txt") returned 99 [0144.327] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0144.327] WriteFile (in: hFile=0x124, lpBuffer=0x527958*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddad8, lpOverlapped=0x0 | out: lpBuffer=0x527958*, lpNumberOfBytesWritten=0x24ddad8*=0x6c3, lpOverlapped=0x0) returned 1 [0144.328] CloseHandle (hObject=0x124) returned 1 [0144.332] GetProcessHeap () returned 0x4e0000 [0144.332] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527958 | out: hHeap=0x4e0000) returned 1 [0144.333] GetProcessHeap () returned 0x4e0000 [0144.333] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0144.333] GetProcessHeap () returned 0x4e0000 [0144.333] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0144.333] FindClose (in: hFindFile=0x523018 | out: hFindFile=0x523018) returned 1 [0144.333] GetProcessHeap () returned 0x4e0000 [0144.333] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527698 | out: hHeap=0x4e0000) returned 1 [0144.333] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c366f00, ftCreationTime.dwHighDateTime=0x1cac0be, ftLastAccessTime.dwLowDateTime=0x6193ae30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3c366f00, ftLastWriteTime.dwHighDateTime=0x1cac0be, nFileSizeHigh=0x0, nFileSizeLow=0x267d78, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FPSRVUTL.DLL", cAlternateFileName="")) returned 1 [0144.333] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1da56400, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xdb7fce60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1da56400, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x14cd90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FPWEC.DLL", cAlternateFileName="")) returned 1 [0144.333] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1da56400, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xdb7fce60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1da56400, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x14cd90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FPWEC.DLL", cAlternateFileName="")) returned 0 [0144.333] FindClose (in: hFindFile=0x522fd8 | out: hFindFile=0x522fd8) returned 1 [0144.333] GetProcessHeap () returned 0x4e0000 [0144.333] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273e0 | out: hHeap=0x4e0000) returned 1 [0144.333] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BIN", cAlternateFileName="")) returned 0 [0144.333] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0144.334] GetProcessHeap () returned 0x4e0000 [0144.334] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527130 | out: hHeap=0x4e0000) returned 1 [0144.334] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="14", cAlternateFileName="")) returned 0 [0144.334] FindClose (in: hFindFile=0x522f58 | out: hFindFile=0x522f58) returned 1 [0144.334] GetProcessHeap () returned 0x4e0000 [0144.334] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x526e88 | out: hHeap=0x4e0000) returned 1 [0144.334] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 0 [0144.334] FindClose (in: hFindFile=0x522ed8 | out: hFindFile=0x522ed8) returned 1 [0144.334] GetProcessHeap () returned 0x4e0000 [0144.334] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5229c0 | out: hHeap=0x4e0000) returned 1 [0144.334] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53821800, ftCreationTime.dwHighDateTime=0x1d5a527, ftLastAccessTime.dwLowDateTime=0x15943cd0, ftLastAccessTime.dwHighDateTime=0x1d591cc, ftLastWriteTime.dwLowDateTime=0x15943cd0, ftLastWriteTime.dwHighDateTime=0x1d591cc, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="organizeellis.exe", cAlternateFileName="ORGANI~1.EXE")) returned 1 [0144.334] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Services", cAlternateFileName="")) returned 1 [0144.334] GetProcessHeap () returned 0x4e0000 [0144.334] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x5e) returned 0x528080 [0144.334] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Services\\*.*", lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522ed8 [0144.335] GetProcessHeap () returned 0x4e0000 [0144.335] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x528080 | out: hHeap=0x4e0000) returned 1 [0144.335] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0144.335] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafbfd139, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0xafbfd139, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0xafbfd139, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="verisign.bmp", cAlternateFileName="")) returned 1 [0144.335] GetProcessHeap () returned 0x4e0000 [0144.335] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x260) returned 0x5229c0 [0144.335] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.336] GetLastError () returned 0x5 [0144.336] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafbfd139, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0xafbfd139, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0xafbfd139, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="verisign.bmp", cAlternateFileName="")) returned 0 [0144.336] FindClose (in: hFindFile=0x522ed8 | out: hFindFile=0x522ed8) returned 1 [0144.336] GetProcessHeap () returned 0x4e0000 [0144.336] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5229c0 | out: hHeap=0x4e0000) returned 1 [0144.337] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SpeechEngines", cAlternateFileName="SPEECH~1")) returned 1 [0144.337] GetProcessHeap () returned 0x4e0000 [0144.337] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x68) returned 0x4fa058 [0144.337] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\*.*", lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522ed8 [0144.337] GetProcessHeap () returned 0x4e0000 [0144.337] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0144.337] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0144.337] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0144.337] GetProcessHeap () returned 0x4e0000 [0144.337] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x26a) returned 0x5229c0 [0144.337] GetProcessHeap () returned 0x4e0000 [0144.337] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x7c) returned 0x4fa058 [0144.337] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\*.*", lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f58 [0144.338] GetProcessHeap () returned 0x4e0000 [0144.338] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0144.338] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0144.338] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TTS20", cAlternateFileName="")) returned 1 [0144.338] GetProcessHeap () returned 0x4e0000 [0144.338] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x27e) returned 0x526e88 [0144.338] GetProcessHeap () returned 0x4e0000 [0144.338] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x88) returned 0x4fa058 [0144.339] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0144.339] GetProcessHeap () returned 0x4e0000 [0144.339] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0144.339] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0144.339] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-US", cAlternateFileName="")) returned 1 [0144.339] GetProcessHeap () returned 0x4e0000 [0144.339] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x28a) returned 0x527110 [0144.339] GetProcessHeap () returned 0x4e0000 [0144.339] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x94) returned 0x4fa058 [0144.339] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*.*", lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522fd8 [0144.339] GetProcessHeap () returned 0x4e0000 [0144.339] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0144.339] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0144.340] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="enu-dsk", cAlternateFileName="")) returned 1 [0144.340] GetProcessHeap () returned 0x4e0000 [0144.340] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x296) returned 0x5273a8 [0144.340] GetProcessHeap () returned 0x4e0000 [0144.340] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa4) returned 0x4fa058 [0144.340] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\*.*", lpFindFileData=0x24deb30 | out: lpFindFileData=0x24deb30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x523018 [0144.340] GetProcessHeap () returned 0x4e0000 [0144.340] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0144.340] FindNextFileW (in: hFindFile=0x523018, lpFindFileData=0x24deb30 | out: lpFindFileData=0x24deb30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0144.340] FindNextFileW (in: hFindFile=0x523018, lpFindFileData=0x24deb30 | out: lpFindFileData=0x24deb30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0 [0144.340] FindClose (in: hFindFile=0x523018 | out: hFindFile=0x523018) returned 1 [0144.340] GetProcessHeap () returned 0x4e0000 [0144.340] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4e0000) returned 1 [0144.340] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc84877a0, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc84877a0, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3739a960, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x5b400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSTTSFrontendENU.dll", cAlternateFileName="")) returned 1 [0144.340] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2c77e3, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2c77e3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSTTSLoc.dll.mui", cAlternateFileName="")) returned 1 [0144.340] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\msttsloc.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.342] GetLastError () returned 0x5 [0144.342] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2c77e3, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2c77e3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSTTSLoc.dll.mui", cAlternateFileName="")) returned 0 [0144.342] FindClose (in: hFindFile=0x522fd8 | out: hFindFile=0x522fd8) returned 1 [0144.342] GetProcessHeap () returned 0x4e0000 [0144.342] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5273a8 | out: hHeap=0x4e0000) returned 1 [0144.342] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc536f5be, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc536f5be, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x36fbb600, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xa200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSTTSCommon.dll", cAlternateFileName="")) returned 1 [0144.342] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc982ab94, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc982ab94, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3702e1f0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2c400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSTTSEngine.dll", cAlternateFileName="")) returned 1 [0144.342] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6d522f4, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc6d522f4, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3739a960, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSTTSLoc.dll", cAlternateFileName="")) returned 1 [0144.342] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6d522f4, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc6d522f4, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3739a960, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSTTSLoc.dll", cAlternateFileName="")) returned 0 [0144.342] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0144.342] GetProcessHeap () returned 0x4e0000 [0144.342] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527110 | out: hHeap=0x4e0000) returned 1 [0144.342] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TTS20", cAlternateFileName="")) returned 0 [0144.342] FindClose (in: hFindFile=0x522f58 | out: hFindFile=0x522f58) returned 1 [0144.342] GetProcessHeap () returned 0x4e0000 [0144.343] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x526e88 | out: hHeap=0x4e0000) returned 1 [0144.343] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0144.343] FindClose (in: hFindFile=0x522ed8 | out: hFindFile=0x522ed8) returned 1 [0144.343] GetProcessHeap () returned 0x4e0000 [0144.343] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5229c0 | out: hHeap=0x4e0000) returned 1 [0144.343] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="System", cAlternateFileName="")) returned 1 [0144.343] GetProcessHeap () returned 0x4e0000 [0144.343] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x5a) returned 0x528080 [0144.343] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\*.*", lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522ed8 [0144.346] GetProcessHeap () returned 0x4e0000 [0144.346] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x528080 | out: hHeap=0x4e0000) returned 1 [0144.346] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0144.346] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ado", cAlternateFileName="")) returned 1 [0144.346] GetProcessHeap () returned 0x4e0000 [0144.346] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x25c) returned 0x5229c0 [0144.346] GetProcessHeap () returned 0x4e0000 [0144.346] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x62) returned 0x4fa058 [0144.346] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\*.*", lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f58 [0144.348] GetProcessHeap () returned 0x4e0000 [0144.348] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0144.348] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0144.348] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4c91ed4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa4c91ed4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa06f97f7, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x3912, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="adojavas.inc", cAlternateFileName="")) returned 1 [0144.348] GetProcessHeap () returned 0x4e0000 [0144.348] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x264) returned 0x526e88 [0144.348] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.349] GetLastError () returned 0x5 [0144.349] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4085067, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa4085067, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa0661283, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x3a67, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="adovbs.inc", cAlternateFileName="")) returned 1 [0144.349] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.349] GetLastError () returned 0x5 [0144.349] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-US", cAlternateFileName="")) returned 1 [0144.349] GetProcessHeap () returned 0x4e0000 [0144.349] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e) returned 0x4fa058 [0144.349] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0144.350] GetProcessHeap () returned 0x4e0000 [0144.350] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0144.350] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.350] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a152a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2a152a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 1 [0144.350] GetProcessHeap () returned 0x4e0000 [0144.350] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x270) returned 0x5270f8 [0144.350] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.351] GetLastError () returned 0x5 [0144.351] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a152a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2a152a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 0 [0144.351] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0144.351] GetProcessHeap () returned 0x4e0000 [0144.351] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5270f8 | out: hHeap=0x4e0000) returned 1 [0144.351] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6129cc5, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x6129cc5, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x80fe7780, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msader15.dll", cAlternateFileName="")) returned 1 [0144.351] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7da10b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f7da10b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f80026c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x16e000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msado15.dll", cAlternateFileName="")) returned 1 [0144.351] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x833eacc3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x833eacc3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x833eacc3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msado20.tlb", cAlternateFileName="")) returned 1 [0144.351] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.352] GetLastError () returned 0x5 [0144.352] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x833eacc3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x833eacc3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x833eacc3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x12000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msado21.tlb", cAlternateFileName="")) returned 1 [0144.352] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.353] GetLastError () returned 0x5 [0144.353] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83410e23, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83410e23, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83410e23, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x17000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msado25.tlb", cAlternateFileName="")) returned 1 [0144.353] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.353] GetLastError () returned 0x5 [0144.353] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83410e23, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83410e23, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83410e23, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msado26.tlb", cAlternateFileName="")) returned 1 [0144.353] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.354] GetLastError () returned 0x5 [0144.354] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83436f83, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83436f83, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8345d0e3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msado27.tlb", cAlternateFileName="")) returned 1 [0144.354] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.354] GetLastError () returned 0x5 [0144.354] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83483244, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83483244, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83483244, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msado28.tlb", cAlternateFileName="")) returned 1 [0144.354] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.354] GetLastError () returned 0x5 [0144.354] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ec495ee, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9ec495ee, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9ec6f74e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x72000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadomd.dll", cAlternateFileName="")) returned 1 [0144.354] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a6a67, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x62a6a67, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x625a7ad, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadomd28.tlb", cAlternateFileName="")) returned 1 [0144.355] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.355] GetLastError () returned 0x5 [0144.355] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad50fa2, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ad50fa2, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ad50fa2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msador15.dll", cAlternateFileName="")) returned 1 [0144.355] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9debf8b5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9debf8b5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9dee5a15, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadox.dll", cAlternateFileName="")) returned 1 [0144.355] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fd3080, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x5fd3080, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x5f60c69, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadox28.tlb", cAlternateFileName="")) returned 1 [0144.356] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.356] GetLastError () returned 0x5 [0144.356] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf55bba, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xbf55bba, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x347dbdb0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadrh15.dll", cAlternateFileName="")) returned 1 [0144.356] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf55bba, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xbf55bba, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x347dbdb0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadrh15.dll", cAlternateFileName="")) returned 0 [0144.356] FindClose (in: hFindFile=0x522f58 | out: hFindFile=0x522f58) returned 1 [0144.356] GetProcessHeap () returned 0x4e0000 [0144.356] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x526e88 | out: hHeap=0x4e0000) returned 1 [0144.356] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf4f1c09, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xbf4f1c09, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x128ffb00, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x7200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DirectDB.dll", cAlternateFileName="")) returned 1 [0144.356] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-US", cAlternateFileName="")) returned 1 [0144.356] GetProcessHeap () returned 0x4e0000 [0144.356] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x66) returned 0x4fa058 [0144.356] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\*.*", lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f58 [0144.357] GetProcessHeap () returned 0x4e0000 [0144.357] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0144.357] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0144.357] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb313d55, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb313d55, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x16e00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 1 [0144.357] GetProcessHeap () returned 0x4e0000 [0144.357] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x268) returned 0x526e88 [0144.357] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui" (normalized: "c:\\program files\\common files\\system\\en-us\\wab32res.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.357] GetLastError () returned 0x5 [0144.357] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb313d55, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb313d55, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x16e00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 0 [0144.357] FindClose (in: hFindFile=0x522f58 | out: hFindFile=0x522f58) returned 1 [0144.357] GetProcessHeap () returned 0x4e0000 [0144.357] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x526e88 | out: hHeap=0x4e0000) returned 1 [0144.357] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadc", cAlternateFileName="")) returned 1 [0144.357] GetProcessHeap () returned 0x4e0000 [0144.357] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x66) returned 0x4fa058 [0144.357] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\*.*", lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f58 [0144.360] GetProcessHeap () returned 0x4e0000 [0144.360] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0144.360] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0144.360] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa34c44b4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa34c44b4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa05a2bb2, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x276, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="adcjavas.inc", cAlternateFileName="")) returned 1 [0144.360] GetProcessHeap () returned 0x4e0000 [0144.360] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x268) returned 0x526e88 [0144.360] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.363] GetLastError () returned 0x5 [0144.363] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa34ea611, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa34ea611, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa063b126, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x26f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="adcvbs.inc", cAlternateFileName="")) returned 1 [0144.363] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.363] GetLastError () returned 0x5 [0144.364] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-US", cAlternateFileName="")) returned 1 [0144.364] GetProcessHeap () returned 0x4e0000 [0144.364] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x72) returned 0x4f1b18 [0144.364] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0144.366] GetProcessHeap () returned 0x4e0000 [0144.366] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1b18 | out: hHeap=0x4e0000) returned 1 [0144.366] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.366] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9351968, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x9351968, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcer.dll.mui", cAlternateFileName="")) returned 1 [0144.366] GetProcessHeap () returned 0x4e0000 [0144.366] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x274) returned 0x5270f8 [0144.366] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcer.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.367] GetLastError () returned 0x5 [0144.367] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc32e361, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xc60371c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xc32e361, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcfr.dll.mui", cAlternateFileName="")) returned 1 [0144.367] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcfr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.367] GetLastError () returned 0x5 [0144.367] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a073ed, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x9e34029, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x9a073ed, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcor.dll.mui", cAlternateFileName="")) returned 1 [0144.367] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcor.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.367] GetLastError () returned 0x5 [0144.367] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93053f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x93053f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msaddsr.dll.mui", cAlternateFileName="")) returned 1 [0144.367] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msaddsr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.368] GetLastError () returned 0x5 [0144.368] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb313d55, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb313d55, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaprsr.dll.mui", cAlternateFileName="")) returned 1 [0144.368] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaprsr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.368] GetLastError () returned 0x5 [0144.368] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92b8e84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x92b8e84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaremr.dll.mui", cAlternateFileName="")) returned 1 [0144.368] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaremr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.369] GetLastError () returned 0x5 [0144.369] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92b8e84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x92b8e84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaremr.dll.mui", cAlternateFileName="")) returned 0 [0144.369] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0144.370] GetProcessHeap () returned 0x4e0000 [0144.370] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5270f8 | out: hHeap=0x4e0000) returned 1 [0144.370] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cac9e93, ftCreationTime.dwHighDateTime=0x1c9ea0b, ftLastAccessTime.dwLowDateTime=0x2cac9e93, ftLastAccessTime.dwHighDateTime=0x1c9ea0b, ftLastWriteTime.dwLowDateTime=0x2cac9e93, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x206, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="handler.reg", cAlternateFileName="")) returned 1 [0144.370] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\handler.reg" (normalized: "c:\\program files\\common files\\system\\msadc\\handler.reg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.371] GetLastError () returned 0x5 [0144.371] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70a4b8b3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70a4b8b3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x2d63e7d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x24c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="handsafe.reg", cAlternateFileName="")) returned 1 [0144.371] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg" (normalized: "c:\\program files\\common files\\system\\msadc\\handsafe.reg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.371] GetLastError () returned 0x5 [0144.371] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b36a80d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b36a80d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b6180d2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb7000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadce.dll", cAlternateFileName="")) returned 1 [0144.371] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc13c33e, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfc13c33e, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80e1eed0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadcer.dll", cAlternateFileName="")) returned 1 [0144.371] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a9e4ffc, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a9e4ffc, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a9e4ffc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1c000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadcf.dll", cAlternateFileName="")) returned 1 [0144.371] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbf732e2, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfbf732e2, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80e6a9c0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadcfr.dll", cAlternateFileName="")) returned 1 [0144.371] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a9bee9c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a9bee9c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a9e4ffc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3f000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadco.dll", cAlternateFileName="")) returned 1 [0144.371] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc0a3dca, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfc0a3dca, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80edd5b0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadcor.dll", cAlternateFileName="")) returned 1 [0144.371] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84872aa8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x84872aa8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x84872aa8, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadcs.dll", cAlternateFileName="")) returned 1 [0144.371] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3801e6, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc3801e6, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x345eeb10, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x4a000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadds.dll", cAlternateFileName="")) returned 1 [0144.371] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfce53b36, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfce53b36, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80fc2d90, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msaddsr.dll", cAlternateFileName="")) returned 1 [0144.371] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd7d9276, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfd7d9276, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x81dbdf30, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msdaprsr.dll", cAlternateFileName="")) returned 1 [0144.371] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0d295c, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc0d295c, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3497fc70, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x5f000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msdaprst.dll", cAlternateFileName="")) returned 1 [0144.371] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93fdbb10, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93fdbb10, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x94001c70, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3d000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msdarem.dll", cAlternateFileName="")) returned 1 [0144.371] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd6a878e, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfd6a878e, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x835d7620, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msdaremr.dll", cAlternateFileName="")) returned 1 [0144.372] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d95dfd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x99d95dfd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x99dbbf5d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msdfmap.dll", cAlternateFileName="")) returned 1 [0144.372] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d95dfd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x99d95dfd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x99dbbf5d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msdfmap.dll", cAlternateFileName="")) returned 0 [0144.372] FindClose (in: hFindFile=0x522f58 | out: hFindFile=0x522f58) returned 1 [0144.372] GetProcessHeap () returned 0x4e0000 [0144.372] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x526e88 | out: hHeap=0x4e0000) returned 1 [0144.372] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSMAPI", cAlternateFileName="")) returned 1 [0144.372] GetProcessHeap () returned 0x4e0000 [0144.372] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x68) returned 0x4fa058 [0144.372] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\*.*", lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f58 [0144.373] GetProcessHeap () returned 0x4e0000 [0144.373] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0144.373] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0144.373] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 1 [0144.373] GetProcessHeap () returned 0x4e0000 [0144.373] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x26a) returned 0x526e88 [0144.373] GetProcessHeap () returned 0x4e0000 [0144.373] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x72) returned 0x4f1b18 [0144.373] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0144.373] GetProcessHeap () returned 0x4e0000 [0144.374] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1b18 | out: hHeap=0x4e0000) returned 1 [0144.374] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0144.374] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x324d2e00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x324d2e00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0xe580, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSMAPI32.DLL", cAlternateFileName="")) returned 1 [0144.374] GetProcessHeap () returned 0x4e0000 [0144.374] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x274) returned 0x527100 [0144.374] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x324d2e00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x324d2e00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0xe580, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSMAPI32.DLL", cAlternateFileName="")) returned 0 [0144.374] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0144.374] GetProcessHeap () returned 0x4e0000 [0144.374] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527100 | out: hHeap=0x4e0000) returned 1 [0144.374] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 0 [0144.374] FindClose (in: hFindFile=0x522f58 | out: hFindFile=0x522f58) returned 1 [0144.374] GetProcessHeap () returned 0x4e0000 [0144.374] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x526e88 | out: hHeap=0x4e0000) returned 1 [0144.374] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Ole DB", cAlternateFileName="OLEDB~1")) returned 1 [0144.374] GetProcessHeap () returned 0x4e0000 [0144.374] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x68) returned 0x4fa058 [0144.374] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\*.*", lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f58 [0144.376] GetProcessHeap () returned 0x4e0000 [0144.376] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0144.376] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0144.376] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-US", cAlternateFileName="")) returned 1 [0144.376] GetProcessHeap () returned 0x4e0000 [0144.376] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x26a) returned 0x526e88 [0144.376] GetProcessHeap () returned 0x4e0000 [0144.376] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x74) returned 0x4f1b18 [0144.376] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0144.377] GetProcessHeap () returned 0x4e0000 [0144.377] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1b18 | out: hHeap=0x4e0000) returned 1 [0144.377] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0144.377] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb6d5cd, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xbeb51b3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xbb6d5cd, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msdasqlr.dll.mui", cAlternateFileName="")) returned 1 [0144.377] GetProcessHeap () returned 0x4e0000 [0144.377] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x276) returned 0x527100 [0144.377] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\msdasqlr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.378] GetLastError () returned 0x5 [0144.378] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aabb7e, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8e65f8f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x8aabb7e, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xba00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oledb32r.dll.mui", cAlternateFileName="")) returned 1 [0144.378] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.379] GetLastError () returned 0x5 [0144.379] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb93886, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xbeb51b3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xbb93886, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sqloledb.rll.mui", cAlternateFileName="")) returned 1 [0144.379] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.379] GetLastError () returned 0x5 [0144.379] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad1e37, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8e65f8f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x8ad1e37, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sqlxmlx.rll.mui", cAlternateFileName="")) returned 1 [0144.379] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.380] GetLastError () returned 0x5 [0144.380] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad1e37, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8e65f8f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x8ad1e37, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sqlxmlx.rll.mui", cAlternateFileName="")) returned 0 [0144.380] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0144.380] GetProcessHeap () returned 0x4e0000 [0144.380] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x527100 | out: hHeap=0x4e0000) returned 1 [0144.380] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ad34e79, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9ad34e79, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9ad5afda, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1f000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msdaosp.dll", cAlternateFileName="")) returned 1 [0144.380] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14cd0c35, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x14cd0c35, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x349a6d70, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x6a000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msdaps.dll", cAlternateFileName="")) returned 1 [0144.380] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86c0138a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x86c0138a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x86c0138a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb6000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msdasql.dll", cAlternateFileName="")) returned 1 [0144.380] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ab69cf, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x2ab69cf, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x838ac7b0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msdasqlr.dll", cAlternateFileName="")) returned 1 [0144.380] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3c3a6b, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfc3c3a6b, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x349f2860, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msdatl3.dll", cAlternateFileName="")) returned 1 [0144.380] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d2cdc0, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x1d2cdc0, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x383128c0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msxactps.dll", cAlternateFileName="")) returned 1 [0144.380] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84c2ad0f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x84c2ad0f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x84c50e6f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10d000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oledb32.dll", cAlternateFileName="")) returned 1 [0144.380] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfabf604b, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfabf604b, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0xdf9a48f0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x14000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oledb32r.dll", cAlternateFileName="")) returned 1 [0144.380] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa542845b, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa542845b, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa4ffde2f, ftLastWriteTime.dwHighDateTime=0x1ca0409, nFileSizeHigh=0x0, nFileSizeLow=0x264c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oledbjvs.inc", cAlternateFileName="")) returned 1 [0144.380] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.381] GetLastError () returned 0x5 [0144.381] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa542845b, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa542845b, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa52d1816, ftLastWriteTime.dwHighDateTime=0x1ca0409, nFileSizeHigh=0x0, nFileSizeLow=0x26f7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oledbvbs.inc", cAlternateFileName="")) returned 1 [0144.381] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.381] GetLastError () returned 0x5 [0144.381] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f0bf91, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92f0bf91, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92f320f1, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x128000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sqloledb.dll", cAlternateFileName="")) returned 1 [0144.381] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc9350f, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xcc9350f, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0xcc210f8, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sqloledb.rll", cAlternateFileName="")) returned 1 [0144.382] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.382] GetLastError () returned 0x5 [0144.382] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14f7e4bf, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x14f7e4bf, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x44773fc0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x59000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sqlxmlx.dll", cAlternateFileName="")) returned 1 [0144.382] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9e5c85, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc9e5c85, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0xc97386e, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sqlxmlx.rll", cAlternateFileName="")) returned 1 [0144.382] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.382] GetLastError () returned 0x5 [0144.382] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc7a4200, ftCreationTime.dwHighDateTime=0x1c8e202, ftLastAccessTime.dwLowDateTime=0x5f34af90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc7a4200, ftLastWriteTime.dwHighDateTime=0x1c8e202, nFileSizeHigh=0x0, nFileSizeLow=0x44e18, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="xmlrw.dll", cAlternateFileName="")) returned 1 [0144.382] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc7a4200, ftCreationTime.dwHighDateTime=0x1c8e202, ftLastAccessTime.dwLowDateTime=0x516f5b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc7a4200, ftLastWriteTime.dwHighDateTime=0x1c8e202, nFileSizeHigh=0x0, nFileSizeLow=0x30a18, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="xmlrwbin.dll", cAlternateFileName="")) returned 1 [0144.382] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc7a4200, ftCreationTime.dwHighDateTime=0x1c8e202, ftLastAccessTime.dwLowDateTime=0x516f5b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc7a4200, ftLastWriteTime.dwHighDateTime=0x1c8e202, nFileSizeHigh=0x0, nFileSizeLow=0x30a18, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="xmlrwbin.dll", cAlternateFileName="")) returned 0 [0144.382] FindClose (in: hFindFile=0x522f58 | out: hFindFile=0x522f58) returned 1 [0144.382] GetProcessHeap () returned 0x4e0000 [0144.382] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x526e88 | out: hHeap=0x4e0000) returned 1 [0144.382] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5390a1, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xcc5390a1, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x4556f160, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xd8800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wab32.dll", cAlternateFileName="")) returned 1 [0144.382] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0f46d56, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xc0f46d56, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x1f9ed5b0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x10c400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wab32res.dll", cAlternateFileName="")) returned 1 [0144.382] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0f46d56, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xc0f46d56, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x1f9ed5b0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x10c400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wab32res.dll", cAlternateFileName="")) returned 0 [0144.383] FindClose (in: hFindFile=0x522ed8 | out: hFindFile=0x522ed8) returned 1 [0144.383] GetProcessHeap () returned 0x4e0000 [0144.383] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5229c0 | out: hHeap=0x4e0000) returned 1 [0144.383] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="System", cAlternateFileName="")) returned 0 [0144.383] FindClose (in: hFindFile=0x522e98 | out: hFindFile=0x522e98) returned 1 [0144.383] GetProcessHeap () returned 0x4e0000 [0144.383] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x522768 | out: hHeap=0x4e0000) returned 1 [0144.383] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28ae853d, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28ae853d, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28ae853d, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x240000, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0144.383] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xde632680, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xde632680, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="DVD Maker", cAlternateFileName="DVDMAK~1")) returned 1 [0144.383] GetProcessHeap () returned 0x4e0000 [0144.383] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x46) returned 0x4fca30 [0144.383] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\*.*", lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xde632680, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xde632680, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522e98 [0144.383] GetProcessHeap () returned 0x4e0000 [0144.383] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fca30 | out: hHeap=0x4e0000) returned 1 [0144.383] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xde632680, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xde632680, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0144.384] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0ed7565, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0ed7565, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0efd6c5, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="audiodepthconverter.ax", cAlternateFileName="")) returned 1 [0144.384] GetProcessHeap () returned 0x4e0000 [0144.384] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x248) returned 0x53a068 [0144.384] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax" (normalized: "c:\\program files\\dvd maker\\audiodepthconverter.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.385] GetLastError () returned 0x5 [0144.385] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92249ef0, ftCreationTime.dwHighDateTime=0x1d5d657, ftLastAccessTime.dwLowDateTime=0x1671a110, ftLastAccessTime.dwHighDateTime=0x1d56193, ftLastWriteTime.dwLowDateTime=0x1671a110, ftLastWriteTime.dwHighDateTime=0x1d56193, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bitkinex.exe", cAlternateFileName="")) returned 1 [0144.385] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499cc441, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x499cc441, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x499cc441, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1303c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bod_r.TTF", cAlternateFileName="")) returned 1 [0144.385] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\bod_r.TTF" (normalized: "c:\\program files\\dvd maker\\bod_r.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.386] GetLastError () returned 0x5 [0144.386] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0eb1404, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0eb1404, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0ed7565, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="directshowtap.ax", cAlternateFileName="")) returned 1 [0144.386] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\directshowtap.ax" (normalized: "c:\\program files\\dvd maker\\directshowtap.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.386] GetLastError () returned 0x5 [0144.386] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9ae6642, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xc9ae6642, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0xe1601f60, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x227600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DVDMaker.exe", cAlternateFileName="")) returned 1 [0144.386] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa276ca7, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f05f082, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-US", cAlternateFileName="")) returned 1 [0144.386] GetProcessHeap () returned 0x4e0000 [0144.386] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x52) returned 0x529080 [0144.386] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\en-US\\*.*", lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa276ca7, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f05f082, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522ed8 [0144.386] GetProcessHeap () returned 0x4e0000 [0144.386] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x529080 | out: hHeap=0x4e0000) returned 1 [0144.386] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa276ca7, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f05f082, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.386] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xca00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVDMaker.exe.mui", cAlternateFileName="")) returned 1 [0144.386] GetProcessHeap () returned 0x4e0000 [0144.387] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x254) returned 0x53a2b8 [0144.387] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\DVDMaker.exe.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\dvdmaker.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.387] GetLastError () returned 0x5 [0144.387] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="OmdProject.dll.mui", cAlternateFileName="")) returned 1 [0144.387] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\omdproject.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.389] GetLastError () returned 0x5 [0144.389] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMM2CLIP.dll.mui", cAlternateFileName="")) returned 1 [0144.389] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\wmm2clip.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.390] GetLastError () returned 0x5 [0144.390] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMM2CLIP.dll.mui", cAlternateFileName="")) returned 0 [0144.390] FindClose (in: hFindFile=0x522ed8 | out: hFindFile=0x522ed8) returned 1 [0144.390] GetProcessHeap () returned 0x4e0000 [0144.390] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x53a2b8 | out: hHeap=0x4e0000) returned 1 [0144.390] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd559b52d, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xd559b52d, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x499cc441, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xddb8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Eurosti.TTF", cAlternateFileName="")) returned 1 [0144.390] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Eurosti.TTF" (normalized: "c:\\program files\\dvd maker\\eurosti.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.390] GetLastError () returned 0x5 [0144.390] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fieldswitch.ax", cAlternateFileName="")) returned 1 [0144.390] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\fieldswitch.ax" (normalized: "c:\\program files\\dvd maker\\fieldswitch.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.391] GetLastError () returned 0x5 [0144.391] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0bdd9df, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0bdd9df, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="offset.ax", cAlternateFileName="")) returned 1 [0144.391] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\offset.ax" (normalized: "c:\\program files\\dvd maker\\offset.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.392] GetLastError () returned 0x5 [0144.392] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0eb1404, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe46400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OmdBase.dll", cAlternateFileName="")) returned 1 [0144.392] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0efd6c5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0efd6c5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb102e1c7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x432600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OmdProject.dll", cAlternateFileName="")) returned 1 [0144.392] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37b8ac80, ftCreationTime.dwHighDateTime=0x1d5b321, ftLastAccessTime.dwLowDateTime=0xe79fcad0, ftLastAccessTime.dwHighDateTime=0x1d56a73, ftLastWriteTime.dwLowDateTime=0xe79fcad0, ftLastWriteTime.dwHighDateTime=0x1d56a73, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pidgin.exe", cAlternateFileName="")) returned 1 [0144.392] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0b6b5be, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0b6b5be, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0bb787f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1c4600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Pipeline.dll", cAlternateFileName="")) returned 1 [0144.392] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7b5c53e, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xc7b5c53e, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x43aceae0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1cc000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PipeTran.dll", cAlternateFileName="")) returned 1 [0144.392] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0eb1404, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0eb1404, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0eb1404, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x13400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="rtstreamsink.ax", cAlternateFileName="")) returned 1 [0144.392] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\rtstreamsink.ax" (normalized: "c:\\program files\\dvd maker\\rtstreamsink.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.393] GetLastError () returned 0x5 [0144.393] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xce00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="rtstreamsource.ax", cAlternateFileName="")) returned 1 [0144.393] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\rtstreamsource.ax" (normalized: "c:\\program files\\dvd maker\\rtstreamsource.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.394] GetLastError () returned 0x5 [0144.394] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd55c168a, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xd55c168a, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x499cc441, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x18208, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SecretST.TTF", cAlternateFileName="")) returned 1 [0144.394] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\SecretST.TTF" (normalized: "c:\\program files\\dvd maker\\secretst.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.394] GetLastError () returned 0x5 [0144.394] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9f0852f1, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f0852f1, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Shared", cAlternateFileName="")) returned 1 [0144.394] GetProcessHeap () returned 0x4e0000 [0144.394] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x54) returned 0x529080 [0144.394] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\*.*", lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9f0852f1, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f0852f1, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522ed8 [0144.396] GetProcessHeap () returned 0x4e0000 [0144.396] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x529080 | out: hHeap=0x4e0000) returned 1 [0144.396] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9f0852f1, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f0852f1, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.396] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93dab239, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93dab239, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x68934cfd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x30e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common.fxh", cAlternateFileName="")) returned 1 [0144.396] GetProcessHeap () returned 0x4e0000 [0144.396] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x256) returned 0x53a2b8 [0144.396] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\Common.fxh" (normalized: "c:\\program files\\dvd maker\\shared\\common.fxh"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.397] GetLastError () returned 0x5 [0144.397] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93d12cc5, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93d12cc5, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x6895ae5b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6d1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="DissolveAnother.png", cAlternateFileName="")) returned 1 [0144.397] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.398] GetLastError () returned 0x5 [0144.398] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93d38e22, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93d38e22, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x68980fb9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb7835, dwReserved0=0x0, dwReserved1=0x0, cFileName="DissolveNoise.png", cAlternateFileName="")) returned 1 [0144.398] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.398] GetLastError () returned 0x5 [0144.398] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabb4389, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DvdStyles", cAlternateFileName="DVDSTY~1")) returned 1 [0144.398] GetProcessHeap () returned 0x4e0000 [0144.398] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x68) returned 0x4fa058 [0144.398] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabb4389, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522f58 [0144.401] GetProcessHeap () returned 0x4e0000 [0144.401] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0144.401] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabb4389, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.401] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec183f4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec183f4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x278b, dwReserved0=0x0, dwReserved1=0x0, cFileName="16to9Squareframe_Buttongraphic.png", cAlternateFileName="")) returned 1 [0144.401] GetProcessHeap () returned 0x4e0000 [0144.401] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x26a) returned 0x522768 [0144.401] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.402] GetLastError () returned 0x5 [0144.402] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec3e551, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec3e551, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xcd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="16to9Squareframe_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0144.402] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.403] GetLastError () returned 0x5 [0144.403] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec3e551, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec3e551, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xcf4, dwReserved0=0x0, dwReserved1=0x0, cFileName="16to9Squareframe_VideoInset.png", cAlternateFileName="")) returned 1 [0144.403] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.404] GetLastError () returned 0x5 [0144.404] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec646ae, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec646ae, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2e55, dwReserved0=0x0, dwReserved1=0x0, cFileName="4to3Squareframe_Buttongraphic.png", cAlternateFileName="")) returned 1 [0144.404] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.404] GetLastError () returned 0x5 [0144.404] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec646ae, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec646ae, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xce8, dwReserved0=0x0, dwReserved1=0x0, cFileName="4to3Squareframe_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0144.404] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.404] GetLastError () returned 0x5 [0144.404] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec8a80b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec8a80b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="4to3Squareframe_VideoInset.png", cAlternateFileName="")) returned 1 [0144.404] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.404] GetLastError () returned 0x5 [0144.404] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoy", cAlternateFileName="")) returned 1 [0144.404] GetProcessHeap () returned 0x4e0000 [0144.404] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x78) returned 0x4f1b18 [0144.405] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0144.407] GetProcessHeap () returned 0x4e0000 [0144.407] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1b18 | out: hHeap=0x4e0000) returned 1 [0144.407] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.407] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70cace83, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70cace83, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x303d, dwReserved0=0x0, dwReserved1=0x0, cFileName="babyblue.png", cAlternateFileName="")) returned 1 [0144.407] GetProcessHeap () returned 0x4e0000 [0144.407] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x27a) returned 0x5229e0 [0144.407] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.408] GetLastError () returned 0x5 [0144.408] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70d1f29a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70d1f29a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cec0f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5354a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainBackground.wmv", cAlternateFileName="")) returned 1 [0144.408] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.409] GetLastError () returned 0x5 [0144.409] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70d6b554, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70d6b554, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cec0f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4f6ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0144.409] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.409] GetLastError () returned 0x5 [0144.409] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e03ac8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e03ac8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49d12255, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2279e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainToNotesBackground.wmv", cAlternateFileName="")) returned 1 [0144.409] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.422] GetLastError () returned 0x5 [0144.422] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e29c25, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e29c25, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49eb515f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2661e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainToNotesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0144.422] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.422] GetLastError () returned 0x5 [0144.422] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e4fd82, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e4fd82, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49eb515f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1c9de, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainToScenesBackground.wmv", cAlternateFileName="")) returned 1 [0144.422] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.494] GetLastError () returned 0x5 [0144.494] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e4fd82, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e4fd82, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49eb515f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2279e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainToScenesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0144.494] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.494] GetLastError () returned 0x5 [0144.494] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ec2199, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ec2199, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49edb2bd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2666c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyNotesBackground.wmv", cAlternateFileName="")) returned 1 [0144.494] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.494] GetLastError () returned 0x5 [0144.494] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f345b0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70f345b0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49edb2bd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2666c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyNotesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0144.494] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.494] GetLastError () returned 0x5 [0144.494] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f5a70d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70f5a70d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f0141b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2472c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyScenesBackground.wmv", cAlternateFileName="")) returned 1 [0144.495] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.498] GetLastError () returned 0x5 [0144.498] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f8086a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70f8086a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f0141b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1e96c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyScenesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0144.498] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.500] GetLastError () returned 0x5 [0144.500] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70fa69c7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70fa69c7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f0141b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="LightBlueRectangle.PNG", cAlternateFileName="")) returned 1 [0144.500] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\lightbluerectangle.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.500] GetLastError () returned 0x5 [0144.500] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70fccb24, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70fccb24, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f27579, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MainMenuButtonIcon.png", cAlternateFileName="")) returned 1 [0144.500] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\mainmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.500] GetLastError () returned 0x5 [0144.501] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7103ef3b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7103ef3b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf63, dwReserved0=0x0, dwReserved1=0x0, cFileName="navSubpicture.png", cAlternateFileName="")) returned 1 [0144.501] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\navsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.501] GetLastError () returned 0x5 [0144.501] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70fccb24, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70fccb24, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f27579, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1197, dwReserved0=0x0, dwReserved1=0x0, cFileName="nav_leftarrow.png", cAlternateFileName="")) returned 1 [0144.502] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_leftarrow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.502] GetLastError () returned 0x5 [0144.502] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ff2c81, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ff2c81, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f27579, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="nav_rightarrow.png", cAlternateFileName="")) returned 1 [0144.502] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_rightarrow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.502] GetLastError () returned 0x5 [0144.502] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71018dde, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71018dde, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1068, dwReserved0=0x0, dwReserved1=0x0, cFileName="nav_uparrow.png", cAlternateFileName="")) returned 1 [0144.502] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_uparrow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.502] GetLastError () returned 0x5 [0144.502] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71018dde, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71018dde, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1068, dwReserved0=0x0, dwReserved1=0x0, cFileName="nav_uparrow.png", cAlternateFileName="")) returned 0 [0144.502] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0144.504] GetProcessHeap () returned 0x4e0000 [0144.504] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5229e0 | out: hHeap=0x4e0000) returned 1 [0144.504] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyGirl", cAlternateFileName="")) returned 1 [0144.504] GetProcessHeap () returned 0x4e0000 [0144.504] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x7a) returned 0x4fa058 [0144.504] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0144.511] GetProcessHeap () returned 0x4e0000 [0144.512] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0144.512] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.512] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72858c15, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72858c15, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xab3, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-background.png", cAlternateFileName="")) returned 1 [0144.512] GetProcessHeap () returned 0x4e0000 [0144.512] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x27c) returned 0x5229e0 [0144.512] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.512] GetLastError () returned 0x5 [0144.512] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72858c15, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72858c15, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-highlight.png", cAlternateFileName="")) returned 1 [0144.512] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.513] GetLastError () returned 0x5 [0144.513] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7287ed72, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7287ed72, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fbfaf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x60f, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-image-mask.png", cAlternateFileName="")) returned 1 [0144.513] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-image-mask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.513] GetLastError () returned 0x5 [0144.513] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72832ab8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72832ab8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fbfaf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4c15, dwReserved0=0x0, dwReserved1=0x0, cFileName="babypink.png", cAlternateFileName="")) returned 1 [0144.513] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\babypink.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.514] GetLastError () returned 0x5 [0144.514] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x728a4ecf, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x728a4ecf, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fbfaf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xcc1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1 [0144.514] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.514] GetLastError () returned 0x5 [0144.514] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x728cb02c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x728cb02c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fe5c4f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2c432, dwReserved0=0x0, dwReserved1=0x0, cFileName="bear_formatted_matte2.wmv", cAlternateFileName="")) returned 1 [0144.514] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.515] GetLastError () returned 0x5 [0144.515] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x728f1189, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x728f1189, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a058069, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2c44a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bear_Formatted_MATTE2_PAL.wmv", cAlternateFileName="")) returned 1 [0144.515] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.515] GetLastError () returned 0x5 [0144.515] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729172e6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729172e6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a351bc1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x39ef2, dwReserved0=0x0, dwReserved1=0x0, cFileName="bear_formatted_rgb6.wmv", cAlternateFileName="")) returned 1 [0144.515] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.515] GetLastError () returned 0x5 [0144.515] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729635a0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729635a0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x41c0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bear_Formatted_RGB6_PAL.wmv", cAlternateFileName="")) returned 1 [0144.515] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.515] GetLastError () returned 0x5 [0144.516] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729af85a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729af85a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-back-static.png", cAlternateFileName="")) returned 1 [0144.516] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-back-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.516] GetLastError () returned 0x5 [0144.516] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729af85a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729af85a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdfc, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-next-static.png", cAlternateFileName="")) returned 1 [0144.517] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-next-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.517] GetLastError () returned 0x5 [0144.517] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729d59b7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729d59b7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xe0b, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-previous-static.png", cAlternateFileName="")) returned 1 [0144.517] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-previous-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.517] GetLastError () returned 0x5 [0144.517] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729d59b7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729d59b7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a39de7d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x75d, dwReserved0=0x0, dwReserved1=0x0, cFileName="button-highlight.png", cAlternateFileName="")) returned 1 [0144.517] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\button-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.517] GetLastError () returned 0x5 [0144.517] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729d59b7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729d59b7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a39de7d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x55f, dwReserved0=0x0, dwReserved1=0x0, cFileName="chapters-static.png", cAlternateFileName="")) returned 1 [0144.517] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\chapters-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.518] GetLastError () returned 0x5 [0144.518] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729fbb14, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729fbb14, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4aba6851, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8df12, dwReserved0=0x0, dwReserved1=0x0, cFileName="content-background.png", cAlternateFileName="")) returned 1 [0144.519] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.519] GetLastError () returned 0x5 [0144.519] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72a47dce, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72a47dce, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b362f69, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="content-foreground.png", cAlternateFileName="")) returned 1 [0144.519] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-foreground.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.519] GetLastError () returned 0x5 [0144.519] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72a6df2b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72a6df2b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b362f69, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb8c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="curtains.png", cAlternateFileName="")) returned 1 [0144.519] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\curtains.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.519] GetLastError () returned 0x5 [0144.519] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b52759, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b52759, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b3fb4e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12d98, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_precomp_matte.wmv", cAlternateFileName="")) returned 1 [0144.519] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.520] GetLastError () returned 0x5 [0144.520] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b52759, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b52759, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b3fb4e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x14cd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_PreComp_MATTE_PAL.wmv", cAlternateFileName="")) returned 1 [0144.520] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.520] GetLastError () returned 0x5 [0144.520] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b788b6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b788b6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b42163f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x26618, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_trans_matte.wmv", cAlternateFileName="")) returned 1 [0144.520] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.521] GetLastError () returned 0x5 [0144.521] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b9ea13, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b9ea13, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b42163f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x28558, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_trans_MATTE_PAL.wmv", cAlternateFileName="")) returned 1 [0144.521] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.521] GetLastError () returned 0x5 [0144.521] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b0649f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b0649f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b44779d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2e31e, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_trans_rgb.wmv", cAlternateFileName="")) returned 1 [0144.521] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.522] GetLastError () returned 0x5 [0144.522] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b2c5fc, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b2c5fc, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5c4549, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x39e98, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_trans_RGB_PAL.wmv", cAlternateFileName="")) returned 1 [0144.522] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.522] GetLastError () returned 0x5 [0144.522] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72a94088, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72a94088, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5c4549, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x609, dwReserved0=0x0, dwReserved1=0x0, cFileName="highlight.png", cAlternateFileName="")) returned 1 [0144.522] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.522] GetLastError () returned 0x5 [0144.522] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72aba1e5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72aba1e5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x239b, dwReserved0=0x0, dwReserved1=0x0, cFileName="mainimage-mask.png", cAlternateFileName="")) returned 1 [0144.522] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\mainimage-mask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.523] GetLastError () returned 0x5 [0144.523] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72ae0342, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72ae0342, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x559, dwReserved0=0x0, dwReserved1=0x0, cFileName="notes-static.png", cAlternateFileName="")) returned 1 [0144.523] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\notes-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.524] GetLastError () returned 0x5 [0144.524] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72ae0342, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72ae0342, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x505, dwReserved0=0x0, dwReserved1=0x0, cFileName="play-static.png", cAlternateFileName="")) returned 1 [0144.524] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\play-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.524] GetLastError () returned 0x5 [0144.524] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72ae0342, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72ae0342, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x505, dwReserved0=0x0, dwReserved1=0x0, cFileName="play-static.png", cAlternateFileName="")) returned 0 [0144.524] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0144.526] GetProcessHeap () returned 0x4e0000 [0144.526] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5229e0 | out: hHeap=0x4e0000) returned 1 [0144.526] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ecb0968, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ecb0968, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1276, dwReserved0=0x0, dwReserved1=0x0, cFileName="BlackRectangle.bmp", cAlternateFileName="")) returned 1 [0144.526] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\blackrectangle.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.528] GetLastError () returned 0x5 [0144.528] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebf2297, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ebf2297, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6a91, dwReserved0=0x0, dwReserved1=0x0, cFileName="circleround_glass.png", cAlternateFileName="")) returned 1 [0144.528] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_glass.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.528] GetLastError () returned 0x5 [0144.528] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebf2297, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ebf2297, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf26, dwReserved0=0x0, dwReserved1=0x0, cFileName="circleround_selectionsubpicture.png", cAlternateFileName="")) returned 1 [0144.528] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.529] GetLastError () returned 0x5 [0144.529] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebcc13a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ebcc13a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="circleround_videoinset.png", cAlternateFileName="")) returned 1 [0144.529] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.529] GetLastError () returned 0x5 [0144.529] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6edbb2f3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6edbb2f3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c53d379, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6a91, dwReserved0=0x0, dwReserved1=0x0, cFileName="Circle_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0144.529] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.530] GetLastError () returned 0x5 [0144.530] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e990cc7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e990cc7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c7063e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="circle_glass_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0144.530] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_glass_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.530] GetLastError () returned 0x5 [0144.530] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ede1450, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ede1450, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c7063e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf26, dwReserved0=0x0, dwReserved1=0x0, cFileName="Circle_SelectionSubpictureA.png", cAlternateFileName="")) returned 1 [0144.530] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpicturea.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.530] GetLastError () returned 0x5 [0144.530] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ede1450, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ede1450, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c7063e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Circle_SelectionSubpictureB.png", cAlternateFileName="")) returned 1 [0144.530] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpictureb.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.531] GetLastError () returned 0x5 [0144.531] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee2d70a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee2d70a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Circle_VideoInset.png", cAlternateFileName="")) returned 1 [0144.531] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.531] GetLastError () returned 0x5 [0144.531] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea030de, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea030de, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9fff39, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cloud_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0144.531] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\cloud_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\cloud_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.531] GetLastError () returned 0x5 [0144.532] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee2d70a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee2d70a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9fff39, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5c9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dot.png", cAlternateFileName="")) returned 1 [0144.532] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.532] GetLastError () returned 0x5 [0144.532] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee799c4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee799c4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4cb30a29, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x422c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DvdTransform.fx", cAlternateFileName="")) returned 1 [0144.532] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dvdtransform.fx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.532] GetLastError () returned 0x5 [0144.532] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f465237, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlipPage", cAlternateFileName="")) returned 1 [0144.532] GetProcessHeap () returned 0x4e0000 [0144.532] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x7a) returned 0x4fa058 [0144.532] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f465237, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0144.539] GetProcessHeap () returned 0x4e0000 [0144.540] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0144.540] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f465237, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.540] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe188e9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe188e9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0144.540] GetProcessHeap () returned 0x4e0000 [0144.540] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x27c) returned 0x5229e0 [0144.540] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.541] GetLastError () returned 0x5 [0144.541] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe3ea46, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe3ea46, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0x0, dwReserved1=0x0, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 1 [0144.541] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\203x8subpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.542] GetLastError () returned 0x5 [0144.542] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fed6fba, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fed6fba, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0144.542] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.543] GetLastError () returned 0x5 [0144.543] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6feb0e5d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6feb0e5d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0144.543] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.544] GetLastError () returned 0x5 [0144.544] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6feb0e5d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6feb0e5d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0144.544] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.544] GetLastError () returned 0x5 [0144.544] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe64ba3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe64ba3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0144.545] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.545] GetLastError () returned 0x5 [0144.545] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe64ba3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe64ba3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0144.545] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.546] GetLastError () returned 0x5 [0144.546] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe8ad00, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe8ad00, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0144.546] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.547] GetLastError () returned 0x5 [0144.547] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fdf278c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fdf278c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5fc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagecurl.png", cAlternateFileName="")) returned 1 [0144.547] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\pagecurl.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\pagecurl.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.547] GetLastError () returned 0x5 [0144.548] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fdf278c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fdf278c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5fc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagecurl.png", cAlternateFileName="")) returned 0 [0144.548] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0144.549] GetProcessHeap () returned 0x4e0000 [0144.549] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5229e0 | out: hHeap=0x4e0000) returned 1 [0144.549] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa63097e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a65ec8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Full", cAlternateFileName="")) returned 1 [0144.549] GetProcessHeap () returned 0x4e0000 [0144.549] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x72) returned 0x4f1b18 [0144.549] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa63097e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a65ec8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0144.551] GetProcessHeap () returned 0x4e0000 [0144.551] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1b18 | out: hHeap=0x4e0000) returned 1 [0144.551] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa63097e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a65ec8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.551] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f12724e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f12724e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0144.551] GetProcessHeap () returned 0x4e0000 [0144.551] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x274) returned 0x5229e0 [0144.551] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.552] GetLastError () returned 0x5 [0144.552] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f173508, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f173508, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x0, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 1 [0144.552] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.553] GetLastError () returned 0x5 [0144.553] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f20ba7c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f20ba7c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="dotsdarkoverlay.png", cAlternateFileName="")) returned 1 [0144.553] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotsdarkoverlay.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.554] GetLastError () returned 0x5 [0144.554] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f20ba7c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f20ba7c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x123d, dwReserved0=0x0, dwReserved1=0x0, cFileName="dotslightoverlay.png", cAlternateFileName="")) returned 1 [0144.554] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotslightoverlay.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.554] GetLastError () returned 0x5 [0144.554] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f12724e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f12724e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6794, dwReserved0=0x0, dwReserved1=0x0, cFileName="full.png", cAlternateFileName="")) returned 1 [0144.554] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\full.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.558] GetLastError () returned 0x5 [0144.558] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1bf7c2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1bf7c2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0144.558] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.559] GetLastError () returned 0x5 [0144.559] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1bf7c2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1bf7c2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0144.559] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.560] GetLastError () returned 0x5 [0144.560] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.561] GetLastError () returned 0x5 [0144.561] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.561] GetLastError () returned 0x5 [0144.561] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.562] GetLastError () returned 0x5 [0144.562] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.563] GetLastError () returned 0x5 [0144.563] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\pushplaysubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.563] GetLastError () returned 0x5 [0144.564] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0144.565] GetProcessHeap () returned 0x4e0000 [0144.566] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5229e0 | out: hHeap=0x4e0000) returned 1 [0144.566] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.567] GetLastError () returned 0x5 [0144.567] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_glass_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.567] GetLastError () returned 0x5 [0144.567] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.567] GetLastError () returned 0x5 [0144.567] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.568] GetLastError () returned 0x5 [0144.568] GetProcessHeap () returned 0x4e0000 [0144.568] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x7a) returned 0x4fa058 [0144.568] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fd11ff, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa787f65, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa108fe2a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0144.570] GetProcessHeap () returned 0x4e0000 [0144.570] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0144.571] GetProcessHeap () returned 0x4e0000 [0144.571] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x27c) returned 0x5229e0 [0144.571] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.571] GetLastError () returned 0x5 [0144.571] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.572] GetLastError () returned 0x5 [0144.572] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\colorcycle.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.572] GetLastError () returned 0x5 [0144.572] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\huemainsubpicture2.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.572] GetLastError () returned 0x5 [0144.572] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.573] GetLastError () returned 0x5 [0144.573] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.573] GetLastError () returned 0x5 [0144.573] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.573] GetLastError () returned 0x5 [0144.573] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.573] GetLastError () returned 0x5 [0144.573] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.573] GetLastError () returned 0x5 [0144.574] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.574] GetLastError () returned 0x5 [0144.574] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\title_stripe.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.574] GetLastError () returned 0x5 [0144.574] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0144.575] GetProcessHeap () returned 0x4e0000 [0144.575] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5229e0 | out: hHeap=0x4e0000) returned 1 [0144.575] GetProcessHeap () returned 0x4e0000 [0144.575] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x84) returned 0x4fa058 [0144.575] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a3fc59, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0144.577] GetProcessHeap () returned 0x4e0000 [0144.577] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0144.577] GetProcessHeap () returned 0x4e0000 [0144.577] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x286) returned 0x5229e0 [0144.578] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.578] GetLastError () returned 0x5 [0144.578] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\203x8subpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.579] GetLastError () returned 0x5 [0144.579] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\blackbars60.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.579] GetLastError () returned 0x5 [0144.580] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\layers.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.580] GetLastError () returned 0x5 [0144.580] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.581] GetLastError () returned 0x5 [0144.581] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.582] GetLastError () returned 0x5 [0144.582] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.583] GetLastError () returned 0x5 [0144.583] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.584] GetLastError () returned 0x5 [0144.584] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.584] GetLastError () returned 0x5 [0144.585] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.585] GetLastError () returned 0x5 [0144.585] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0144.587] GetProcessHeap () returned 0x4e0000 [0144.587] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5229e0 | out: hHeap=0x4e0000) returned 1 [0144.589] GetProcessHeap () returned 0x4e0000 [0144.589] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x7a) returned 0x4fa058 [0144.590] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab41c3c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fdc8b88, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0144.592] GetProcessHeap () returned 0x4e0000 [0144.592] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0144.592] GetProcessHeap () returned 0x4e0000 [0144.592] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x27c) returned 0x5229e0 [0144.592] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.593] GetLastError () returned 0x5 [0144.593] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.593] GetLastError () returned 0x5 [0144.593] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-image-mask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.593] GetLastError () returned 0x5 [0144.593] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-overlay.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.593] GetLastError () returned 0x5 [0144.593] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.594] GetLastError () returned 0x5 [0144.594] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-back-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.594] GetLastError () returned 0x5 [0144.595] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-next-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.595] GetLastError () returned 0x5 [0144.595] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-previous-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.595] GetLastError () returned 0x5 [0144.596] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.596] GetLastError () returned 0x5 [0144.596] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-overlay.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.596] GetLastError () returned 0x5 [0144.596] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Memories_buttonClear.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\memories_buttonclear.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.596] GetLastError () returned 0x5 [0144.596] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_btn-back-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.597] GetLastError () returned 0x5 [0144.597] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_content-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.597] GetLastError () returned 0x5 [0144.598] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\scrapbook.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.598] GetLastError () returned 0x5 [0144.598] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_content-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.598] GetLastError () returned 0x5 [0144.598] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_mainimage-mask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.598] GetLastError () returned 0x5 [0144.598] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_select-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.599] GetLastError () returned 0x5 [0144.599] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0144.600] GetProcessHeap () returned 0x4e0000 [0144.600] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5229e0 | out: hHeap=0x4e0000) returned 1 [0144.600] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\menu_style_default_thumbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.601] GetLastError () returned 0x5 [0144.601] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.602] GetLastError () returned 0x5 [0144.602] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.602] GetLastError () returned 0x5 [0144.602] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.602] GetLastError () returned 0x5 [0144.602] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.603] GetLastError () returned 0x5 [0144.603] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.603] GetLastError () returned 0x5 [0144.603] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.603] GetLastError () returned 0x5 [0144.603] GetProcessHeap () returned 0x4e0000 [0144.603] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x76) returned 0x4f1b18 [0144.604] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f465237, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7ae1d4, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f48b4a6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0144.606] GetProcessHeap () returned 0x4e0000 [0144.606] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1b18 | out: hHeap=0x4e0000) returned 1 [0144.606] GetProcessHeap () returned 0x4e0000 [0144.606] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x278) returned 0x5229e0 [0144.606] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.606] GetLastError () returned 0x5 [0144.606] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.606] GetLastError () returned 0x5 [0144.606] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\decorative_rule.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.607] GetLastError () returned 0x5 [0144.607] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.607] GetLastError () returned 0x5 [0144.607] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.608] GetLastError () returned 0x5 [0144.608] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.608] GetLastError () returned 0x5 [0144.608] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.608] GetLastError () returned 0x5 [0144.608] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.608] GetLastError () returned 0x5 [0144.608] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.608] GetLastError () returned 0x5 [0144.608] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\vintage.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.609] GetLastError () returned 0x5 [0144.609] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0144.610] GetProcessHeap () returned 0x4e0000 [0144.610] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5229e0 | out: hHeap=0x4e0000) returned 1 [0144.610] GetProcessHeap () returned 0x4e0000 [0144.610] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x80) returned 0x4fa058 [0144.610] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f9e8c42, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0144.613] GetProcessHeap () returned 0x4e0000 [0144.613] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0144.613] GetProcessHeap () returned 0x4e0000 [0144.613] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x282) returned 0x5229e0 [0144.613] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\720x480blacksquare.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.614] GetLastError () returned 0x5 [0144.614] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.614] GetLastError () returned 0x5 [0144.614] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttoniconsubpictur.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.614] GetLastError () returned 0x5 [0144.614] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.615] GetLastError () returned 0x5 [0144.615] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.615] GetLastError () returned 0x5 [0144.615] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.616] GetLastError () returned 0x5 [0144.616] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttoniconsubpict.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.616] GetLastError () returned 0x5 [0144.616] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\performance.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.617] GetLastError () returned 0x5 [0144.617] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_mask1.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.617] GetLastError () returned 0x5 [0144.617] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_subpicture1.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.617] GetLastError () returned 0x5 [0144.617] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.617] GetLastError () returned 0x5 [0144.618] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttoniconsubpi.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.618] GetLastError () returned 0x5 [0144.618] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\redmenu.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.619] GetLastError () returned 0x5 [0144.619] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.619] GetLastError () returned 0x5 [0144.619] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.619] GetLastError () returned 0x5 [0144.619] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.620] GetLastError () returned 0x5 [0144.620] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.620] GetLastError () returned 0x5 [0144.620] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.620] GetLastError () returned 0x5 [0144.620] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.621] GetLastError () returned 0x5 [0144.621] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.623] GetLastError () returned 0x5 [0144.623] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.624] GetLastError () returned 0x5 [0144.624] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.624] GetLastError () returned 0x5 [0144.624] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.624] GetLastError () returned 0x5 [0144.624] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\usercontent_16x9_imagemask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.624] GetLastError () returned 0x5 [0144.624] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\whitemenu.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.624] GetLastError () returned 0x5 [0144.625] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0144.626] GetProcessHeap () returned 0x4e0000 [0144.626] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5229e0 | out: hHeap=0x4e0000) returned 1 [0144.626] GetProcessHeap () returned 0x4e0000 [0144.626] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x72) returned 0x4f1b18 [0144.626] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa15a10e8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa198102e, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0144.628] GetProcessHeap () returned 0x4e0000 [0144.628] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1b18 | out: hHeap=0x4e0000) returned 1 [0144.628] GetProcessHeap () returned 0x4e0000 [0144.628] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x274) returned 0x5229e0 [0144.628] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.628] GetLastError () returned 0x5 [0144.628] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.629] GetLastError () returned 0x5 [0144.629] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.630] GetLastError () returned 0x5 [0144.630] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.630] GetLastError () returned 0x5 [0144.630] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-over-select.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.631] GetLastError () returned 0x5 [0144.631] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.631] GetLastError () returned 0x5 [0144.631] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-over-select.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.631] GetLastError () returned 0x5 [0144.631] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.631] GetLastError () returned 0x5 [0144.631] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-over-dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.632] GetLastError () returned 0x5 [0144.632] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-over-select.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.633] GetLastError () returned 0x5 [0144.633] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.633] GetLastError () returned 0x5 [0144.633] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-border.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.633] GetLastError () returned 0x5 [0144.633] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.633] GetLastError () returned 0x5 [0144.633] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-imagemask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.634] GetLastError () returned 0x5 [0144.634] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-shadow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.634] GetLastError () returned 0x5 [0144.634] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-backglow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.635] GetLastError () returned 0x5 [0144.635] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-border.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.635] GetLastError () returned 0x5 [0144.635] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-imagemask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.636] GetLastError () returned 0x5 [0144.636] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_notes-txt-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.636] GetLastError () returned 0x5 [0144.636] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\rollinghills.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.636] GetLastError () returned 0x5 [0144.636] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.636] GetLastError () returned 0x5 [0144.636] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.637] GetLastError () returned 0x5 [0144.637] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.637] GetLastError () returned 0x5 [0144.638] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.638] GetLastError () returned 0x5 [0144.638] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.638] GetLastError () returned 0x5 [0144.638] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.639] GetLastError () returned 0x5 [0144.639] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0144.640] GetProcessHeap () returned 0x4e0000 [0144.640] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5229e0 | out: hHeap=0x4e0000) returned 1 [0144.640] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.640] GetLastError () returned 0x5 [0144.640] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.641] GetLastError () returned 0x5 [0144.641] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.641] GetLastError () returned 0x5 [0144.641] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.642] GetLastError () returned 0x5 [0144.642] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.642] GetLastError () returned 0x5 [0144.642] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.642] GetLastError () returned 0x5 [0144.642] GetProcessHeap () returned 0x4e0000 [0144.642] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x72) returned 0x4f1b18 [0144.642] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa11287e6, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa73ba87, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa119af33, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0144.644] GetProcessHeap () returned 0x4e0000 [0144.645] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1b18 | out: hHeap=0x4e0000) returned 1 [0144.645] GetProcessHeap () returned 0x4e0000 [0144.645] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x274) returned 0x5229e0 [0144.645] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.645] GetLastError () returned 0x5 [0144.645] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047_576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.645] GetLastError () returned 0x5 [0144.645] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.645] GetLastError () returned 0x5 [0144.699] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0144.699] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0144.700] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0144.700] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.700] GetProcessHeap () returned 0x4e0000 [0144.700] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0144.700] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30) returned 1 [0144.700] CryptDestroyKey (hKey=0x522fd8) returned 1 [0144.700] WriteFile (in: hFile=0x100, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24defc8*=0x30, lpOverlapped=0x0) returned 1 [0144.702] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0144.702] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0144.702] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0144.703] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0144.703] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0144.703] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0144.703] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.703] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.703] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4360, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x4360, lpOverlapped=0x0) returned 1 [0144.704] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x4360, dwBufLen=0x4360 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x4360) returned 1 [0144.704] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.704] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x4360, lpOverlapped=0x0) returned 1 [0144.705] CryptDestroyKey (hKey=0x522fd8) returned 1 [0144.705] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x4424, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.705] SetEndOfFile (hFile=0x100) returned 1 [0144.708] GetProcessHeap () returned 0x4e0000 [0144.708] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0144.708] GetProcessHeap () returned 0x4e0000 [0144.708] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0144.708] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0144.709] CloseHandle (hObject=0x100) returned 1 [0144.709] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x5ed7d9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x4932, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="as90.xsl", cAlternateFileName="")) returned 1 [0144.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0144.710] GetProcessHeap () returned 0x4e0000 [0144.710] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0144.710] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0144.710] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0144.710] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xe, lpOverlapped=0x0) returned 1 [0144.712] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0144.713] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.713] GetProcessHeap () returned 0x4e0000 [0144.713] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0144.713] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30) returned 1 [0144.713] CryptDestroyKey (hKey=0x522fd8) returned 1 [0144.713] WriteFile (in: hFile=0x100, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24defc8*=0x30, lpOverlapped=0x0) returned 1 [0144.713] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0144.713] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0144.713] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0144.713] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0144.713] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0144.713] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0144.713] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.713] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.713] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4932, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x4932, lpOverlapped=0x0) returned 1 [0144.714] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x4940, dwBufLen=0x4940 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x4940) returned 1 [0144.715] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.715] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4940, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x4940, lpOverlapped=0x0) returned 1 [0144.715] CryptDestroyKey (hKey=0x522fd8) returned 1 [0144.715] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x4a04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.715] SetEndOfFile (hFile=0x100) returned 1 [0144.718] GetProcessHeap () returned 0x4e0000 [0144.718] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0144.718] GetProcessHeap () returned 0x4e0000 [0144.718] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0144.718] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0144.719] CloseHandle (hObject=0x100) returned 1 [0144.719] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa81fdc00, ftCreationTime.dwHighDateTime=0x1c8dd0e, ftLastAccessTime.dwLowDateTime=0x51494530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa81fdc00, ftLastWriteTime.dwHighDateTime=0x1c8dd0e, nFileSizeHigh=0x0, nFileSizeLow=0x78e4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Informix.xsl", cAlternateFileName="")) returned 1 [0144.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0144.720] GetProcessHeap () returned 0x4e0000 [0144.720] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0144.720] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0144.720] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0144.720] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xc, lpOverlapped=0x0) returned 1 [0144.723] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0144.723] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.723] GetProcessHeap () returned 0x4e0000 [0144.723] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0144.723] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0144.723] CryptDestroyKey (hKey=0x522fd8) returned 1 [0144.723] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0144.723] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0144.723] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0144.723] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0144.723] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0144.723] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0144.724] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0144.724] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.724] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.724] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x78e4, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x78e4, lpOverlapped=0x0) returned 1 [0144.725] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x78f0, dwBufLen=0x78f0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x78f0) returned 1 [0144.725] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.725] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x78f0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x78f0, lpOverlapped=0x0) returned 1 [0144.726] CryptDestroyKey (hKey=0x522fd8) returned 1 [0144.726] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x79c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.726] SetEndOfFile (hFile=0x100) returned 1 [0144.729] GetProcessHeap () returned 0x4e0000 [0144.729] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0144.729] GetProcessHeap () returned 0x4e0000 [0144.729] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0144.729] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0144.730] CloseHandle (hObject=0x100) returned 1 [0144.730] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51494530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x712e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msjet.xsl", cAlternateFileName="")) returned 1 [0144.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0144.730] GetProcessHeap () returned 0x4e0000 [0144.730] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0144.730] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0144.730] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0144.731] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x2, lpOverlapped=0x0) returned 1 [0144.733] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0144.733] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.733] GetProcessHeap () returned 0x4e0000 [0144.733] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0144.733] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30) returned 1 [0144.733] CryptDestroyKey (hKey=0x522fd8) returned 1 [0144.733] WriteFile (in: hFile=0x100, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24defc8*=0x30, lpOverlapped=0x0) returned 1 [0144.733] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0144.733] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0144.733] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0144.733] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0144.733] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0144.734] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0144.734] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.734] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.734] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x712e, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x712e, lpOverlapped=0x0) returned 1 [0144.735] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x7130, dwBufLen=0x7130 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x7130) returned 1 [0144.735] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.735] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7130, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x7130, lpOverlapped=0x0) returned 1 [0144.736] CryptDestroyKey (hKey=0x522fd8) returned 1 [0144.736] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x71f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.736] SetEndOfFile (hFile=0x100) returned 1 [0144.739] GetProcessHeap () returned 0x4e0000 [0144.739] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0144.739] GetProcessHeap () returned 0x4e0000 [0144.739] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0144.739] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0144.740] CloseHandle (hObject=0x100) returned 1 [0144.740] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51552c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x851c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sql2000.xsl", cAlternateFileName="")) returned 1 [0144.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0144.741] GetProcessHeap () returned 0x4e0000 [0144.741] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0144.741] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0144.741] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0144.741] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0144.743] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0144.743] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.743] GetProcessHeap () returned 0x4e0000 [0144.743] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0144.743] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0144.744] CryptDestroyKey (hKey=0x522fd8) returned 1 [0144.744] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0144.744] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0144.744] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0144.744] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0144.744] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0144.744] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0144.744] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0144.744] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.744] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.744] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x851c, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x851c, lpOverlapped=0x0) returned 1 [0144.746] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x8520, dwBufLen=0x8520 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x8520) returned 1 [0144.746] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.746] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x8520, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x8520, lpOverlapped=0x0) returned 1 [0144.746] CryptDestroyKey (hKey=0x522fd8) returned 1 [0144.746] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x85f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.747] SetEndOfFile (hFile=0x100) returned 1 [0144.749] GetProcessHeap () returned 0x4e0000 [0144.749] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0144.749] GetProcessHeap () returned 0x4e0000 [0144.750] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0144.750] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0144.751] CloseHandle (hObject=0x100) returned 1 [0144.751] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x7d92, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sql70.xsl", cAlternateFileName="")) returned 1 [0144.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0144.755] GetProcessHeap () returned 0x4e0000 [0144.755] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0144.755] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0144.755] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0144.755] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xe, lpOverlapped=0x0) returned 1 [0144.759] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0144.759] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.759] GetProcessHeap () returned 0x4e0000 [0144.759] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0144.759] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30) returned 1 [0144.759] CryptDestroyKey (hKey=0x522fd8) returned 1 [0144.760] WriteFile (in: hFile=0x100, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24defc8*=0x30, lpOverlapped=0x0) returned 1 [0144.760] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0144.760] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0144.760] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0144.760] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0144.760] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0144.760] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0144.760] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.760] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.760] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7d92, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x7d92, lpOverlapped=0x0) returned 1 [0144.762] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x7da0, dwBufLen=0x7da0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x7da0) returned 1 [0144.762] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.762] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7da0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x7da0, lpOverlapped=0x0) returned 1 [0144.762] CryptDestroyKey (hKey=0x522fd8) returned 1 [0144.762] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x7e64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.762] SetEndOfFile (hFile=0x100) returned 1 [0144.765] GetProcessHeap () returned 0x4e0000 [0144.765] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0144.765] GetProcessHeap () returned 0x4e0000 [0144.765] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0144.765] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0144.766] CloseHandle (hObject=0x100) returned 1 [0144.766] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51552c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x9a5b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sql90.xsl", cAlternateFileName="")) returned 1 [0144.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0144.767] GetProcessHeap () returned 0x4e0000 [0144.767] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0144.767] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0144.767] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0144.767] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x5, lpOverlapped=0x0) returned 1 [0144.770] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0144.770] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.770] GetProcessHeap () returned 0x4e0000 [0144.770] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0144.770] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30) returned 1 [0144.770] CryptDestroyKey (hKey=0x522fd8) returned 1 [0144.770] WriteFile (in: hFile=0x100, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24defc8*=0x30, lpOverlapped=0x0) returned 1 [0144.770] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0144.770] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0144.770] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0144.770] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0144.770] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0144.771] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0144.771] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.771] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.771] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x9a5b, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x9a5b, lpOverlapped=0x0) returned 1 [0144.772] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x9a60, dwBufLen=0x9a60 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x9a60) returned 1 [0144.772] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.772] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x9a60, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x9a60, lpOverlapped=0x0) returned 1 [0144.772] CryptDestroyKey (hKey=0x522fd8) returned 1 [0144.772] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x9b24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.772] SetEndOfFile (hFile=0x100) returned 1 [0144.775] GetProcessHeap () returned 0x4e0000 [0144.775] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0144.775] GetProcessHeap () returned 0x4e0000 [0144.775] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0144.775] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0144.777] CloseHandle (hObject=0x100) returned 1 [0144.777] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa81fdc00, ftCreationTime.dwHighDateTime=0x1c8dd0e, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa81fdc00, ftLastWriteTime.dwHighDateTime=0x1c8dd0e, nFileSizeHigh=0x0, nFileSizeLow=0x745e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Sybase.xsl", cAlternateFileName="")) returned 1 [0144.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0144.778] GetProcessHeap () returned 0x4e0000 [0144.778] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0144.778] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0144.778] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0144.778] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x2, lpOverlapped=0x0) returned 1 [0144.780] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0144.781] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.781] GetProcessHeap () returned 0x4e0000 [0144.781] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0144.781] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24defa8*=0x30) returned 1 [0144.781] CryptDestroyKey (hKey=0x522fd8) returned 1 [0144.781] WriteFile (in: hFile=0x100, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24defc8*=0x30, lpOverlapped=0x0) returned 1 [0144.781] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0144.781] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0144.781] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0144.781] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0144.781] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0144.781] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0144.781] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.781] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.782] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x745e, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x745e, lpOverlapped=0x0) returned 1 [0144.783] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x7460, dwBufLen=0x7460 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x7460) returned 1 [0144.783] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.783] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7460, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x7460, lpOverlapped=0x0) returned 1 [0144.784] CryptDestroyKey (hKey=0x522fd8) returned 1 [0144.784] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x7524, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.784] SetEndOfFile (hFile=0x100) returned 1 [0144.787] GetProcessHeap () returned 0x4e0000 [0144.787] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0144.787] GetProcessHeap () returned 0x4e0000 [0144.787] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0144.787] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0144.788] CloseHandle (hObject=0x100) returned 1 [0144.788] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa81fdc00, ftCreationTime.dwHighDateTime=0x1c8dd0e, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa81fdc00, ftLastWriteTime.dwHighDateTime=0x1c8dd0e, nFileSizeHigh=0x0, nFileSizeLow=0x745e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Sybase.xsl", cAlternateFileName="")) returned 0 [0144.788] GetProcessHeap () returned 0x4e0000 [0144.788] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0144.788] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0144.788] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df020 | out: pbData=0x4f53d8, pdwDataLen=0x24df020) returned 1 [0144.788] CryptDestroyKey (hKey=0x522fd8) returned 1 [0144.788] GetProcessHeap () returned 0x4e0000 [0144.788] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0144.788] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0144.789] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df020 | out: pbData=0x4f5420, pdwDataLen=0x24df020) returned 1 [0144.789] CryptDestroyKey (hKey=0x522fd8) returned 1 [0144.789] GetProcessHeap () returned 0x4e0000 [0144.789] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x524380 [0144.789] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0144.789] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x524380, pdwDataLen=0x24df020 | out: pbData=0x524380, pdwDataLen=0x24df020) returned 1 [0144.789] CryptDestroyKey (hKey=0x522fd8) returned 1 [0144.789] wsprintfW (in: param_1=0x24ddffc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\readme-warning.txt") returned 86 [0144.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\readme-warning.txt" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0144.789] WriteFile (in: hFile=0x100, lpBuffer=0x524380*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddff8, lpOverlapped=0x0 | out: lpBuffer=0x524380*, lpNumberOfBytesWritten=0x24ddff8*=0x6c3, lpOverlapped=0x0) returned 1 [0144.791] CloseHandle (hObject=0x100) returned 1 [0144.791] GetProcessHeap () returned 0x4e0000 [0144.791] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x524380 | out: hHeap=0x4e0000) returned 1 [0144.791] GetProcessHeap () returned 0x4e0000 [0144.791] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0144.791] GetProcessHeap () returned 0x4e0000 [0144.791] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0144.791] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0144.791] GetProcessHeap () returned 0x4e0000 [0144.791] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5229f8 | out: hHeap=0x4e0000) returned 1 [0144.791] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3cf6c00, ftCreationTime.dwHighDateTime=0x1ca2caa, ftLastAccessTime.dwLowDateTime=0x5f005150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3cf6c00, ftLastWriteTime.dwHighDateTime=0x1ca2caa, nFileSizeHigh=0x0, nFileSizeLow=0x2a65d68, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msmdlocal.dll", cAlternateFileName="MSMDLO~1.DLL")) returned 1 [0144.791] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47fe200, ftCreationTime.dwHighDateTime=0x1ca2cab, ftLastAccessTime.dwLowDateTime=0x51552c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x47fe200, ftLastWriteTime.dwHighDateTime=0x1ca2cab, nFileSizeHigh=0x0, nFileSizeLow=0xbc4568, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msmgdsrv.dll", cAlternateFileName="")) returned 1 [0144.791] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b10f00, ftCreationTime.dwHighDateTime=0x1ca2cab, ftLastAccessTime.dwLowDateTime=0x5f28c8b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b10f00, ftLastWriteTime.dwHighDateTime=0x1ca2cab, nFileSizeHigh=0x0, nFileSizeLow=0x7c6f68, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msolap100.dll", cAlternateFileName="MSOLAP~1.DLL")) returned 1 [0144.791] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb46ad400, ftCreationTime.dwHighDateTime=0x1c8e1fb, ftLastAccessTime.dwLowDateTime=0x516f5b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb46ad400, ftLastWriteTime.dwHighDateTime=0x1c8e1fb, nFileSizeHigh=0x0, nFileSizeLow=0x4dc18, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msolui100.dll", cAlternateFileName="MSOLUI~1.DLL")) returned 1 [0144.791] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1 [0144.791] GetProcessHeap () returned 0x4e0000 [0144.791] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x96) returned 0x4fa058 [0144.792] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0144.792] GetProcessHeap () returned 0x4e0000 [0144.792] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0144.792] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0144.792] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 1 [0144.792] GetProcessHeap () returned 0x4e0000 [0144.792] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x298) returned 0x5229f8 [0144.792] GetProcessHeap () returned 0x4e0000 [0144.792] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa0) returned 0x4fa058 [0144.792] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\*.*", lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522fd8 [0144.793] GetProcessHeap () returned 0x4e0000 [0144.793] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0144.793] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0144.793] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9f68100, ftCreationTime.dwHighDateTime=0x1c9b09b, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd9f68100, ftLastWriteTime.dwHighDateTime=0x1c9b09b, nFileSizeHigh=0x0, nFileSizeLow=0xa2b58, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msmdsrv.rll", cAlternateFileName="")) returned 1 [0144.793] GetProcessHeap () returned 0x4e0000 [0144.793] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2a2) returned 0x524380 [0144.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0144.794] GetProcessHeap () returned 0x4e0000 [0144.794] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0144.794] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0144.794] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded50 | out: lpNewFilePointer=0x0) returned 1 [0144.794] WriteFile (in: hFile=0x104, lpBuffer=0x24ded60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded60*, lpNumberOfBytesWritten=0x24ded38*=0x8, lpOverlapped=0x0) returned 1 [0144.796] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0144.796] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.796] GetProcessHeap () returned 0x4e0000 [0144.796] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0144.796] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24ded18*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24ded18*=0x40) returned 1 [0144.796] CryptDestroyKey (hKey=0x523018) returned 1 [0144.796] WriteFile (in: hFile=0x104, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24ded38*=0x40, lpOverlapped=0x0) returned 1 [0144.796] WriteFile (in: hFile=0x104, lpBuffer=0x24ded40*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded40*, lpNumberOfBytesWritten=0x24ded38*=0x4, lpOverlapped=0x0) returned 1 [0144.796] WriteFile (in: hFile=0x104, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24ded38*=0x10, lpOverlapped=0x0) returned 1 [0144.797] WriteFile (in: hFile=0x104, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24ded38*=0x80, lpOverlapped=0x0) returned 1 [0144.797] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded48 | out: lpNewFilePointer=0x0) returned 1 [0144.797] WriteFile (in: hFile=0x104, lpBuffer=0x24ded58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded58*, lpNumberOfBytesWritten=0x24ded38*=0x8, lpOverlapped=0x0) returned 1 [0144.797] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0144.797] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.797] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.797] ReadFile (in: hFile=0x104, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xa2b58, lpNumberOfBytesRead=0x24decf0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24decf0*=0xa2b58, lpOverlapped=0x0) returned 1 [0144.806] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24decf8*=0xa2b60, dwBufLen=0xa2b60 | out: pbData=0x22d0020*, pdwDataLen=0x24decf8*=0xa2b60) returned 1 [0144.814] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.814] WriteFile (in: hFile=0x104, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xa2b60, lpNumberOfBytesWritten=0x24decf4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24decf4*=0xa2b60, lpOverlapped=0x0) returned 1 [0144.816] CryptDestroyKey (hKey=0x523018) returned 1 [0144.816] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xa2c34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.816] SetEndOfFile (hFile=0x104) returned 1 [0144.820] GetProcessHeap () returned 0x4e0000 [0144.820] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0144.820] GetProcessHeap () returned 0x4e0000 [0144.820] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0144.820] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0144.821] CloseHandle (hObject=0x104) returned 1 [0144.822] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2512f000, ftCreationTime.dwHighDateTime=0x1c8e1fe, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x2512f000, ftLastWriteTime.dwHighDateTime=0x1c8e1fe, nFileSizeHigh=0x0, nFileSizeLow=0x3a18, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msolui100.rll", cAlternateFileName="MSOLUI~1.RLL")) returned 1 [0144.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0144.822] GetProcessHeap () returned 0x4e0000 [0144.822] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0144.822] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0144.822] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded50 | out: lpNewFilePointer=0x0) returned 1 [0144.822] WriteFile (in: hFile=0x104, lpBuffer=0x24ded60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded60*, lpNumberOfBytesWritten=0x24ded38*=0x8, lpOverlapped=0x0) returned 1 [0144.824] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0144.825] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.825] GetProcessHeap () returned 0x4e0000 [0144.825] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0144.825] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24ded18*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24ded18*=0x40) returned 1 [0144.825] CryptDestroyKey (hKey=0x523018) returned 1 [0144.825] WriteFile (in: hFile=0x104, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24ded38*=0x40, lpOverlapped=0x0) returned 1 [0144.825] WriteFile (in: hFile=0x104, lpBuffer=0x24ded40*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded40*, lpNumberOfBytesWritten=0x24ded38*=0x4, lpOverlapped=0x0) returned 1 [0144.825] WriteFile (in: hFile=0x104, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24ded38*=0x10, lpOverlapped=0x0) returned 1 [0144.825] WriteFile (in: hFile=0x104, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24ded38*=0x80, lpOverlapped=0x0) returned 1 [0144.825] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24ded48 | out: lpNewFilePointer=0x0) returned 1 [0144.825] WriteFile (in: hFile=0x104, lpBuffer=0x24ded58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24ded38, lpOverlapped=0x0 | out: lpBuffer=0x24ded58*, lpNumberOfBytesWritten=0x24ded38*=0x8, lpOverlapped=0x0) returned 1 [0144.825] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24ded3c | out: phKey=0x24ded3c*=0x523018) returned 1 [0144.825] CryptSetKeyParam (hKey=0x523018, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.825] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.826] ReadFile (in: hFile=0x104, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3a18, lpNumberOfBytesRead=0x24decf0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24decf0*=0x3a18, lpOverlapped=0x0) returned 1 [0144.827] CryptEncrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x3a20, dwBufLen=0x3a20 | out: pbData=0x22d0020*, pdwDataLen=0x24decf8*=0x3a20) returned 1 [0144.827] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.827] WriteFile (in: hFile=0x104, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x24decf4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24decf4*=0x3a20, lpOverlapped=0x0) returned 1 [0144.827] CryptDestroyKey (hKey=0x523018) returned 1 [0144.827] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x3af4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.827] SetEndOfFile (hFile=0x104) returned 1 [0144.830] GetProcessHeap () returned 0x4e0000 [0144.830] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0144.830] GetProcessHeap () returned 0x4e0000 [0144.830] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0144.830] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0144.831] CloseHandle (hObject=0x104) returned 1 [0144.831] FindNextFileW (in: hFindFile=0x522fd8, lpFindFileData=0x24dedc0 | out: lpFindFileData=0x24dedc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2512f000, ftCreationTime.dwHighDateTime=0x1c8e1fe, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x2512f000, ftLastWriteTime.dwHighDateTime=0x1c8e1fe, nFileSizeHigh=0x0, nFileSizeLow=0x3a18, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msolui100.rll", cAlternateFileName="MSOLUI~1.RLL")) returned 0 [0144.831] GetProcessHeap () returned 0x4e0000 [0144.831] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0144.832] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0144.832] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24ded90 | out: pbData=0x4f53d8, pdwDataLen=0x24ded90) returned 1 [0144.832] CryptDestroyKey (hKey=0x523018) returned 1 [0144.832] GetProcessHeap () returned 0x4e0000 [0144.832] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0144.832] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0144.832] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24ded90 | out: pbData=0x4f5420, pdwDataLen=0x24ded90) returned 1 [0144.832] CryptDestroyKey (hKey=0x523018) returned 1 [0144.832] GetProcessHeap () returned 0x4e0000 [0144.832] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x524630 [0144.832] CryptImportKey (in: hProv=0x4f0590, pbData=0x24ded28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x523018) returned 1 [0144.832] CryptDecrypt (in: hKey=0x523018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x524630, pdwDataLen=0x24ded90 | out: pbData=0x524630, pdwDataLen=0x24ded90) returned 1 [0144.832] CryptDestroyKey (hKey=0x523018) returned 1 [0144.832] wsprintfW (in: param_1=0x24ddd6c, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\readme-warning.txt") returned 90 [0144.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\readme-warning.txt" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0144.834] WriteFile (in: hFile=0x104, lpBuffer=0x524630*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddd68, lpOverlapped=0x0 | out: lpBuffer=0x524630*, lpNumberOfBytesWritten=0x24ddd68*=0x6c3, lpOverlapped=0x0) returned 1 [0144.837] CloseHandle (hObject=0x104) returned 1 [0144.837] GetProcessHeap () returned 0x4e0000 [0144.837] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x524630 | out: hHeap=0x4e0000) returned 1 [0144.837] GetProcessHeap () returned 0x4e0000 [0144.837] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0144.837] GetProcessHeap () returned 0x4e0000 [0144.837] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0144.837] FindClose (in: hFindFile=0x522fd8 | out: hFindFile=0x522fd8) returned 1 [0144.837] GetProcessHeap () returned 0x4e0000 [0144.837] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x524380 | out: hHeap=0x4e0000) returned 1 [0144.837] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 0 [0144.837] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0144.838] GetProcessHeap () returned 0x4e0000 [0144.838] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5229f8 | out: hHeap=0x4e0000) returned 1 [0144.838] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 0 [0144.838] FindClose (in: hFindFile=0x522f58 | out: hFindFile=0x522f58) returned 1 [0144.838] GetProcessHeap () returned 0x4e0000 [0144.838] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x522768 | out: hHeap=0x4e0000) returned 1 [0144.838] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="10", cAlternateFileName="")) returned 0 [0144.838] FindClose (in: hFindFile=0x522ed8 | out: hFindFile=0x522ed8) returned 1 [0144.838] GetProcessHeap () returned 0x4e0000 [0144.838] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5240f8 | out: hHeap=0x4e0000) returned 1 [0144.838] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa819b080, ftCreationTime.dwHighDateTime=0x1d58f4c, ftLastAccessTime.dwLowDateTime=0xc07e5710, ftLastAccessTime.dwHighDateTime=0x1d5c5b7, ftLastWriteTime.dwLowDateTime=0xc07e5710, ftLastWriteTime.dwHighDateTime=0x1d5c5b7, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="coreftp.exe", cAlternateFileName="")) returned 1 [0144.838] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x238e5e70, ftCreationTime.dwHighDateTime=0x1d5ad41, ftLastAccessTime.dwLowDateTime=0x3ee71140, ftLastAccessTime.dwHighDateTime=0x1d56cc7, ftLastWriteTime.dwLowDateTime=0x3ee71140, ftLastWriteTime.dwHighDateTime=0x1d56cc7, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="operamail.exe", cAlternateFileName="OPERAM~1.EXE")) returned 1 [0144.838] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x238e5e70, ftCreationTime.dwHighDateTime=0x1d5ad41, ftLastAccessTime.dwLowDateTime=0x3ee71140, ftLastAccessTime.dwHighDateTime=0x1d56cc7, ftLastWriteTime.dwLowDateTime=0x3ee71140, ftLastWriteTime.dwHighDateTime=0x1d56cc7, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="operamail.exe", cAlternateFileName="OPERAM~1.EXE")) returned 0 [0144.838] FindClose (in: hFindFile=0x522e98 | out: hFindFile=0x522e98) returned 1 [0144.839] GetProcessHeap () returned 0x4e0000 [0144.839] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x523e80 | out: hHeap=0x4e0000) returned 1 [0144.839] FindNextFileW (in: hFindFile=0x522f18, lpFindFileData=0x24dfa90 | out: lpFindFileData=0x24dfa90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xddba24e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xddba24e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0144.839] GetProcessHeap () returned 0x4e0000 [0144.839] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x54) returned 0x529080 [0144.839] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\*.*", lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xddba24e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xddba24e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522e98 [0144.839] GetProcessHeap () returned 0x4e0000 [0144.839] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x529080 | out: hHeap=0x4e0000) returned 1 [0144.839] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xddba24e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xddba24e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0144.839] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CLIPART", cAlternateFileName="")) returned 1 [0144.839] GetProcessHeap () returned 0x4e0000 [0144.839] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x256) returned 0x53a068 [0144.839] GetProcessHeap () returned 0x4e0000 [0144.839] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x64) returned 0x4fa058 [0144.839] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\*.*", lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522ed8 [0144.840] GetProcessHeap () returned 0x4e0000 [0144.841] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0144.841] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0144.841] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7090d6b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PUB60COR", cAlternateFileName="")) returned 1 [0144.841] GetProcessHeap () returned 0x4e0000 [0144.841] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x266) returned 0x53a2c8 [0144.841] GetProcessHeap () returned 0x4e0000 [0144.841] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x76) returned 0x4f1b18 [0144.841] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7090d6b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f58 [0144.844] GetProcessHeap () returned 0x4e0000 [0144.844] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1b18 | out: hHeap=0x4e0000) returned 1 [0144.844] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7090d6b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0144.845] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54952c00, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54952c00, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x2340, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00004_.GIF", cAlternateFileName="")) returned 1 [0144.845] GetProcessHeap () returned 0x4e0000 [0144.845] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x278) returned 0x522768 [0144.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0144.846] GetProcessHeap () returned 0x4e0000 [0144.846] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0144.846] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0144.846] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0144.846] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0144.846] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.846] GetProcessHeap () returned 0x4e0000 [0144.846] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0144.846] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0144.846] CryptDestroyKey (hKey=0x522f98) returned 1 [0144.846] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0144.850] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0144.850] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0144.850] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0144.850] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0144.851] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0144.851] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0144.851] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.851] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.851] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2340, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2340, lpOverlapped=0x0) returned 1 [0144.852] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2340, dwBufLen=0x2340 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2340) returned 1 [0144.852] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.852] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2340, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2340, lpOverlapped=0x0) returned 1 [0144.852] CryptDestroyKey (hKey=0x522f98) returned 1 [0144.852] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2414, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.852] SetEndOfFile (hFile=0xdc) returned 1 [0144.855] GetProcessHeap () returned 0x4e0000 [0144.855] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0144.855] GetProcessHeap () returned 0x4e0000 [0144.855] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0144.855] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0144.856] CloseHandle (hObject=0xdc) returned 1 [0144.856] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83130700, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83130700, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x1c30, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00011_.GIF", cAlternateFileName="")) returned 1 [0144.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0144.856] GetProcessHeap () returned 0x4e0000 [0144.856] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0144.856] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0144.856] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0144.857] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0144.857] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.857] GetProcessHeap () returned 0x4e0000 [0144.857] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0144.857] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0144.857] CryptDestroyKey (hKey=0x522f98) returned 1 [0144.857] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0144.859] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0144.859] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0144.859] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0144.859] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0144.859] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0144.859] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0144.859] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.859] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.859] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1c30, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1c30, lpOverlapped=0x0) returned 1 [0144.860] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1c30, dwBufLen=0x1c30 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1c30) returned 1 [0144.860] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.861] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1c30, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1c30, lpOverlapped=0x0) returned 1 [0144.861] CryptDestroyKey (hKey=0x522f98) returned 1 [0144.861] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1d04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.861] SetEndOfFile (hFile=0xdc) returned 1 [0144.864] GetProcessHeap () returned 0x4e0000 [0144.864] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0144.864] GetProcessHeap () returned 0x4e0000 [0144.864] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0144.864] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0144.865] CloseHandle (hObject=0xdc) returned 1 [0144.865] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78587200, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78587200, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x3a19, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00021_.GIF", cAlternateFileName="")) returned 1 [0144.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0144.866] GetProcessHeap () returned 0x4e0000 [0144.866] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0144.866] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0144.866] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0144.866] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x7, lpOverlapped=0x0) returned 1 [0144.869] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0144.869] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.869] GetProcessHeap () returned 0x4e0000 [0144.869] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0144.869] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0144.869] CryptDestroyKey (hKey=0x522f98) returned 1 [0144.869] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0144.869] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0144.869] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0144.869] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0144.869] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0144.870] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0144.870] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0144.870] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.870] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.870] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3a19, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3a19, lpOverlapped=0x0) returned 1 [0144.871] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3a20, dwBufLen=0x3a20 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3a20) returned 1 [0144.871] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.871] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3a20, lpOverlapped=0x0) returned 1 [0144.871] CryptDestroyKey (hKey=0x522f98) returned 1 [0144.871] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3af4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.871] SetEndOfFile (hFile=0xdc) returned 1 [0144.874] GetProcessHeap () returned 0x4e0000 [0144.874] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0144.874] GetProcessHeap () returned 0x4e0000 [0144.874] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0144.874] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0144.876] CloseHandle (hObject=0xdc) returned 1 [0144.876] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64147500, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64147500, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x1a1c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00037_.GIF", cAlternateFileName="")) returned 1 [0144.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0144.877] GetProcessHeap () returned 0x4e0000 [0144.877] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0144.877] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0144.877] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0144.877] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0144.880] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0144.880] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.880] GetProcessHeap () returned 0x4e0000 [0144.880] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0144.880] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0144.880] CryptDestroyKey (hKey=0x522f98) returned 1 [0144.880] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0144.881] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0144.881] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0144.881] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0144.881] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0144.881] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0144.881] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0144.881] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.881] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.881] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1a1c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1a1c, lpOverlapped=0x0) returned 1 [0144.884] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1a20, dwBufLen=0x1a20 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1a20) returned 1 [0144.884] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.884] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1a20, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1a20, lpOverlapped=0x0) returned 1 [0144.884] CryptDestroyKey (hKey=0x522f98) returned 1 [0144.884] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1af4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.884] SetEndOfFile (hFile=0xdc) returned 1 [0144.887] GetProcessHeap () returned 0x4e0000 [0144.887] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0144.887] GetProcessHeap () returned 0x4e0000 [0144.887] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0144.887] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0144.888] CloseHandle (hObject=0xdc) returned 1 [0144.888] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47589c00, ftCreationTime.dwHighDateTime=0x1bf325d, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x47589c00, ftLastWriteTime.dwHighDateTime=0x1bf325d, nFileSizeHigh=0x0, nFileSizeLow=0xcb3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00038_.GIF", cAlternateFileName="")) returned 1 [0144.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0144.890] GetProcessHeap () returned 0x4e0000 [0144.890] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0144.890] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0144.890] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0144.890] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xd, lpOverlapped=0x0) returned 1 [0144.892] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0144.892] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.892] GetProcessHeap () returned 0x4e0000 [0144.892] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0144.892] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0144.892] CryptDestroyKey (hKey=0x522f98) returned 1 [0144.892] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0144.892] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0144.892] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0144.892] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0144.893] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0144.893] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0144.893] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0144.893] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.893] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.893] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xcb3, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xcb3, lpOverlapped=0x0) returned 1 [0144.893] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xcc0, dwBufLen=0xcc0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xcc0) returned 1 [0144.893] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.893] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xcc0, lpOverlapped=0x0) returned 1 [0144.893] CryptDestroyKey (hKey=0x522f98) returned 1 [0144.893] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xd94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.894] SetEndOfFile (hFile=0xdc) returned 1 [0144.896] GetProcessHeap () returned 0x4e0000 [0144.896] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0144.896] GetProcessHeap () returned 0x4e0000 [0144.896] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0144.896] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0144.897] CloseHandle (hObject=0xdc) returned 1 [0144.897] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f4fc100, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f4fc100, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x1fa1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00040_.GIF", cAlternateFileName="")) returned 1 [0144.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0144.898] GetProcessHeap () returned 0x4e0000 [0144.898] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0144.898] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0144.898] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0144.898] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xf, lpOverlapped=0x0) returned 1 [0144.909] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0144.909] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.909] GetProcessHeap () returned 0x4e0000 [0144.909] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0144.909] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0144.909] CryptDestroyKey (hKey=0x522f98) returned 1 [0144.909] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0144.909] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0144.909] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0144.910] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0144.910] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0144.910] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0144.910] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0144.910] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.910] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.910] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1fa1, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1fa1, lpOverlapped=0x0) returned 1 [0144.911] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1fb0, dwBufLen=0x1fb0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1fb0) returned 1 [0144.911] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.911] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1fb0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1fb0, lpOverlapped=0x0) returned 1 [0144.911] CryptDestroyKey (hKey=0x522f98) returned 1 [0144.911] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2084, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.911] SetEndOfFile (hFile=0xdc) returned 1 [0144.914] GetProcessHeap () returned 0x4e0000 [0144.914] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0144.914] GetProcessHeap () returned 0x4e0000 [0144.914] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0144.914] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0144.915] CloseHandle (hObject=0xdc) returned 1 [0144.915] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x262e5400, ftCreationTime.dwHighDateTime=0x1bd4c10, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x262e5400, ftLastWriteTime.dwHighDateTime=0x1bd4c10, nFileSizeHigh=0x0, nFileSizeLow=0x1e06, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00052_.GIF", cAlternateFileName="")) returned 1 [0144.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0144.916] GetProcessHeap () returned 0x4e0000 [0144.916] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0144.916] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0144.916] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0144.916] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0144.918] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0144.918] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.918] GetProcessHeap () returned 0x4e0000 [0144.918] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0144.918] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0144.918] CryptDestroyKey (hKey=0x522f98) returned 1 [0144.918] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0144.919] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0144.919] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0144.919] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0144.919] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0144.919] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0144.919] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0144.919] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.919] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.919] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1e06, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1e06, lpOverlapped=0x0) returned 1 [0144.920] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1e10, dwBufLen=0x1e10 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1e10) returned 1 [0144.920] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.920] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1e10, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1e10, lpOverlapped=0x0) returned 1 [0144.920] CryptDestroyKey (hKey=0x522f98) returned 1 [0144.920] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1ee4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.921] SetEndOfFile (hFile=0xdc) returned 1 [0144.923] GetProcessHeap () returned 0x4e0000 [0144.923] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0144.923] GetProcessHeap () returned 0x4e0000 [0144.923] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0144.923] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0144.924] CloseHandle (hObject=0xdc) returned 1 [0144.925] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b6b4200, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8b6b4200, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x2e73, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00057_.GIF", cAlternateFileName="")) returned 1 [0144.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0144.925] GetProcessHeap () returned 0x4e0000 [0144.925] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0144.925] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0144.925] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0144.925] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xd, lpOverlapped=0x0) returned 1 [0144.928] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0144.928] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.928] GetProcessHeap () returned 0x4e0000 [0144.928] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0144.928] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0144.928] CryptDestroyKey (hKey=0x522f98) returned 1 [0144.928] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0144.928] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0144.928] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0144.928] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0144.928] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0144.928] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0144.928] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0144.928] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.928] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.929] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2e73, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2e73, lpOverlapped=0x0) returned 1 [0144.930] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2e80, dwBufLen=0x2e80 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2e80) returned 1 [0144.930] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.930] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2e80, lpOverlapped=0x0) returned 1 [0144.930] CryptDestroyKey (hKey=0x522f98) returned 1 [0144.930] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2f54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.930] SetEndOfFile (hFile=0xdc) returned 1 [0144.933] GetProcessHeap () returned 0x4e0000 [0144.933] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0144.933] GetProcessHeap () returned 0x4e0000 [0144.933] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0144.933] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0144.934] CloseHandle (hObject=0xdc) returned 1 [0144.934] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29618e00, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x29618e00, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0x205, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00090_.GIF", cAlternateFileName="")) returned 1 [0144.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0144.934] GetProcessHeap () returned 0x4e0000 [0144.934] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0144.934] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0144.934] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0144.934] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xb, lpOverlapped=0x0) returned 1 [0144.936] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0144.936] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.936] GetProcessHeap () returned 0x4e0000 [0144.936] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0144.936] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0144.936] CryptDestroyKey (hKey=0x522f98) returned 1 [0144.936] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0144.936] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0144.937] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0144.937] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0144.937] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0144.937] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0144.937] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0144.937] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.937] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.937] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x205, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x205, lpOverlapped=0x0) returned 1 [0144.937] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x210, dwBufLen=0x210 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x210) returned 1 [0144.937] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.937] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x210, lpOverlapped=0x0) returned 1 [0144.938] CryptDestroyKey (hKey=0x522f98) returned 1 [0144.938] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.938] SetEndOfFile (hFile=0xdc) returned 1 [0144.940] GetProcessHeap () returned 0x4e0000 [0144.941] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0144.941] GetProcessHeap () returned 0x4e0000 [0144.941] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0144.941] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0144.942] CloseHandle (hObject=0xdc) returned 1 [0144.942] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26ff3400, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x26ff3400, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0x1f6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00092_.GIF", cAlternateFileName="")) returned 1 [0144.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0144.942] GetProcessHeap () returned 0x4e0000 [0144.942] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0144.942] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0144.942] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0144.942] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0144.944] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0144.944] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.944] GetProcessHeap () returned 0x4e0000 [0144.944] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0144.944] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0144.944] CryptDestroyKey (hKey=0x522f98) returned 1 [0144.944] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0144.944] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0144.944] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0144.945] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0144.945] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0144.945] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0144.945] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0144.945] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.945] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.945] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1f6, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1f6, lpOverlapped=0x0) returned 1 [0144.945] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x200, dwBufLen=0x200 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x200) returned 1 [0144.945] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.945] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x200, lpOverlapped=0x0) returned 1 [0144.945] CryptDestroyKey (hKey=0x522f98) returned 1 [0144.945] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.946] SetEndOfFile (hFile=0xdc) returned 1 [0144.948] GetProcessHeap () returned 0x4e0000 [0144.948] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0144.948] GetProcessHeap () returned 0x4e0000 [0144.948] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0144.949] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0144.950] CloseHandle (hObject=0xdc) returned 1 [0144.950] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ef57700, ftCreationTime.dwHighDateTime=0x1bd4f8b, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4ef57700, ftLastWriteTime.dwHighDateTime=0x1bd4f8b, nFileSizeHigh=0x0, nFileSizeLow=0x319e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00103_.GIF", cAlternateFileName="")) returned 1 [0144.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0144.951] GetProcessHeap () returned 0x4e0000 [0144.951] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0144.952] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0144.952] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0144.952] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0144.954] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0144.954] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.954] GetProcessHeap () returned 0x4e0000 [0144.954] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0144.954] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0144.954] CryptDestroyKey (hKey=0x522f98) returned 1 [0144.954] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0144.954] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0144.954] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0144.954] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0144.955] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0144.955] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0144.955] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0144.955] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.955] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.955] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x319e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x319e, lpOverlapped=0x0) returned 1 [0144.956] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x31a0, dwBufLen=0x31a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x31a0) returned 1 [0144.957] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.957] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x31a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x31a0, lpOverlapped=0x0) returned 1 [0144.957] CryptDestroyKey (hKey=0x522f98) returned 1 [0144.957] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3274, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.957] SetEndOfFile (hFile=0xdc) returned 1 [0144.960] GetProcessHeap () returned 0x4e0000 [0144.960] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0144.960] GetProcessHeap () returned 0x4e0000 [0144.960] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0144.960] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0144.961] CloseHandle (hObject=0xdc) returned 1 [0144.961] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf316a100, ftCreationTime.dwHighDateTime=0x1bd4bcc, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf316a100, ftLastWriteTime.dwHighDateTime=0x1bd4bcc, nFileSizeHigh=0x0, nFileSizeLow=0xd9c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00120_.GIF", cAlternateFileName="")) returned 1 [0144.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0144.962] GetProcessHeap () returned 0x4e0000 [0144.962] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0144.962] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0144.962] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0144.962] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0144.964] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0144.964] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.964] GetProcessHeap () returned 0x4e0000 [0144.964] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0144.964] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0144.964] CryptDestroyKey (hKey=0x522f98) returned 1 [0144.964] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0144.965] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0144.965] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0144.965] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0144.965] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0144.965] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0144.965] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0144.965] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.965] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.965] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xd9c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xd9c, lpOverlapped=0x0) returned 1 [0144.965] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xda0, dwBufLen=0xda0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xda0) returned 1 [0144.965] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.965] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xda0, lpOverlapped=0x0) returned 1 [0144.966] CryptDestroyKey (hKey=0x522f98) returned 1 [0144.966] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xe74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.966] SetEndOfFile (hFile=0xdc) returned 1 [0144.969] GetProcessHeap () returned 0x4e0000 [0144.969] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0144.969] GetProcessHeap () returned 0x4e0000 [0144.969] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0144.969] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0144.970] CloseHandle (hObject=0xdc) returned 1 [0144.970] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33bee00, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33bee00, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0xc44, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00126_.GIF", cAlternateFileName="")) returned 1 [0144.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0144.970] GetProcessHeap () returned 0x4e0000 [0144.970] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0144.970] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0144.970] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0144.971] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0144.973] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0144.973] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.973] GetProcessHeap () returned 0x4e0000 [0144.974] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0144.974] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0144.974] CryptDestroyKey (hKey=0x522f98) returned 1 [0144.974] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0144.974] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0144.974] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0144.974] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0144.974] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0144.974] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0144.974] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0144.974] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.974] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.974] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xc44, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xc44, lpOverlapped=0x0) returned 1 [0144.975] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xc50, dwBufLen=0xc50 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xc50) returned 1 [0144.975] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.975] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xc50, lpOverlapped=0x0) returned 1 [0144.975] CryptDestroyKey (hKey=0x522f98) returned 1 [0144.975] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xd24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.975] SetEndOfFile (hFile=0xdc) returned 1 [0144.978] GetProcessHeap () returned 0x4e0000 [0144.978] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0144.978] GetProcessHeap () returned 0x4e0000 [0144.978] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0144.978] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0144.979] CloseHandle (hObject=0xdc) returned 1 [0144.979] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd99400, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd99400, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0x30c2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00129_.GIF", cAlternateFileName="")) returned 1 [0144.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0144.979] GetProcessHeap () returned 0x4e0000 [0144.979] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0144.979] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0144.979] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0144.979] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0144.982] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0144.982] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.982] GetProcessHeap () returned 0x4e0000 [0144.982] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0144.982] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0144.982] CryptDestroyKey (hKey=0x522f98) returned 1 [0144.982] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0144.982] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0144.982] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0144.982] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0144.982] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0144.982] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0144.982] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0144.982] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.982] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.983] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x30c2, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x30c2, lpOverlapped=0x0) returned 1 [0144.984] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x30d0, dwBufLen=0x30d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x30d0) returned 1 [0144.984] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.984] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x30d0, lpOverlapped=0x0) returned 1 [0144.984] CryptDestroyKey (hKey=0x522f98) returned 1 [0144.984] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x31a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.984] SetEndOfFile (hFile=0xdc) returned 1 [0144.987] GetProcessHeap () returned 0x4e0000 [0144.987] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0144.987] GetProcessHeap () returned 0x4e0000 [0144.987] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0144.987] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0144.988] CloseHandle (hObject=0xdc) returned 1 [0144.989] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffa86700, ftCreationTime.dwHighDateTime=0x1bd50ae, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xffa86700, ftLastWriteTime.dwHighDateTime=0x1bd50ae, nFileSizeHigh=0x0, nFileSizeLow=0x1485, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00130_.GIF", cAlternateFileName="")) returned 1 [0144.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0144.989] GetProcessHeap () returned 0x4e0000 [0144.989] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0144.989] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0144.989] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0144.989] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xb, lpOverlapped=0x0) returned 1 [0144.991] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0144.991] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.992] GetProcessHeap () returned 0x4e0000 [0144.992] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0144.992] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0144.992] CryptDestroyKey (hKey=0x522f98) returned 1 [0144.992] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0144.992] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0144.992] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0144.992] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0144.992] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0144.992] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0144.992] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0144.992] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0144.992] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.992] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1485, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1485, lpOverlapped=0x0) returned 1 [0144.993] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1490, dwBufLen=0x1490 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1490) returned 1 [0144.994] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.994] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1490, lpOverlapped=0x0) returned 1 [0144.994] CryptDestroyKey (hKey=0x522f98) returned 1 [0144.994] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1564, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.994] SetEndOfFile (hFile=0xdc) returned 1 [0144.997] GetProcessHeap () returned 0x4e0000 [0144.997] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0144.997] GetProcessHeap () returned 0x4e0000 [0144.997] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0144.997] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0144.998] CloseHandle (hObject=0xdc) returned 1 [0144.998] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9b28600, ftCreationTime.dwHighDateTime=0x1bd50ae, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9b28600, ftLastWriteTime.dwHighDateTime=0x1bd50ae, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00135_.GIF", cAlternateFileName="")) returned 1 [0144.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0144.999] GetProcessHeap () returned 0x4e0000 [0144.999] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.000] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.000] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.000] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0145.002] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.002] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.002] GetProcessHeap () returned 0x4e0000 [0145.002] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.002] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.002] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.002] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.002] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.002] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.003] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.003] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.003] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.003] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.003] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.003] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.003] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xa24, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xa24, lpOverlapped=0x0) returned 1 [0145.003] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa30, dwBufLen=0xa30 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa30) returned 1 [0145.003] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.003] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xa30, lpOverlapped=0x0) returned 1 [0145.003] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.003] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xb04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.003] SetEndOfFile (hFile=0xdc) returned 1 [0145.006] GetProcessHeap () returned 0x4e0000 [0145.006] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.006] GetProcessHeap () returned 0x4e0000 [0145.006] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.006] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.007] CloseHandle (hObject=0xdc) returned 1 [0145.007] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3bca500, ftCreationTime.dwHighDateTime=0x1bd50ae, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3bca500, ftLastWriteTime.dwHighDateTime=0x1bd50ae, nFileSizeHigh=0x0, nFileSizeLow=0x296f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00139_.GIF", cAlternateFileName="")) returned 1 [0145.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.009] GetProcessHeap () returned 0x4e0000 [0145.009] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.009] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.009] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.009] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x1, lpOverlapped=0x0) returned 1 [0145.014] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.014] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.014] GetProcessHeap () returned 0x4e0000 [0145.014] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.014] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.014] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.014] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.014] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.014] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.014] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.015] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.015] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.015] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.015] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.015] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.015] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x296f, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x296f, lpOverlapped=0x0) returned 1 [0145.016] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2970, dwBufLen=0x2970 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2970) returned 1 [0145.016] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.016] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2970, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2970, lpOverlapped=0x0) returned 1 [0145.016] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.016] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2a44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.016] SetEndOfFile (hFile=0xdc) returned 1 [0145.019] GetProcessHeap () returned 0x4e0000 [0145.019] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.019] GetProcessHeap () returned 0x4e0000 [0145.019] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.019] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.020] CloseHandle (hObject=0xdc) returned 1 [0145.021] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedc6c400, ftCreationTime.dwHighDateTime=0x1bd50ae, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xedc6c400, ftLastWriteTime.dwHighDateTime=0x1bd50ae, nFileSizeHigh=0x0, nFileSizeLow=0x3bcc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00142_.GIF", cAlternateFileName="")) returned 1 [0145.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.021] GetProcessHeap () returned 0x4e0000 [0145.021] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.021] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.021] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.022] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.024] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.024] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.024] GetProcessHeap () returned 0x4e0000 [0145.024] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.024] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.024] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.024] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.024] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.024] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.024] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.024] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.024] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.024] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.025] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.025] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.025] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3bcc, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3bcc, lpOverlapped=0x0) returned 1 [0145.026] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3bd0, dwBufLen=0x3bd0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3bd0) returned 1 [0145.026] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.026] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3bd0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3bd0, lpOverlapped=0x0) returned 1 [0145.026] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.026] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3ca4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.026] SetEndOfFile (hFile=0xdc) returned 1 [0145.029] GetProcessHeap () returned 0x4e0000 [0145.029] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.029] GetProcessHeap () returned 0x4e0000 [0145.029] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.029] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.030] CloseHandle (hObject=0xdc) returned 1 [0145.030] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9688900, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9688900, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x14c3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00154_.GIF", cAlternateFileName="")) returned 1 [0145.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.031] GetProcessHeap () returned 0x4e0000 [0145.031] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.031] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.031] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.031] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xd, lpOverlapped=0x0) returned 1 [0145.034] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.034] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.034] GetProcessHeap () returned 0x4e0000 [0145.034] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.034] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.034] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.034] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.034] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.034] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.034] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.034] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.034] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.034] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.034] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.034] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.035] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x14c3, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x14c3, lpOverlapped=0x0) returned 1 [0145.035] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x14d0, dwBufLen=0x14d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x14d0) returned 1 [0145.036] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.036] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x14d0, lpOverlapped=0x0) returned 1 [0145.036] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.036] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x15a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.036] SetEndOfFile (hFile=0xdc) returned 1 [0145.038] GetProcessHeap () returned 0x4e0000 [0145.039] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.039] GetProcessHeap () returned 0x4e0000 [0145.039] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.039] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.040] CloseHandle (hObject=0xdc) returned 1 [0145.040] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2417b00, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2417b00, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00157_.GIF", cAlternateFileName="")) returned 1 [0145.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.040] GetProcessHeap () returned 0x4e0000 [0145.040] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.040] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.040] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.040] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x5, lpOverlapped=0x0) returned 1 [0145.043] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.043] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.043] GetProcessHeap () returned 0x4e0000 [0145.043] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.043] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.043] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.043] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.043] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.043] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.043] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.043] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.043] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.044] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.044] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.044] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.044] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x135b, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x135b, lpOverlapped=0x0) returned 1 [0145.045] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1360, dwBufLen=0x1360 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1360) returned 1 [0145.045] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.045] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1360, lpOverlapped=0x0) returned 1 [0145.045] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.045] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1434, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.045] SetEndOfFile (hFile=0xdc) returned 1 [0145.048] GetProcessHeap () returned 0x4e0000 [0145.048] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.048] GetProcessHeap () returned 0x4e0000 [0145.048] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.048] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.049] CloseHandle (hObject=0xdc) returned 1 [0145.049] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad7cc700, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad7cc700, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x13a6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00158_.GIF", cAlternateFileName="")) returned 1 [0145.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.049] GetProcessHeap () returned 0x4e0000 [0145.049] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.050] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.050] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.050] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0145.052] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.052] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.052] GetProcessHeap () returned 0x4e0000 [0145.052] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.052] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.052] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.052] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.052] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.052] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.052] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.052] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.053] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.053] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.053] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.053] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.053] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x13a6, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x13a6, lpOverlapped=0x0) returned 1 [0145.054] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x13b0, dwBufLen=0x13b0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x13b0) returned 1 [0145.054] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.054] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x13b0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x13b0, lpOverlapped=0x0) returned 1 [0145.054] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.054] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1484, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.054] SetEndOfFile (hFile=0xdc) returned 1 [0145.057] GetProcessHeap () returned 0x4e0000 [0145.057] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.057] GetProcessHeap () returned 0x4e0000 [0145.057] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.057] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.058] CloseHandle (hObject=0xdc) returned 1 [0145.058] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a69f700, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a69f700, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x47a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00160_.GIF", cAlternateFileName="")) returned 1 [0145.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.058] GetProcessHeap () returned 0x4e0000 [0145.058] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.058] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.059] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.059] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0145.061] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.061] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.061] GetProcessHeap () returned 0x4e0000 [0145.061] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.061] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.061] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.061] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.061] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.061] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.061] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.061] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.061] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.061] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.061] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.062] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.062] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x47a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x47a, lpOverlapped=0x0) returned 1 [0145.062] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x480, dwBufLen=0x480 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x480) returned 1 [0145.062] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.062] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x480, lpOverlapped=0x0) returned 1 [0145.062] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.062] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x554, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.062] SetEndOfFile (hFile=0xdc) returned 1 [0145.065] GetProcessHeap () returned 0x4e0000 [0145.065] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.065] GetProcessHeap () returned 0x4e0000 [0145.065] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.065] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.069] CloseHandle (hObject=0xdc) returned 1 [0145.069] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95a54300, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95a54300, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x1d9f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00161_.GIF", cAlternateFileName="")) returned 1 [0145.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.070] GetProcessHeap () returned 0x4e0000 [0145.070] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.070] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.070] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.070] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x1, lpOverlapped=0x0) returned 1 [0145.072] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.072] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.072] GetProcessHeap () returned 0x4e0000 [0145.073] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.073] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.073] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.073] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.073] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.073] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.073] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.073] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.073] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.073] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.073] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.073] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.073] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1d9f, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1d9f, lpOverlapped=0x0) returned 1 [0145.074] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1da0, dwBufLen=0x1da0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1da0) returned 1 [0145.074] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.074] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1da0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1da0, lpOverlapped=0x0) returned 1 [0145.075] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.075] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1e74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.075] SetEndOfFile (hFile=0xdc) returned 1 [0145.077] GetProcessHeap () returned 0x4e0000 [0145.077] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.077] GetProcessHeap () returned 0x4e0000 [0145.077] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.078] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.079] CloseHandle (hObject=0xdc) returned 1 [0145.079] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65e47e00, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65e47e00, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0x1b48, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00163_.GIF", cAlternateFileName="")) returned 1 [0145.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.080] GetProcessHeap () returned 0x4e0000 [0145.081] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.081] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.081] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.081] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.083] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.083] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.083] GetProcessHeap () returned 0x4e0000 [0145.083] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.083] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.083] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.083] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.083] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.083] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.083] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.084] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.084] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.084] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.084] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.084] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.084] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1b48, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1b48, lpOverlapped=0x0) returned 1 [0145.085] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1b50, dwBufLen=0x1b50 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1b50) returned 1 [0145.085] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.085] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1b50, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1b50, lpOverlapped=0x0) returned 1 [0145.085] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.085] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1c24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.085] SetEndOfFile (hFile=0xdc) returned 1 [0145.088] GetProcessHeap () returned 0x4e0000 [0145.088] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.088] GetProcessHeap () returned 0x4e0000 [0145.088] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.088] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.089] CloseHandle (hObject=0xdc) returned 1 [0145.089] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d4d0800, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d4d0800, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x33c6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00164_.GIF", cAlternateFileName="")) returned 1 [0145.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.090] GetProcessHeap () returned 0x4e0000 [0145.090] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.090] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.090] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.090] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0145.092] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.092] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.092] GetProcessHeap () returned 0x4e0000 [0145.092] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.092] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.092] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.092] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.093] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.093] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.093] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.093] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.093] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.093] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.093] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.093] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.093] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x33c6, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x33c6, lpOverlapped=0x0) returned 1 [0145.094] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x33d0, dwBufLen=0x33d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x33d0) returned 1 [0145.094] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.095] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x33d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x33d0, lpOverlapped=0x0) returned 1 [0145.095] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.095] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x34a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.095] SetEndOfFile (hFile=0xdc) returned 1 [0145.098] GetProcessHeap () returned 0x4e0000 [0145.098] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.098] GetProcessHeap () returned 0x4e0000 [0145.098] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.098] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.099] CloseHandle (hObject=0xdc) returned 1 [0145.099] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89b98100, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x89b98100, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x2186, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00165_.GIF", cAlternateFileName="")) returned 1 [0145.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.100] GetProcessHeap () returned 0x4e0000 [0145.100] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.100] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.100] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.101] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0145.103] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.103] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.103] GetProcessHeap () returned 0x4e0000 [0145.103] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.103] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.103] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.103] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.103] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.103] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.103] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.103] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.103] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.103] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.104] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.104] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.104] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2186, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2186, lpOverlapped=0x0) returned 1 [0145.105] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2190, dwBufLen=0x2190 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2190) returned 1 [0145.105] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.105] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2190, lpOverlapped=0x0) returned 1 [0145.105] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.105] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2264, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.105] SetEndOfFile (hFile=0xdc) returned 1 [0145.108] GetProcessHeap () returned 0x4e0000 [0145.108] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.108] GetProcessHeap () returned 0x4e0000 [0145.108] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.108] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.109] CloseHandle (hObject=0xdc) returned 1 [0145.109] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81614600, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81614600, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x131e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00167_.GIF", cAlternateFileName="")) returned 1 [0145.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.110] GetProcessHeap () returned 0x4e0000 [0145.110] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.110] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.110] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.110] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0145.112] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.112] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.112] GetProcessHeap () returned 0x4e0000 [0145.112] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.112] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.112] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.112] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.112] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.112] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.112] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.113] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.113] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.113] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.113] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.113] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.113] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x131e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x131e, lpOverlapped=0x0) returned 1 [0145.114] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1320, dwBufLen=0x1320 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1320) returned 1 [0145.114] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.114] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1320, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1320, lpOverlapped=0x0) returned 1 [0145.114] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.114] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x13f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.114] SetEndOfFile (hFile=0xdc) returned 1 [0145.117] GetProcessHeap () returned 0x4e0000 [0145.117] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.117] GetProcessHeap () returned 0x4e0000 [0145.117] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.117] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.118] CloseHandle (hObject=0xdc) returned 1 [0145.118] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c9c9200, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c9c9200, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x14ff, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00169_.GIF", cAlternateFileName="")) returned 1 [0145.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.119] GetProcessHeap () returned 0x4e0000 [0145.119] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.119] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.119] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.119] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x1, lpOverlapped=0x0) returned 1 [0145.121] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.121] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.121] GetProcessHeap () returned 0x4e0000 [0145.121] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.121] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.121] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.121] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.122] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.122] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.122] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.122] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.122] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.122] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.122] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.122] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.122] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x14ff, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x14ff, lpOverlapped=0x0) returned 1 [0145.123] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1500, dwBufLen=0x1500 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1500) returned 1 [0145.123] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.123] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1500, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1500, lpOverlapped=0x0) returned 1 [0145.123] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.123] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x15d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.124] SetEndOfFile (hFile=0xdc) returned 1 [0145.126] GetProcessHeap () returned 0x4e0000 [0145.126] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.126] GetProcessHeap () returned 0x4e0000 [0145.126] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.126] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.128] CloseHandle (hObject=0xdc) returned 1 [0145.128] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76a6b100, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76a6b100, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x2420, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00170_.GIF", cAlternateFileName="")) returned 1 [0145.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.128] GetProcessHeap () returned 0x4e0000 [0145.128] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.128] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.128] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.129] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.129] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.129] GetProcessHeap () returned 0x4e0000 [0145.129] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.129] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.129] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.129] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.131] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.131] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.131] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.131] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.131] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.131] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.132] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.132] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.132] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2420, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2420, lpOverlapped=0x0) returned 1 [0145.133] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2420, dwBufLen=0x2420 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2420) returned 1 [0145.133] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.133] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2420, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2420, lpOverlapped=0x0) returned 1 [0145.133] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.133] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x24f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.133] SetEndOfFile (hFile=0xdc) returned 1 [0145.136] GetProcessHeap () returned 0x4e0000 [0145.136] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.136] GetProcessHeap () returned 0x4e0000 [0145.136] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.136] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.137] CloseHandle (hObject=0xdc) returned 1 [0145.137] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71e1fd00, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71e1fd00, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x1398, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00171_.GIF", cAlternateFileName="")) returned 1 [0145.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.137] GetProcessHeap () returned 0x4e0000 [0145.137] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.138] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.138] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.138] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.140] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.140] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.140] GetProcessHeap () returned 0x4e0000 [0145.140] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.140] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.140] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.140] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.140] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.140] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.140] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.140] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.140] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.141] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.141] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.141] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.141] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1398, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1398, lpOverlapped=0x0) returned 1 [0145.145] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x13a0, dwBufLen=0x13a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x13a0) returned 1 [0145.145] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.145] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x13a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x13a0, lpOverlapped=0x0) returned 1 [0145.145] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.145] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.145] SetEndOfFile (hFile=0xdc) returned 1 [0145.148] GetProcessHeap () returned 0x4e0000 [0145.148] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.148] GetProcessHeap () returned 0x4e0000 [0145.148] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.148] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.149] CloseHandle (hObject=0xdc) returned 1 [0145.149] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a04e500, ftCreationTime.dwHighDateTime=0x1bd4e61, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2a04e500, ftLastWriteTime.dwHighDateTime=0x1bd4e61, nFileSizeHigh=0x0, nFileSizeLow=0x1126, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00172_.GIF", cAlternateFileName="")) returned 1 [0145.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.150] GetProcessHeap () returned 0x4e0000 [0145.151] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.151] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.151] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.151] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0145.153] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.153] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.153] GetProcessHeap () returned 0x4e0000 [0145.153] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.153] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.153] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.153] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.153] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.153] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.153] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.154] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.154] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.154] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.154] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.154] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.154] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1126, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1126, lpOverlapped=0x0) returned 1 [0145.155] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1130, dwBufLen=0x1130 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1130) returned 1 [0145.155] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.155] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1130, lpOverlapped=0x0) returned 1 [0145.155] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.155] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.155] SetEndOfFile (hFile=0xdc) returned 1 [0145.158] GetProcessHeap () returned 0x4e0000 [0145.158] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.158] GetProcessHeap () returned 0x4e0000 [0145.158] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.158] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.159] CloseHandle (hObject=0xdc) returned 1 [0145.160] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde4d3e00, ftCreationTime.dwHighDateTime=0x1bd4e56, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xde4d3e00, ftLastWriteTime.dwHighDateTime=0x1bd4e56, nFileSizeHigh=0x0, nFileSizeLow=0xf7e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00174_.GIF", cAlternateFileName="")) returned 1 [0145.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.160] GetProcessHeap () returned 0x4e0000 [0145.160] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.160] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.160] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.160] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0145.162] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.162] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.162] GetProcessHeap () returned 0x4e0000 [0145.163] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.163] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.163] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.163] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.163] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.163] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.163] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.163] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.163] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.163] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.163] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.164] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.164] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xf7e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xf7e, lpOverlapped=0x0) returned 1 [0145.164] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xf80, dwBufLen=0xf80 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xf80) returned 1 [0145.164] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.164] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xf80, lpOverlapped=0x0) returned 1 [0145.164] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.164] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1054, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.164] SetEndOfFile (hFile=0xdc) returned 1 [0145.167] GetProcessHeap () returned 0x4e0000 [0145.167] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.167] GetProcessHeap () returned 0x4e0000 [0145.167] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.167] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.168] CloseHandle (hObject=0xdc) returned 1 [0145.168] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc18a400, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc18a400, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0xd32, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00175_.GIF", cAlternateFileName="")) returned 1 [0145.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.169] GetProcessHeap () returned 0x4e0000 [0145.169] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.169] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.169] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.169] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0145.171] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.171] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.171] GetProcessHeap () returned 0x4e0000 [0145.171] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.171] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.171] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.171] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.171] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.171] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.171] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.172] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.172] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.172] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.172] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.172] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.172] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xd32, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xd32, lpOverlapped=0x0) returned 1 [0145.172] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xd40, dwBufLen=0xd40 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xd40) returned 1 [0145.172] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.172] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xd40, lpOverlapped=0x0) returned 1 [0145.172] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.172] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xe14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.172] SetEndOfFile (hFile=0xdc) returned 1 [0145.175] GetProcessHeap () returned 0x4e0000 [0145.175] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.175] GetProcessHeap () returned 0x4e0000 [0145.175] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.175] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.176] CloseHandle (hObject=0xdc) returned 1 [0145.176] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e3cb900, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e3cb900, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0xc30, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00176_.GIF", cAlternateFileName="")) returned 1 [0145.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.178] GetProcessHeap () returned 0x4e0000 [0145.178] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.178] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.178] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.178] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.178] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.178] GetProcessHeap () returned 0x4e0000 [0145.178] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.178] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.178] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.178] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.181] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.181] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.181] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.181] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.181] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.181] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.181] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.181] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.181] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xc30, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xc30, lpOverlapped=0x0) returned 1 [0145.181] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xc30, dwBufLen=0xc30 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xc30) returned 1 [0145.181] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.181] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc30, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xc30, lpOverlapped=0x0) returned 1 [0145.182] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.182] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xd04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.182] SetEndOfFile (hFile=0xdc) returned 1 [0145.184] GetProcessHeap () returned 0x4e0000 [0145.184] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.184] GetProcessHeap () returned 0x4e0000 [0145.184] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.184] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.186] CloseHandle (hObject=0xdc) returned 1 [0145.186] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a5f2300, ftCreationTime.dwHighDateTime=0x1bd4af1, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a5f2300, ftLastWriteTime.dwHighDateTime=0x1bd4af1, nFileSizeHigh=0x0, nFileSizeLow=0xbd2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN00010_.WMF", cAlternateFileName="")) returned 1 [0145.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.187] GetProcessHeap () returned 0x4e0000 [0145.187] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.187] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.187] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.187] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0145.190] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.190] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.190] GetProcessHeap () returned 0x4e0000 [0145.190] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.190] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.190] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.190] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.190] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.190] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.190] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.190] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.190] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.190] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.191] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.191] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.191] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xbd2, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xbd2, lpOverlapped=0x0) returned 1 [0145.191] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xbe0, dwBufLen=0xbe0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xbe0) returned 1 [0145.191] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.191] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xbe0, lpOverlapped=0x0) returned 1 [0145.191] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.191] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xcb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.191] SetEndOfFile (hFile=0xdc) returned 1 [0145.194] GetProcessHeap () returned 0x4e0000 [0145.194] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.194] GetProcessHeap () returned 0x4e0000 [0145.194] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.194] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.195] CloseHandle (hObject=0xdc) returned 1 [0145.195] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab1c4f00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab1c4f00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN00015_.WMF", cAlternateFileName="")) returned 1 [0145.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.195] GetProcessHeap () returned 0x4e0000 [0145.195] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.195] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.196] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.196] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0145.198] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.198] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.198] GetProcessHeap () returned 0x4e0000 [0145.198] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.198] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.198] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.199] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.199] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.199] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.199] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.199] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.199] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.199] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.199] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.199] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.199] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x127e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x127e, lpOverlapped=0x0) returned 1 [0145.200] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1280, dwBufLen=0x1280 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1280) returned 1 [0145.200] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.200] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1280, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1280, lpOverlapped=0x0) returned 1 [0145.201] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.201] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1354, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.201] SetEndOfFile (hFile=0xdc) returned 1 [0145.203] GetProcessHeap () returned 0x4e0000 [0145.203] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.203] GetProcessHeap () returned 0x4e0000 [0145.203] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.204] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.205] CloseHandle (hObject=0xdc) returned 1 [0145.205] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e812b00, ftCreationTime.dwHighDateTime=0x1bd4b16, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e812b00, ftLastWriteTime.dwHighDateTime=0x1bd4b16, nFileSizeHigh=0x0, nFileSizeLow=0x1634, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN00790_.WMF", cAlternateFileName="")) returned 1 [0145.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.206] GetProcessHeap () returned 0x4e0000 [0145.206] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.206] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.206] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.206] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0145.211] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.211] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.211] GetProcessHeap () returned 0x4e0000 [0145.211] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.211] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.211] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.211] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.211] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.211] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.211] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.211] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.211] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.212] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.212] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.212] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.212] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1634, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1634, lpOverlapped=0x0) returned 1 [0145.213] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1640, dwBufLen=0x1640 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1640) returned 1 [0145.213] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.213] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1640, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1640, lpOverlapped=0x0) returned 1 [0145.213] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.213] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.213] SetEndOfFile (hFile=0xdc) returned 1 [0145.216] GetProcessHeap () returned 0x4e0000 [0145.216] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.216] GetProcessHeap () returned 0x4e0000 [0145.216] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.216] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.217] CloseHandle (hObject=0xdc) returned 1 [0145.217] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9eb2200, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9eb2200, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x5062, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN00853_.WMF", cAlternateFileName="")) returned 1 [0145.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.218] GetProcessHeap () returned 0x4e0000 [0145.218] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.218] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.218] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.218] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0145.220] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.220] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.220] GetProcessHeap () returned 0x4e0000 [0145.220] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.220] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.221] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.221] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.221] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.221] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.221] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.221] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.221] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.221] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.221] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.221] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.221] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5062, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x5062, lpOverlapped=0x0) returned 1 [0145.222] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5070, dwBufLen=0x5070 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5070) returned 1 [0145.223] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.223] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5070, lpOverlapped=0x0) returned 1 [0145.223] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.223] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5144, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.223] SetEndOfFile (hFile=0xdc) returned 1 [0145.226] GetProcessHeap () returned 0x4e0000 [0145.226] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.226] GetProcessHeap () returned 0x4e0000 [0145.226] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.226] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.227] CloseHandle (hObject=0xdc) returned 1 [0145.227] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2efb2900, ftCreationTime.dwHighDateTime=0x1bd4b2f, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2efb2900, ftLastWriteTime.dwHighDateTime=0x1bd4b2f, nFileSizeHigh=0x0, nFileSizeLow=0x2a50, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN00914_.WMF", cAlternateFileName="")) returned 1 [0145.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.229] GetProcessHeap () returned 0x4e0000 [0145.229] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.229] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.229] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.229] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.229] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.229] GetProcessHeap () returned 0x4e0000 [0145.229] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.229] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.229] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.229] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.239] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.239] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.240] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.240] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.240] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.240] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.240] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.240] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.240] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2a50, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2a50, lpOverlapped=0x0) returned 1 [0145.241] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2a50, dwBufLen=0x2a50 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2a50) returned 1 [0145.241] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.241] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2a50, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2a50, lpOverlapped=0x0) returned 1 [0145.241] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.241] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2b24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.242] SetEndOfFile (hFile=0xdc) returned 1 [0145.244] GetProcessHeap () returned 0x4e0000 [0145.244] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.244] GetProcessHeap () returned 0x4e0000 [0145.244] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.244] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.246] CloseHandle (hObject=0xdc) returned 1 [0145.246] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9f500, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8b9f500, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x385c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN00932_.WMF", cAlternateFileName="")) returned 1 [0145.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.246] GetProcessHeap () returned 0x4e0000 [0145.246] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.246] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.246] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.246] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.249] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.249] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.249] GetProcessHeap () returned 0x4e0000 [0145.249] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.249] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.249] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.249] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.249] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.249] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.249] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.249] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.249] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.249] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.249] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.249] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.250] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x385c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x385c, lpOverlapped=0x0) returned 1 [0145.251] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3860, dwBufLen=0x3860 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3860) returned 1 [0145.251] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.251] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3860, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3860, lpOverlapped=0x0) returned 1 [0145.251] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.251] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3934, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.252] SetEndOfFile (hFile=0xdc) returned 1 [0145.254] GetProcessHeap () returned 0x4e0000 [0145.254] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.254] GetProcessHeap () returned 0x4e0000 [0145.255] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.255] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.255] CloseHandle (hObject=0xdc) returned 1 [0145.256] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc14efd00, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc14efd00, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x1ba0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN00965_.WMF", cAlternateFileName="")) returned 1 [0145.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.256] GetProcessHeap () returned 0x4e0000 [0145.256] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.256] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.256] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.256] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.256] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.256] GetProcessHeap () returned 0x4e0000 [0145.256] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.256] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.257] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.257] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.259] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.259] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.259] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.259] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.259] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.259] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.259] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.259] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.259] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1ba0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1ba0, lpOverlapped=0x0) returned 1 [0145.260] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1ba0, dwBufLen=0x1ba0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1ba0) returned 1 [0145.260] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.260] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1ba0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1ba0, lpOverlapped=0x0) returned 1 [0145.260] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.261] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1c74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.261] SetEndOfFile (hFile=0xdc) returned 1 [0145.263] GetProcessHeap () returned 0x4e0000 [0145.263] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.263] GetProcessHeap () returned 0x4e0000 [0145.263] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.263] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.264] CloseHandle (hObject=0xdc) returned 1 [0145.265] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d83ea00, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d83ea00, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0xd10, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN01039_.WMF", cAlternateFileName="")) returned 1 [0145.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.265] GetProcessHeap () returned 0x4e0000 [0145.265] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.265] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.265] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.265] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.265] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.265] GetProcessHeap () returned 0x4e0000 [0145.265] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.265] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.265] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.265] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.268] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.268] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.268] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.268] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.268] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.268] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.268] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.268] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.269] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xd10, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xd10, lpOverlapped=0x0) returned 1 [0145.269] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xd10, dwBufLen=0xd10 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xd10) returned 1 [0145.269] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.269] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xd10, lpOverlapped=0x0) returned 1 [0145.269] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.269] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xde4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.269] SetEndOfFile (hFile=0xdc) returned 1 [0145.272] GetProcessHeap () returned 0x4e0000 [0145.272] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.272] GetProcessHeap () returned 0x4e0000 [0145.272] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.272] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.273] CloseHandle (hObject=0xdc) returned 1 [0145.273] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31e92000, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x31e92000, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x63c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN01044_.WMF", cAlternateFileName="")) returned 1 [0145.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.274] GetProcessHeap () returned 0x4e0000 [0145.274] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.274] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.274] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.274] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.276] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.276] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.276] GetProcessHeap () returned 0x4e0000 [0145.276] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.276] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.276] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.276] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.276] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.276] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.277] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.277] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.277] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.277] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.277] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.277] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.277] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x63c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x63c, lpOverlapped=0x0) returned 1 [0145.277] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x640, dwBufLen=0x640 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x640) returned 1 [0145.277] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.277] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x640, lpOverlapped=0x0) returned 1 [0145.277] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.277] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.277] SetEndOfFile (hFile=0xdc) returned 1 [0145.280] GetProcessHeap () returned 0x4e0000 [0145.280] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.280] GetProcessHeap () returned 0x4e0000 [0145.280] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.280] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.281] CloseHandle (hObject=0xdc) returned 1 [0145.281] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1fda300, ftCreationTime.dwHighDateTime=0x1bd4b21, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa1fda300, ftLastWriteTime.dwHighDateTime=0x1bd4b21, nFileSizeHigh=0x0, nFileSizeLow=0x1f20, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN01060_.WMF", cAlternateFileName="")) returned 1 [0145.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.283] GetProcessHeap () returned 0x4e0000 [0145.283] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.283] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.283] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.283] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.283] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.283] GetProcessHeap () returned 0x4e0000 [0145.283] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.284] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.284] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.284] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.285] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.285] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.286] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.286] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.286] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.286] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.286] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.286] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.286] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1f20, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1f20, lpOverlapped=0x0) returned 1 [0145.287] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1f20, dwBufLen=0x1f20 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1f20) returned 1 [0145.287] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.287] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1f20, lpOverlapped=0x0) returned 1 [0145.287] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.287] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1ff4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.287] SetEndOfFile (hFile=0xdc) returned 1 [0145.289] GetProcessHeap () returned 0x4e0000 [0145.289] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.289] GetProcessHeap () returned 0x4e0000 [0145.289] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.289] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.290] CloseHandle (hObject=0xdc) returned 1 [0145.290] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86dd6400, ftCreationTime.dwHighDateTime=0x1bd4b1e, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86dd6400, ftLastWriteTime.dwHighDateTime=0x1bd4b1e, nFileSizeHigh=0x0, nFileSizeLow=0x728, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN01084_.WMF", cAlternateFileName="")) returned 1 [0145.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.290] GetProcessHeap () returned 0x4e0000 [0145.290] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.290] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.290] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.290] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.299] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.299] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.299] GetProcessHeap () returned 0x4e0000 [0145.299] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.299] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.299] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.299] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.299] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.299] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.299] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.299] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.299] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.299] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.299] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.299] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.299] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x728, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x728, lpOverlapped=0x0) returned 1 [0145.299] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x730, dwBufLen=0x730 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x730) returned 1 [0145.299] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.299] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x730, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x730, lpOverlapped=0x0) returned 1 [0145.300] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.300] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x804, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.300] SetEndOfFile (hFile=0xdc) returned 1 [0145.302] GetProcessHeap () returned 0x4e0000 [0145.302] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.302] GetProcessHeap () returned 0x4e0000 [0145.302] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.302] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.302] CloseHandle (hObject=0xdc) returned 1 [0145.303] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54406500, ftCreationTime.dwHighDateTime=0x1bd4b38, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54406500, ftLastWriteTime.dwHighDateTime=0x1bd4b38, nFileSizeHigh=0x0, nFileSizeLow=0x66dc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN01173_.WMF", cAlternateFileName="")) returned 1 [0145.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.304] GetProcessHeap () returned 0x4e0000 [0145.304] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.304] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.304] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.304] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.305] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.305] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.305] GetProcessHeap () returned 0x4e0000 [0145.305] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.306] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.306] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.306] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.306] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.306] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.306] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.306] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.306] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.306] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.306] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.306] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.306] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x66dc, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x66dc, lpOverlapped=0x0) returned 1 [0145.307] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x66e0, dwBufLen=0x66e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x66e0) returned 1 [0145.307] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.307] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x66e0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x66e0, lpOverlapped=0x0) returned 1 [0145.308] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.308] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x67b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.308] SetEndOfFile (hFile=0xdc) returned 1 [0145.310] GetProcessHeap () returned 0x4e0000 [0145.310] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.310] GetProcessHeap () returned 0x4e0000 [0145.310] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.310] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.311] CloseHandle (hObject=0xdc) returned 1 [0145.311] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x530f3800, ftCreationTime.dwHighDateTime=0x1bd4b38, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x530f3800, ftLastWriteTime.dwHighDateTime=0x1bd4b38, nFileSizeHigh=0x0, nFileSizeLow=0x6cd2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN01174_.WMF", cAlternateFileName="")) returned 1 [0145.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.311] GetProcessHeap () returned 0x4e0000 [0145.311] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.311] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.311] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.311] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0145.313] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.313] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.313] GetProcessHeap () returned 0x4e0000 [0145.313] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.313] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.313] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.313] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.313] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.313] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.313] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.313] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.314] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.314] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.314] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.314] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.314] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x6cd2, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x6cd2, lpOverlapped=0x0) returned 1 [0145.315] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6ce0, dwBufLen=0x6ce0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6ce0) returned 1 [0145.315] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.315] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6ce0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x6ce0, lpOverlapped=0x0) returned 1 [0145.315] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.315] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.315] SetEndOfFile (hFile=0xdc) returned 1 [0145.318] GetProcessHeap () returned 0x4e0000 [0145.318] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.318] GetProcessHeap () returned 0x4e0000 [0145.318] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.318] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.318] CloseHandle (hObject=0xdc) returned 1 [0145.318] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cbf4f00, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8cbf4f00, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xea2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN01184_.WMF", cAlternateFileName="")) returned 1 [0145.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.319] GetProcessHeap () returned 0x4e0000 [0145.319] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.319] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.319] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.319] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0145.321] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.321] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.321] GetProcessHeap () returned 0x4e0000 [0145.321] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.321] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.321] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.321] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.321] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.321] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.321] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.321] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.321] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.321] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.321] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.321] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.321] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xea2, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xea2, lpOverlapped=0x0) returned 1 [0145.321] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xeb0, dwBufLen=0xeb0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xeb0) returned 1 [0145.321] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.321] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xeb0, lpOverlapped=0x0) returned 1 [0145.322] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.322] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xf84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.322] SetEndOfFile (hFile=0xdc) returned 1 [0145.324] GetProcessHeap () returned 0x4e0000 [0145.324] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.324] GetProcessHeap () returned 0x4e0000 [0145.324] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.324] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.324] CloseHandle (hObject=0xdc) returned 1 [0145.325] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8335e700, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8335e700, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0x16cc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN01216_.WMF", cAlternateFileName="")) returned 1 [0145.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.325] GetProcessHeap () returned 0x4e0000 [0145.325] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.325] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.325] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.325] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.336] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.336] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.336] GetProcessHeap () returned 0x4e0000 [0145.336] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.336] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.336] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.336] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.336] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.336] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.336] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.336] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.336] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.336] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.336] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.336] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.336] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x16cc, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x16cc, lpOverlapped=0x0) returned 1 [0145.340] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x16d0, dwBufLen=0x16d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x16d0) returned 1 [0145.340] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.340] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x16d0, lpOverlapped=0x0) returned 1 [0145.340] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.341] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x17a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.341] SetEndOfFile (hFile=0xdc) returned 1 [0145.343] GetProcessHeap () returned 0x4e0000 [0145.343] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.343] GetProcessHeap () returned 0x4e0000 [0145.343] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.343] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.343] CloseHandle (hObject=0xdc) returned 1 [0145.344] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fa26000, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7fa26000, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xbc4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN01218_.WMF", cAlternateFileName="")) returned 1 [0145.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.344] GetProcessHeap () returned 0x4e0000 [0145.344] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.344] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.344] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.344] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0145.346] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.346] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.346] GetProcessHeap () returned 0x4e0000 [0145.346] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.346] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.346] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.346] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.346] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.346] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.346] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.346] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.346] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.347] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.347] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.347] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.347] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xbc4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xbc4, lpOverlapped=0x0) returned 1 [0145.347] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xbd0, dwBufLen=0xbd0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xbd0) returned 1 [0145.347] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.347] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xbd0, lpOverlapped=0x0) returned 1 [0145.347] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.347] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xca4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.347] SetEndOfFile (hFile=0xdc) returned 1 [0145.349] GetProcessHeap () returned 0x4e0000 [0145.349] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.349] GetProcessHeap () returned 0x4e0000 [0145.349] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.349] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.350] CloseHandle (hObject=0xdc) returned 1 [0145.350] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68bb3800, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x68bb3800, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0xac4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN01251_.WMF", cAlternateFileName="")) returned 1 [0145.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.350] GetProcessHeap () returned 0x4e0000 [0145.350] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.350] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.350] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.350] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0145.352] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.352] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.352] GetProcessHeap () returned 0x4e0000 [0145.352] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.352] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.352] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.352] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.352] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.352] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.352] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.353] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.353] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.353] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.353] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.353] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.353] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xac4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xac4, lpOverlapped=0x0) returned 1 [0145.353] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xad0, dwBufLen=0xad0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xad0) returned 1 [0145.353] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.353] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xad0, lpOverlapped=0x0) returned 1 [0145.353] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.353] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xba4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.353] SetEndOfFile (hFile=0xdc) returned 1 [0145.355] GetProcessHeap () returned 0x4e0000 [0145.355] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.355] GetProcessHeap () returned 0x4e0000 [0145.355] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.355] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.356] CloseHandle (hObject=0xdc) returned 1 [0145.356] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc436f700, ftCreationTime.dwHighDateTime=0x1bd4b08, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc436f700, ftLastWriteTime.dwHighDateTime=0x1bd4b08, nFileSizeHigh=0x0, nFileSizeLow=0x1ccc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN01545_.WMF", cAlternateFileName="")) returned 1 [0145.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.357] GetProcessHeap () returned 0x4e0000 [0145.357] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.357] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.357] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.357] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.358] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.358] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.358] GetProcessHeap () returned 0x4e0000 [0145.358] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.358] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.358] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.358] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.358] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.359] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.359] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.359] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.359] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.359] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.359] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.359] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.359] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1ccc, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1ccc, lpOverlapped=0x0) returned 1 [0145.360] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1cd0, dwBufLen=0x1cd0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1cd0) returned 1 [0145.360] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.360] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1cd0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1cd0, lpOverlapped=0x0) returned 1 [0145.360] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.360] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1da4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.360] SetEndOfFile (hFile=0xdc) returned 1 [0145.362] GetProcessHeap () returned 0x4e0000 [0145.362] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.362] GetProcessHeap () returned 0x4e0000 [0145.362] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.362] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.363] CloseHandle (hObject=0xdc) returned 1 [0145.363] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe37a5800, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe37a5800, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x1d74, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN02122_.WMF", cAlternateFileName="")) returned 1 [0145.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.364] GetProcessHeap () returned 0x4e0000 [0145.364] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.364] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.364] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.364] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0145.365] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.365] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.365] GetProcessHeap () returned 0x4e0000 [0145.365] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.365] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.366] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.366] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.366] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.366] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.366] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.366] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.366] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.366] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.366] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.366] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.366] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1d74, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1d74, lpOverlapped=0x0) returned 1 [0145.375] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1d80, dwBufLen=0x1d80 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1d80) returned 1 [0145.375] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.375] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1d80, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1d80, lpOverlapped=0x0) returned 1 [0145.375] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.375] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1e54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.375] SetEndOfFile (hFile=0xdc) returned 1 [0145.378] GetProcessHeap () returned 0x4e0000 [0145.378] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.378] GetProcessHeap () returned 0x4e0000 [0145.378] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.378] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.379] CloseHandle (hObject=0xdc) returned 1 [0145.379] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec9bd00, ftCreationTime.dwHighDateTime=0x1bd4bea, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcec9bd00, ftLastWriteTime.dwHighDateTime=0x1bd4bea, nFileSizeHigh=0x0, nFileSizeLow=0x19e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN02559_.WMF", cAlternateFileName="")) returned 1 [0145.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.379] GetProcessHeap () returned 0x4e0000 [0145.379] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.379] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.379] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.379] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.381] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.381] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.381] GetProcessHeap () returned 0x4e0000 [0145.381] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.381] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.381] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.381] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.381] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.381] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.381] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.381] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.382] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.382] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.382] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.382] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.382] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x19e8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x19e8, lpOverlapped=0x0) returned 1 [0145.383] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x19f0, dwBufLen=0x19f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x19f0) returned 1 [0145.383] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.383] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x19f0, lpOverlapped=0x0) returned 1 [0145.383] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.383] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1ac4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.383] SetEndOfFile (hFile=0xdc) returned 1 [0145.385] GetProcessHeap () returned 0x4e0000 [0145.385] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.385] GetProcessHeap () returned 0x4e0000 [0145.385] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.385] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.389] CloseHandle (hObject=0xdc) returned 1 [0145.389] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b6bc300, ftCreationTime.dwHighDateTime=0x1bd4c00, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b6bc300, ftLastWriteTime.dwHighDateTime=0x1bd4c00, nFileSizeHigh=0x0, nFileSizeLow=0x83c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN02724_.WMF", cAlternateFileName="")) returned 1 [0145.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.390] GetProcessHeap () returned 0x4e0000 [0145.390] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.390] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.390] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.390] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.392] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.392] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.392] GetProcessHeap () returned 0x4e0000 [0145.392] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.392] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.392] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.392] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.392] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.393] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.393] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.393] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.393] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.393] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.393] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.393] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.393] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x83c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x83c, lpOverlapped=0x0) returned 1 [0145.393] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x840, dwBufLen=0x840 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x840) returned 1 [0145.393] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.393] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x840, lpOverlapped=0x0) returned 1 [0145.393] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.393] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x914, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.393] SetEndOfFile (hFile=0xdc) returned 1 [0145.395] GetProcessHeap () returned 0x4e0000 [0145.395] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.395] GetProcessHeap () returned 0x4e0000 [0145.395] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.395] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.396] CloseHandle (hObject=0xdc) returned 1 [0145.396] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c87b100, ftCreationTime.dwHighDateTime=0x1bd4c18, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c87b100, ftLastWriteTime.dwHighDateTime=0x1bd4c18, nFileSizeHigh=0x0, nFileSizeLow=0x2418, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN03500_.WMF", cAlternateFileName="")) returned 1 [0145.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.396] GetProcessHeap () returned 0x4e0000 [0145.397] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.397] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.397] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.397] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.398] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.398] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.398] GetProcessHeap () returned 0x4e0000 [0145.398] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.398] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.398] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.398] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.399] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.399] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.399] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.399] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.399] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.399] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.399] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.399] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.399] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2418, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2418, lpOverlapped=0x0) returned 1 [0145.400] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2420, dwBufLen=0x2420 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2420) returned 1 [0145.400] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.400] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2420, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2420, lpOverlapped=0x0) returned 1 [0145.400] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.400] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x24f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.400] SetEndOfFile (hFile=0xdc) returned 1 [0145.402] GetProcessHeap () returned 0x4e0000 [0145.402] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.402] GetProcessHeap () returned 0x4e0000 [0145.402] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.402] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.403] CloseHandle (hObject=0xdc) returned 1 [0145.403] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x928, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04108_.WMF", cAlternateFileName="")) returned 1 [0145.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.403] GetProcessHeap () returned 0x4e0000 [0145.403] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.403] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.403] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.404] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.406] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.406] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.406] GetProcessHeap () returned 0x4e0000 [0145.406] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.406] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.406] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.406] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.406] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.406] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.406] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.406] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.406] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.406] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.406] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.406] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.406] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x928, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x928, lpOverlapped=0x0) returned 1 [0145.406] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x930, dwBufLen=0x930 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x930) returned 1 [0145.406] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.406] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x930, lpOverlapped=0x0) returned 1 [0145.406] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.407] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xa04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.407] SetEndOfFile (hFile=0xdc) returned 1 [0145.419] GetProcessHeap () returned 0x4e0000 [0145.419] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.419] GetProcessHeap () returned 0x4e0000 [0145.420] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.420] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.420] CloseHandle (hObject=0xdc) returned 1 [0145.420] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x17ac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04117_.WMF", cAlternateFileName="")) returned 1 [0145.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.421] GetProcessHeap () returned 0x4e0000 [0145.421] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.421] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.421] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.421] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.423] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.423] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.423] GetProcessHeap () returned 0x4e0000 [0145.423] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.423] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.423] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.423] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.423] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.423] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.423] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.423] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.423] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.423] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.423] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.423] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.423] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x17ac, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x17ac, lpOverlapped=0x0) returned 1 [0145.424] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x17b0, dwBufLen=0x17b0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x17b0) returned 1 [0145.424] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.424] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x17b0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x17b0, lpOverlapped=0x0) returned 1 [0145.424] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.424] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1884, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.425] SetEndOfFile (hFile=0xdc) returned 1 [0145.427] GetProcessHeap () returned 0x4e0000 [0145.427] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.427] GetProcessHeap () returned 0x4e0000 [0145.427] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.427] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.427] CloseHandle (hObject=0xdc) returned 1 [0145.428] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd58, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04134_.WMF", cAlternateFileName="")) returned 1 [0145.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.428] GetProcessHeap () returned 0x4e0000 [0145.428] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.428] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.428] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.428] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.445] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.445] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.445] GetProcessHeap () returned 0x4e0000 [0145.445] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.445] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.445] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.445] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.445] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.445] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.445] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.445] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.446] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.446] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.446] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.446] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.446] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xd58, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xd58, lpOverlapped=0x0) returned 1 [0145.446] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xd60, dwBufLen=0xd60 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xd60) returned 1 [0145.446] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.446] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xd60, lpOverlapped=0x0) returned 1 [0145.446] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.446] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xe34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.446] SetEndOfFile (hFile=0xdc) returned 1 [0145.448] GetProcessHeap () returned 0x4e0000 [0145.448] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.448] GetProcessHeap () returned 0x4e0000 [0145.448] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.448] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.449] CloseHandle (hObject=0xdc) returned 1 [0145.449] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa4c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04174_.WMF", cAlternateFileName="")) returned 1 [0145.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.450] GetProcessHeap () returned 0x4e0000 [0145.450] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.450] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.450] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.450] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.452] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.452] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.452] GetProcessHeap () returned 0x4e0000 [0145.452] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.452] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.452] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.452] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.452] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.452] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.452] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.453] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.453] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.453] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.453] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.453] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.453] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xa4c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xa4c, lpOverlapped=0x0) returned 1 [0145.453] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa50, dwBufLen=0xa50 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa50) returned 1 [0145.453] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.453] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xa50, lpOverlapped=0x0) returned 1 [0145.453] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.453] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xb24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.453] SetEndOfFile (hFile=0xdc) returned 1 [0145.456] GetProcessHeap () returned 0x4e0000 [0145.456] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.456] GetProcessHeap () returned 0x4e0000 [0145.456] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.456] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.457] CloseHandle (hObject=0xdc) returned 1 [0145.457] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x19ec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04191_.WMF", cAlternateFileName="")) returned 1 [0145.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.457] GetProcessHeap () returned 0x4e0000 [0145.457] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.457] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.457] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.457] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.459] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.459] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.459] GetProcessHeap () returned 0x4e0000 [0145.459] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.459] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.459] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.459] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.459] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.459] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.460] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.460] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.460] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.460] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.460] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.460] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.460] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x19ec, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x19ec, lpOverlapped=0x0) returned 1 [0145.461] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x19f0, dwBufLen=0x19f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x19f0) returned 1 [0145.461] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.461] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x19f0, lpOverlapped=0x0) returned 1 [0145.461] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.461] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1ac4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.461] SetEndOfFile (hFile=0xdc) returned 1 [0145.463] GetProcessHeap () returned 0x4e0000 [0145.463] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.463] GetProcessHeap () returned 0x4e0000 [0145.463] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.463] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.464] CloseHandle (hObject=0xdc) returned 1 [0145.464] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1204, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04195_.WMF", cAlternateFileName="")) returned 1 [0145.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.464] GetProcessHeap () returned 0x4e0000 [0145.464] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.464] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.465] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.465] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0145.472] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.472] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.472] GetProcessHeap () returned 0x4e0000 [0145.472] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.472] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.472] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.472] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.472] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.472] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.472] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.472] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.472] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.472] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.472] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.472] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.472] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1204, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1204, lpOverlapped=0x0) returned 1 [0145.473] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1210, dwBufLen=0x1210 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1210) returned 1 [0145.473] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.473] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1210, lpOverlapped=0x0) returned 1 [0145.473] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.473] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x12e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.474] SetEndOfFile (hFile=0xdc) returned 1 [0145.476] GetProcessHeap () returned 0x4e0000 [0145.476] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.476] GetProcessHeap () returned 0x4e0000 [0145.476] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.476] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.477] CloseHandle (hObject=0xdc) returned 1 [0145.477] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc48, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04196_.WMF", cAlternateFileName="")) returned 1 [0145.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.477] GetProcessHeap () returned 0x4e0000 [0145.477] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.477] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.477] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.477] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.479] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.479] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.479] GetProcessHeap () returned 0x4e0000 [0145.479] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.479] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.479] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.480] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.480] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.480] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.480] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.480] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.480] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.480] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.480] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.480] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.480] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xc48, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xc48, lpOverlapped=0x0) returned 1 [0145.480] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xc50, dwBufLen=0xc50 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xc50) returned 1 [0145.480] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.480] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xc50, lpOverlapped=0x0) returned 1 [0145.480] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.480] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xd24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.480] SetEndOfFile (hFile=0xdc) returned 1 [0145.482] GetProcessHeap () returned 0x4e0000 [0145.482] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.482] GetProcessHeap () returned 0x4e0000 [0145.483] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.483] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.483] CloseHandle (hObject=0xdc) returned 1 [0145.484] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1df4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04206_.WMF", cAlternateFileName="")) returned 1 [0145.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.485] GetProcessHeap () returned 0x4e0000 [0145.485] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.485] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.485] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.485] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0145.487] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.487] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.487] GetProcessHeap () returned 0x4e0000 [0145.487] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.487] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.487] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.487] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.487] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.487] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.487] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.487] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.487] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.488] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.488] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.488] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.488] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1df4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1df4, lpOverlapped=0x0) returned 1 [0145.488] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1e00, dwBufLen=0x1e00 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1e00) returned 1 [0145.488] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.489] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1e00, lpOverlapped=0x0) returned 1 [0145.489] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.489] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.489] SetEndOfFile (hFile=0xdc) returned 1 [0145.491] GetProcessHeap () returned 0x4e0000 [0145.491] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.491] GetProcessHeap () returned 0x4e0000 [0145.491] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.491] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.492] CloseHandle (hObject=0xdc) returned 1 [0145.492] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x212c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04225_.WMF", cAlternateFileName="")) returned 1 [0145.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.492] GetProcessHeap () returned 0x4e0000 [0145.492] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.492] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.492] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.492] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.494] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.494] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.494] GetProcessHeap () returned 0x4e0000 [0145.494] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.494] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.494] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.494] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.494] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.494] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.494] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.495] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.495] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.495] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.495] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.495] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.495] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x212c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x212c, lpOverlapped=0x0) returned 1 [0145.496] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2130, dwBufLen=0x2130 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2130) returned 1 [0145.496] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.496] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2130, lpOverlapped=0x0) returned 1 [0145.496] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.496] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.496] SetEndOfFile (hFile=0xdc) returned 1 [0145.498] GetProcessHeap () returned 0x4e0000 [0145.498] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.498] GetProcessHeap () returned 0x4e0000 [0145.498] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.498] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.499] CloseHandle (hObject=0xdc) returned 1 [0145.499] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e7c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04235_.WMF", cAlternateFileName="")) returned 1 [0145.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.499] GetProcessHeap () returned 0x4e0000 [0145.499] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.499] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.499] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.499] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.501] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.501] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.501] GetProcessHeap () returned 0x4e0000 [0145.501] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.501] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.501] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.501] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.501] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.501] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.502] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.502] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.502] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.502] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.502] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.502] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.502] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1e7c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1e7c, lpOverlapped=0x0) returned 1 [0145.503] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1e80, dwBufLen=0x1e80 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1e80) returned 1 [0145.503] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.503] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1e80, lpOverlapped=0x0) returned 1 [0145.503] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.503] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1f54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.503] SetEndOfFile (hFile=0xdc) returned 1 [0145.505] GetProcessHeap () returned 0x4e0000 [0145.505] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.505] GetProcessHeap () returned 0x4e0000 [0145.505] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.505] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.506] CloseHandle (hObject=0xdc) returned 1 [0145.506] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e7c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04267_.WMF", cAlternateFileName="")) returned 1 [0145.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.506] GetProcessHeap () returned 0x4e0000 [0145.506] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.506] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.506] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.506] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.508] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.508] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.508] GetProcessHeap () returned 0x4e0000 [0145.508] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.508] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.508] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.508] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.508] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.508] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.508] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.508] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.508] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.509] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.509] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.509] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.509] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1e7c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1e7c, lpOverlapped=0x0) returned 1 [0145.509] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1e80, dwBufLen=0x1e80 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1e80) returned 1 [0145.509] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.510] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1e80, lpOverlapped=0x0) returned 1 [0145.510] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.510] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1f54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.510] SetEndOfFile (hFile=0xdc) returned 1 [0145.512] GetProcessHeap () returned 0x4e0000 [0145.512] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.512] GetProcessHeap () returned 0x4e0000 [0145.512] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.512] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.512] CloseHandle (hObject=0xdc) returned 1 [0145.513] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7e0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04269_.WMF", cAlternateFileName="")) returned 1 [0145.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.514] GetProcessHeap () returned 0x4e0000 [0145.514] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.514] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.514] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.514] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.514] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.514] GetProcessHeap () returned 0x4e0000 [0145.514] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.514] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.514] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.514] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.515] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.516] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.516] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.516] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.516] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.516] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.516] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.516] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.516] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7e0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7e0, lpOverlapped=0x0) returned 1 [0145.516] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7e0, dwBufLen=0x7e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7e0) returned 1 [0145.516] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.516] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7e0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7e0, lpOverlapped=0x0) returned 1 [0145.516] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.516] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x8b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.516] SetEndOfFile (hFile=0xdc) returned 1 [0145.519] GetProcessHeap () returned 0x4e0000 [0145.519] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.519] GetProcessHeap () returned 0x4e0000 [0145.519] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.519] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.519] CloseHandle (hObject=0xdc) returned 1 [0145.520] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04323_.WMF", cAlternateFileName="")) returned 1 [0145.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.521] GetProcessHeap () returned 0x4e0000 [0145.521] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.521] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.521] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.521] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.523] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.523] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.523] GetProcessHeap () returned 0x4e0000 [0145.523] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.523] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.523] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.523] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.523] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.523] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.523] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.523] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.523] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.523] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.523] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.523] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.524] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x9bc, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x9bc, lpOverlapped=0x0) returned 1 [0145.524] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9c0, dwBufLen=0x9c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9c0) returned 1 [0145.524] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.524] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x9c0, lpOverlapped=0x0) returned 1 [0145.524] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.524] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xa94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.524] SetEndOfFile (hFile=0xdc) returned 1 [0145.527] GetProcessHeap () returned 0x4e0000 [0145.527] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.527] GetProcessHeap () returned 0x4e0000 [0145.527] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.527] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.527] CloseHandle (hObject=0xdc) returned 1 [0145.528] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd14, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04326_.WMF", cAlternateFileName="")) returned 1 [0145.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.528] GetProcessHeap () returned 0x4e0000 [0145.528] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.528] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.528] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.528] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0145.530] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.530] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.530] GetProcessHeap () returned 0x4e0000 [0145.530] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.530] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.530] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.530] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.530] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.530] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.530] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.530] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.530] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.530] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.530] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.530] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.531] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xd14, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xd14, lpOverlapped=0x0) returned 1 [0145.531] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xd20, dwBufLen=0xd20 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xd20) returned 1 [0145.531] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.531] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xd20, lpOverlapped=0x0) returned 1 [0145.531] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.531] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xdf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.531] SetEndOfFile (hFile=0xdc) returned 1 [0145.533] GetProcessHeap () returned 0x4e0000 [0145.533] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.533] GetProcessHeap () returned 0x4e0000 [0145.533] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.533] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.534] CloseHandle (hObject=0xdc) returned 1 [0145.534] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x10c8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04332_.WMF", cAlternateFileName="")) returned 1 [0145.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.535] GetProcessHeap () returned 0x4e0000 [0145.535] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.535] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.535] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.535] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.537] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.537] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.537] GetProcessHeap () returned 0x4e0000 [0145.537] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.537] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.537] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.537] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.537] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.537] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.537] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.537] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.537] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.537] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.537] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.537] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.537] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x10c8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x10c8, lpOverlapped=0x0) returned 1 [0145.538] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x10d0, dwBufLen=0x10d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x10d0) returned 1 [0145.538] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.538] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x10d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x10d0, lpOverlapped=0x0) returned 1 [0145.539] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.539] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x11a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.539] SetEndOfFile (hFile=0xdc) returned 1 [0145.541] GetProcessHeap () returned 0x4e0000 [0145.541] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.541] GetProcessHeap () returned 0x4e0000 [0145.541] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.541] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.541] CloseHandle (hObject=0xdc) returned 1 [0145.542] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc9c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04355_.WMF", cAlternateFileName="")) returned 1 [0145.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.542] GetProcessHeap () returned 0x4e0000 [0145.542] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.542] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.542] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.542] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.544] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.544] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.544] GetProcessHeap () returned 0x4e0000 [0145.544] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.544] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.544] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.544] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.544] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.544] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.544] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.544] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.544] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.544] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.544] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.544] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.544] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xc9c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xc9c, lpOverlapped=0x0) returned 1 [0145.545] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xca0, dwBufLen=0xca0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xca0) returned 1 [0145.545] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.545] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xca0, lpOverlapped=0x0) returned 1 [0145.545] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.545] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xd74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.545] SetEndOfFile (hFile=0xdc) returned 1 [0145.547] GetProcessHeap () returned 0x4e0000 [0145.547] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.547] GetProcessHeap () returned 0x4e0000 [0145.547] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.547] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.548] CloseHandle (hObject=0xdc) returned 1 [0145.548] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x12c8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04369_.WMF", cAlternateFileName="")) returned 1 [0145.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.548] GetProcessHeap () returned 0x4e0000 [0145.548] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.548] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.548] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.548] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.550] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.550] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.550] GetProcessHeap () returned 0x4e0000 [0145.550] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.550] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.550] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.550] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.550] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.550] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.550] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.550] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.550] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.550] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.550] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.550] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.550] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x12c8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x12c8, lpOverlapped=0x0) returned 1 [0145.551] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x12d0, dwBufLen=0x12d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x12d0) returned 1 [0145.551] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.551] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x12d0, lpOverlapped=0x0) returned 1 [0145.551] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.551] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x13a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.551] SetEndOfFile (hFile=0xdc) returned 1 [0145.554] GetProcessHeap () returned 0x4e0000 [0145.554] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.554] GetProcessHeap () returned 0x4e0000 [0145.554] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.554] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.554] CloseHandle (hObject=0xdc) returned 1 [0145.555] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1384, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04384_.WMF", cAlternateFileName="")) returned 1 [0145.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.555] GetProcessHeap () returned 0x4e0000 [0145.555] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.555] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.555] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.555] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0145.557] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.557] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.557] GetProcessHeap () returned 0x4e0000 [0145.557] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.557] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.557] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.557] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.557] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.557] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.557] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.557] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.557] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.557] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.557] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.557] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.557] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1384, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1384, lpOverlapped=0x0) returned 1 [0145.558] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1390, dwBufLen=0x1390 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1390) returned 1 [0145.558] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.558] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1390, lpOverlapped=0x0) returned 1 [0145.558] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.558] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.558] SetEndOfFile (hFile=0xdc) returned 1 [0145.560] GetProcessHeap () returned 0x4e0000 [0145.560] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.560] GetProcessHeap () returned 0x4e0000 [0145.560] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.560] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.561] CloseHandle (hObject=0xdc) returned 1 [0145.561] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x138c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04385_.WMF", cAlternateFileName="")) returned 1 [0145.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.562] GetProcessHeap () returned 0x4e0000 [0145.562] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.562] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.562] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.562] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.563] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.563] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.563] GetProcessHeap () returned 0x4e0000 [0145.563] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.563] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.564] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.564] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.564] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.564] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.564] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.564] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.564] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.564] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.564] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.564] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.564] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x138c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x138c, lpOverlapped=0x0) returned 1 [0145.565] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1390, dwBufLen=0x1390 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1390) returned 1 [0145.565] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.565] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1390, lpOverlapped=0x0) returned 1 [0145.565] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.565] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.565] SetEndOfFile (hFile=0xdc) returned 1 [0145.567] GetProcessHeap () returned 0x4e0000 [0145.568] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.568] GetProcessHeap () returned 0x4e0000 [0145.568] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.568] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.568] CloseHandle (hObject=0xdc) returned 1 [0145.568] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfc41400, ftCreationTime.dwHighDateTime=0x1bd4c15, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcfc41400, ftLastWriteTime.dwHighDateTime=0x1bd4c15, nFileSizeHigh=0x0, nFileSizeLow=0x1cd8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BABY_01.MID", cAlternateFileName="")) returned 1 [0145.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.569] GetProcessHeap () returned 0x4e0000 [0145.569] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.569] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.569] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.569] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.570] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.570] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.570] GetProcessHeap () returned 0x4e0000 [0145.570] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.571] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.571] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.571] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.571] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.571] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.571] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.571] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.571] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.571] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.571] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.571] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.571] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1cd8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1cd8, lpOverlapped=0x0) returned 1 [0145.580] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1ce0, dwBufLen=0x1ce0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1ce0) returned 1 [0145.581] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.581] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1ce0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1ce0, lpOverlapped=0x0) returned 1 [0145.581] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.581] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.581] SetEndOfFile (hFile=0xdc) returned 1 [0145.583] GetProcessHeap () returned 0x4e0000 [0145.583] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.583] GetProcessHeap () returned 0x4e0000 [0145.583] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.583] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.584] CloseHandle (hObject=0xdc) returned 1 [0145.584] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1306, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD00116_.WMF", cAlternateFileName="")) returned 1 [0145.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.585] GetProcessHeap () returned 0x4e0000 [0145.585] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.585] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.585] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.585] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0145.587] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.587] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.587] GetProcessHeap () returned 0x4e0000 [0145.587] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.587] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.587] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.587] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.587] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.587] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.587] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.587] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.587] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.587] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.587] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.587] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.587] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1306, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1306, lpOverlapped=0x0) returned 1 [0145.588] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1310, dwBufLen=0x1310 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1310) returned 1 [0145.588] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.588] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1310, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1310, lpOverlapped=0x0) returned 1 [0145.588] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.588] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x13e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.588] SetEndOfFile (hFile=0xdc) returned 1 [0145.590] GetProcessHeap () returned 0x4e0000 [0145.590] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.590] GetProcessHeap () returned 0x4e0000 [0145.591] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.591] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.591] CloseHandle (hObject=0xdc) returned 1 [0145.591] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2332bb00, ftCreationTime.dwHighDateTime=0x1bd4fa4, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2332bb00, ftLastWriteTime.dwHighDateTime=0x1bd4fa4, nFileSizeHigh=0x0, nFileSizeLow=0x6906, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD00141_.WMF", cAlternateFileName="")) returned 1 [0145.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.592] GetProcessHeap () returned 0x4e0000 [0145.592] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.592] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.592] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.592] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0145.593] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.593] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.593] GetProcessHeap () returned 0x4e0000 [0145.593] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.594] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.594] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.594] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.594] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.594] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.594] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.594] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.594] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.594] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.594] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.594] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.594] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x6906, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x6906, lpOverlapped=0x0) returned 1 [0145.595] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6910, dwBufLen=0x6910 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6910) returned 1 [0145.595] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.595] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6910, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x6910, lpOverlapped=0x0) returned 1 [0145.596] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.596] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x69e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.596] SetEndOfFile (hFile=0xdc) returned 1 [0145.598] GetProcessHeap () returned 0x4e0000 [0145.598] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.598] GetProcessHeap () returned 0x4e0000 [0145.598] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.598] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.599] CloseHandle (hObject=0xdc) returned 1 [0145.599] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb983d700, ftCreationTime.dwHighDateTime=0x1bf148e, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb983d700, ftLastWriteTime.dwHighDateTime=0x1bf148e, nFileSizeHigh=0x0, nFileSizeLow=0x7114, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD00146_.WMF", cAlternateFileName="")) returned 1 [0145.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.599] GetProcessHeap () returned 0x4e0000 [0145.599] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.599] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.599] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.599] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0145.601] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.601] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.601] GetProcessHeap () returned 0x4e0000 [0145.601] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.601] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.601] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.601] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.601] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.601] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.601] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.601] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.601] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.602] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.602] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.602] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.602] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7114, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7114, lpOverlapped=0x0) returned 1 [0145.603] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7120, dwBufLen=0x7120 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7120) returned 1 [0145.603] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.603] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7120, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7120, lpOverlapped=0x0) returned 1 [0145.603] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.603] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x71f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.603] SetEndOfFile (hFile=0xdc) returned 1 [0145.605] GetProcessHeap () returned 0x4e0000 [0145.605] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.605] GetProcessHeap () returned 0x4e0000 [0145.605] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.605] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.606] CloseHandle (hObject=0xdc) returned 1 [0145.606] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d1cf00, ftCreationTime.dwHighDateTime=0x1bd4fa4, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d1cf00, ftLastWriteTime.dwHighDateTime=0x1bd4fa4, nFileSizeHigh=0x0, nFileSizeLow=0x2d74, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD00155_.WMF", cAlternateFileName="")) returned 1 [0145.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.607] GetProcessHeap () returned 0x4e0000 [0145.607] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.607] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.607] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.607] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0145.609] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.609] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.609] GetProcessHeap () returned 0x4e0000 [0145.609] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.609] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.609] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.609] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.609] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.609] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.609] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.609] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.609] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.609] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.609] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.609] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.609] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2d74, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2d74, lpOverlapped=0x0) returned 1 [0145.610] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2d80, dwBufLen=0x2d80 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2d80) returned 1 [0145.610] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.610] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2d80, lpOverlapped=0x0) returned 1 [0145.610] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.610] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2e54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.610] SetEndOfFile (hFile=0xdc) returned 1 [0145.613] GetProcessHeap () returned 0x4e0000 [0145.613] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.613] GetProcessHeap () returned 0x4e0000 [0145.613] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.613] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.613] CloseHandle (hObject=0xdc) returned 1 [0145.613] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaaac100, ftCreationTime.dwHighDateTime=0x1bd4fa3, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfaaac100, ftLastWriteTime.dwHighDateTime=0x1bd4fa3, nFileSizeHigh=0x0, nFileSizeLow=0x57f4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD00160_.WMF", cAlternateFileName="")) returned 1 [0145.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.621] GetProcessHeap () returned 0x4e0000 [0145.621] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.621] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.621] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.621] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0145.623] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.623] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.623] GetProcessHeap () returned 0x4e0000 [0145.623] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.623] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.623] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.623] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.623] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.623] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.623] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.623] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.624] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.624] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.624] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.624] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.624] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x57f4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x57f4, lpOverlapped=0x0) returned 1 [0145.625] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5800, dwBufLen=0x5800 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5800) returned 1 [0145.625] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.625] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5800, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5800, lpOverlapped=0x0) returned 1 [0145.625] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.625] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x58d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.625] SetEndOfFile (hFile=0xdc) returned 1 [0145.627] GetProcessHeap () returned 0x4e0000 [0145.627] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.627] GetProcessHeap () returned 0x4e0000 [0145.627] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.628] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.628] CloseHandle (hObject=0xdc) returned 1 [0145.628] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcafbb900, ftCreationTime.dwHighDateTime=0x1bd4fa3, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcafbb900, ftLastWriteTime.dwHighDateTime=0x1bd4fa3, nFileSizeHigh=0x0, nFileSizeLow=0x3f34, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD00173_.WMF", cAlternateFileName="")) returned 1 [0145.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.629] GetProcessHeap () returned 0x4e0000 [0145.629] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.629] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.629] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.629] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0145.631] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.631] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.631] GetProcessHeap () returned 0x4e0000 [0145.631] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.631] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.631] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.631] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.631] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.631] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.631] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.631] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.631] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.632] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.632] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.632] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.632] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3f34, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3f34, lpOverlapped=0x0) returned 1 [0145.632] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3f40, dwBufLen=0x3f40 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3f40) returned 1 [0145.633] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.633] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3f40, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3f40, lpOverlapped=0x0) returned 1 [0145.633] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.633] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.633] SetEndOfFile (hFile=0xdc) returned 1 [0145.635] GetProcessHeap () returned 0x4e0000 [0145.635] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.635] GetProcessHeap () returned 0x4e0000 [0145.635] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.635] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.636] CloseHandle (hObject=0xdc) returned 1 [0145.636] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4354, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD05119_.WMF", cAlternateFileName="")) returned 1 [0145.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.636] GetProcessHeap () returned 0x4e0000 [0145.636] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.636] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.636] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.636] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0145.638] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.638] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.638] GetProcessHeap () returned 0x4e0000 [0145.638] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.638] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.638] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.638] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.638] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.638] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.638] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.638] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.638] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.639] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.639] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.639] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.639] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4354, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4354, lpOverlapped=0x0) returned 1 [0145.639] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4360, dwBufLen=0x4360 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4360) returned 1 [0145.640] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.640] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4360, lpOverlapped=0x0) returned 1 [0145.640] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.640] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4434, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.640] SetEndOfFile (hFile=0xdc) returned 1 [0145.642] GetProcessHeap () returned 0x4e0000 [0145.642] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.642] GetProcessHeap () returned 0x4e0000 [0145.642] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.642] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.643] CloseHandle (hObject=0xdc) returned 1 [0145.643] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3ef0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD06102_.WMF", cAlternateFileName="")) returned 1 [0145.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.643] GetProcessHeap () returned 0x4e0000 [0145.643] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.643] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.643] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.643] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.643] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.643] GetProcessHeap () returned 0x4e0000 [0145.644] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.644] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.644] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.644] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.645] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.645] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.645] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.645] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.645] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.645] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.645] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.645] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.646] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3ef0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3ef0, lpOverlapped=0x0) returned 1 [0145.646] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3ef0, dwBufLen=0x3ef0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3ef0) returned 1 [0145.646] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.646] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3ef0, lpOverlapped=0x0) returned 1 [0145.647] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.647] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3fc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.647] SetEndOfFile (hFile=0xdc) returned 1 [0145.649] GetProcessHeap () returned 0x4e0000 [0145.649] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.649] GetProcessHeap () returned 0x4e0000 [0145.649] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.649] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.649] CloseHandle (hObject=0xdc) returned 1 [0145.650] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4124, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD06200_.WMF", cAlternateFileName="")) returned 1 [0145.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.650] GetProcessHeap () returned 0x4e0000 [0145.650] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.651] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.651] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.651] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0145.652] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.652] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.652] GetProcessHeap () returned 0x4e0000 [0145.653] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.653] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.653] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.653] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.653] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.653] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.653] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.653] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.653] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.653] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.653] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.653] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.653] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4124, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4124, lpOverlapped=0x0) returned 1 [0145.654] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4130, dwBufLen=0x4130 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4130) returned 1 [0145.654] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.654] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4130, lpOverlapped=0x0) returned 1 [0145.654] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.654] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.654] SetEndOfFile (hFile=0xdc) returned 1 [0145.657] GetProcessHeap () returned 0x4e0000 [0145.657] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.657] GetProcessHeap () returned 0x4e0000 [0145.657] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.657] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.659] CloseHandle (hObject=0xdc) returned 1 [0145.659] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x687c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD07761_.WMF", cAlternateFileName="")) returned 1 [0145.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.659] GetProcessHeap () returned 0x4e0000 [0145.659] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.659] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.659] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.659] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.661] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.661] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.661] GetProcessHeap () returned 0x4e0000 [0145.661] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.661] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.661] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.661] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.661] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.661] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.661] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.661] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.661] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.661] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.662] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.662] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.662] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x687c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x687c, lpOverlapped=0x0) returned 1 [0145.665] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6880, dwBufLen=0x6880 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6880) returned 1 [0145.665] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.665] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6880, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x6880, lpOverlapped=0x0) returned 1 [0145.666] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.666] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6954, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.666] SetEndOfFile (hFile=0xdc) returned 1 [0145.668] GetProcessHeap () returned 0x4e0000 [0145.668] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.668] GetProcessHeap () returned 0x4e0000 [0145.668] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.668] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.669] CloseHandle (hObject=0xdc) returned 1 [0145.669] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x133c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD07804_.WMF", cAlternateFileName="")) returned 1 [0145.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.669] GetProcessHeap () returned 0x4e0000 [0145.669] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.669] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.669] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.669] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.671] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.671] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.671] GetProcessHeap () returned 0x4e0000 [0145.671] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.671] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.671] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.671] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.671] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.671] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.671] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.671] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.671] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.672] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.672] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.672] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.672] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x133c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x133c, lpOverlapped=0x0) returned 1 [0145.672] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1340, dwBufLen=0x1340 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1340) returned 1 [0145.672] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.673] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1340, lpOverlapped=0x0) returned 1 [0145.673] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.673] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1414, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.673] SetEndOfFile (hFile=0xdc) returned 1 [0145.675] GetProcessHeap () returned 0x4e0000 [0145.675] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.675] GetProcessHeap () returned 0x4e0000 [0145.675] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.675] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.676] CloseHandle (hObject=0xdc) returned 1 [0145.676] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xfe2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD07831_.WMF", cAlternateFileName="")) returned 1 [0145.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.677] GetProcessHeap () returned 0x4e0000 [0145.677] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.677] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.677] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.677] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0145.679] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.679] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.679] GetProcessHeap () returned 0x4e0000 [0145.679] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.679] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.679] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.679] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.679] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.679] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.679] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.679] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.679] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.679] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.679] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.679] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.679] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xfe2, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xfe2, lpOverlapped=0x0) returned 1 [0145.680] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xff0, dwBufLen=0xff0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xff0) returned 1 [0145.680] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.680] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xff0, lpOverlapped=0x0) returned 1 [0145.680] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.680] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x10c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.680] SetEndOfFile (hFile=0xdc) returned 1 [0145.682] GetProcessHeap () returned 0x4e0000 [0145.682] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.682] GetProcessHeap () returned 0x4e0000 [0145.682] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.682] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.685] CloseHandle (hObject=0xdc) returned 1 [0145.685] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5f00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD08758_.WMF", cAlternateFileName="")) returned 1 [0145.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.686] GetProcessHeap () returned 0x4e0000 [0145.686] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.686] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.686] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.686] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.686] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.686] GetProcessHeap () returned 0x4e0000 [0145.686] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.686] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.686] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.686] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.688] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.688] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.688] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.688] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.688] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.688] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.688] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.689] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.689] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5f00, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x5f00, lpOverlapped=0x0) returned 1 [0145.690] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5f00, dwBufLen=0x5f00 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5f00) returned 1 [0145.690] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.690] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5f00, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5f00, lpOverlapped=0x0) returned 1 [0145.690] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.690] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5fd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.690] SetEndOfFile (hFile=0xdc) returned 1 [0145.692] GetProcessHeap () returned 0x4e0000 [0145.692] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.692] GetProcessHeap () returned 0x4e0000 [0145.692] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.692] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.693] CloseHandle (hObject=0xdc) returned 1 [0145.693] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x60ca, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD08773_.WMF", cAlternateFileName="")) returned 1 [0145.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.693] GetProcessHeap () returned 0x4e0000 [0145.693] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.694] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.694] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.694] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0145.695] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.695] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.695] GetProcessHeap () returned 0x4e0000 [0145.696] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.696] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.696] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.696] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.696] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.696] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.696] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.696] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.696] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.696] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.696] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.696] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.696] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x60ca, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x60ca, lpOverlapped=0x0) returned 1 [0145.697] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x60d0, dwBufLen=0x60d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x60d0) returned 1 [0145.697] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.697] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x60d0, lpOverlapped=0x0) returned 1 [0145.698] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.698] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x61a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.698] SetEndOfFile (hFile=0xdc) returned 1 [0145.700] GetProcessHeap () returned 0x4e0000 [0145.700] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.700] GetProcessHeap () returned 0x4e0000 [0145.700] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.700] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.701] CloseHandle (hObject=0xdc) returned 1 [0145.701] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbb7c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD08808_.WMF", cAlternateFileName="")) returned 1 [0145.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.701] GetProcessHeap () returned 0x4e0000 [0145.701] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.701] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.701] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.701] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.703] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.703] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.703] GetProcessHeap () returned 0x4e0000 [0145.703] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.703] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.703] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.703] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.703] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.703] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.703] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.703] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.704] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.704] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.704] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.704] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.704] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xbb7c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xbb7c, lpOverlapped=0x0) returned 1 [0145.705] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xbb80, dwBufLen=0xbb80 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xbb80) returned 1 [0145.706] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.706] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xbb80, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xbb80, lpOverlapped=0x0) returned 1 [0145.706] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.706] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xbc54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.706] SetEndOfFile (hFile=0xdc) returned 1 [0145.708] GetProcessHeap () returned 0x4e0000 [0145.708] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.708] GetProcessHeap () returned 0x4e0000 [0145.708] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.708] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.709] CloseHandle (hObject=0xdc) returned 1 [0145.709] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9d0e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD08868_.WMF", cAlternateFileName="")) returned 1 [0145.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.710] GetProcessHeap () returned 0x4e0000 [0145.710] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.710] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.710] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.710] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0145.711] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.711] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.711] GetProcessHeap () returned 0x4e0000 [0145.711] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.712] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.712] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.712] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.712] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.712] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.712] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.712] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.712] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.712] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.712] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.712] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.712] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x9d0e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x9d0e, lpOverlapped=0x0) returned 1 [0145.713] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9d10, dwBufLen=0x9d10 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9d10) returned 1 [0145.714] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.714] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x9d10, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x9d10, lpOverlapped=0x0) returned 1 [0145.714] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.714] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x9de4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.714] SetEndOfFile (hFile=0xdc) returned 1 [0145.716] GetProcessHeap () returned 0x4e0000 [0145.716] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.716] GetProcessHeap () returned 0x4e0000 [0145.716] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.716] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.717] CloseHandle (hObject=0xdc) returned 1 [0145.717] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbaaa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD09031_.WMF", cAlternateFileName="")) returned 1 [0145.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.717] GetProcessHeap () returned 0x4e0000 [0145.717] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.717] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.717] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.718] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0145.719] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.719] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.719] GetProcessHeap () returned 0x4e0000 [0145.719] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.719] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.719] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.719] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.720] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.720] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.720] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.720] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.720] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.720] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.720] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.720] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.720] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xbaaa, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xbaaa, lpOverlapped=0x0) returned 1 [0145.722] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xbab0, dwBufLen=0xbab0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xbab0) returned 1 [0145.722] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.722] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xbab0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xbab0, lpOverlapped=0x0) returned 1 [0145.722] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.722] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xbb84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.722] SetEndOfFile (hFile=0xdc) returned 1 [0145.725] GetProcessHeap () returned 0x4e0000 [0145.725] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.725] GetProcessHeap () returned 0x4e0000 [0145.725] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.725] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.725] CloseHandle (hObject=0xdc) returned 1 [0145.726] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x38cc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD09194_.WMF", cAlternateFileName="")) returned 1 [0145.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.726] GetProcessHeap () returned 0x4e0000 [0145.726] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.726] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.726] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.726] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.730] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.730] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.730] GetProcessHeap () returned 0x4e0000 [0145.730] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.730] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.730] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.730] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.730] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.731] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.731] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.731] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.731] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.731] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.731] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.731] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.731] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x38cc, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x38cc, lpOverlapped=0x0) returned 1 [0145.732] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x38d0, dwBufLen=0x38d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x38d0) returned 1 [0145.732] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.732] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x38d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x38d0, lpOverlapped=0x0) returned 1 [0145.732] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.732] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x39a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.732] SetEndOfFile (hFile=0xdc) returned 1 [0145.734] GetProcessHeap () returned 0x4e0000 [0145.734] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.734] GetProcessHeap () returned 0x4e0000 [0145.734] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.734] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.736] CloseHandle (hObject=0xdc) returned 1 [0145.737] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x504a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD09662_.WMF", cAlternateFileName="")) returned 1 [0145.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.738] GetProcessHeap () returned 0x4e0000 [0145.738] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.738] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.738] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.738] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0145.739] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.739] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.739] GetProcessHeap () returned 0x4e0000 [0145.740] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.740] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.740] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.740] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.740] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.740] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.740] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.740] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.740] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.740] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.740] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.740] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.740] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x504a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x504a, lpOverlapped=0x0) returned 1 [0145.741] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5050, dwBufLen=0x5050 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5050) returned 1 [0145.741] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.741] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5050, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5050, lpOverlapped=0x0) returned 1 [0145.742] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.742] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5124, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.742] SetEndOfFile (hFile=0xdc) returned 1 [0145.744] GetProcessHeap () returned 0x4e0000 [0145.744] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.744] GetProcessHeap () returned 0x4e0000 [0145.744] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.744] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.745] CloseHandle (hObject=0xdc) returned 1 [0145.745] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f1e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD09664_.WMF", cAlternateFileName="")) returned 1 [0145.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.745] GetProcessHeap () returned 0x4e0000 [0145.745] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.745] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.745] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.745] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0145.747] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.747] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.747] GetProcessHeap () returned 0x4e0000 [0145.747] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.747] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.747] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.747] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.747] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.747] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.747] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.748] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.748] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.748] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.748] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.748] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.748] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1f1e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1f1e, lpOverlapped=0x0) returned 1 [0145.749] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1f20, dwBufLen=0x1f20 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1f20) returned 1 [0145.749] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.749] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1f20, lpOverlapped=0x0) returned 1 [0145.749] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.749] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1ff4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.749] SetEndOfFile (hFile=0xdc) returned 1 [0145.751] GetProcessHeap () returned 0x4e0000 [0145.751] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.751] GetProcessHeap () returned 0x4e0000 [0145.751] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.751] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.752] CloseHandle (hObject=0xdc) returned 1 [0145.752] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c365a00, ftCreationTime.dwHighDateTime=0x1bd4f6a, ftLastAccessTime.dwLowDateTime=0x5f47ba90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4c365a00, ftLastWriteTime.dwHighDateTime=0x1bd4f6a, nFileSizeHigh=0x0, nFileSizeLow=0x34cb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD10890_.GIF", cAlternateFileName="")) returned 1 [0145.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.753] GetProcessHeap () returned 0x4e0000 [0145.753] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.753] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.753] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.753] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x5, lpOverlapped=0x0) returned 1 [0145.754] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.754] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.754] GetProcessHeap () returned 0x4e0000 [0145.754] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.754] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.755] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.755] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.755] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.755] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.755] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.755] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.755] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.755] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.755] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.755] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.755] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x34cb, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x34cb, lpOverlapped=0x0) returned 1 [0145.756] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x34d0, dwBufLen=0x34d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x34d0) returned 1 [0145.756] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.756] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x34d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x34d0, lpOverlapped=0x0) returned 1 [0145.756] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.756] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x35a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.756] SetEndOfFile (hFile=0xdc) returned 1 [0145.759] GetProcessHeap () returned 0x4e0000 [0145.759] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.759] GetProcessHeap () returned 0x4e0000 [0145.759] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.759] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.759] CloseHandle (hObject=0xdc) returned 1 [0145.760] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93701b00, ftCreationTime.dwHighDateTime=0x1bd4f69, ftLastAccessTime.dwLowDateTime=0x517da370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x93701b00, ftLastWriteTime.dwHighDateTime=0x1bd4f69, nFileSizeHigh=0x0, nFileSizeLow=0x4edd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD10972_.GIF", cAlternateFileName="")) returned 1 [0145.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.760] GetProcessHeap () returned 0x4e0000 [0145.760] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.760] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.761] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.761] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x3, lpOverlapped=0x0) returned 1 [0145.762] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.762] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.762] GetProcessHeap () returned 0x4e0000 [0145.762] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.762] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.763] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.763] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.763] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.763] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.763] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.763] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.763] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.763] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.763] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.763] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.763] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4edd, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4edd, lpOverlapped=0x0) returned 1 [0145.764] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4ee0, dwBufLen=0x4ee0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4ee0) returned 1 [0145.764] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.764] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4ee0, lpOverlapped=0x0) returned 1 [0145.764] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.764] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4fb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.765] SetEndOfFile (hFile=0xdc) returned 1 [0145.767] GetProcessHeap () returned 0x4e0000 [0145.767] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.767] GetProcessHeap () returned 0x4e0000 [0145.767] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.767] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.768] CloseHandle (hObject=0xdc) returned 1 [0145.768] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6557800, ftCreationTime.dwHighDateTime=0x1bd4d57, ftLastAccessTime.dwLowDateTime=0x5190ae70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6557800, ftLastWriteTime.dwHighDateTime=0x1bd4d57, nFileSizeHigh=0x0, nFileSizeLow=0x4fe6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD19563_.GIF", cAlternateFileName="")) returned 1 [0145.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.768] GetProcessHeap () returned 0x4e0000 [0145.768] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.768] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.768] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.768] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0145.770] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.770] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.770] GetProcessHeap () returned 0x4e0000 [0145.770] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.770] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.770] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.770] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.770] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.770] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.771] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.771] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.771] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.771] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.771] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.771] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.771] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4fe6, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4fe6, lpOverlapped=0x0) returned 1 [0145.772] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4ff0, dwBufLen=0x4ff0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4ff0) returned 1 [0145.772] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.772] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4ff0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4ff0, lpOverlapped=0x0) returned 1 [0145.772] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.772] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x50c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.772] SetEndOfFile (hFile=0xdc) returned 1 [0145.774] GetProcessHeap () returned 0x4e0000 [0145.774] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.774] GetProcessHeap () returned 0x4e0000 [0145.774] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.774] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.775] CloseHandle (hObject=0xdc) returned 1 [0145.775] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4f48c00, ftCreationTime.dwHighDateTime=0x1bd4d56, ftLastAccessTime.dwLowDateTime=0x5f586430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe4f48c00, ftLastWriteTime.dwHighDateTime=0x1bd4d56, nFileSizeHigh=0x0, nFileSizeLow=0x3d75, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD19582_.GIF", cAlternateFileName="")) returned 1 [0145.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.775] GetProcessHeap () returned 0x4e0000 [0145.775] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.775] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.775] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.776] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xb, lpOverlapped=0x0) returned 1 [0145.777] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.777] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.777] GetProcessHeap () returned 0x4e0000 [0145.777] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.777] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.777] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.777] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.777] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.778] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.778] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.778] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.778] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.778] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.778] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.778] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.778] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3d75, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3d75, lpOverlapped=0x0) returned 1 [0145.779] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3d80, dwBufLen=0x3d80 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3d80) returned 1 [0145.779] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.779] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3d80, lpOverlapped=0x0) returned 1 [0145.779] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.779] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3e54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.779] SetEndOfFile (hFile=0xdc) returned 1 [0145.781] GetProcessHeap () returned 0x4e0000 [0145.781] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.781] GetProcessHeap () returned 0x4e0000 [0145.781] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.781] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.782] CloseHandle (hObject=0xdc) returned 1 [0145.782] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c6cc00, ftCreationTime.dwHighDateTime=0x1bd4d5a, ftLastAccessTime.dwLowDateTime=0x5190ae70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc4c6cc00, ftLastWriteTime.dwHighDateTime=0x1bd4d5a, nFileSizeHigh=0x0, nFileSizeLow=0x32b6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD19695_.WMF", cAlternateFileName="")) returned 1 [0145.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.783] GetProcessHeap () returned 0x4e0000 [0145.783] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.783] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.783] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.783] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0145.784] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.785] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.785] GetProcessHeap () returned 0x4e0000 [0145.785] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.785] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.785] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.785] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.785] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.785] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.785] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.785] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.785] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.785] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.785] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.785] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.785] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x32b6, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x32b6, lpOverlapped=0x0) returned 1 [0145.786] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x32c0, dwBufLen=0x32c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x32c0) returned 1 [0145.786] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.786] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x32c0, lpOverlapped=0x0) returned 1 [0145.786] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.786] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3394, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.787] SetEndOfFile (hFile=0xdc) returned 1 [0145.789] GetProcessHeap () returned 0x4e0000 [0145.789] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.789] GetProcessHeap () returned 0x4e0000 [0145.789] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.789] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.789] CloseHandle (hObject=0xdc) returned 1 [0145.790] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee332800, ftCreationTime.dwHighDateTime=0x1bd4d59, ftLastAccessTime.dwLowDateTime=0x5f586430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xee332800, ftLastWriteTime.dwHighDateTime=0x1bd4d59, nFileSizeHigh=0x0, nFileSizeLow=0x25ee, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD19827_.WMF", cAlternateFileName="")) returned 1 [0145.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.791] GetProcessHeap () returned 0x4e0000 [0145.791] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.791] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.791] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.791] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0145.796] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.796] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.796] GetProcessHeap () returned 0x4e0000 [0145.796] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.796] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.796] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.796] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.796] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.796] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.796] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.796] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.796] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.796] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.796] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.796] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.796] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x25ee, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x25ee, lpOverlapped=0x0) returned 1 [0145.797] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x25f0, dwBufLen=0x25f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x25f0) returned 1 [0145.797] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.797] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x25f0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x25f0, lpOverlapped=0x0) returned 1 [0145.798] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.798] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x26c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.798] SetEndOfFile (hFile=0xdc) returned 1 [0145.800] GetProcessHeap () returned 0x4e0000 [0145.800] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.800] GetProcessHeap () returned 0x4e0000 [0145.800] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.800] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.801] CloseHandle (hObject=0xdc) returned 1 [0145.801] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed01fb00, ftCreationTime.dwHighDateTime=0x1bd4d59, ftLastAccessTime.dwLowDateTime=0x5f586430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xed01fb00, ftLastWriteTime.dwHighDateTime=0x1bd4d59, nFileSizeHigh=0x0, nFileSizeLow=0x2244, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD19828_.WMF", cAlternateFileName="")) returned 1 [0145.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.801] GetProcessHeap () returned 0x4e0000 [0145.801] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.801] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.801] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.801] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0145.803] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.803] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.803] GetProcessHeap () returned 0x4e0000 [0145.803] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.803] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.803] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.803] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.803] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.804] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.804] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.804] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.804] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.804] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.804] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.804] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.804] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2244, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2244, lpOverlapped=0x0) returned 1 [0145.805] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2250, dwBufLen=0x2250 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2250) returned 1 [0145.805] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.805] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2250, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2250, lpOverlapped=0x0) returned 1 [0145.805] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.805] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2324, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.805] SetEndOfFile (hFile=0xdc) returned 1 [0145.807] GetProcessHeap () returned 0x4e0000 [0145.807] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.807] GetProcessHeap () returned 0x4e0000 [0145.807] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.807] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.808] CloseHandle (hObject=0xdc) returned 1 [0145.808] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe58e2200, ftCreationTime.dwHighDateTime=0x1bd4d58, ftLastAccessTime.dwLowDateTime=0x5190ae70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe58e2200, ftLastWriteTime.dwHighDateTime=0x1bd4d58, nFileSizeHigh=0x0, nFileSizeLow=0x3896, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD19986_.WMF", cAlternateFileName="")) returned 1 [0145.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.809] GetProcessHeap () returned 0x4e0000 [0145.809] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.809] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.809] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.809] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0145.811] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.811] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.811] GetProcessHeap () returned 0x4e0000 [0145.811] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.811] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.811] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.811] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.811] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.811] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.811] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.811] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.811] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.812] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.812] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.812] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.812] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3896, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3896, lpOverlapped=0x0) returned 1 [0145.813] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x38a0, dwBufLen=0x38a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x38a0) returned 1 [0145.813] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.813] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x38a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x38a0, lpOverlapped=0x0) returned 1 [0145.813] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.813] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3974, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.813] SetEndOfFile (hFile=0xdc) returned 1 [0145.815] GetProcessHeap () returned 0x4e0000 [0145.815] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.815] GetProcessHeap () returned 0x4e0000 [0145.815] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.816] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.816] CloseHandle (hObject=0xdc) returned 1 [0145.816] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1fa9b00, ftCreationTime.dwHighDateTime=0x1bd4d58, ftLastAccessTime.dwLowDateTime=0x5190ae70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1fa9b00, ftLastWriteTime.dwHighDateTime=0x1bd4d58, nFileSizeHigh=0x0, nFileSizeLow=0x4780, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD19988_.WMF", cAlternateFileName="")) returned 1 [0145.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.817] GetProcessHeap () returned 0x4e0000 [0145.817] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.817] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.817] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.817] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.817] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.817] GetProcessHeap () returned 0x4e0000 [0145.817] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.817] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.817] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.817] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.819] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.819] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.819] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.819] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.819] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.819] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.819] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.819] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.819] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4780, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4780, lpOverlapped=0x0) returned 1 [0145.820] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4780, dwBufLen=0x4780 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4780) returned 1 [0145.820] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.820] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4780, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4780, lpOverlapped=0x0) returned 1 [0145.820] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.820] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4854, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.820] SetEndOfFile (hFile=0xdc) returned 1 [0145.823] GetProcessHeap () returned 0x4e0000 [0145.823] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.823] GetProcessHeap () returned 0x4e0000 [0145.823] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.823] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.823] CloseHandle (hObject=0xdc) returned 1 [0145.823] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf688200, ftCreationTime.dwHighDateTime=0x1bd4d58, ftLastAccessTime.dwLowDateTime=0x5f586430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf688200, ftLastWriteTime.dwHighDateTime=0x1bd4d58, nFileSizeHigh=0x0, nFileSizeLow=0x2b32, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD20013_.WMF", cAlternateFileName="")) returned 1 [0145.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.824] GetProcessHeap () returned 0x4e0000 [0145.824] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.824] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.824] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.824] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0145.826] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.826] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.826] GetProcessHeap () returned 0x4e0000 [0145.826] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.826] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.826] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.826] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.826] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.826] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.826] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.826] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.826] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.826] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.826] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.826] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.826] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2b32, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2b32, lpOverlapped=0x0) returned 1 [0145.827] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2b40, dwBufLen=0x2b40 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2b40) returned 1 [0145.827] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.827] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2b40, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2b40, lpOverlapped=0x0) returned 1 [0145.827] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.827] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2c14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.827] SetEndOfFile (hFile=0xdc) returned 1 [0145.830] GetProcessHeap () returned 0x4e0000 [0145.830] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.830] GetProcessHeap () returned 0x4e0000 [0145.830] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.830] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.830] CloseHandle (hObject=0xdc) returned 1 [0145.830] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b147c00, ftCreationTime.dwHighDateTime=0x1bd4b34, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8b147c00, ftLastWriteTime.dwHighDateTime=0x1bd4b34, nFileSizeHigh=0x0, nFileSizeLow=0x30e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00008_.WMF", cAlternateFileName="")) returned 1 [0145.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.833] GetProcessHeap () returned 0x4e0000 [0145.833] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.833] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.833] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.833] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.835] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.835] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.835] GetProcessHeap () returned 0x4e0000 [0145.835] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.835] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.835] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.835] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.835] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.835] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.835] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.835] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.835] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.835] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.835] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.835] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.836] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x30e8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x30e8, lpOverlapped=0x0) returned 1 [0145.836] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x30f0, dwBufLen=0x30f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x30f0) returned 1 [0145.837] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.837] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x30f0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x30f0, lpOverlapped=0x0) returned 1 [0145.837] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.837] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x31c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.837] SetEndOfFile (hFile=0xdc) returned 1 [0145.839] GetProcessHeap () returned 0x4e0000 [0145.839] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.839] GetProcessHeap () returned 0x4e0000 [0145.839] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.839] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.840] CloseHandle (hObject=0xdc) returned 1 [0145.840] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x851e9b00, ftCreationTime.dwHighDateTime=0x1bd4b34, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x851e9b00, ftLastWriteTime.dwHighDateTime=0x1bd4b34, nFileSizeHigh=0x0, nFileSizeLow=0x265a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00012_.WMF", cAlternateFileName="")) returned 1 [0145.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.841] GetProcessHeap () returned 0x4e0000 [0145.841] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.841] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.841] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.841] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0145.843] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.843] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.843] GetProcessHeap () returned 0x4e0000 [0145.843] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.843] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.843] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.843] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.843] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.843] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.843] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.843] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.843] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.844] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.844] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.844] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.844] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x265a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x265a, lpOverlapped=0x0) returned 1 [0145.845] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2660, dwBufLen=0x2660 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2660) returned 1 [0145.845] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.845] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2660, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2660, lpOverlapped=0x0) returned 1 [0145.845] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.845] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2734, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.845] SetEndOfFile (hFile=0xdc) returned 1 [0145.847] GetProcessHeap () returned 0x4e0000 [0145.847] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.847] GetProcessHeap () returned 0x4e0000 [0145.847] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.847] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.848] CloseHandle (hObject=0xdc) returned 1 [0145.848] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1c98800, ftCreationTime.dwHighDateTime=0x1bd4b2b, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1c98800, ftLastWriteTime.dwHighDateTime=0x1bd4b2b, nFileSizeHigh=0x0, nFileSizeLow=0x1eb6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00045_.WMF", cAlternateFileName="")) returned 1 [0145.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.848] GetProcessHeap () returned 0x4e0000 [0145.848] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.848] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.848] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.848] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0145.850] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.850] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.850] GetProcessHeap () returned 0x4e0000 [0145.850] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.850] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.850] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.850] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.850] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.850] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.850] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.850] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.851] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.851] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.851] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.851] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.851] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1eb6, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1eb6, lpOverlapped=0x0) returned 1 [0145.851] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1ec0, dwBufLen=0x1ec0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1ec0) returned 1 [0145.852] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.852] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1ec0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1ec0, lpOverlapped=0x0) returned 1 [0145.852] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.852] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1f94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.852] SetEndOfFile (hFile=0xdc) returned 1 [0145.854] GetProcessHeap () returned 0x4e0000 [0145.854] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.854] GetProcessHeap () returned 0x4e0000 [0145.854] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.854] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.855] CloseHandle (hObject=0xdc) returned 1 [0145.855] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a40fd00, ftCreationTime.dwHighDateTime=0x1bd4b27, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a40fd00, ftLastWriteTime.dwHighDateTime=0x1bd4b27, nFileSizeHigh=0x0, nFileSizeLow=0x3f4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00098_.WMF", cAlternateFileName="")) returned 1 [0145.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.855] GetProcessHeap () returned 0x4e0000 [0145.855] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.855] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.855] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.855] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0145.857] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.857] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.857] GetProcessHeap () returned 0x4e0000 [0145.857] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.857] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.857] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.857] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.857] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.857] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.857] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.857] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.857] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.857] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.857] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.857] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.857] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3f4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3f4, lpOverlapped=0x0) returned 1 [0145.857] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x400, dwBufLen=0x400 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x400) returned 1 [0145.857] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.857] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x400, lpOverlapped=0x0) returned 1 [0145.857] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.858] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.858] SetEndOfFile (hFile=0xdc) returned 1 [0145.860] GetProcessHeap () returned 0x4e0000 [0145.860] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.860] GetProcessHeap () returned 0x4e0000 [0145.860] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.860] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.860] CloseHandle (hObject=0xdc) returned 1 [0145.860] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x888a3600, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x888a3600, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x370, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00105_.WMF", cAlternateFileName="")) returned 1 [0145.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.861] GetProcessHeap () returned 0x4e0000 [0145.861] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.861] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.861] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.862] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.862] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.862] GetProcessHeap () returned 0x4e0000 [0145.862] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.862] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.862] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.862] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.863] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.863] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.863] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.863] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.863] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.864] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.864] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.864] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.864] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x370, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x370, lpOverlapped=0x0) returned 1 [0145.864] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x370, dwBufLen=0x370 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x370) returned 1 [0145.864] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.864] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x370, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x370, lpOverlapped=0x0) returned 1 [0145.864] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.864] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x444, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.864] SetEndOfFile (hFile=0xdc) returned 1 [0145.866] GetProcessHeap () returned 0x4e0000 [0145.866] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.866] GetProcessHeap () returned 0x4e0000 [0145.866] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.866] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.867] CloseHandle (hObject=0xdc) returned 1 [0145.867] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d0f5c00, ftCreationTime.dwHighDateTime=0x1bd4b24, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d0f5c00, ftLastWriteTime.dwHighDateTime=0x1bd4b24, nFileSizeHigh=0x0, nFileSizeLow=0x27a2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00122_.WMF", cAlternateFileName="")) returned 1 [0145.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.867] GetProcessHeap () returned 0x4e0000 [0145.867] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.867] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.867] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.867] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0145.869] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.869] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.869] GetProcessHeap () returned 0x4e0000 [0145.869] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.869] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.869] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.869] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.869] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.869] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.869] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.870] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.870] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.870] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.870] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.870] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.870] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x27a2, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x27a2, lpOverlapped=0x0) returned 1 [0145.871] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x27b0, dwBufLen=0x27b0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x27b0) returned 1 [0145.871] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.871] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x27b0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x27b0, lpOverlapped=0x0) returned 1 [0145.871] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.871] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2884, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.871] SetEndOfFile (hFile=0xdc) returned 1 [0145.873] GetProcessHeap () returned 0x4e0000 [0145.873] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.873] GetProcessHeap () returned 0x4e0000 [0145.873] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.873] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.874] CloseHandle (hObject=0xdc) returned 1 [0145.874] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39fc8c00, ftCreationTime.dwHighDateTime=0x1bd4b24, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x39fc8c00, ftLastWriteTime.dwHighDateTime=0x1bd4b24, nFileSizeHigh=0x0, nFileSizeLow=0x5b8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00130_.WMF", cAlternateFileName="")) returned 1 [0145.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.874] GetProcessHeap () returned 0x4e0000 [0145.874] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.874] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.874] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.874] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.876] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.876] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.876] GetProcessHeap () returned 0x4e0000 [0145.876] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.876] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.876] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.876] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.876] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.876] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.876] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.877] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.877] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.877] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.877] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.877] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.877] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5b8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x5b8, lpOverlapped=0x0) returned 1 [0145.877] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5c0, dwBufLen=0x5c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5c0) returned 1 [0145.877] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.877] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5c0, lpOverlapped=0x0) returned 1 [0145.877] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.877] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.877] SetEndOfFile (hFile=0xdc) returned 1 [0145.879] GetProcessHeap () returned 0x4e0000 [0145.879] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.879] GetProcessHeap () returned 0x4e0000 [0145.879] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.879] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.880] CloseHandle (hObject=0xdc) returned 1 [0145.880] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83c58200, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83c58200, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x6a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00148_.WMF", cAlternateFileName="")) returned 1 [0145.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.880] GetProcessHeap () returned 0x4e0000 [0145.880] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.880] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.881] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.881] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.881] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.881] GetProcessHeap () returned 0x4e0000 [0145.881] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.881] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.881] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.881] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.882] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.882] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.882] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.882] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.882] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.883] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.883] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.883] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.883] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x6a0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x6a0, lpOverlapped=0x0) returned 1 [0145.883] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6a0, dwBufLen=0x6a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6a0) returned 1 [0145.883] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.883] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x6a0, lpOverlapped=0x0) returned 1 [0145.883] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.883] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x774, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.883] SetEndOfFile (hFile=0xdc) returned 1 [0145.885] GetProcessHeap () returned 0x4e0000 [0145.885] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.885] GetProcessHeap () returned 0x4e0000 [0145.885] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.885] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.886] CloseHandle (hObject=0xdc) returned 1 [0145.886] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82945500, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82945500, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x5ec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00152_.WMF", cAlternateFileName="")) returned 1 [0145.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.886] GetProcessHeap () returned 0x4e0000 [0145.886] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.886] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.886] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.886] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.888] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.888] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.888] GetProcessHeap () returned 0x4e0000 [0145.888] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.888] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.888] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.888] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.888] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.888] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.888] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.888] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.888] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.889] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.889] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.889] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.889] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5ec, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x5ec, lpOverlapped=0x0) returned 1 [0145.889] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5f0, dwBufLen=0x5f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5f0) returned 1 [0145.889] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.889] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5f0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5f0, lpOverlapped=0x0) returned 1 [0145.889] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.889] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.889] SetEndOfFile (hFile=0xdc) returned 1 [0145.891] GetProcessHeap () returned 0x4e0000 [0145.891] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.891] GetProcessHeap () returned 0x4e0000 [0145.892] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.892] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.892] CloseHandle (hObject=0xdc) returned 1 [0145.893] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95a72500, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95a72500, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0xf92, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00194_.WMF", cAlternateFileName="")) returned 1 [0145.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.893] GetProcessHeap () returned 0x4e0000 [0145.893] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.893] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.893] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.893] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0145.895] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.895] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.895] GetProcessHeap () returned 0x4e0000 [0145.895] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.895] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.895] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.895] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.895] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.895] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.895] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.895] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.895] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.896] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.896] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.896] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.896] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xf92, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xf92, lpOverlapped=0x0) returned 1 [0145.896] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xfa0, dwBufLen=0xfa0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xfa0) returned 1 [0145.896] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.896] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xfa0, lpOverlapped=0x0) returned 1 [0145.896] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.896] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1074, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.896] SetEndOfFile (hFile=0xdc) returned 1 [0145.898] GetProcessHeap () returned 0x4e0000 [0145.898] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.898] GetProcessHeap () returned 0x4e0000 [0145.898] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.898] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.899] CloseHandle (hObject=0xdc) returned 1 [0145.899] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81632800, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81632800, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x1f86, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00195_.WMF", cAlternateFileName="")) returned 1 [0145.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.900] GetProcessHeap () returned 0x4e0000 [0145.900] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.900] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.900] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.900] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0145.902] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.902] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.902] GetProcessHeap () returned 0x4e0000 [0145.902] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.902] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.902] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.902] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.902] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.902] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.902] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.902] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.902] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.902] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.902] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.902] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.902] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1f86, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1f86, lpOverlapped=0x0) returned 1 [0145.903] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1f90, dwBufLen=0x1f90 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1f90) returned 1 [0145.903] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.903] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1f90, lpOverlapped=0x0) returned 1 [0145.903] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.903] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2064, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.903] SetEndOfFile (hFile=0xdc) returned 1 [0145.905] GetProcessHeap () returned 0x4e0000 [0145.906] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.906] GetProcessHeap () returned 0x4e0000 [0145.906] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.906] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.906] CloseHandle (hObject=0xdc) returned 1 [0145.906] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81891500, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81891500, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x2458, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00234_.WMF", cAlternateFileName="")) returned 1 [0145.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.907] GetProcessHeap () returned 0x4e0000 [0145.907] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.907] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.907] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.907] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.909] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.909] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.909] GetProcessHeap () returned 0x4e0000 [0145.909] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.909] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.909] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.909] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.909] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.909] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.909] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.909] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.909] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.909] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.909] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.909] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.909] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2458, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2458, lpOverlapped=0x0) returned 1 [0145.910] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2460, dwBufLen=0x2460 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2460) returned 1 [0145.910] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.910] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2460, lpOverlapped=0x0) returned 1 [0145.911] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.911] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2534, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.911] SetEndOfFile (hFile=0xdc) returned 1 [0145.913] GetProcessHeap () returned 0x4e0000 [0145.913] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.913] GetProcessHeap () returned 0x4e0000 [0145.913] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.913] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.913] CloseHandle (hObject=0xdc) returned 1 [0145.914] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9438d00, ftCreationTime.dwHighDateTime=0x1bd4b2f, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9438d00, ftLastWriteTime.dwHighDateTime=0x1bd4b2f, nFileSizeHigh=0x0, nFileSizeLow=0xfb8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00242_.WMF", cAlternateFileName="")) returned 1 [0145.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.914] GetProcessHeap () returned 0x4e0000 [0145.914] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.914] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.914] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.914] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.916] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.916] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.916] GetProcessHeap () returned 0x4e0000 [0145.916] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.916] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.916] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.916] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.916] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.916] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.916] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.916] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.917] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.917] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.917] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.917] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.917] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xfb8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xfb8, lpOverlapped=0x0) returned 1 [0145.917] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xfc0, dwBufLen=0xfc0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xfc0) returned 1 [0145.917] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.917] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xfc0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xfc0, lpOverlapped=0x0) returned 1 [0145.917] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.917] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1094, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.917] SetEndOfFile (hFile=0xdc) returned 1 [0145.919] GetProcessHeap () returned 0x4e0000 [0145.919] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.919] GetProcessHeap () returned 0x4e0000 [0145.919] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.919] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.920] CloseHandle (hObject=0xdc) returned 1 [0145.920] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5124300, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe5124300, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x386c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00247_.WMF", cAlternateFileName="")) returned 1 [0145.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.920] GetProcessHeap () returned 0x4e0000 [0145.920] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.920] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.920] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.920] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.925] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.925] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.925] GetProcessHeap () returned 0x4e0000 [0145.925] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.925] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.925] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.925] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.925] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.926] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.926] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.926] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.926] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.926] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.926] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.926] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.926] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x386c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x386c, lpOverlapped=0x0) returned 1 [0145.927] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3870, dwBufLen=0x3870 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3870) returned 1 [0145.927] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.927] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3870, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3870, lpOverlapped=0x0) returned 1 [0145.927] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.927] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3944, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.927] SetEndOfFile (hFile=0xdc) returned 1 [0145.930] GetProcessHeap () returned 0x4e0000 [0145.930] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.930] GetProcessHeap () returned 0x4e0000 [0145.930] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.930] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.931] CloseHandle (hObject=0xdc) returned 1 [0145.931] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b9eb00, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b9eb00, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00248_.WMF", cAlternateFileName="")) returned 1 [0145.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.931] GetProcessHeap () returned 0x4e0000 [0145.932] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.932] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.932] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.932] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.932] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.932] GetProcessHeap () returned 0x4e0000 [0145.932] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.932] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.932] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.932] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.934] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.934] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.934] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.934] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.934] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.934] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.934] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.934] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.934] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x600, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x600, lpOverlapped=0x0) returned 1 [0145.934] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x600, dwBufLen=0x600 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x600) returned 1 [0145.934] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.934] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x600, lpOverlapped=0x0) returned 1 [0145.935] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.935] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.935] SetEndOfFile (hFile=0xdc) returned 1 [0145.937] GetProcessHeap () returned 0x4e0000 [0145.937] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.937] GetProcessHeap () returned 0x4e0000 [0145.937] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.937] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.938] CloseHandle (hObject=0xdc) returned 1 [0145.941] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b67a200, ftCreationTime.dwHighDateTime=0x1bd4b2f, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2b67a200, ftLastWriteTime.dwHighDateTime=0x1bd4b2f, nFileSizeHigh=0x0, nFileSizeLow=0x1264, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00252_.WMF", cAlternateFileName="")) returned 1 [0145.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.942] GetProcessHeap () returned 0x4e0000 [0145.942] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.942] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.942] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.942] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0145.944] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.944] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.944] GetProcessHeap () returned 0x4e0000 [0145.944] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.944] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.944] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.944] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.945] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.945] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.945] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.945] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.945] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.945] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.945] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.945] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.945] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1264, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1264, lpOverlapped=0x0) returned 1 [0145.946] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1270, dwBufLen=0x1270 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1270) returned 1 [0145.946] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.946] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1270, lpOverlapped=0x0) returned 1 [0145.946] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.946] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1344, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.946] SetEndOfFile (hFile=0xdc) returned 1 [0145.949] GetProcessHeap () returned 0x4e0000 [0145.949] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.949] GetProcessHeap () returned 0x4e0000 [0145.949] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.949] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.950] CloseHandle (hObject=0xdc) returned 1 [0145.950] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c9e7400, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c9e7400, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x6c8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00254_.WMF", cAlternateFileName="")) returned 1 [0145.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.951] GetProcessHeap () returned 0x4e0000 [0145.951] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.951] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.951] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.951] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.953] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.953] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.953] GetProcessHeap () returned 0x4e0000 [0145.953] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.953] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.954] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.954] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.954] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.954] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.954] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.954] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.954] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.954] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.954] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.954] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.954] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x6c8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x6c8, lpOverlapped=0x0) returned 1 [0145.955] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6d0, dwBufLen=0x6d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6d0) returned 1 [0145.955] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.955] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x6d0, lpOverlapped=0x0) returned 1 [0145.955] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.955] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.955] SetEndOfFile (hFile=0xdc) returned 1 [0145.958] GetProcessHeap () returned 0x4e0000 [0145.958] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.958] GetProcessHeap () returned 0x4e0000 [0145.958] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.958] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.958] CloseHandle (hObject=0xdc) returned 1 [0145.959] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ae0bf00, ftCreationTime.dwHighDateTime=0x1bd4b2c, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ae0bf00, ftLastWriteTime.dwHighDateTime=0x1bd4b2c, nFileSizeHigh=0x0, nFileSizeLow=0x30c2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00261_.WMF", cAlternateFileName="")) returned 1 [0145.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.959] GetProcessHeap () returned 0x4e0000 [0145.959] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.959] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.959] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.959] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0145.961] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.961] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.961] GetProcessHeap () returned 0x4e0000 [0145.962] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.962] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.962] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.962] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.962] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.962] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.962] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.962] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.962] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.962] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.962] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.962] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.962] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x30c2, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x30c2, lpOverlapped=0x0) returned 1 [0145.963] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x30d0, dwBufLen=0x30d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x30d0) returned 1 [0145.964] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.964] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x30d0, lpOverlapped=0x0) returned 1 [0145.964] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.964] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x31a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.964] SetEndOfFile (hFile=0xdc) returned 1 [0145.967] GetProcessHeap () returned 0x4e0000 [0145.967] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.967] GetProcessHeap () returned 0x4e0000 [0145.967] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.967] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.968] CloseHandle (hObject=0xdc) returned 1 [0145.968] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63b9b100, ftCreationTime.dwHighDateTime=0x1bd4b2c, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x63b9b100, ftLastWriteTime.dwHighDateTime=0x1bd4b2c, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00262_.WMF", cAlternateFileName="")) returned 1 [0145.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.970] GetProcessHeap () returned 0x4e0000 [0145.971] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.971] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.971] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.971] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.973] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.973] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.973] GetProcessHeap () returned 0x4e0000 [0145.973] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.973] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.973] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.973] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.973] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.973] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.973] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.973] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.974] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.974] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.974] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.974] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.974] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x9fc, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x9fc, lpOverlapped=0x0) returned 1 [0145.974] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa00, dwBufLen=0xa00 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa00) returned 1 [0145.974] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.974] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xa00, lpOverlapped=0x0) returned 1 [0145.974] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.974] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.974] SetEndOfFile (hFile=0xdc) returned 1 [0145.977] GetProcessHeap () returned 0x4e0000 [0145.977] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.977] GetProcessHeap () returned 0x4e0000 [0145.977] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.977] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.978] CloseHandle (hObject=0xdc) returned 1 [0145.978] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcaca6c00, ftCreationTime.dwHighDateTime=0x1bd4b12, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcaca6c00, ftLastWriteTime.dwHighDateTime=0x1bd4b12, nFileSizeHigh=0x0, nFileSizeLow=0x1678, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00265_.WMF", cAlternateFileName="")) returned 1 [0145.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.978] GetProcessHeap () returned 0x4e0000 [0145.978] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.979] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.979] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.979] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.981] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.981] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.981] GetProcessHeap () returned 0x4e0000 [0145.981] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.981] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.981] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.981] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.981] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.981] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.982] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.982] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.982] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.982] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.982] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.982] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.982] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1678, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1678, lpOverlapped=0x0) returned 1 [0145.983] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1680, dwBufLen=0x1680 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1680) returned 1 [0145.983] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.983] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1680, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1680, lpOverlapped=0x0) returned 1 [0145.983] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.983] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1754, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.983] SetEndOfFile (hFile=0xdc) returned 1 [0145.986] GetProcessHeap () returned 0x4e0000 [0145.986] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.986] GetProcessHeap () returned 0x4e0000 [0145.986] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.986] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.987] CloseHandle (hObject=0xdc) returned 1 [0145.987] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2253700, ftCreationTime.dwHighDateTime=0x1bd4b1a, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2253700, ftLastWriteTime.dwHighDateTime=0x1bd4b1a, nFileSizeHigh=0x0, nFileSizeLow=0xa54, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00267_.WMF", cAlternateFileName="")) returned 1 [0145.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.988] GetProcessHeap () returned 0x4e0000 [0145.988] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.988] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.988] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.988] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0145.991] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.991] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.991] GetProcessHeap () returned 0x4e0000 [0145.991] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.991] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.991] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.991] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.991] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.991] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.991] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.991] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0145.991] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.992] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.992] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.992] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.992] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xa54, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xa54, lpOverlapped=0x0) returned 1 [0145.992] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa60, dwBufLen=0xa60 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa60) returned 1 [0145.992] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.992] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xa60, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xa60, lpOverlapped=0x0) returned 1 [0145.992] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.992] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xb34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.992] SetEndOfFile (hFile=0xdc) returned 1 [0145.995] GetProcessHeap () returned 0x4e0000 [0145.995] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0145.995] GetProcessHeap () returned 0x4e0000 [0145.995] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0145.995] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0145.996] CloseHandle (hObject=0xdc) returned 1 [0145.996] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbde25400, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbde25400, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1498, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00269_.WMF", cAlternateFileName="")) returned 1 [0145.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0145.996] GetProcessHeap () returned 0x4e0000 [0145.996] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0145.997] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0145.997] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0145.997] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0145.999] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0145.999] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0145.999] GetProcessHeap () returned 0x4e0000 [0145.999] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0145.999] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0145.999] CryptDestroyKey (hKey=0x522f98) returned 1 [0145.999] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0145.999] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0145.999] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0145.999] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0145.999] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.000] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.000] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.000] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.000] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.000] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1498, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1498, lpOverlapped=0x0) returned 1 [0146.001] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x14a0, dwBufLen=0x14a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x14a0) returned 1 [0146.001] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.001] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x14a0, lpOverlapped=0x0) returned 1 [0146.001] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.001] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1574, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.001] SetEndOfFile (hFile=0xdc) returned 1 [0146.003] GetProcessHeap () returned 0x4e0000 [0146.003] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.003] GetProcessHeap () returned 0x4e0000 [0146.003] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.003] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.005] CloseHandle (hObject=0xdc) returned 1 [0146.005] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d095f00, ftCreationTime.dwHighDateTime=0x1bd4b18, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d095f00, ftLastWriteTime.dwHighDateTime=0x1bd4b18, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00270_.WMF", cAlternateFileName="")) returned 1 [0146.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.006] GetProcessHeap () returned 0x4e0000 [0146.006] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.007] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.007] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.007] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.009] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.009] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.009] GetProcessHeap () returned 0x4e0000 [0146.009] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.009] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.009] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.009] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.009] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.009] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.009] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.009] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.010] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.010] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.010] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.010] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.010] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xbc8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xbc8, lpOverlapped=0x0) returned 1 [0146.010] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xbd0, dwBufLen=0xbd0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xbd0) returned 1 [0146.010] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.010] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xbd0, lpOverlapped=0x0) returned 1 [0146.010] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.010] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xca4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.010] SetEndOfFile (hFile=0xdc) returned 1 [0146.013] GetProcessHeap () returned 0x4e0000 [0146.013] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.013] GetProcessHeap () returned 0x4e0000 [0146.013] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.013] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.014] CloseHandle (hObject=0xdc) returned 1 [0146.014] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd2a9800, ftCreationTime.dwHighDateTime=0x1bd4b17, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd2a9800, ftLastWriteTime.dwHighDateTime=0x1bd4b17, nFileSizeHigh=0x0, nFileSizeLow=0xec4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00273_.WMF", cAlternateFileName="")) returned 1 [0146.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.015] GetProcessHeap () returned 0x4e0000 [0146.015] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.015] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.015] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.015] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0146.017] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.017] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.018] GetProcessHeap () returned 0x4e0000 [0146.018] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.018] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.018] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.018] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.018] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.018] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.018] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.018] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.018] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.018] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.018] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.018] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.018] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xec4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xec4, lpOverlapped=0x0) returned 1 [0146.019] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xed0, dwBufLen=0xed0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xed0) returned 1 [0146.019] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.019] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xed0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xed0, lpOverlapped=0x0) returned 1 [0146.019] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.019] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xfa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.019] SetEndOfFile (hFile=0xdc) returned 1 [0146.021] GetProcessHeap () returned 0x4e0000 [0146.022] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.022] GetProcessHeap () returned 0x4e0000 [0146.022] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.022] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.023] CloseHandle (hObject=0xdc) returned 1 [0146.023] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9e80900, ftCreationTime.dwHighDateTime=0x1bd4b17, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc9e80900, ftLastWriteTime.dwHighDateTime=0x1bd4b17, nFileSizeHigh=0x0, nFileSizeLow=0x1044, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00274_.WMF", cAlternateFileName="")) returned 1 [0146.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.023] GetProcessHeap () returned 0x4e0000 [0146.023] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.023] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.023] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.023] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0146.026] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.026] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.026] GetProcessHeap () returned 0x4e0000 [0146.026] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.026] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.026] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.026] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.026] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.026] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.026] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.026] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.026] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.026] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.027] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.027] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.027] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1044, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1044, lpOverlapped=0x0) returned 1 [0146.027] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1050, dwBufLen=0x1050 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1050) returned 1 [0146.027] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.028] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1050, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1050, lpOverlapped=0x0) returned 1 [0146.028] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.028] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1124, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.028] SetEndOfFile (hFile=0xdc) returned 1 [0146.030] GetProcessHeap () returned 0x4e0000 [0146.030] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.030] GetProcessHeap () returned 0x4e0000 [0146.030] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.030] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.031] CloseHandle (hObject=0xdc) returned 1 [0146.031] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac309900, ftCreationTime.dwHighDateTime=0x1bd4b43, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac309900, ftLastWriteTime.dwHighDateTime=0x1bd4b43, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00296_.WMF", cAlternateFileName="")) returned 1 [0146.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.031] GetProcessHeap () returned 0x4e0000 [0146.031] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.031] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.031] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.031] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.033] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.033] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.033] GetProcessHeap () returned 0x4e0000 [0146.033] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.033] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.033] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.033] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.033] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.033] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.033] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.033] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.034] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.034] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.034] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.034] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.034] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x32c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x32c, lpOverlapped=0x0) returned 1 [0146.034] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x330, dwBufLen=0x330 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x330) returned 1 [0146.034] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.034] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x330, lpOverlapped=0x0) returned 1 [0146.034] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.034] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x404, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.034] SetEndOfFile (hFile=0xdc) returned 1 [0146.036] GetProcessHeap () returned 0x4e0000 [0146.036] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.036] GetProcessHeap () returned 0x4e0000 [0146.036] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.036] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.037] CloseHandle (hObject=0xdc) returned 1 [0146.037] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf533800, ftCreationTime.dwHighDateTime=0x1bd4b03, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdf533800, ftLastWriteTime.dwHighDateTime=0x1bd4b03, nFileSizeHigh=0x0, nFileSizeLow=0x332e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00390_.WMF", cAlternateFileName="")) returned 1 [0146.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.038] GetProcessHeap () returned 0x4e0000 [0146.038] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.038] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.038] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.038] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0146.040] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.040] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.040] GetProcessHeap () returned 0x4e0000 [0146.040] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.040] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.040] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.040] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.040] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.040] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.040] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.040] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.040] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.040] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.040] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.040] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.040] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x332e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x332e, lpOverlapped=0x0) returned 1 [0146.041] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3330, dwBufLen=0x3330 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3330) returned 1 [0146.042] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.042] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3330, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3330, lpOverlapped=0x0) returned 1 [0146.042] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.042] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3404, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.042] SetEndOfFile (hFile=0xdc) returned 1 [0146.044] GetProcessHeap () returned 0x4e0000 [0146.044] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.044] GetProcessHeap () returned 0x4e0000 [0146.044] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.044] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.045] CloseHandle (hObject=0xdc) returned 1 [0146.045] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcf0de00, ftCreationTime.dwHighDateTime=0x1bd4b03, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdcf0de00, ftLastWriteTime.dwHighDateTime=0x1bd4b03, nFileSizeHigh=0x0, nFileSizeLow=0x69aa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00392_.WMF", cAlternateFileName="")) returned 1 [0146.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.045] GetProcessHeap () returned 0x4e0000 [0146.045] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.045] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.045] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.045] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0146.047] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.047] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.047] GetProcessHeap () returned 0x4e0000 [0146.047] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.047] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.047] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.047] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.047] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.047] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.047] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.047] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.047] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.047] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.047] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.047] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.047] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x69aa, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x69aa, lpOverlapped=0x0) returned 1 [0146.048] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x69b0, dwBufLen=0x69b0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x69b0) returned 1 [0146.048] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.048] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x69b0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x69b0, lpOverlapped=0x0) returned 1 [0146.049] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.049] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6a84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.049] SetEndOfFile (hFile=0xdc) returned 1 [0146.051] GetProcessHeap () returned 0x4e0000 [0146.051] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.051] GetProcessHeap () returned 0x4e0000 [0146.051] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.051] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.052] CloseHandle (hObject=0xdc) returned 1 [0146.052] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd65d6900, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd65d6900, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x1b54, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00524_.WMF", cAlternateFileName="")) returned 1 [0146.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.052] GetProcessHeap () returned 0x4e0000 [0146.052] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.052] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.052] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.052] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0146.056] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.056] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.056] GetProcessHeap () returned 0x4e0000 [0146.056] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.056] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.056] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.056] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.056] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.056] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.056] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.056] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.056] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.056] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.056] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.056] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.056] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1b54, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1b54, lpOverlapped=0x0) returned 1 [0146.057] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1b60, dwBufLen=0x1b60 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1b60) returned 1 [0146.057] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.057] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1b60, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1b60, lpOverlapped=0x0) returned 1 [0146.057] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.057] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1c34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.058] SetEndOfFile (hFile=0xdc) returned 1 [0146.060] GetProcessHeap () returned 0x4e0000 [0146.060] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.060] GetProcessHeap () returned 0x4e0000 [0146.060] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.060] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.060] CloseHandle (hObject=0xdc) returned 1 [0146.061] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd52c3c00, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd52c3c00, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x2576, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00525_.WMF", cAlternateFileName="")) returned 1 [0146.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.062] GetProcessHeap () returned 0x4e0000 [0146.062] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.062] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.062] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.062] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0146.063] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.063] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.064] GetProcessHeap () returned 0x4e0000 [0146.064] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.064] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.064] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.064] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.064] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.064] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.064] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.064] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.064] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.064] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.064] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.064] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.064] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2576, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2576, lpOverlapped=0x0) returned 1 [0146.065] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2580, dwBufLen=0x2580 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2580) returned 1 [0146.065] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.065] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2580, lpOverlapped=0x0) returned 1 [0146.065] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.065] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2654, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.066] SetEndOfFile (hFile=0xdc) returned 1 [0146.068] GetProcessHeap () returned 0x4e0000 [0146.068] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.068] GetProcessHeap () returned 0x4e0000 [0146.068] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.068] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.068] CloseHandle (hObject=0xdc) returned 1 [0146.068] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3fb0f00, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd3fb0f00, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x6ba0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00526_.WMF", cAlternateFileName="")) returned 1 [0146.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.069] GetProcessHeap () returned 0x4e0000 [0146.069] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.069] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.069] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.069] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.069] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.069] GetProcessHeap () returned 0x4e0000 [0146.069] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.069] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.069] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.069] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.071] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.071] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.071] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.071] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.071] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.071] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.071] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.071] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.071] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x6ba0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x6ba0, lpOverlapped=0x0) returned 1 [0146.072] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6ba0, dwBufLen=0x6ba0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6ba0) returned 1 [0146.073] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.073] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6ba0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x6ba0, lpOverlapped=0x0) returned 1 [0146.073] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.073] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6c74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.073] SetEndOfFile (hFile=0xdc) returned 1 [0146.075] GetProcessHeap () returned 0x4e0000 [0146.075] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.075] GetProcessHeap () returned 0x4e0000 [0146.075] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.075] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.076] CloseHandle (hObject=0xdc) returned 1 [0146.076] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20fce500, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x20fce500, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x2cec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00648_.WMF", cAlternateFileName="")) returned 1 [0146.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.076] GetProcessHeap () returned 0x4e0000 [0146.076] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.076] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.076] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.076] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.078] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.078] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.078] GetProcessHeap () returned 0x4e0000 [0146.078] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.078] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.078] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.078] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.078] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.078] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.079] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.079] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.079] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.079] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.079] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.079] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.079] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2cec, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2cec, lpOverlapped=0x0) returned 1 [0146.080] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2cf0, dwBufLen=0x2cf0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2cf0) returned 1 [0146.080] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.080] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2cf0, lpOverlapped=0x0) returned 1 [0146.080] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.080] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2dc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.080] SetEndOfFile (hFile=0xdc) returned 1 [0146.082] GetProcessHeap () returned 0x4e0000 [0146.082] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.082] GetProcessHeap () returned 0x4e0000 [0146.082] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.082] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.083] CloseHandle (hObject=0xdc) returned 1 [0146.083] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeba4c700, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeba4c700, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x1138, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00921_.WMF", cAlternateFileName="")) returned 1 [0146.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.084] GetProcessHeap () returned 0x4e0000 [0146.084] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.084] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.084] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.084] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.094] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.094] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.094] GetProcessHeap () returned 0x4e0000 [0146.094] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.094] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.094] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.094] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.095] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.095] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.095] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.095] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.095] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.095] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.095] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.095] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.095] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1138, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1138, lpOverlapped=0x0) returned 1 [0146.096] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1140, dwBufLen=0x1140 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1140) returned 1 [0146.096] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.096] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1140, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1140, lpOverlapped=0x0) returned 1 [0146.096] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.096] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.096] SetEndOfFile (hFile=0xdc) returned 1 [0146.098] GetProcessHeap () returned 0x4e0000 [0146.098] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.098] GetProcessHeap () returned 0x4e0000 [0146.098] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.098] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.099] CloseHandle (hObject=0xdc) returned 1 [0146.099] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74832900, ftCreationTime.dwHighDateTime=0x1bd4bf7, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74832900, ftLastWriteTime.dwHighDateTime=0x1bd4bf7, nFileSizeHigh=0x0, nFileSizeLow=0x1870, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00923_.WMF", cAlternateFileName="")) returned 1 [0146.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.100] GetProcessHeap () returned 0x4e0000 [0146.100] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.100] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.100] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.100] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.100] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.100] GetProcessHeap () returned 0x4e0000 [0146.100] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.100] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.100] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.100] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.114] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.114] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.114] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.114] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.114] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.114] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.114] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.114] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.114] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1870, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1870, lpOverlapped=0x0) returned 1 [0146.115] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1870, dwBufLen=0x1870 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1870) returned 1 [0146.115] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.115] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1870, lpOverlapped=0x0) returned 1 [0146.115] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.116] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1944, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.116] SetEndOfFile (hFile=0xdc) returned 1 [0146.118] GetProcessHeap () returned 0x4e0000 [0146.118] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.118] GetProcessHeap () returned 0x4e0000 [0146.118] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.118] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.119] CloseHandle (hObject=0xdc) returned 1 [0146.119] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4c14, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00932_.WMF", cAlternateFileName="")) returned 1 [0146.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.119] GetProcessHeap () returned 0x4e0000 [0146.119] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.119] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.119] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.119] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0146.121] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.121] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.121] GetProcessHeap () returned 0x4e0000 [0146.121] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.121] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.121] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.121] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.121] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.121] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.121] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.121] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.122] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.122] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.122] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.122] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.122] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4c14, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4c14, lpOverlapped=0x0) returned 1 [0146.122] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4c20, dwBufLen=0x4c20 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4c20) returned 1 [0146.123] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.123] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4c20, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4c20, lpOverlapped=0x0) returned 1 [0146.123] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.123] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4cf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.123] SetEndOfFile (hFile=0xdc) returned 1 [0146.125] GetProcessHeap () returned 0x4e0000 [0146.125] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.125] GetProcessHeap () returned 0x4e0000 [0146.125] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.125] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.126] CloseHandle (hObject=0xdc) returned 1 [0146.126] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7d46d00, ftCreationTime.dwHighDateTime=0x1bd4bee, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe7d46d00, ftLastWriteTime.dwHighDateTime=0x1bd4bee, nFileSizeHigh=0x0, nFileSizeLow=0xeb8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00985_.WMF", cAlternateFileName="")) returned 1 [0146.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.126] GetProcessHeap () returned 0x4e0000 [0146.126] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.127] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.127] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.127] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.128] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.129] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.129] GetProcessHeap () returned 0x4e0000 [0146.129] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.129] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.129] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.129] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.129] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.129] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.129] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.129] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.129] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.129] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.129] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.129] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.129] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xeb8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xeb8, lpOverlapped=0x0) returned 1 [0146.129] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xec0, dwBufLen=0xec0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xec0) returned 1 [0146.129] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.129] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xec0, lpOverlapped=0x0) returned 1 [0146.129] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.130] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xf94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.130] SetEndOfFile (hFile=0xdc) returned 1 [0146.132] GetProcessHeap () returned 0x4e0000 [0146.132] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.132] GetProcessHeap () returned 0x4e0000 [0146.132] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.132] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.132] CloseHandle (hObject=0xdc) returned 1 [0146.132] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6849b000, ftCreationTime.dwHighDateTime=0x1bd0318, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6849b000, ftLastWriteTime.dwHighDateTime=0x1bd0318, nFileSizeHigh=0x0, nFileSizeLow=0xd16, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BOAT.WMF", cAlternateFileName="")) returned 1 [0146.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.133] GetProcessHeap () returned 0x4e0000 [0146.133] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.133] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.133] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.133] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0146.135] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.135] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.135] GetProcessHeap () returned 0x4e0000 [0146.135] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0146.135] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0146.135] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.135] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0146.135] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.135] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.135] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.135] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.135] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.136] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.136] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.136] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.136] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xd16, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xd16, lpOverlapped=0x0) returned 1 [0146.136] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xd20, dwBufLen=0xd20 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xd20) returned 1 [0146.136] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.136] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xd20, lpOverlapped=0x0) returned 1 [0146.136] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.136] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xde4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.136] SetEndOfFile (hFile=0xdc) returned 1 [0146.139] GetProcessHeap () returned 0x4e0000 [0146.139] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0146.139] GetProcessHeap () returned 0x4e0000 [0146.139] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.139] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.140] CloseHandle (hObject=0xdc) returned 1 [0146.140] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ce30000, ftCreationTime.dwHighDateTime=0x1bd78be, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ce30000, ftLastWriteTime.dwHighDateTime=0x1bd78be, nFileSizeHigh=0x0, nFileSizeLow=0x714c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BOATINST.WMF", cAlternateFileName="")) returned 1 [0146.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.140] GetProcessHeap () returned 0x4e0000 [0146.140] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.140] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.141] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.141] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.143] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.143] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.143] GetProcessHeap () returned 0x4e0000 [0146.143] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.143] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.143] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.143] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.143] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.143] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.144] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.144] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.144] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.144] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.144] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.144] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.144] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x714c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x714c, lpOverlapped=0x0) returned 1 [0146.146] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7150, dwBufLen=0x7150 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7150) returned 1 [0146.146] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.146] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7150, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7150, lpOverlapped=0x0) returned 1 [0146.146] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.146] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.146] SetEndOfFile (hFile=0xdc) returned 1 [0146.149] GetProcessHeap () returned 0x4e0000 [0146.149] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.149] GetProcessHeap () returned 0x4e0000 [0146.149] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.149] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.150] CloseHandle (hObject=0xdc) returned 1 [0146.150] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77641800, ftCreationTime.dwHighDateTime=0x1bd4b2a, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77641800, ftLastWriteTime.dwHighDateTime=0x1bd4b2a, nFileSizeHigh=0x0, nFileSizeLow=0x532, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00076_.WMF", cAlternateFileName="")) returned 1 [0146.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.151] GetProcessHeap () returned 0x4e0000 [0146.151] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.151] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.151] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.151] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0146.152] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.152] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.153] GetProcessHeap () returned 0x4e0000 [0146.153] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.153] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.153] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.153] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.153] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.153] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.153] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.153] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.153] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.153] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.153] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.153] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.153] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x532, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x532, lpOverlapped=0x0) returned 1 [0146.153] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x540, dwBufLen=0x540 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x540) returned 1 [0146.153] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.153] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x540, lpOverlapped=0x0) returned 1 [0146.153] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.153] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.153] SetEndOfFile (hFile=0xdc) returned 1 [0146.156] GetProcessHeap () returned 0x4e0000 [0146.156] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.156] GetProcessHeap () returned 0x4e0000 [0146.156] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.156] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.156] CloseHandle (hObject=0xdc) returned 1 [0146.157] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfadcd00, ftCreationTime.dwHighDateTime=0x1bd4b2a, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfadcd00, ftLastWriteTime.dwHighDateTime=0x1bd4b2a, nFileSizeHigh=0x0, nFileSizeLow=0x5a4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00078_.WMF", cAlternateFileName="")) returned 1 [0146.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.157] GetProcessHeap () returned 0x4e0000 [0146.158] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.158] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.158] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.158] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0146.160] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.160] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.160] GetProcessHeap () returned 0x4e0000 [0146.160] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.160] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.160] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.160] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.160] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.160] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.160] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.160] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.160] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.160] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.160] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.160] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.160] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5a4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x5a4, lpOverlapped=0x0) returned 1 [0146.160] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5b0) returned 1 [0146.160] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.160] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5b0, lpOverlapped=0x0) returned 1 [0146.160] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.161] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.161] SetEndOfFile (hFile=0xdc) returned 1 [0146.163] GetProcessHeap () returned 0x4e0000 [0146.163] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.163] GetProcessHeap () returned 0x4e0000 [0146.163] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.163] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.163] CloseHandle (hObject=0xdc) returned 1 [0146.164] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6395c300, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6395c300, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x1f26, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00092_.WMF", cAlternateFileName="")) returned 1 [0146.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.164] GetProcessHeap () returned 0x4e0000 [0146.164] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.164] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.164] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.164] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0146.166] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.166] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.166] GetProcessHeap () returned 0x4e0000 [0146.166] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.166] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.166] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.166] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.166] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.166] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.166] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.167] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.167] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.167] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.167] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.167] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.167] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1f26, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1f26, lpOverlapped=0x0) returned 1 [0146.168] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1f30, dwBufLen=0x1f30 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1f30) returned 1 [0146.168] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.168] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1f30, lpOverlapped=0x0) returned 1 [0146.168] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.168] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2004, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.168] SetEndOfFile (hFile=0xdc) returned 1 [0146.170] GetProcessHeap () returned 0x4e0000 [0146.170] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.170] GetProcessHeap () returned 0x4e0000 [0146.170] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.170] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.171] CloseHandle (hObject=0xdc) returned 1 [0146.171] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60023c00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60023c00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x94a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00100_.WMF", cAlternateFileName="")) returned 1 [0146.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.171] GetProcessHeap () returned 0x4e0000 [0146.171] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.171] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.171] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.171] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0146.173] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.173] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.173] GetProcessHeap () returned 0x4e0000 [0146.173] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.173] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.173] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.173] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.173] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.173] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.174] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.174] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.174] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.174] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.174] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.174] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.174] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x94a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x94a, lpOverlapped=0x0) returned 1 [0146.174] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x950, dwBufLen=0x950 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x950) returned 1 [0146.174] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.174] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x950, lpOverlapped=0x0) returned 1 [0146.174] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.174] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xa24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.174] SetEndOfFile (hFile=0xdc) returned 1 [0146.176] GetProcessHeap () returned 0x4e0000 [0146.176] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.176] GetProcessHeap () returned 0x4e0000 [0146.176] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.176] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.177] CloseHandle (hObject=0xdc) returned 1 [0146.177] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c6eb500, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c6eb500, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x414, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00135_.WMF", cAlternateFileName="")) returned 1 [0146.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.177] GetProcessHeap () returned 0x4e0000 [0146.177] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.177] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.177] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.177] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0146.179] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.179] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.179] GetProcessHeap () returned 0x4e0000 [0146.179] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.179] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.179] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.179] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.179] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.179] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.179] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.180] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.180] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.180] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.180] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.180] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.180] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x414, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x414, lpOverlapped=0x0) returned 1 [0146.180] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x420, dwBufLen=0x420 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x420) returned 1 [0146.180] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.180] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x420, lpOverlapped=0x0) returned 1 [0146.180] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.180] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.180] SetEndOfFile (hFile=0xdc) returned 1 [0146.185] GetProcessHeap () returned 0x4e0000 [0146.185] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.185] GetProcessHeap () returned 0x4e0000 [0146.185] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.185] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.186] CloseHandle (hObject=0xdc) returned 1 [0146.186] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5295200, ftCreationTime.dwHighDateTime=0x1bd4b23, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc5295200, ftLastWriteTime.dwHighDateTime=0x1bd4b23, nFileSizeHigh=0x0, nFileSizeLow=0x876, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00136_.WMF", cAlternateFileName="")) returned 1 [0146.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.186] GetProcessHeap () returned 0x4e0000 [0146.186] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.186] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.186] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.187] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0146.188] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.188] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.188] GetProcessHeap () returned 0x4e0000 [0146.188] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.188] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.188] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.189] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.189] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.189] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.189] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.189] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.189] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.189] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.189] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.189] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.189] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x876, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x876, lpOverlapped=0x0) returned 1 [0146.189] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x880, dwBufLen=0x880 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x880) returned 1 [0146.189] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.189] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x880, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x880, lpOverlapped=0x0) returned 1 [0146.189] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.189] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x954, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.189] SetEndOfFile (hFile=0xdc) returned 1 [0146.191] GetProcessHeap () returned 0x4e0000 [0146.191] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.191] GetProcessHeap () returned 0x4e0000 [0146.191] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.192] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.192] CloseHandle (hObject=0xdc) returned 1 [0146.192] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd99a2a00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd99a2a00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x6b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00145_.WMF", cAlternateFileName="")) returned 1 [0146.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.193] GetProcessHeap () returned 0x4e0000 [0146.193] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.193] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.193] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.193] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.193] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.193] GetProcessHeap () returned 0x4e0000 [0146.193] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.193] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.194] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.194] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.195] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.195] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.195] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.195] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.195] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.196] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.196] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.196] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.196] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x6b0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x6b0, lpOverlapped=0x0) returned 1 [0146.196] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6b0, dwBufLen=0x6b0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6b0) returned 1 [0146.196] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.196] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6b0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x6b0, lpOverlapped=0x0) returned 1 [0146.196] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.196] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x784, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.196] SetEndOfFile (hFile=0xdc) returned 1 [0146.198] GetProcessHeap () returned 0x4e0000 [0146.198] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.198] GetProcessHeap () returned 0x4e0000 [0146.198] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.198] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.199] CloseHandle (hObject=0xdc) returned 1 [0146.199] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ca47100, ftCreationTime.dwHighDateTime=0x1bd4af0, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7ca47100, ftLastWriteTime.dwHighDateTime=0x1bd4af0, nFileSizeHigh=0x0, nFileSizeLow=0x20ae, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00174_.WMF", cAlternateFileName="")) returned 1 [0146.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.199] GetProcessHeap () returned 0x4e0000 [0146.199] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.199] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.199] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.199] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0146.201] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.201] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.201] GetProcessHeap () returned 0x4e0000 [0146.201] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.201] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.201] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.201] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.202] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.202] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.202] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.202] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.202] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.202] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.202] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.202] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.202] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x20ae, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x20ae, lpOverlapped=0x0) returned 1 [0146.203] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x20b0, dwBufLen=0x20b0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x20b0) returned 1 [0146.203] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.203] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x20b0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x20b0, lpOverlapped=0x0) returned 1 [0146.203] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.203] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2184, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.203] SetEndOfFile (hFile=0xdc) returned 1 [0146.205] GetProcessHeap () returned 0x4e0000 [0146.205] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.205] GetProcessHeap () returned 0x4e0000 [0146.205] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.205] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.206] CloseHandle (hObject=0xdc) returned 1 [0146.206] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f738600, ftCreationTime.dwHighDateTime=0x1bd4b31, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f738600, ftLastWriteTime.dwHighDateTime=0x1bd4b31, nFileSizeHigh=0x0, nFileSizeLow=0x1370, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00184_.WMF", cAlternateFileName="")) returned 1 [0146.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.207] GetProcessHeap () returned 0x4e0000 [0146.207] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.207] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.207] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.207] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.207] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.207] GetProcessHeap () returned 0x4e0000 [0146.207] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.207] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.207] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.207] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.209] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.209] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.209] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.209] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.209] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.209] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.209] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.210] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.210] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1370, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1370, lpOverlapped=0x0) returned 1 [0146.210] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1370, dwBufLen=0x1370 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1370) returned 1 [0146.210] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.210] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1370, lpOverlapped=0x0) returned 1 [0146.211] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.211] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1444, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.211] SetEndOfFile (hFile=0xdc) returned 1 [0146.213] GetProcessHeap () returned 0x4e0000 [0146.213] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.213] GetProcessHeap () returned 0x4e0000 [0146.213] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.213] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.213] CloseHandle (hObject=0xdc) returned 1 [0146.213] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c60b600, ftCreationTime.dwHighDateTime=0x1bd4b31, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c60b600, ftLastWriteTime.dwHighDateTime=0x1bd4b31, nFileSizeHigh=0x0, nFileSizeLow=0x31f4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00186_.WMF", cAlternateFileName="")) returned 1 [0146.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.214] GetProcessHeap () returned 0x4e0000 [0146.215] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.215] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.215] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.215] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0146.216] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.216] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.216] GetProcessHeap () returned 0x4e0000 [0146.216] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.216] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.216] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.217] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.217] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.217] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.217] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.217] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.217] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.217] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.217] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.217] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.217] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x31f4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x31f4, lpOverlapped=0x0) returned 1 [0146.218] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3200, dwBufLen=0x3200 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3200) returned 1 [0146.218] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.218] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3200, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3200, lpOverlapped=0x0) returned 1 [0146.218] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.218] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x32d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.218] SetEndOfFile (hFile=0xdc) returned 1 [0146.221] GetProcessHeap () returned 0x4e0000 [0146.221] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.221] GetProcessHeap () returned 0x4e0000 [0146.221] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.221] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.221] CloseHandle (hObject=0xdc) returned 1 [0146.221] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9efd600, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9efd600, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0xc20, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00200_.WMF", cAlternateFileName="")) returned 1 [0146.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.222] GetProcessHeap () returned 0x4e0000 [0146.222] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.222] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.222] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.222] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.222] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.222] GetProcessHeap () returned 0x4e0000 [0146.222] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.222] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.222] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.222] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.224] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.224] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.224] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.224] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.224] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.224] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.224] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.224] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.224] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xc20, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xc20, lpOverlapped=0x0) returned 1 [0146.224] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xc20, dwBufLen=0xc20 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xc20) returned 1 [0146.224] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.224] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc20, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xc20, lpOverlapped=0x0) returned 1 [0146.224] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.224] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xcf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.224] SetEndOfFile (hFile=0xdc) returned 1 [0146.226] GetProcessHeap () returned 0x4e0000 [0146.227] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.227] GetProcessHeap () returned 0x4e0000 [0146.227] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.227] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.227] CloseHandle (hObject=0xdc) returned 1 [0146.227] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54fadc00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54fadc00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x634, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00224_.WMF", cAlternateFileName="")) returned 1 [0146.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.228] GetProcessHeap () returned 0x4e0000 [0146.228] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.228] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.228] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.228] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0146.232] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.232] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.232] GetProcessHeap () returned 0x4e0000 [0146.232] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.232] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.232] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.232] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.232] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.232] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.232] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.232] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.232] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.232] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.232] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.232] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.232] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x634, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x634, lpOverlapped=0x0) returned 1 [0146.232] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x640, dwBufLen=0x640 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x640) returned 1 [0146.232] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.232] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x640, lpOverlapped=0x0) returned 1 [0146.233] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.233] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.233] SetEndOfFile (hFile=0xdc) returned 1 [0146.235] GetProcessHeap () returned 0x4e0000 [0146.235] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.235] GetProcessHeap () returned 0x4e0000 [0146.235] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.235] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.235] CloseHandle (hObject=0xdc) returned 1 [0146.235] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62c55700, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x62c55700, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0x4bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00438_.WMF", cAlternateFileName="")) returned 1 [0146.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.236] GetProcessHeap () returned 0x4e0000 [0146.236] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.236] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.236] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.236] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.238] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.238] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.238] GetProcessHeap () returned 0x4e0000 [0146.238] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.238] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.238] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.238] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.238] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.238] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.238] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.238] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.238] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.238] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.238] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.238] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.238] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4bc, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4bc, lpOverlapped=0x0) returned 1 [0146.238] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4c0, dwBufLen=0x4c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4c0) returned 1 [0146.238] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.238] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4c0, lpOverlapped=0x0) returned 1 [0146.239] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.239] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x594, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.239] SetEndOfFile (hFile=0xdc) returned 1 [0146.242] GetProcessHeap () returned 0x4e0000 [0146.242] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.242] GetProcessHeap () returned 0x4e0000 [0146.242] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.242] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.243] CloseHandle (hObject=0xdc) returned 1 [0146.243] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x276b5e00, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x276b5e00, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0x804, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00439_.WMF", cAlternateFileName="")) returned 1 [0146.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.243] GetProcessHeap () returned 0x4e0000 [0146.243] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.244] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.244] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.244] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0146.245] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.245] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.245] GetProcessHeap () returned 0x4e0000 [0146.245] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.245] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.246] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.246] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.246] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.246] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.246] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.246] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.246] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.246] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.246] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.246] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.246] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x804, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x804, lpOverlapped=0x0) returned 1 [0146.246] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x810, dwBufLen=0x810 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x810) returned 1 [0146.246] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.246] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x810, lpOverlapped=0x0) returned 1 [0146.246] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.246] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x8e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.247] SetEndOfFile (hFile=0xdc) returned 1 [0146.249] GetProcessHeap () returned 0x4e0000 [0146.249] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.249] GetProcessHeap () returned 0x4e0000 [0146.249] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.249] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.250] CloseHandle (hObject=0xdc) returned 1 [0146.250] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x263a3100, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x263a3100, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0x15cc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00440_.WMF", cAlternateFileName="")) returned 1 [0146.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.250] GetProcessHeap () returned 0x4e0000 [0146.250] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.250] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.250] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.250] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.252] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.252] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.252] GetProcessHeap () returned 0x4e0000 [0146.252] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.252] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.252] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.252] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.252] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.253] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.253] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.253] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.253] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.254] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.254] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.254] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.254] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x15cc, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x15cc, lpOverlapped=0x0) returned 1 [0146.255] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x15d0, dwBufLen=0x15d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x15d0) returned 1 [0146.255] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.255] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x15d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x15d0, lpOverlapped=0x0) returned 1 [0146.255] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.255] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x16a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.255] SetEndOfFile (hFile=0xdc) returned 1 [0146.257] GetProcessHeap () returned 0x4e0000 [0146.257] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.257] GetProcessHeap () returned 0x4e0000 [0146.257] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.257] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.258] CloseHandle (hObject=0xdc) returned 1 [0146.258] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25090400, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x25090400, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xdc4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00441_.WMF", cAlternateFileName="")) returned 1 [0146.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.258] GetProcessHeap () returned 0x4e0000 [0146.258] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.258] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.258] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.258] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0146.260] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.260] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.260] GetProcessHeap () returned 0x4e0000 [0146.260] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.260] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.260] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.260] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.260] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.260] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.261] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.261] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.261] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.261] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.261] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.261] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.261] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xdc4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xdc4, lpOverlapped=0x0) returned 1 [0146.261] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xdd0, dwBufLen=0xdd0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xdd0) returned 1 [0146.261] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.261] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xdd0, lpOverlapped=0x0) returned 1 [0146.261] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.261] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xea4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.261] SetEndOfFile (hFile=0xdc) returned 1 [0146.263] GetProcessHeap () returned 0x4e0000 [0146.263] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.263] GetProcessHeap () returned 0x4e0000 [0146.263] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.263] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.264] CloseHandle (hObject=0xdc) returned 1 [0146.264] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23d7d700, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x23d7d700, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0x9b8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00442_.WMF", cAlternateFileName="")) returned 1 [0146.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.264] GetProcessHeap () returned 0x4e0000 [0146.264] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.264] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.264] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.264] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.266] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.266] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.266] GetProcessHeap () returned 0x4e0000 [0146.266] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.266] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.266] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.266] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.266] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.266] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.267] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.267] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.267] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.267] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.267] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.267] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.267] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x9b8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x9b8, lpOverlapped=0x0) returned 1 [0146.267] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9c0, dwBufLen=0x9c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9c0) returned 1 [0146.267] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.267] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x9c0, lpOverlapped=0x0) returned 1 [0146.267] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.267] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xa94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.267] SetEndOfFile (hFile=0xdc) returned 1 [0146.269] GetProcessHeap () returned 0x4e0000 [0146.269] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.269] GetProcessHeap () returned 0x4e0000 [0146.269] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.269] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.270] CloseHandle (hObject=0xdc) returned 1 [0146.270] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb7ffa00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb7ffa00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x68c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00443_.WMF", cAlternateFileName="")) returned 1 [0146.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.270] GetProcessHeap () returned 0x4e0000 [0146.270] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.270] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.270] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.270] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.280] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.280] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.280] GetProcessHeap () returned 0x4e0000 [0146.280] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.280] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.280] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.280] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.281] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.281] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.281] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.281] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.281] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.281] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.281] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.281] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.281] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x68c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x68c, lpOverlapped=0x0) returned 1 [0146.281] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x690, dwBufLen=0x690 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x690) returned 1 [0146.281] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.281] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x690, lpOverlapped=0x0) returned 1 [0146.281] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.281] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x764, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.281] SetEndOfFile (hFile=0xdc) returned 1 [0146.283] GetProcessHeap () returned 0x4e0000 [0146.284] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.284] GetProcessHeap () returned 0x4e0000 [0146.284] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.284] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.284] CloseHandle (hObject=0xdc) returned 1 [0146.284] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22a6aa00, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22a6aa00, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xf38, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00444_.WMF", cAlternateFileName="")) returned 1 [0146.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.285] GetProcessHeap () returned 0x4e0000 [0146.285] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.285] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.285] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.285] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.295] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.295] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.295] GetProcessHeap () returned 0x4e0000 [0146.296] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.296] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.296] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.296] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.296] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.296] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.296] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.296] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.296] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.297] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.297] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.297] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.297] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xf38, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xf38, lpOverlapped=0x0) returned 1 [0146.297] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xf40, dwBufLen=0xf40 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xf40) returned 1 [0146.297] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.297] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xf40, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xf40, lpOverlapped=0x0) returned 1 [0146.297] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.297] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.297] SetEndOfFile (hFile=0xdc) returned 1 [0146.299] GetProcessHeap () returned 0x4e0000 [0146.299] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.299] GetProcessHeap () returned 0x4e0000 [0146.299] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.299] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.300] CloseHandle (hObject=0xdc) returned 1 [0146.300] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21757d00, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21757d00, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xed4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00445_.WMF", cAlternateFileName="")) returned 1 [0146.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.300] GetProcessHeap () returned 0x4e0000 [0146.300] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.300] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.301] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.301] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0146.311] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.311] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.311] GetProcessHeap () returned 0x4e0000 [0146.311] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.311] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.311] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.311] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.311] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.311] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.311] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.311] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.311] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.311] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.311] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.311] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.311] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xed4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xed4, lpOverlapped=0x0) returned 1 [0146.312] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xee0, dwBufLen=0xee0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xee0) returned 1 [0146.312] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.312] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xee0, lpOverlapped=0x0) returned 1 [0146.312] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.312] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xfb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.312] SetEndOfFile (hFile=0xdc) returned 1 [0146.314] GetProcessHeap () returned 0x4e0000 [0146.314] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.314] GetProcessHeap () returned 0x4e0000 [0146.314] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.314] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.315] CloseHandle (hObject=0xdc) returned 1 [0146.315] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00453_.WMF", cAlternateFileName="")) returned 1 [0146.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.315] GetProcessHeap () returned 0x4e0000 [0146.315] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.315] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.315] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.315] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0146.317] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.317] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.317] GetProcessHeap () returned 0x4e0000 [0146.317] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.317] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.317] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.317] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.317] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.317] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.317] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.317] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.317] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.317] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.317] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.318] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.318] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x984, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x984, lpOverlapped=0x0) returned 1 [0146.318] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x990, dwBufLen=0x990 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x990) returned 1 [0146.318] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.318] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x990, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x990, lpOverlapped=0x0) returned 1 [0146.318] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.318] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xa64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.318] SetEndOfFile (hFile=0xdc) returned 1 [0146.320] GetProcessHeap () returned 0x4e0000 [0146.320] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.320] GetProcessHeap () returned 0x4e0000 [0146.320] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.320] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.320] CloseHandle (hObject=0xdc) returned 1 [0146.321] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ba86700, ftCreationTime.dwHighDateTime=0x1bd4bea, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4ba86700, ftLastWriteTime.dwHighDateTime=0x1bd4bea, nFileSizeHigh=0x0, nFileSizeLow=0xaac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS01080_.WMF", cAlternateFileName="")) returned 1 [0146.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.321] GetProcessHeap () returned 0x4e0000 [0146.321] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.321] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.321] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.321] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.323] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.323] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.323] GetProcessHeap () returned 0x4e0000 [0146.323] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.323] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.323] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.323] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.323] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.323] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.323] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.323] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.323] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.323] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.323] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.323] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.323] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xaac, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xaac, lpOverlapped=0x0) returned 1 [0146.323] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xab0, dwBufLen=0xab0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xab0) returned 1 [0146.323] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.323] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xab0, lpOverlapped=0x0) returned 1 [0146.324] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.324] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xb84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.324] SetEndOfFile (hFile=0xdc) returned 1 [0146.326] GetProcessHeap () returned 0x4e0000 [0146.326] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.326] GetProcessHeap () returned 0x4e0000 [0146.326] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.326] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.326] CloseHandle (hObject=0xdc) returned 1 [0146.326] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d186600, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d186600, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x1c08, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS01603_.WMF", cAlternateFileName="")) returned 1 [0146.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.328] GetProcessHeap () returned 0x4e0000 [0146.328] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.328] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.328] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.328] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.329] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.330] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.330] GetProcessHeap () returned 0x4e0000 [0146.330] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.330] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.330] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.330] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.330] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.330] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.330] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.330] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.330] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.330] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.330] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.330] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.330] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1c08, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1c08, lpOverlapped=0x0) returned 1 [0146.331] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1c10, dwBufLen=0x1c10 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1c10) returned 1 [0146.331] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.331] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1c10, lpOverlapped=0x0) returned 1 [0146.331] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.331] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1ce4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.331] SetEndOfFile (hFile=0xdc) returned 1 [0146.333] GetProcessHeap () returned 0x4e0000 [0146.333] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.333] GetProcessHeap () returned 0x4e0000 [0146.333] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.334] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.334] CloseHandle (hObject=0xdc) returned 1 [0146.334] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc31ccd00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc31ccd00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0xda6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS01634_.WMF", cAlternateFileName="")) returned 1 [0146.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.334] GetProcessHeap () returned 0x4e0000 [0146.334] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.334] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.335] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.335] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0146.336] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.336] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.336] GetProcessHeap () returned 0x4e0000 [0146.336] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.336] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.336] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.336] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.336] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.337] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.337] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.337] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.337] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.337] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.337] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.337] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.337] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xda6, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xda6, lpOverlapped=0x0) returned 1 [0146.337] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xdb0, dwBufLen=0xdb0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xdb0) returned 1 [0146.337] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.337] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xdb0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xdb0, lpOverlapped=0x0) returned 1 [0146.337] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.337] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xe84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.337] SetEndOfFile (hFile=0xdc) returned 1 [0146.339] GetProcessHeap () returned 0x4e0000 [0146.339] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.339] GetProcessHeap () returned 0x4e0000 [0146.339] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.339] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.340] CloseHandle (hObject=0xdc) returned 1 [0146.340] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63bebd00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x63bebd00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x3a94, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS01635_.WMF", cAlternateFileName="")) returned 1 [0146.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.340] GetProcessHeap () returned 0x4e0000 [0146.340] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.340] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.340] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.340] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0146.342] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.342] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.342] GetProcessHeap () returned 0x4e0000 [0146.342] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.342] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.342] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.342] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.342] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.342] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.342] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.342] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.343] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.343] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.343] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.343] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.343] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3a94, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3a94, lpOverlapped=0x0) returned 1 [0146.344] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3aa0, dwBufLen=0x3aa0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3aa0) returned 1 [0146.344] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.344] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3aa0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3aa0, lpOverlapped=0x0) returned 1 [0146.344] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.344] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3b74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.344] SetEndOfFile (hFile=0xdc) returned 1 [0146.346] GetProcessHeap () returned 0x4e0000 [0146.346] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.346] GetProcessHeap () returned 0x4e0000 [0146.346] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.346] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.347] CloseHandle (hObject=0xdc) returned 1 [0146.347] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe440e600, ftCreationTime.dwHighDateTime=0x1bd4bee, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe440e600, ftLastWriteTime.dwHighDateTime=0x1bd4bee, nFileSizeHigh=0x0, nFileSizeLow=0x752, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS01636_.WMF", cAlternateFileName="")) returned 1 [0146.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.348] GetProcessHeap () returned 0x4e0000 [0146.348] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.348] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.348] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.348] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0146.350] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.350] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.350] GetProcessHeap () returned 0x4e0000 [0146.350] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.350] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.350] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.350] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.350] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.350] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.350] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.350] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.350] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.350] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.350] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.351] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.351] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x752, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x752, lpOverlapped=0x0) returned 1 [0146.351] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x760, dwBufLen=0x760 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x760) returned 1 [0146.351] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.351] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x760, lpOverlapped=0x0) returned 1 [0146.351] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.351] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.351] SetEndOfFile (hFile=0xdc) returned 1 [0146.353] GetProcessHeap () returned 0x4e0000 [0146.353] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.353] GetProcessHeap () returned 0x4e0000 [0146.353] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.353] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.353] CloseHandle (hObject=0xdc) returned 1 [0146.354] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910b6b00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x910b6b00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0xf6c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS01637_.WMF", cAlternateFileName="")) returned 1 [0146.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.354] GetProcessHeap () returned 0x4e0000 [0146.354] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.354] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.354] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.354] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.356] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.356] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.356] GetProcessHeap () returned 0x4e0000 [0146.356] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.356] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.356] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.356] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.356] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.356] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.356] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.356] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.356] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.356] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.356] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.356] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.356] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xf6c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xf6c, lpOverlapped=0x0) returned 1 [0146.357] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xf70, dwBufLen=0xf70 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xf70) returned 1 [0146.357] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.357] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xf70, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xf70, lpOverlapped=0x0) returned 1 [0146.357] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.357] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1044, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.357] SetEndOfFile (hFile=0xdc) returned 1 [0146.359] GetProcessHeap () returned 0x4e0000 [0146.359] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.359] GetProcessHeap () returned 0x4e0000 [0146.359] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.359] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.359] CloseHandle (hObject=0xdc) returned 1 [0146.359] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd16ae900, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd16ae900, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x292a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS01638_.WMF", cAlternateFileName="")) returned 1 [0146.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.360] GetProcessHeap () returned 0x4e0000 [0146.360] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.360] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.360] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.360] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0146.362] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.362] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.362] GetProcessHeap () returned 0x4e0000 [0146.362] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.362] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.362] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.362] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.362] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.362] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.362] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.362] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.362] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.362] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.362] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.362] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.362] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x292a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x292a, lpOverlapped=0x0) returned 1 [0146.363] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2930, dwBufLen=0x2930 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2930) returned 1 [0146.363] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.363] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2930, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2930, lpOverlapped=0x0) returned 1 [0146.363] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.363] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2a04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.363] SetEndOfFile (hFile=0xdc) returned 1 [0146.365] GetProcessHeap () returned 0x4e0000 [0146.366] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.366] GetProcessHeap () returned 0x4e0000 [0146.366] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.366] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.366] CloseHandle (hObject=0xdc) returned 1 [0146.366] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88c32800, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x88c32800, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x108c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS01639_.WMF", cAlternateFileName="")) returned 1 [0146.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.366] GetProcessHeap () returned 0x4e0000 [0146.367] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.367] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.367] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.367] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.368] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.368] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.368] GetProcessHeap () returned 0x4e0000 [0146.368] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.368] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.368] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.368] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.368] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.369] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.369] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.369] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.369] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.369] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.369] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.369] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.369] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x108c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x108c, lpOverlapped=0x0) returned 1 [0146.370] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1090, dwBufLen=0x1090 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1090) returned 1 [0146.370] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.370] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1090, lpOverlapped=0x0) returned 1 [0146.370] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.370] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1164, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.370] SetEndOfFile (hFile=0xdc) returned 1 [0146.372] GetProcessHeap () returned 0x4e0000 [0146.372] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.372] GetProcessHeap () returned 0x4e0000 [0146.372] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.372] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.373] CloseHandle (hObject=0xdc) returned 1 [0146.373] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x246a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CARBN_01.MID", cAlternateFileName="")) returned 1 [0146.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.373] GetProcessHeap () returned 0x4e0000 [0146.373] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.373] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.373] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.373] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0146.383] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.383] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.383] GetProcessHeap () returned 0x4e0000 [0146.383] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.383] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.383] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.383] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.383] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.384] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.384] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.384] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.384] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.384] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.384] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.384] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.384] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x246a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x246a, lpOverlapped=0x0) returned 1 [0146.385] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2470, dwBufLen=0x2470 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2470) returned 1 [0146.385] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.385] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2470, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2470, lpOverlapped=0x0) returned 1 [0146.385] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.385] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2544, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.385] SetEndOfFile (hFile=0xdc) returned 1 [0146.387] GetProcessHeap () returned 0x4e0000 [0146.387] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.387] GetProcessHeap () returned 0x4e0000 [0146.387] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.387] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.388] CloseHandle (hObject=0xdc) returned 1 [0146.388] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xceceee00, ftCreationTime.dwHighDateTime=0x1c9b81d, ftLastAccessTime.dwLowDateTime=0x60382570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xceceee00, ftLastWriteTime.dwHighDateTime=0x1c9b81d, nFileSizeHigh=0x0, nFileSizeLow=0xdec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CG1606.WMF", cAlternateFileName="")) returned 1 [0146.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.389] GetProcessHeap () returned 0x4e0000 [0146.389] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.389] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.389] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.389] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.391] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.391] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.391] GetProcessHeap () returned 0x4e0000 [0146.391] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0146.391] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0146.391] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.391] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0146.391] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.391] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.391] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.392] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.392] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.392] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.392] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.392] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.392] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xdec, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xdec, lpOverlapped=0x0) returned 1 [0146.392] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xdf0, dwBufLen=0xdf0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xdf0) returned 1 [0146.392] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.392] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xdf0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xdf0, lpOverlapped=0x0) returned 1 [0146.392] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.392] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xeb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.392] SetEndOfFile (hFile=0xdc) returned 1 [0146.394] GetProcessHeap () returned 0x4e0000 [0146.394] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0146.394] GetProcessHeap () returned 0x4e0000 [0146.394] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.394] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.395] CloseHandle (hObject=0xdc) returned 1 [0146.395] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x51c76e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x976, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CLASSIC1.WMF", cAlternateFileName="")) returned 1 [0146.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.396] GetProcessHeap () returned 0x4e0000 [0146.396] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.396] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.396] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.396] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0146.398] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.398] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.398] GetProcessHeap () returned 0x4e0000 [0146.398] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.398] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.398] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.398] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.398] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.398] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.398] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.398] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.399] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.399] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.399] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.399] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.399] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x976, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x976, lpOverlapped=0x0) returned 1 [0146.399] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x980, dwBufLen=0x980 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x980) returned 1 [0146.399] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.399] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x980, lpOverlapped=0x0) returned 1 [0146.399] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.399] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xa54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.399] SetEndOfFile (hFile=0xdc) returned 1 [0146.401] GetProcessHeap () returned 0x4e0000 [0146.401] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.401] GetProcessHeap () returned 0x4e0000 [0146.401] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.401] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.402] CloseHandle (hObject=0xdc) returned 1 [0146.402] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x8d6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CLASSIC2.WMF", cAlternateFileName="")) returned 1 [0146.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.403] GetProcessHeap () returned 0x4e0000 [0146.403] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.403] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.403] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.403] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0146.406] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.406] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.406] GetProcessHeap () returned 0x4e0000 [0146.406] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.416] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.416] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.416] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.416] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.416] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.416] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.416] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.416] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.416] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.416] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.416] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.416] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x8d6, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x8d6, lpOverlapped=0x0) returned 1 [0146.417] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8e0, dwBufLen=0x8e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8e0) returned 1 [0146.417] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.417] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x8e0, lpOverlapped=0x0) returned 1 [0146.417] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.417] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x9b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.417] SetEndOfFile (hFile=0xdc) returned 1 [0146.419] GetProcessHeap () returned 0x4e0000 [0146.419] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.419] GetProcessHeap () returned 0x4e0000 [0146.419] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.419] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.420] CloseHandle (hObject=0xdc) returned 1 [0146.420] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x51c76e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x8d6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CLIP.WMF", cAlternateFileName="")) returned 1 [0146.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.528] GetProcessHeap () returned 0x4e0000 [0146.528] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.528] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.528] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.528] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0146.537] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.537] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.537] GetProcessHeap () returned 0x4e0000 [0146.537] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0146.537] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0146.537] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.537] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0146.537] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.537] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.537] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.537] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.537] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.537] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.537] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.537] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.537] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x8d6, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x8d6, lpOverlapped=0x0) returned 1 [0146.537] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8e0, dwBufLen=0x8e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8e0) returned 1 [0146.538] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.538] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x8e0, lpOverlapped=0x0) returned 1 [0146.538] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.538] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x9a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.538] SetEndOfFile (hFile=0xdc) returned 1 [0146.540] GetProcessHeap () returned 0x4e0000 [0146.540] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0146.540] GetProcessHeap () returned 0x4e0000 [0146.540] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.540] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.541] CloseHandle (hObject=0xdc) returned 1 [0146.541] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1b3a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CMNTY_01.MID", cAlternateFileName="")) returned 1 [0146.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.541] GetProcessHeap () returned 0x4e0000 [0146.541] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.541] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.541] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.541] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0146.561] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.561] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.561] GetProcessHeap () returned 0x4e0000 [0146.561] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.561] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.561] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.561] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.561] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.561] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.561] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.561] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.561] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.562] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.562] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.562] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.562] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1b3a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1b3a, lpOverlapped=0x0) returned 1 [0146.562] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1b40, dwBufLen=0x1b40 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1b40) returned 1 [0146.563] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.563] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1b40, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1b40, lpOverlapped=0x0) returned 1 [0146.563] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.563] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1c14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.563] SetEndOfFile (hFile=0xdc) returned 1 [0146.565] GetProcessHeap () returned 0x4e0000 [0146.565] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.565] GetProcessHeap () returned 0x4e0000 [0146.565] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.565] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.566] CloseHandle (hObject=0xdc) returned 1 [0146.566] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6849b000, ftCreationTime.dwHighDateTime=0x1bd0318, ftLastAccessTime.dwLowDateTime=0x51d0f390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6849b000, ftLastWriteTime.dwHighDateTime=0x1bd0318, nFileSizeHigh=0x0, nFileSizeLow=0x1496, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CRANE.WMF", cAlternateFileName="")) returned 1 [0146.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.575] GetProcessHeap () returned 0x4e0000 [0146.575] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.575] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.575] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.575] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0146.578] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.578] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.578] GetProcessHeap () returned 0x4e0000 [0146.578] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0146.578] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0146.578] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.578] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0146.579] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.579] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.579] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.579] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.579] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.579] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.579] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.579] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.579] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1496, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1496, lpOverlapped=0x0) returned 1 [0146.580] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x14a0, dwBufLen=0x14a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x14a0) returned 1 [0146.580] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.580] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x14a0, lpOverlapped=0x0) returned 1 [0146.580] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.580] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1564, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.580] SetEndOfFile (hFile=0xdc) returned 1 [0146.582] GetProcessHeap () returned 0x4e0000 [0146.582] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0146.582] GetProcessHeap () returned 0x4e0000 [0146.582] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.582] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.583] CloseHandle (hObject=0xdc) returned 1 [0146.583] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ce30000, ftCreationTime.dwHighDateTime=0x1bd78be, ftLastAccessTime.dwLowDateTime=0x60609cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ce30000, ftLastWriteTime.dwHighDateTime=0x1bd78be, nFileSizeHigh=0x0, nFileSizeLow=0xc18a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CRANINST.WMF", cAlternateFileName="")) returned 1 [0146.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.584] GetProcessHeap () returned 0x4e0000 [0146.584] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.584] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.584] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.584] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0146.586] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.586] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.586] GetProcessHeap () returned 0x4e0000 [0146.586] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.586] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.586] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.586] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.586] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.586] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.586] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.586] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.587] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.587] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.587] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.587] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.587] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xc18a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xc18a, lpOverlapped=0x0) returned 1 [0146.588] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xc190, dwBufLen=0xc190 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xc190) returned 1 [0146.588] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.588] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc190, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xc190, lpOverlapped=0x0) returned 1 [0146.589] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.589] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xc264, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.589] SetEndOfFile (hFile=0xdc) returned 1 [0146.591] GetProcessHeap () returned 0x4e0000 [0146.591] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.591] GetProcessHeap () returned 0x4e0000 [0146.591] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.591] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.592] CloseHandle (hObject=0xdc) returned 1 [0146.592] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6849b000, ftCreationTime.dwHighDateTime=0x1bd0318, ftLastAccessTime.dwLowDateTime=0x51d354f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6849b000, ftLastWriteTime.dwHighDateTime=0x1bd0318, nFileSizeHigh=0x0, nFileSizeLow=0xb96, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CUP.WMF", cAlternateFileName="")) returned 1 [0146.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.593] GetProcessHeap () returned 0x4e0000 [0146.593] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.593] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.593] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.593] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0146.595] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.595] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.595] GetProcessHeap () returned 0x4e0000 [0146.595] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0146.595] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0146.595] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.595] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0146.595] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.595] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.595] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.595] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.595] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.595] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.595] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.595] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.595] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb96, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xb96, lpOverlapped=0x0) returned 1 [0146.595] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xba0, dwBufLen=0xba0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xba0) returned 1 [0146.596] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.596] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xba0, lpOverlapped=0x0) returned 1 [0146.596] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.596] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xc64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.596] SetEndOfFile (hFile=0xdc) returned 1 [0146.598] GetProcessHeap () returned 0x4e0000 [0146.598] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0146.598] GetProcessHeap () returned 0x4e0000 [0146.598] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.598] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.599] CloseHandle (hObject=0xdc) returned 1 [0146.599] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ce30000, ftCreationTime.dwHighDateTime=0x1bd78be, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ce30000, ftLastWriteTime.dwHighDateTime=0x1bd78be, nFileSizeHigh=0x0, nFileSizeLow=0x2856, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CUPINST.WMF", cAlternateFileName="")) returned 1 [0146.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.600] GetProcessHeap () returned 0x4e0000 [0146.600] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.600] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.600] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.600] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0146.601] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.601] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.601] GetProcessHeap () returned 0x4e0000 [0146.601] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.602] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.602] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.602] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.602] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.602] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.602] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.602] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.602] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.602] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.602] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.602] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.602] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2856, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2856, lpOverlapped=0x0) returned 1 [0146.603] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2860, dwBufLen=0x2860 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2860) returned 1 [0146.603] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.603] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2860, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2860, lpOverlapped=0x0) returned 1 [0146.603] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.603] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2934, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.603] SetEndOfFile (hFile=0xdc) returned 1 [0146.605] GetProcessHeap () returned 0x4e0000 [0146.605] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.606] GetProcessHeap () returned 0x4e0000 [0146.606] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.606] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.606] CloseHandle (hObject=0xdc) returned 1 [0146.606] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7992, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00117_.WMF", cAlternateFileName="")) returned 1 [0146.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.607] GetProcessHeap () returned 0x4e0000 [0146.607] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.607] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.607] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.608] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0146.609] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.609] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.609] GetProcessHeap () returned 0x4e0000 [0146.609] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.609] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.609] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.609] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.609] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.610] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.610] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.610] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.610] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.610] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.610] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.610] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.610] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7992, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7992, lpOverlapped=0x0) returned 1 [0146.611] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x79a0, dwBufLen=0x79a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x79a0) returned 1 [0146.611] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.611] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x79a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x79a0, lpOverlapped=0x0) returned 1 [0146.611] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.611] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7a74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.612] SetEndOfFile (hFile=0xdc) returned 1 [0146.614] GetProcessHeap () returned 0x4e0000 [0146.614] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.614] GetProcessHeap () returned 0x4e0000 [0146.614] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.614] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.614] CloseHandle (hObject=0xdc) returned 1 [0146.614] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6a43700, ftCreationTime.dwHighDateTime=0x1bd4aee, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd6a43700, ftLastWriteTime.dwHighDateTime=0x1bd4aee, nFileSizeHigh=0x0, nFileSizeLow=0x2040, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00121_.WMF", cAlternateFileName="")) returned 1 [0146.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.615] GetProcessHeap () returned 0x4e0000 [0146.615] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.616] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.616] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.616] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.616] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.616] GetProcessHeap () returned 0x4e0000 [0146.616] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.616] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.616] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.616] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.618] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.618] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.618] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.618] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.618] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.618] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.618] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.618] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.618] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2040, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2040, lpOverlapped=0x0) returned 1 [0146.619] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2040, dwBufLen=0x2040 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2040) returned 1 [0146.619] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.619] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2040, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2040, lpOverlapped=0x0) returned 1 [0146.619] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.619] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2114, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.619] SetEndOfFile (hFile=0xdc) returned 1 [0146.622] GetProcessHeap () returned 0x4e0000 [0146.622] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.622] GetProcessHeap () returned 0x4e0000 [0146.622] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.622] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.622] CloseHandle (hObject=0xdc) returned 1 [0146.622] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x73bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00234_.WMF", cAlternateFileName="")) returned 1 [0146.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.623] GetProcessHeap () returned 0x4e0000 [0146.623] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.623] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.623] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.623] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.625] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.625] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.625] GetProcessHeap () returned 0x4e0000 [0146.625] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.625] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.625] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.625] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.625] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.625] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.625] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.625] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.625] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.625] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.625] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.625] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.625] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x73bc, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x73bc, lpOverlapped=0x0) returned 1 [0146.626] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x73c0, dwBufLen=0x73c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x73c0) returned 1 [0146.627] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.627] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x73c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x73c0, lpOverlapped=0x0) returned 1 [0146.627] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.627] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.627] SetEndOfFile (hFile=0xdc) returned 1 [0146.629] GetProcessHeap () returned 0x4e0000 [0146.629] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.629] GetProcessHeap () returned 0x4e0000 [0146.629] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.629] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.630] CloseHandle (hObject=0xdc) returned 1 [0146.630] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf650000, ftCreationTime.dwHighDateTime=0x1bd4b31, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf650000, ftLastWriteTime.dwHighDateTime=0x1bd4b31, nFileSizeHigh=0x0, nFileSizeLow=0xa82, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00255_.WMF", cAlternateFileName="")) returned 1 [0146.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.631] GetProcessHeap () returned 0x4e0000 [0146.631] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.631] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.631] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.631] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0146.633] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.633] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.633] GetProcessHeap () returned 0x4e0000 [0146.633] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.633] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.633] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.633] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.633] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.633] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.633] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.633] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.633] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.633] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.633] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.633] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.633] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xa82, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xa82, lpOverlapped=0x0) returned 1 [0146.634] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa90, dwBufLen=0xa90 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa90) returned 1 [0146.634] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.634] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xa90, lpOverlapped=0x0) returned 1 [0146.634] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.634] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xb64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.634] SetEndOfFile (hFile=0xdc) returned 1 [0146.636] GetProcessHeap () returned 0x4e0000 [0146.636] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.636] GetProcessHeap () returned 0x4e0000 [0146.636] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.636] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.637] CloseHandle (hObject=0xdc) returned 1 [0146.637] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb10, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00256_.WMF", cAlternateFileName="")) returned 1 [0146.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.637] GetProcessHeap () returned 0x4e0000 [0146.637] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.637] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.637] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.637] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.637] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.637] GetProcessHeap () returned 0x4e0000 [0146.637] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.637] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.637] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.637] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.644] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.644] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.644] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.644] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.644] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.644] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.644] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.644] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.644] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb10, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xb10, lpOverlapped=0x0) returned 1 [0146.644] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xb10, dwBufLen=0xb10 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xb10) returned 1 [0146.644] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.644] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xb10, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xb10, lpOverlapped=0x0) returned 1 [0146.644] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.644] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xbe4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.644] SetEndOfFile (hFile=0xdc) returned 1 [0146.646] GetProcessHeap () returned 0x4e0000 [0146.646] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.646] GetProcessHeap () returned 0x4e0000 [0146.647] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.647] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.647] CloseHandle (hObject=0xdc) returned 1 [0146.647] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe550c00, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbe550c00, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x9456, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00261_.WMF", cAlternateFileName="")) returned 1 [0146.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.648] GetProcessHeap () returned 0x4e0000 [0146.648] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.648] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.648] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.648] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0146.650] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.650] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.650] GetProcessHeap () returned 0x4e0000 [0146.650] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.650] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.650] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.650] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.650] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.650] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.650] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.650] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.650] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.650] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.650] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.650] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.650] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x9456, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x9456, lpOverlapped=0x0) returned 1 [0146.651] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9460, dwBufLen=0x9460 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9460) returned 1 [0146.652] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.652] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x9460, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x9460, lpOverlapped=0x0) returned 1 [0146.652] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.652] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x9534, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.652] SetEndOfFile (hFile=0xdc) returned 1 [0146.654] GetProcessHeap () returned 0x4e0000 [0146.654] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.654] GetProcessHeap () returned 0x4e0000 [0146.654] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.654] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.655] CloseHandle (hObject=0xdc) returned 1 [0146.655] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8572f00, ftCreationTime.dwHighDateTime=0x1bd4b20, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb8572f00, ftLastWriteTime.dwHighDateTime=0x1bd4b20, nFileSizeHigh=0x0, nFileSizeLow=0x9c5e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00297_.WMF", cAlternateFileName="")) returned 1 [0146.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.656] GetProcessHeap () returned 0x4e0000 [0146.656] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.656] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.656] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.656] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0146.658] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.658] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.658] GetProcessHeap () returned 0x4e0000 [0146.658] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.658] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.658] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.658] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.658] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.658] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.658] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.658] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.658] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.658] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.658] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.658] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.658] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x9c5e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x9c5e, lpOverlapped=0x0) returned 1 [0146.659] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9c60, dwBufLen=0x9c60 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9c60) returned 1 [0146.660] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.660] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x9c60, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x9c60, lpOverlapped=0x0) returned 1 [0146.660] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.660] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x9d34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.660] SetEndOfFile (hFile=0xdc) returned 1 [0146.662] GetProcessHeap () returned 0x4e0000 [0146.662] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.662] GetProcessHeap () returned 0x4e0000 [0146.662] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.662] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.663] CloseHandle (hObject=0xdc) returned 1 [0146.663] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d8c4300, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5d8c4300, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0x318, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00372_.WMF", cAlternateFileName="")) returned 1 [0146.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.664] GetProcessHeap () returned 0x4e0000 [0146.664] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.664] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.664] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.664] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.665] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.665] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.665] GetProcessHeap () returned 0x4e0000 [0146.666] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.666] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.666] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.666] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.666] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.666] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.666] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.666] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.666] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.666] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.666] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.666] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.666] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x318, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x318, lpOverlapped=0x0) returned 1 [0146.666] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x320, dwBufLen=0x320 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x320) returned 1 [0146.666] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.666] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x320, lpOverlapped=0x0) returned 1 [0146.666] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.666] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.666] SetEndOfFile (hFile=0xdc) returned 1 [0146.668] GetProcessHeap () returned 0x4e0000 [0146.669] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.669] GetProcessHeap () returned 0x4e0000 [0146.669] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.669] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.669] CloseHandle (hObject=0xdc) returned 1 [0146.669] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x44b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00405_.WMF", cAlternateFileName="")) returned 1 [0146.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.670] GetProcessHeap () returned 0x4e0000 [0146.670] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.670] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.670] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.670] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.670] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.670] GetProcessHeap () returned 0x4e0000 [0146.670] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.670] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.670] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.670] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.680] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.680] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.680] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.680] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.680] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.680] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.680] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.680] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.680] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x44b0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x44b0, lpOverlapped=0x0) returned 1 [0146.681] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x44b0, dwBufLen=0x44b0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x44b0) returned 1 [0146.682] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.682] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x44b0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x44b0, lpOverlapped=0x0) returned 1 [0146.682] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.682] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4584, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.682] SetEndOfFile (hFile=0xdc) returned 1 [0146.684] GetProcessHeap () returned 0x4e0000 [0146.684] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.684] GetProcessHeap () returned 0x4e0000 [0146.684] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.684] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.685] CloseHandle (hObject=0xdc) returned 1 [0146.685] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e94, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00407_.WMF", cAlternateFileName="")) returned 1 [0146.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.685] GetProcessHeap () returned 0x4e0000 [0146.685] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.685] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.685] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.686] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0146.687] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.687] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.687] GetProcessHeap () returned 0x4e0000 [0146.687] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.687] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.687] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.687] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.687] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.688] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.688] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.688] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.688] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.688] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.688] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.688] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.688] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1e94, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1e94, lpOverlapped=0x0) returned 1 [0146.689] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1ea0, dwBufLen=0x1ea0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1ea0) returned 1 [0146.689] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.689] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1ea0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1ea0, lpOverlapped=0x0) returned 1 [0146.689] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.689] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1f74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.689] SetEndOfFile (hFile=0xdc) returned 1 [0146.691] GetProcessHeap () returned 0x4e0000 [0146.691] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.691] GetProcessHeap () returned 0x4e0000 [0146.691] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.691] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.692] CloseHandle (hObject=0xdc) returned 1 [0146.692] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa7f0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00413_.WMF", cAlternateFileName="")) returned 1 [0146.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.693] GetProcessHeap () returned 0x4e0000 [0146.693] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.693] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.693] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.693] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.693] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.693] GetProcessHeap () returned 0x4e0000 [0146.693] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.693] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.693] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.693] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.695] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.695] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.695] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.695] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.695] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.695] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.695] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.695] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.695] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xa7f0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xa7f0, lpOverlapped=0x0) returned 1 [0146.696] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa7f0, dwBufLen=0xa7f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa7f0) returned 1 [0146.697] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.697] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xa7f0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xa7f0, lpOverlapped=0x0) returned 1 [0146.697] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.697] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xa8c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.697] SetEndOfFile (hFile=0xdc) returned 1 [0146.699] GetProcessHeap () returned 0x4e0000 [0146.699] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.699] GetProcessHeap () returned 0x4e0000 [0146.699] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.700] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.700] CloseHandle (hObject=0xdc) returned 1 [0146.700] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa79c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00414_.WMF", cAlternateFileName="")) returned 1 [0146.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.701] GetProcessHeap () returned 0x4e0000 [0146.701] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.701] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.701] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.701] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.702] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.702] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.702] GetProcessHeap () returned 0x4e0000 [0146.702] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.702] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.702] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.702] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.702] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.702] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.703] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.703] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.703] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.703] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.703] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.703] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.703] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xa79c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xa79c, lpOverlapped=0x0) returned 1 [0146.706] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa7a0, dwBufLen=0xa7a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa7a0) returned 1 [0146.706] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.706] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xa7a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xa7a0, lpOverlapped=0x0) returned 1 [0146.706] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.706] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xa874, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.706] SetEndOfFile (hFile=0xdc) returned 1 [0146.709] GetProcessHeap () returned 0x4e0000 [0146.709] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.709] GetProcessHeap () returned 0x4e0000 [0146.709] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.709] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.709] CloseHandle (hObject=0xdc) returned 1 [0146.709] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba4ecd00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xba4ecd00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x2c8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00419_.WMF", cAlternateFileName="")) returned 1 [0146.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.710] GetProcessHeap () returned 0x4e0000 [0146.710] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.710] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.710] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.710] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.711] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.711] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.711] GetProcessHeap () returned 0x4e0000 [0146.711] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.711] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.711] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.711] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.712] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.712] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.712] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.712] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.712] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.712] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.712] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.712] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.712] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2c8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2c8, lpOverlapped=0x0) returned 1 [0146.712] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2d0) returned 1 [0146.712] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.712] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2d0, lpOverlapped=0x0) returned 1 [0146.712] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.712] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.712] SetEndOfFile (hFile=0xdc) returned 1 [0146.714] GetProcessHeap () returned 0x4e0000 [0146.714] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.714] GetProcessHeap () returned 0x4e0000 [0146.714] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.715] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.715] CloseHandle (hObject=0xdc) returned 1 [0146.715] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb91da000, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb91da000, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x78c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00437_.WMF", cAlternateFileName="")) returned 1 [0146.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.715] GetProcessHeap () returned 0x4e0000 [0146.715] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.716] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.716] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.716] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.718] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.718] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.718] GetProcessHeap () returned 0x4e0000 [0146.718] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.718] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.718] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.718] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.718] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.718] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.719] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.719] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.719] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.719] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.719] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.719] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.719] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x78c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x78c, lpOverlapped=0x0) returned 1 [0146.719] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x790, dwBufLen=0x790 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x790) returned 1 [0146.719] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.719] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x790, lpOverlapped=0x0) returned 1 [0146.719] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.719] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x864, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.719] SetEndOfFile (hFile=0xdc) returned 1 [0146.722] GetProcessHeap () returned 0x4e0000 [0146.722] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.722] GetProcessHeap () returned 0x4e0000 [0146.722] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.722] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.723] CloseHandle (hObject=0xdc) returned 1 [0146.723] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb88, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00448_.WMF", cAlternateFileName="")) returned 1 [0146.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.724] GetProcessHeap () returned 0x4e0000 [0146.724] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.724] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.724] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.724] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.727] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.727] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.727] GetProcessHeap () returned 0x4e0000 [0146.727] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.727] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.727] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.727] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.727] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.727] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.727] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.727] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.727] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.727] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.727] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.727] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.727] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb88, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xb88, lpOverlapped=0x0) returned 1 [0146.727] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xb90, dwBufLen=0xb90 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xb90) returned 1 [0146.727] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.727] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xb90, lpOverlapped=0x0) returned 1 [0146.728] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.728] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xc64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.728] SetEndOfFile (hFile=0xdc) returned 1 [0146.730] GetProcessHeap () returned 0x4e0000 [0146.730] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.730] GetProcessHeap () returned 0x4e0000 [0146.730] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.730] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.730] CloseHandle (hObject=0xdc) returned 1 [0146.730] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2708, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00449_.WMF", cAlternateFileName="")) returned 1 [0146.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.731] GetProcessHeap () returned 0x4e0000 [0146.731] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.731] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.731] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.731] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.733] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.733] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.733] GetProcessHeap () returned 0x4e0000 [0146.733] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.733] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.733] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.733] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.733] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.733] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.733] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.733] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.733] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.734] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.734] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.734] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.734] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2708, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2708, lpOverlapped=0x0) returned 1 [0146.734] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2710, dwBufLen=0x2710 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2710) returned 1 [0146.735] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.735] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2710, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2710, lpOverlapped=0x0) returned 1 [0146.735] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.735] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x27e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.735] SetEndOfFile (hFile=0xdc) returned 1 [0146.737] GetProcessHeap () returned 0x4e0000 [0146.737] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.737] GetProcessHeap () returned 0x4e0000 [0146.737] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.737] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.738] CloseHandle (hObject=0xdc) returned 1 [0146.738] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac04fe00, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac04fe00, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x5130, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00687_.WMF", cAlternateFileName="")) returned 1 [0146.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.738] GetProcessHeap () returned 0x4e0000 [0146.738] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.738] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.738] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.738] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.738] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.738] GetProcessHeap () returned 0x4e0000 [0146.739] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.739] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.739] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.739] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.740] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.740] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.740] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.740] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.741] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.741] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.741] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.741] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.741] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5130, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x5130, lpOverlapped=0x0) returned 1 [0146.742] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5130, dwBufLen=0x5130 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5130) returned 1 [0146.742] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.742] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5130, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5130, lpOverlapped=0x0) returned 1 [0146.742] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.742] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.742] SetEndOfFile (hFile=0xdc) returned 1 [0146.744] GetProcessHeap () returned 0x4e0000 [0146.744] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.744] GetProcessHeap () returned 0x4e0000 [0146.744] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.744] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.745] CloseHandle (hObject=0xdc) returned 1 [0146.745] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bcb1e00, ftCreationTime.dwHighDateTime=0x1bd4b37, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6bcb1e00, ftLastWriteTime.dwHighDateTime=0x1bd4b37, nFileSizeHigh=0x0, nFileSizeLow=0x600c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00705_.WMF", cAlternateFileName="")) returned 1 [0146.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.746] GetProcessHeap () returned 0x4e0000 [0146.746] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.746] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.746] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.746] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.747] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.747] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.747] GetProcessHeap () returned 0x4e0000 [0146.747] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.748] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.748] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.748] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.748] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.748] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.748] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.748] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.748] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.748] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.748] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.748] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.748] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x600c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x600c, lpOverlapped=0x0) returned 1 [0146.749] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6010, dwBufLen=0x6010 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6010) returned 1 [0146.750] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.750] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6010, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x6010, lpOverlapped=0x0) returned 1 [0146.750] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.750] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x60e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.750] SetEndOfFile (hFile=0xdc) returned 1 [0146.752] GetProcessHeap () returned 0x4e0000 [0146.752] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.752] GetProcessHeap () returned 0x4e0000 [0146.752] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.752] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.753] CloseHandle (hObject=0xdc) returned 1 [0146.753] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb92d600, ftCreationTime.dwHighDateTime=0x1bd4b42, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdb92d600, ftLastWriteTime.dwHighDateTime=0x1bd4b42, nFileSizeHigh=0x0, nFileSizeLow=0x8b2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01015_.WMF", cAlternateFileName="")) returned 1 [0146.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.753] GetProcessHeap () returned 0x4e0000 [0146.753] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.753] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.753] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.754] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0146.755] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.755] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.755] GetProcessHeap () returned 0x4e0000 [0146.755] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.755] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.755] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.755] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.756] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.756] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.756] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.756] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.756] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.756] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.756] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.756] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.756] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x8b2, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x8b2, lpOverlapped=0x0) returned 1 [0146.756] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8c0, dwBufLen=0x8c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8c0) returned 1 [0146.756] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.756] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x8c0, lpOverlapped=0x0) returned 1 [0146.756] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.756] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.756] SetEndOfFile (hFile=0xdc) returned 1 [0146.758] GetProcessHeap () returned 0x4e0000 [0146.758] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.758] GetProcessHeap () returned 0x4e0000 [0146.758] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.759] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.759] CloseHandle (hObject=0xdc) returned 1 [0146.759] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x39e4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01039_.WMF", cAlternateFileName="")) returned 1 [0146.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.760] GetProcessHeap () returned 0x4e0000 [0146.760] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.760] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.760] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.760] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0146.762] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.762] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.762] GetProcessHeap () returned 0x4e0000 [0146.762] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.762] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.762] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.762] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.762] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.762] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.762] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.762] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.762] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.762] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.762] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.762] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.762] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x39e4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x39e4, lpOverlapped=0x0) returned 1 [0146.763] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x39f0, dwBufLen=0x39f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x39f0) returned 1 [0146.763] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.763] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x39f0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x39f0, lpOverlapped=0x0) returned 1 [0146.764] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.764] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3ac4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.764] SetEndOfFile (hFile=0xdc) returned 1 [0146.766] GetProcessHeap () returned 0x4e0000 [0146.766] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.766] GetProcessHeap () returned 0x4e0000 [0146.766] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.766] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.767] CloseHandle (hObject=0xdc) returned 1 [0146.767] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe6c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01138_.WMF", cAlternateFileName="")) returned 1 [0146.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.768] GetProcessHeap () returned 0x4e0000 [0146.768] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.768] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.768] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.768] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.771] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.771] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.771] GetProcessHeap () returned 0x4e0000 [0146.771] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.771] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.771] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.771] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.772] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.772] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.772] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.772] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.772] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.772] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.772] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.772] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.772] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xe6c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xe6c, lpOverlapped=0x0) returned 1 [0146.772] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe70, dwBufLen=0xe70 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe70) returned 1 [0146.772] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.772] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xe70, lpOverlapped=0x0) returned 1 [0146.772] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.772] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xf44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.772] SetEndOfFile (hFile=0xdc) returned 1 [0146.774] GetProcessHeap () returned 0x4e0000 [0146.774] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.774] GetProcessHeap () returned 0x4e0000 [0146.774] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.774] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.775] CloseHandle (hObject=0xdc) returned 1 [0146.775] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe30, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01139_.WMF", cAlternateFileName="")) returned 1 [0146.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.776] GetProcessHeap () returned 0x4e0000 [0146.776] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.776] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.776] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.776] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.776] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.776] GetProcessHeap () returned 0x4e0000 [0146.776] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.776] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.776] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.777] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.778] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.778] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.778] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.778] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.778] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.779] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.779] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.779] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.779] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xe30, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xe30, lpOverlapped=0x0) returned 1 [0146.779] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe30, dwBufLen=0xe30 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe30) returned 1 [0146.779] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.779] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xe30, lpOverlapped=0x0) returned 1 [0146.779] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.779] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xf04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.779] SetEndOfFile (hFile=0xdc) returned 1 [0146.781] GetProcessHeap () returned 0x4e0000 [0146.781] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.781] GetProcessHeap () returned 0x4e0000 [0146.781] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.781] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.782] CloseHandle (hObject=0xdc) returned 1 [0146.782] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe20, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01140_.WMF", cAlternateFileName="")) returned 1 [0146.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.783] GetProcessHeap () returned 0x4e0000 [0146.783] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.783] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.783] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.783] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.783] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.783] GetProcessHeap () returned 0x4e0000 [0146.783] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.783] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.783] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.783] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.785] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.785] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.785] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.785] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.785] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.785] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.785] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.786] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.786] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xe20, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xe20, lpOverlapped=0x0) returned 1 [0146.786] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe20, dwBufLen=0xe20 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe20) returned 1 [0146.786] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.786] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xe20, lpOverlapped=0x0) returned 1 [0146.786] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.786] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.786] SetEndOfFile (hFile=0xdc) returned 1 [0146.788] GetProcessHeap () returned 0x4e0000 [0146.788] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.788] GetProcessHeap () returned 0x4e0000 [0146.788] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.788] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.789] CloseHandle (hObject=0xdc) returned 1 [0146.789] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x85c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01143_.WMF", cAlternateFileName="")) returned 1 [0146.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.789] GetProcessHeap () returned 0x4e0000 [0146.789] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.789] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.789] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.789] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.791] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.791] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.791] GetProcessHeap () returned 0x4e0000 [0146.791] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.791] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.791] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.791] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.791] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.791] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.791] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.792] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.792] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.792] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.792] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.792] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.792] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x85c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x85c, lpOverlapped=0x0) returned 1 [0146.792] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x860, dwBufLen=0x860 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x860) returned 1 [0146.792] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.792] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x860, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x860, lpOverlapped=0x0) returned 1 [0146.792] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.792] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x934, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.792] SetEndOfFile (hFile=0xdc) returned 1 [0146.794] GetProcessHeap () returned 0x4e0000 [0146.794] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.794] GetProcessHeap () returned 0x4e0000 [0146.794] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.794] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.795] CloseHandle (hObject=0xdc) returned 1 [0146.795] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xadc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01145_.WMF", cAlternateFileName="")) returned 1 [0146.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.796] GetProcessHeap () returned 0x4e0000 [0146.796] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.796] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.796] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.796] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.798] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.798] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.798] GetProcessHeap () returned 0x4e0000 [0146.798] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.798] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.798] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.798] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.798] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.798] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.798] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.798] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.798] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.798] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.798] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.798] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.799] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xadc, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xadc, lpOverlapped=0x0) returned 1 [0146.799] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xae0, dwBufLen=0xae0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xae0) returned 1 [0146.799] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.799] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xae0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xae0, lpOverlapped=0x0) returned 1 [0146.799] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.799] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xbb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.799] SetEndOfFile (hFile=0xdc) returned 1 [0146.801] GetProcessHeap () returned 0x4e0000 [0146.801] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.801] GetProcessHeap () returned 0x4e0000 [0146.801] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.801] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.802] CloseHandle (hObject=0xdc) returned 1 [0146.802] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01146_.WMF", cAlternateFileName="")) returned 1 [0146.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.802] GetProcessHeap () returned 0x4e0000 [0146.802] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.802] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.802] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.803] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.804] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.804] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.804] GetProcessHeap () returned 0x4e0000 [0146.804] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.804] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.804] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.804] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.805] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.805] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.805] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.805] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.805] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.805] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.805] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.805] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.805] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xaec, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xaec, lpOverlapped=0x0) returned 1 [0146.805] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xaf0, dwBufLen=0xaf0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xaf0) returned 1 [0146.805] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.805] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xaf0, lpOverlapped=0x0) returned 1 [0146.805] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.805] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xbc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.805] SetEndOfFile (hFile=0xdc) returned 1 [0146.807] GetProcessHeap () returned 0x4e0000 [0146.807] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.807] GetProcessHeap () returned 0x4e0000 [0146.807] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.808] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.808] CloseHandle (hObject=0xdc) returned 1 [0146.808] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01151_.WMF", cAlternateFileName="")) returned 1 [0146.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.809] GetProcessHeap () returned 0x4e0000 [0146.809] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.809] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.809] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.809] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.809] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.809] GetProcessHeap () returned 0x4e0000 [0146.809] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.809] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.809] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.809] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.811] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.811] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.811] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.811] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.811] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.811] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.812] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.812] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.812] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb90, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xb90, lpOverlapped=0x0) returned 1 [0146.812] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xb90, dwBufLen=0xb90 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xb90) returned 1 [0146.812] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.812] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xb90, lpOverlapped=0x0) returned 1 [0146.812] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.812] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xc64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.812] SetEndOfFile (hFile=0xdc) returned 1 [0146.814] GetProcessHeap () returned 0x4e0000 [0146.814] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.814] GetProcessHeap () returned 0x4e0000 [0146.814] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.814] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.815] CloseHandle (hObject=0xdc) returned 1 [0146.815] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01152_.WMF", cAlternateFileName="")) returned 1 [0146.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.815] GetProcessHeap () returned 0x4e0000 [0146.816] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.816] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.816] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.816] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.816] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.816] GetProcessHeap () returned 0x4e0000 [0146.816] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.816] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.816] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.816] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.818] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.818] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.818] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.818] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.818] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.818] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.818] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.818] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.818] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb90, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xb90, lpOverlapped=0x0) returned 1 [0146.818] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xb90, dwBufLen=0xb90 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xb90) returned 1 [0146.818] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.818] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xb90, lpOverlapped=0x0) returned 1 [0146.818] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.818] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xc64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.819] SetEndOfFile (hFile=0xdc) returned 1 [0146.821] GetProcessHeap () returned 0x4e0000 [0146.821] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.821] GetProcessHeap () returned 0x4e0000 [0146.821] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.821] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.821] CloseHandle (hObject=0xdc) returned 1 [0146.821] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe04, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01157_.WMF", cAlternateFileName="")) returned 1 [0146.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.822] GetProcessHeap () returned 0x4e0000 [0146.823] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.823] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.823] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.823] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0146.824] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.824] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.824] GetProcessHeap () returned 0x4e0000 [0146.825] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.825] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.825] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.825] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.825] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.825] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.825] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.825] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.825] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.825] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.825] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.825] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.825] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xe04, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xe04, lpOverlapped=0x0) returned 1 [0146.825] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe10, dwBufLen=0xe10 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe10) returned 1 [0146.825] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.825] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xe10, lpOverlapped=0x0) returned 1 [0146.825] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.825] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xee4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.826] SetEndOfFile (hFile=0xdc) returned 1 [0146.828] GetProcessHeap () returned 0x4e0000 [0146.828] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.828] GetProcessHeap () returned 0x4e0000 [0146.828] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.828] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.829] CloseHandle (hObject=0xdc) returned 1 [0146.829] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8b4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01160_.WMF", cAlternateFileName="")) returned 1 [0146.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.829] GetProcessHeap () returned 0x4e0000 [0146.829] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.829] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.829] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.829] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0146.831] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.831] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.831] GetProcessHeap () returned 0x4e0000 [0146.831] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.831] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.831] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.832] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.832] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.832] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.832] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.832] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.832] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.832] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.832] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.832] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.832] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x8b4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x8b4, lpOverlapped=0x0) returned 1 [0146.832] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8c0, dwBufLen=0x8c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8c0) returned 1 [0146.832] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.832] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x8c0, lpOverlapped=0x0) returned 1 [0146.832] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.833] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.833] SetEndOfFile (hFile=0xdc) returned 1 [0146.835] GetProcessHeap () returned 0x4e0000 [0146.835] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.835] GetProcessHeap () returned 0x4e0000 [0146.835] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.835] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.836] CloseHandle (hObject=0xdc) returned 1 [0146.836] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8fc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01162_.WMF", cAlternateFileName="")) returned 1 [0146.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.836] GetProcessHeap () returned 0x4e0000 [0146.836] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.837] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.837] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.837] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.838] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.838] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.838] GetProcessHeap () returned 0x4e0000 [0146.838] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.838] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.839] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.839] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.839] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.839] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.839] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.839] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.839] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.839] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.839] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.839] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.839] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x8fc, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x8fc, lpOverlapped=0x0) returned 1 [0146.839] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x900, dwBufLen=0x900 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x900) returned 1 [0146.839] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.839] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x900, lpOverlapped=0x0) returned 1 [0146.840] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.840] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x9d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.840] SetEndOfFile (hFile=0xdc) returned 1 [0146.842] GetProcessHeap () returned 0x4e0000 [0146.842] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.842] GetProcessHeap () returned 0x4e0000 [0146.842] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.842] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.843] CloseHandle (hObject=0xdc) returned 1 [0146.843] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8fc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01163_.WMF", cAlternateFileName="")) returned 1 [0146.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.843] GetProcessHeap () returned 0x4e0000 [0146.843] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.843] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.843] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.844] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.845] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.845] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.845] GetProcessHeap () returned 0x4e0000 [0146.845] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.845] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.845] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.845] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.846] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.846] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.846] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.846] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.846] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.846] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.846] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.846] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.846] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x8fc, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x8fc, lpOverlapped=0x0) returned 1 [0146.846] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x900, dwBufLen=0x900 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x900) returned 1 [0146.846] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.846] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x900, lpOverlapped=0x0) returned 1 [0146.846] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.846] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x9d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.846] SetEndOfFile (hFile=0xdc) returned 1 [0146.849] GetProcessHeap () returned 0x4e0000 [0146.849] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.849] GetProcessHeap () returned 0x4e0000 [0146.849] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.849] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.849] CloseHandle (hObject=0xdc) returned 1 [0146.849] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x820, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01166_.WMF", cAlternateFileName="")) returned 1 [0146.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.850] GetProcessHeap () returned 0x4e0000 [0146.850] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.850] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.850] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.851] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.851] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.851] GetProcessHeap () returned 0x4e0000 [0146.851] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.851] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.851] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.851] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.852] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.853] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.853] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.853] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.853] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.853] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.853] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.853] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.853] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x820, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x820, lpOverlapped=0x0) returned 1 [0146.853] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x820, dwBufLen=0x820 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x820) returned 1 [0146.853] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.853] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x820, lpOverlapped=0x0) returned 1 [0146.853] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.853] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x8f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.853] SetEndOfFile (hFile=0xdc) returned 1 [0146.856] GetProcessHeap () returned 0x4e0000 [0146.856] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.856] GetProcessHeap () returned 0x4e0000 [0146.856] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.856] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.856] CloseHandle (hObject=0xdc) returned 1 [0146.857] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x820, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01167_.WMF", cAlternateFileName="")) returned 1 [0146.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.857] GetProcessHeap () returned 0x4e0000 [0146.857] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.857] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.857] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.857] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.857] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.857] GetProcessHeap () returned 0x4e0000 [0146.857] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.857] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.857] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.857] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.859] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.859] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.859] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.859] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.859] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.859] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.859] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.859] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.859] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x820, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x820, lpOverlapped=0x0) returned 1 [0146.859] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x820, dwBufLen=0x820 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x820) returned 1 [0146.860] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.860] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x820, lpOverlapped=0x0) returned 1 [0146.860] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.860] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x8f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.860] SetEndOfFile (hFile=0xdc) returned 1 [0146.862] GetProcessHeap () returned 0x4e0000 [0146.862] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.862] GetProcessHeap () returned 0x4e0000 [0146.862] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.862] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.863] CloseHandle (hObject=0xdc) returned 1 [0146.863] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7d4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01168_.WMF", cAlternateFileName="")) returned 1 [0146.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.863] GetProcessHeap () returned 0x4e0000 [0146.863] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.863] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.863] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.863] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0146.865] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.865] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.865] GetProcessHeap () returned 0x4e0000 [0146.865] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.865] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.865] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.865] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.865] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.865] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.865] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.865] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.865] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.865] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.865] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.865] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.866] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7d4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7d4, lpOverlapped=0x0) returned 1 [0146.866] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7e0, dwBufLen=0x7e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7e0) returned 1 [0146.866] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.866] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7e0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7e0, lpOverlapped=0x0) returned 1 [0146.866] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.866] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x8b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.866] SetEndOfFile (hFile=0xdc) returned 1 [0146.868] GetProcessHeap () returned 0x4e0000 [0146.868] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.868] GetProcessHeap () returned 0x4e0000 [0146.868] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.868] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.869] CloseHandle (hObject=0xdc) returned 1 [0146.869] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7e4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01169_.WMF", cAlternateFileName="")) returned 1 [0146.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.870] GetProcessHeap () returned 0x4e0000 [0146.870] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.870] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.870] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.870] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0146.871] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.871] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.871] GetProcessHeap () returned 0x4e0000 [0146.871] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.872] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.872] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.872] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.872] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.872] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.872] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.872] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.872] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.872] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.872] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.872] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.872] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7e4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7e4, lpOverlapped=0x0) returned 1 [0146.872] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7f0, dwBufLen=0x7f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7f0) returned 1 [0146.872] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.872] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7f0, lpOverlapped=0x0) returned 1 [0146.872] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.872] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x8c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.872] SetEndOfFile (hFile=0xdc) returned 1 [0146.875] GetProcessHeap () returned 0x4e0000 [0146.875] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.875] GetProcessHeap () returned 0x4e0000 [0146.875] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.875] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.875] CloseHandle (hObject=0xdc) returned 1 [0146.876] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x964, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01170_.WMF", cAlternateFileName="")) returned 1 [0146.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.876] GetProcessHeap () returned 0x4e0000 [0146.876] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.876] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.876] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.876] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0146.878] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.878] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.878] GetProcessHeap () returned 0x4e0000 [0146.878] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.878] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.878] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.878] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.878] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.878] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.878] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.878] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.878] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.879] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.879] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.879] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.879] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x964, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x964, lpOverlapped=0x0) returned 1 [0146.879] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x970, dwBufLen=0x970 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x970) returned 1 [0146.879] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.879] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x970, lpOverlapped=0x0) returned 1 [0146.879] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.879] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xa44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.879] SetEndOfFile (hFile=0xdc) returned 1 [0146.881] GetProcessHeap () returned 0x4e0000 [0146.881] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.881] GetProcessHeap () returned 0x4e0000 [0146.881] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.881] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.884] CloseHandle (hObject=0xdc) returned 1 [0146.884] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x804, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01171_.WMF", cAlternateFileName="")) returned 1 [0146.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.884] GetProcessHeap () returned 0x4e0000 [0146.884] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.884] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.884] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.885] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0146.886] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.886] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.886] GetProcessHeap () returned 0x4e0000 [0146.886] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.886] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.886] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.886] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.886] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.886] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.886] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.887] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.887] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.887] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.887] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.887] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.887] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x804, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x804, lpOverlapped=0x0) returned 1 [0146.887] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x810, dwBufLen=0x810 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x810) returned 1 [0146.887] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.887] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x810, lpOverlapped=0x0) returned 1 [0146.887] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.887] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x8e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.887] SetEndOfFile (hFile=0xdc) returned 1 [0146.889] GetProcessHeap () returned 0x4e0000 [0146.889] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.889] GetProcessHeap () returned 0x4e0000 [0146.889] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.889] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.890] CloseHandle (hObject=0xdc) returned 1 [0146.890] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8b8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01172_.WMF", cAlternateFileName="")) returned 1 [0146.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.890] GetProcessHeap () returned 0x4e0000 [0146.890] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.890] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.890] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.890] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.892] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.892] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.892] GetProcessHeap () returned 0x4e0000 [0146.892] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.892] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.892] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.892] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.892] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.892] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.892] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.893] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.893] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.893] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.893] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.893] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.893] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x8b8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x8b8, lpOverlapped=0x0) returned 1 [0146.893] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8c0, dwBufLen=0x8c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8c0) returned 1 [0146.893] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.893] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x8c0, lpOverlapped=0x0) returned 1 [0146.893] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.893] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.893] SetEndOfFile (hFile=0xdc) returned 1 [0146.895] GetProcessHeap () returned 0x4e0000 [0146.895] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.895] GetProcessHeap () returned 0x4e0000 [0146.895] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.895] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.896] CloseHandle (hObject=0xdc) returned 1 [0146.896] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x70c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01173_.WMF", cAlternateFileName="")) returned 1 [0146.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.897] GetProcessHeap () returned 0x4e0000 [0146.897] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.897] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.897] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.897] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.901] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.901] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.901] GetProcessHeap () returned 0x4e0000 [0146.901] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.901] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.901] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.901] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.902] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.902] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.902] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.902] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.902] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.902] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.902] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.902] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.902] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x70c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x70c, lpOverlapped=0x0) returned 1 [0146.902] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x710, dwBufLen=0x710 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x710) returned 1 [0146.902] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.902] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x710, lpOverlapped=0x0) returned 1 [0146.902] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.902] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.902] SetEndOfFile (hFile=0xdc) returned 1 [0146.904] GetProcessHeap () returned 0x4e0000 [0146.904] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.904] GetProcessHeap () returned 0x4e0000 [0146.904] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.904] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.905] CloseHandle (hObject=0xdc) returned 1 [0146.905] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x760, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01176_.WMF", cAlternateFileName="")) returned 1 [0146.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.906] GetProcessHeap () returned 0x4e0000 [0146.906] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.906] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.906] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.906] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.906] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.906] GetProcessHeap () returned 0x4e0000 [0146.906] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.906] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.906] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.906] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.908] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.908] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.908] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.908] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.908] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.908] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.908] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.908] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.908] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x760, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x760, lpOverlapped=0x0) returned 1 [0146.908] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x760, dwBufLen=0x760 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x760) returned 1 [0146.908] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.908] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x760, lpOverlapped=0x0) returned 1 [0146.908] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.908] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.908] SetEndOfFile (hFile=0xdc) returned 1 [0146.910] GetProcessHeap () returned 0x4e0000 [0146.910] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.910] GetProcessHeap () returned 0x4e0000 [0146.910] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.910] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.911] CloseHandle (hObject=0xdc) returned 1 [0146.911] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xed4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01178_.WMF", cAlternateFileName="")) returned 1 [0146.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.911] GetProcessHeap () returned 0x4e0000 [0146.911] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.911] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.911] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.912] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0146.913] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.913] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.913] GetProcessHeap () returned 0x4e0000 [0146.913] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.913] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.913] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.913] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.913] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.914] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.914] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.914] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.914] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.914] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.914] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.914] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.914] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xed4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xed4, lpOverlapped=0x0) returned 1 [0146.914] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xee0, dwBufLen=0xee0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xee0) returned 1 [0146.914] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.914] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xee0, lpOverlapped=0x0) returned 1 [0146.914] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.914] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xfb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.914] SetEndOfFile (hFile=0xdc) returned 1 [0146.916] GetProcessHeap () returned 0x4e0000 [0146.916] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.916] GetProcessHeap () returned 0x4e0000 [0146.916] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.916] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.917] CloseHandle (hObject=0xdc) returned 1 [0146.917] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01179_.WMF", cAlternateFileName="")) returned 1 [0146.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.917] GetProcessHeap () returned 0x4e0000 [0146.917] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.917] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.918] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.918] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.919] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.919] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.919] GetProcessHeap () returned 0x4e0000 [0146.919] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.919] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.919] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.919] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.920] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.920] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.920] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.920] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.920] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.920] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.920] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.920] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.920] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7e8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7e8, lpOverlapped=0x0) returned 1 [0146.920] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7f0, dwBufLen=0x7f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7f0) returned 1 [0146.920] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.920] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7f0, lpOverlapped=0x0) returned 1 [0146.920] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.920] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x8c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.920] SetEndOfFile (hFile=0xdc) returned 1 [0146.923] GetProcessHeap () returned 0x4e0000 [0146.923] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.923] GetProcessHeap () returned 0x4e0000 [0146.923] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.923] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.924] CloseHandle (hObject=0xdc) returned 1 [0146.924] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x824, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01180_.WMF", cAlternateFileName="")) returned 1 [0146.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.924] GetProcessHeap () returned 0x4e0000 [0146.924] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.924] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.924] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.924] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0146.926] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.926] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.926] GetProcessHeap () returned 0x4e0000 [0146.926] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.926] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.926] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.926] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.926] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.926] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.926] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.926] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.926] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.926] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.926] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.926] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.926] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x824, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x824, lpOverlapped=0x0) returned 1 [0146.927] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x830, dwBufLen=0x830 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x830) returned 1 [0146.927] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.927] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x830, lpOverlapped=0x0) returned 1 [0146.927] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.927] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x904, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.927] SetEndOfFile (hFile=0xdc) returned 1 [0146.929] GetProcessHeap () returned 0x4e0000 [0146.929] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.929] GetProcessHeap () returned 0x4e0000 [0146.929] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.929] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.929] CloseHandle (hObject=0xdc) returned 1 [0146.930] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5a8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01181_.WMF", cAlternateFileName="")) returned 1 [0146.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.931] GetProcessHeap () returned 0x4e0000 [0146.931] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.931] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.931] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.931] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.933] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.933] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.933] GetProcessHeap () returned 0x4e0000 [0146.933] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.933] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.933] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.933] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.933] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.933] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.933] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.933] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.933] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.933] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.933] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.933] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.933] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5a8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x5a8, lpOverlapped=0x0) returned 1 [0146.933] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5b0) returned 1 [0146.934] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.934] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5b0, lpOverlapped=0x0) returned 1 [0146.934] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.934] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.934] SetEndOfFile (hFile=0xdc) returned 1 [0146.936] GetProcessHeap () returned 0x4e0000 [0146.936] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.936] GetProcessHeap () returned 0x4e0000 [0146.936] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.936] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.937] CloseHandle (hObject=0xdc) returned 1 [0146.937] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbb4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01182_.WMF", cAlternateFileName="")) returned 1 [0146.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.937] GetProcessHeap () returned 0x4e0000 [0146.937] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.937] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.937] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.937] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0146.939] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.939] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.939] GetProcessHeap () returned 0x4e0000 [0146.939] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.939] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.939] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.939] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.939] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.939] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.939] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.939] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.939] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.939] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.939] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.939] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.939] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xbb4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xbb4, lpOverlapped=0x0) returned 1 [0146.939] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xbc0, dwBufLen=0xbc0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xbc0) returned 1 [0146.940] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.940] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xbc0, lpOverlapped=0x0) returned 1 [0146.940] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.940] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xc94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.940] SetEndOfFile (hFile=0xdc) returned 1 [0146.942] GetProcessHeap () returned 0x4e0000 [0146.942] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.942] GetProcessHeap () returned 0x4e0000 [0146.942] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.942] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.942] CloseHandle (hObject=0xdc) returned 1 [0146.942] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01183_.WMF", cAlternateFileName="")) returned 1 [0146.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.943] GetProcessHeap () returned 0x4e0000 [0146.943] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.943] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.943] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.943] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.945] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.945] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.945] GetProcessHeap () returned 0x4e0000 [0146.945] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.945] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.945] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.945] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.945] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.945] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.945] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.945] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.945] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.945] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.945] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.945] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.945] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x8f8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x8f8, lpOverlapped=0x0) returned 1 [0146.945] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x900, dwBufLen=0x900 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x900) returned 1 [0146.946] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.946] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x900, lpOverlapped=0x0) returned 1 [0146.946] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.946] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x9d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.946] SetEndOfFile (hFile=0xdc) returned 1 [0146.948] GetProcessHeap () returned 0x4e0000 [0146.948] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.948] GetProcessHeap () returned 0x4e0000 [0146.948] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.948] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.948] CloseHandle (hObject=0xdc) returned 1 [0146.948] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9936cb00, ftCreationTime.dwHighDateTime=0x1bd4c0e, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9936cb00, ftLastWriteTime.dwHighDateTime=0x1bd4c0e, nFileSizeHigh=0x0, nFileSizeLow=0x2174, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01186_.WMF", cAlternateFileName="")) returned 1 [0146.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.949] GetProcessHeap () returned 0x4e0000 [0146.949] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.949] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.949] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.949] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0146.951] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.951] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.951] GetProcessHeap () returned 0x4e0000 [0146.951] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.951] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.951] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.951] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.951] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.951] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.951] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.951] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.951] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.951] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.951] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.951] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.951] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2174, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2174, lpOverlapped=0x0) returned 1 [0146.952] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2180, dwBufLen=0x2180 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2180) returned 1 [0146.952] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.952] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2180, lpOverlapped=0x0) returned 1 [0146.953] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.953] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2254, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.953] SetEndOfFile (hFile=0xdc) returned 1 [0146.955] GetProcessHeap () returned 0x4e0000 [0146.955] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.955] GetProcessHeap () returned 0x4e0000 [0146.955] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.955] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.955] CloseHandle (hObject=0xdc) returned 1 [0146.955] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4fe9900, ftCreationTime.dwHighDateTime=0x1c7a766, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4fe9900, ftLastWriteTime.dwHighDateTime=0x1c7a766, nFileSizeHigh=0x0, nFileSizeLow=0x6e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01366_.WMF", cAlternateFileName="")) returned 1 [0146.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.956] GetProcessHeap () returned 0x4e0000 [0146.956] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.956] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.956] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.956] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.958] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.958] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.958] GetProcessHeap () returned 0x4e0000 [0146.958] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.958] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.958] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.958] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.958] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.958] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.958] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.958] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.959] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.959] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.959] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.959] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.959] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x6e8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x6e8, lpOverlapped=0x0) returned 1 [0146.959] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6f0, dwBufLen=0x6f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6f0) returned 1 [0146.959] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.959] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6f0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x6f0, lpOverlapped=0x0) returned 1 [0146.959] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.959] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.959] SetEndOfFile (hFile=0xdc) returned 1 [0146.961] GetProcessHeap () returned 0x4e0000 [0146.961] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.961] GetProcessHeap () returned 0x4e0000 [0146.961] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.961] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.962] CloseHandle (hObject=0xdc) returned 1 [0146.962] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81594a00, ftCreationTime.dwHighDateTime=0x1bd4c02, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81594a00, ftLastWriteTime.dwHighDateTime=0x1bd4c02, nFileSizeHigh=0x0, nFileSizeLow=0x384, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01434_.WMF", cAlternateFileName="")) returned 1 [0146.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.963] GetProcessHeap () returned 0x4e0000 [0146.963] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.963] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.963] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.963] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0146.966] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.966] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.966] GetProcessHeap () returned 0x4e0000 [0146.967] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.967] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.967] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.967] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.967] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.967] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.967] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.967] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.967] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.967] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.967] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.967] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.967] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x384, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x384, lpOverlapped=0x0) returned 1 [0146.967] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x390, dwBufLen=0x390 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x390) returned 1 [0146.967] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.967] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x390, lpOverlapped=0x0) returned 1 [0146.967] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.968] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.968] SetEndOfFile (hFile=0xdc) returned 1 [0146.970] GetProcessHeap () returned 0x4e0000 [0146.970] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.970] GetProcessHeap () returned 0x4e0000 [0146.970] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.970] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.971] CloseHandle (hObject=0xdc) returned 1 [0146.971] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55829800, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x55829800, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x9dc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01585_.WMF", cAlternateFileName="")) returned 1 [0146.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.971] GetProcessHeap () returned 0x4e0000 [0146.971] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.971] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.971] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.971] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.973] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.973] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.973] GetProcessHeap () returned 0x4e0000 [0146.973] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.973] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.973] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.973] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.973] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.973] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.973] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.973] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.973] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.973] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.973] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.973] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.973] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x9dc, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x9dc, lpOverlapped=0x0) returned 1 [0146.973] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9e0, dwBufLen=0x9e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9e0) returned 1 [0146.973] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.974] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x9e0, lpOverlapped=0x0) returned 1 [0146.974] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.974] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xab4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.974] SetEndOfFile (hFile=0xdc) returned 1 [0146.976] GetProcessHeap () returned 0x4e0000 [0146.976] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.976] GetProcessHeap () returned 0x4e0000 [0146.976] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.976] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.976] CloseHandle (hObject=0xdc) returned 1 [0146.977] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bf93000, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4bf93000, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x914, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01586_.WMF", cAlternateFileName="")) returned 1 [0146.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.977] GetProcessHeap () returned 0x4e0000 [0146.977] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.977] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.977] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.977] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0146.979] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.979] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.979] GetProcessHeap () returned 0x4e0000 [0146.979] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.979] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.979] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.979] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.979] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.979] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.979] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.979] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.979] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.979] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.979] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.979] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.979] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x914, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x914, lpOverlapped=0x0) returned 1 [0146.979] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x920, dwBufLen=0x920 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x920) returned 1 [0146.979] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.979] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x920, lpOverlapped=0x0) returned 1 [0146.979] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.980] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x9f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.980] SetEndOfFile (hFile=0xdc) returned 1 [0146.982] GetProcessHeap () returned 0x4e0000 [0146.982] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.982] GetProcessHeap () returned 0x4e0000 [0146.982] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.982] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.982] CloseHandle (hObject=0xdc) returned 1 [0146.982] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf28f0200, ftCreationTime.dwHighDateTime=0x1bd4bee, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf28f0200, ftLastWriteTime.dwHighDateTime=0x1bd4bee, nFileSizeHigh=0x0, nFileSizeLow=0x4a7c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01628_.WMF", cAlternateFileName="")) returned 1 [0146.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.983] GetProcessHeap () returned 0x4e0000 [0146.983] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.983] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.983] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.983] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.986] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.986] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.986] GetProcessHeap () returned 0x4e0000 [0146.986] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.986] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.986] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.986] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.986] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.986] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.986] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.986] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.986] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.986] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.987] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.987] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.987] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4a7c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4a7c, lpOverlapped=0x0) returned 1 [0146.988] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4a80, dwBufLen=0x4a80 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4a80) returned 1 [0146.988] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.988] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4a80, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4a80, lpOverlapped=0x0) returned 1 [0146.988] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.988] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4b54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.988] SetEndOfFile (hFile=0xdc) returned 1 [0146.990] GetProcessHeap () returned 0x4e0000 [0146.990] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.990] GetProcessHeap () returned 0x4e0000 [0146.990] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.990] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.991] CloseHandle (hObject=0xdc) returned 1 [0146.991] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa241400, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaa241400, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01629_.WMF", cAlternateFileName="")) returned 1 [0146.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.991] GetProcessHeap () returned 0x4e0000 [0146.991] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.992] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.992] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.992] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0146.993] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.993] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.993] GetProcessHeap () returned 0x4e0000 [0146.993] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0146.993] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0146.993] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.993] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0146.993] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0146.993] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0146.993] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0146.993] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0146.993] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0146.994] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0146.994] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0146.994] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.994] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x244, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x244, lpOverlapped=0x0) returned 1 [0146.994] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x250, dwBufLen=0x250 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x250) returned 1 [0146.994] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.994] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x250, lpOverlapped=0x0) returned 1 [0146.994] CryptDestroyKey (hKey=0x522f98) returned 1 [0146.994] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x324, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.994] SetEndOfFile (hFile=0xdc) returned 1 [0146.996] GetProcessHeap () returned 0x4e0000 [0146.996] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0146.996] GetProcessHeap () returned 0x4e0000 [0146.996] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0146.996] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0146.997] CloseHandle (hObject=0xdc) returned 1 [0146.997] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef951100, ftCreationTime.dwHighDateTime=0x1bd4bf0, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xef951100, ftLastWriteTime.dwHighDateTime=0x1bd4bf0, nFileSizeHigh=0x0, nFileSizeLow=0x128, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01630_.WMF", cAlternateFileName="")) returned 1 [0146.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0146.999] GetProcessHeap () returned 0x4e0000 [0146.999] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0146.999] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0146.999] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0146.999] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.000] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.001] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.001] GetProcessHeap () returned 0x4e0000 [0147.001] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.001] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.001] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.001] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.001] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.001] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.001] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.001] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.001] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.001] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.001] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.002] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.002] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x128, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x128, lpOverlapped=0x0) returned 1 [0147.002] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x130, dwBufLen=0x130 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x130) returned 1 [0147.002] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.002] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x130, lpOverlapped=0x0) returned 1 [0147.002] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.002] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.002] SetEndOfFile (hFile=0xdc) returned 1 [0147.005] GetProcessHeap () returned 0x4e0000 [0147.005] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.005] GetProcessHeap () returned 0x4e0000 [0147.005] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.005] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.007] CloseHandle (hObject=0xdc) returned 1 [0147.007] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8660ce00, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8660ce00, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01631_.WMF", cAlternateFileName="")) returned 1 [0147.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.008] GetProcessHeap () returned 0x4e0000 [0147.008] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.008] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.008] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.008] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.010] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.010] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.010] GetProcessHeap () returned 0x4e0000 [0147.010] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.010] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.010] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.010] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.010] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.010] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.010] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.011] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.011] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.011] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.011] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.011] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.011] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x228, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x228, lpOverlapped=0x0) returned 1 [0147.011] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x230, dwBufLen=0x230 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x230) returned 1 [0147.011] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.011] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x230, lpOverlapped=0x0) returned 1 [0147.011] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.011] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x304, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.011] SetEndOfFile (hFile=0xdc) returned 1 [0147.014] GetProcessHeap () returned 0x4e0000 [0147.014] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.014] GetProcessHeap () returned 0x4e0000 [0147.014] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.014] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.015] CloseHandle (hObject=0xdc) returned 1 [0147.015] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1034, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01761_.WMF", cAlternateFileName="")) returned 1 [0147.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.016] GetProcessHeap () returned 0x4e0000 [0147.016] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.016] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.016] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.016] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0147.018] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.018] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.018] GetProcessHeap () returned 0x4e0000 [0147.019] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.019] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.019] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.019] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.019] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.019] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.019] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.019] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.019] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.019] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.019] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.019] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.019] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1034, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1034, lpOverlapped=0x0) returned 1 [0147.020] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1040, dwBufLen=0x1040 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1040) returned 1 [0147.020] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.021] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1040, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1040, lpOverlapped=0x0) returned 1 [0147.021] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.021] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1114, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.021] SetEndOfFile (hFile=0xdc) returned 1 [0147.023] GetProcessHeap () returned 0x4e0000 [0147.024] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.024] GetProcessHeap () returned 0x4e0000 [0147.024] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.024] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.025] CloseHandle (hObject=0xdc) returned 1 [0147.025] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8fc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01772_.WMF", cAlternateFileName="")) returned 1 [0147.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.026] GetProcessHeap () returned 0x4e0000 [0147.026] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.026] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.026] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.026] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.032] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.032] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.032] GetProcessHeap () returned 0x4e0000 [0147.032] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.032] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.032] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.032] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.032] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.032] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.033] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.033] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.033] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.033] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.033] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.033] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.033] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x8fc, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x8fc, lpOverlapped=0x0) returned 1 [0147.033] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x900, dwBufLen=0x900 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x900) returned 1 [0147.033] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.033] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x900, lpOverlapped=0x0) returned 1 [0147.033] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.033] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x9d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.033] SetEndOfFile (hFile=0xdc) returned 1 [0147.036] GetProcessHeap () returned 0x4e0000 [0147.036] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.036] GetProcessHeap () returned 0x4e0000 [0147.036] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.036] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.037] CloseHandle (hObject=0xdc) returned 1 [0147.038] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xcb4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01793_.WMF", cAlternateFileName="")) returned 1 [0147.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.038] GetProcessHeap () returned 0x4e0000 [0147.038] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.038] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.038] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.038] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0147.040] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.040] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.040] GetProcessHeap () returned 0x4e0000 [0147.040] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.040] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.041] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.041] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.041] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.041] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.041] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.041] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.041] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.041] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.041] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.041] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.041] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xcb4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xcb4, lpOverlapped=0x0) returned 1 [0147.041] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xcc0, dwBufLen=0xcc0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xcc0) returned 1 [0147.041] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.042] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xcc0, lpOverlapped=0x0) returned 1 [0147.042] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.042] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xd94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.042] SetEndOfFile (hFile=0xdc) returned 1 [0147.045] GetProcessHeap () returned 0x4e0000 [0147.045] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.045] GetProcessHeap () returned 0x4e0000 [0147.045] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.045] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.046] CloseHandle (hObject=0xdc) returned 1 [0147.046] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x51e3fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1815, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EAST_01.MID", cAlternateFileName="")) returned 1 [0147.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.046] GetProcessHeap () returned 0x4e0000 [0147.046] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.046] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.046] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.047] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xb, lpOverlapped=0x0) returned 1 [0147.049] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.049] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.049] GetProcessHeap () returned 0x4e0000 [0147.049] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.049] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.049] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.049] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.049] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.049] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.049] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.049] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.049] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.049] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.049] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.050] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.050] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1815, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1815, lpOverlapped=0x0) returned 1 [0147.050] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1820, dwBufLen=0x1820 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1820) returned 1 [0147.050] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.051] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1820, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1820, lpOverlapped=0x0) returned 1 [0147.051] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.051] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x18f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.051] SetEndOfFile (hFile=0xdc) returned 1 [0147.053] GetProcessHeap () returned 0x4e0000 [0147.053] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.053] GetProcessHeap () returned 0x4e0000 [0147.053] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.053] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.054] CloseHandle (hObject=0xdc) returned 1 [0147.054] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd787d00, ftCreationTime.dwHighDateTime=0x1bd4ae1, ftLastAccessTime.dwLowDateTime=0x51f4a830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd787d00, ftLastWriteTime.dwHighDateTime=0x1bd4ae1, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ED00010_.WMF", cAlternateFileName="")) returned 1 [0147.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.054] GetProcessHeap () returned 0x4e0000 [0147.054] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.054] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.054] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.055] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0147.057] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.057] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.057] GetProcessHeap () returned 0x4e0000 [0147.057] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.057] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.057] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.057] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.057] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.057] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.057] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.057] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.057] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.057] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.057] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.057] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.057] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x566, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x566, lpOverlapped=0x0) returned 1 [0147.057] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x570, dwBufLen=0x570 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x570) returned 1 [0147.057] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.057] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x570, lpOverlapped=0x0) returned 1 [0147.058] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.058] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x644, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.058] SetEndOfFile (hFile=0xdc) returned 1 [0147.060] GetProcessHeap () returned 0x4e0000 [0147.060] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.060] GetProcessHeap () returned 0x4e0000 [0147.060] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.060] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.061] CloseHandle (hObject=0xdc) returned 1 [0147.061] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a81c00, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x51f4a830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2a81c00, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x32f2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ED00019_.WMF", cAlternateFileName="")) returned 1 [0147.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.061] GetProcessHeap () returned 0x4e0000 [0147.061] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.061] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.061] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.061] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0147.063] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.063] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.063] GetProcessHeap () returned 0x4e0000 [0147.063] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.063] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.063] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.063] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.063] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.063] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.064] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.064] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.064] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.064] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.064] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.064] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.064] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x32f2, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x32f2, lpOverlapped=0x0) returned 1 [0147.065] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3300, dwBufLen=0x3300 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3300) returned 1 [0147.065] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.065] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3300, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3300, lpOverlapped=0x0) returned 1 [0147.065] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.065] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x33d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.065] SetEndOfFile (hFile=0xdc) returned 1 [0147.067] GetProcessHeap () returned 0x4e0000 [0147.067] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.067] GetProcessHeap () returned 0x4e0000 [0147.067] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.067] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.068] CloseHandle (hObject=0xdc) returned 1 [0147.068] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc465ee00, ftCreationTime.dwHighDateTime=0x1bd4bff, ftLastAccessTime.dwLowDateTime=0x608b7590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc465ee00, ftLastWriteTime.dwHighDateTime=0x1bd4bff, nFileSizeHigh=0x0, nFileSizeLow=0xa8c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ED00172_.WMF", cAlternateFileName="")) returned 1 [0147.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.069] GetProcessHeap () returned 0x4e0000 [0147.069] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.069] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.069] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.069] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.071] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.071] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.071] GetProcessHeap () returned 0x4e0000 [0147.071] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.071] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.071] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.071] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.071] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.071] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.071] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.071] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.071] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.071] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.071] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.071] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.071] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xa8c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xa8c, lpOverlapped=0x0) returned 1 [0147.071] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa90, dwBufLen=0xa90 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa90) returned 1 [0147.071] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.071] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xa90, lpOverlapped=0x0) returned 1 [0147.072] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.072] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xb64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.072] SetEndOfFile (hFile=0xdc) returned 1 [0147.074] GetProcessHeap () returned 0x4e0000 [0147.074] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.074] GetProcessHeap () returned 0x4e0000 [0147.074] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.074] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.077] CloseHandle (hObject=0xdc) returned 1 [0147.077] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95cb3000, ftCreationTime.dwHighDateTime=0x1bd4c5e, ftLastAccessTime.dwLowDateTime=0x51f70990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95cb3000, ftLastWriteTime.dwHighDateTime=0x1bd4c5e, nFileSizeHigh=0x0, nFileSizeLow=0x1b2e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ED00184_.WMF", cAlternateFileName="")) returned 1 [0147.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.078] GetProcessHeap () returned 0x4e0000 [0147.078] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.078] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.078] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.078] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0147.079] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.079] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.079] GetProcessHeap () returned 0x4e0000 [0147.080] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.080] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.080] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.080] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.080] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.080] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.080] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.080] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.080] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.080] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.080] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.080] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.080] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1b2e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1b2e, lpOverlapped=0x0) returned 1 [0147.081] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1b30, dwBufLen=0x1b30 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1b30) returned 1 [0147.081] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.081] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1b30, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1b30, lpOverlapped=0x0) returned 1 [0147.081] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.081] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1c04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.081] SetEndOfFile (hFile=0xdc) returned 1 [0147.083] GetProcessHeap () returned 0x4e0000 [0147.083] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.083] GetProcessHeap () returned 0x4e0000 [0147.083] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.083] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.084] CloseHandle (hObject=0xdc) returned 1 [0147.084] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d81900, ftCreationTime.dwHighDateTime=0x1bd4b37, ftLastAccessTime.dwLowDateTime=0x609299b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x27d81900, ftLastWriteTime.dwHighDateTime=0x1bd4b37, nFileSizeHigh=0x0, nFileSizeLow=0x3670, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EN00006_.WMF", cAlternateFileName="")) returned 1 [0147.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.086] GetProcessHeap () returned 0x4e0000 [0147.086] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.086] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.086] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.086] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.086] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.086] GetProcessHeap () returned 0x4e0000 [0147.086] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.086] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.086] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.086] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.087] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.088] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.088] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.088] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.088] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.088] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.088] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.088] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.088] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3670, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3670, lpOverlapped=0x0) returned 1 [0147.089] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3670, dwBufLen=0x3670 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3670) returned 1 [0147.089] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.089] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3670, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3670, lpOverlapped=0x0) returned 1 [0147.089] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.089] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3744, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.089] SetEndOfFile (hFile=0xdc) returned 1 [0147.091] GetProcessHeap () returned 0x4e0000 [0147.091] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.091] GetProcessHeap () returned 0x4e0000 [0147.091] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.091] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.093] CloseHandle (hObject=0xdc) returned 1 [0147.093] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57852200, ftCreationTime.dwHighDateTime=0x1bd4b33, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x57852200, ftLastWriteTime.dwHighDateTime=0x1bd4b33, nFileSizeHigh=0x0, nFileSizeLow=0x1b1a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EN00202_.WMF", cAlternateFileName="")) returned 1 [0147.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.096] GetProcessHeap () returned 0x4e0000 [0147.096] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.096] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.096] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.096] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0147.098] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.098] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.098] GetProcessHeap () returned 0x4e0000 [0147.098] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.098] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.098] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.098] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.098] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.098] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.098] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.098] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.098] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.099] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.099] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.099] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.099] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1b1a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1b1a, lpOverlapped=0x0) returned 1 [0147.099] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1b20, dwBufLen=0x1b20 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1b20) returned 1 [0147.099] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.099] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1b20, lpOverlapped=0x0) returned 1 [0147.100] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.100] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1bf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.100] SetEndOfFile (hFile=0xdc) returned 1 [0147.102] GetProcessHeap () returned 0x4e0000 [0147.102] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.102] GetProcessHeap () returned 0x4e0000 [0147.102] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.102] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.103] CloseHandle (hObject=0xdc) returned 1 [0147.103] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7a68a00, ftCreationTime.dwHighDateTime=0x1bd4b29, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd7a68a00, ftLastWriteTime.dwHighDateTime=0x1bd4b29, nFileSizeHigh=0x0, nFileSizeLow=0x3044, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EN00222_.WMF", cAlternateFileName="")) returned 1 [0147.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.103] GetProcessHeap () returned 0x4e0000 [0147.103] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.103] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.103] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.103] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0147.105] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.105] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.105] GetProcessHeap () returned 0x4e0000 [0147.105] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.105] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.105] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.105] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.105] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.105] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.105] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.105] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.106] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.106] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.106] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.106] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.106] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3044, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3044, lpOverlapped=0x0) returned 1 [0147.107] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3050, dwBufLen=0x3050 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3050) returned 1 [0147.107] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.107] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3050, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3050, lpOverlapped=0x0) returned 1 [0147.107] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.107] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3124, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.107] SetEndOfFile (hFile=0xdc) returned 1 [0147.109] GetProcessHeap () returned 0x4e0000 [0147.109] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.109] GetProcessHeap () returned 0x4e0000 [0147.109] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.109] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.110] CloseHandle (hObject=0xdc) returned 1 [0147.110] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1dc9900, ftCreationTime.dwHighDateTime=0x1bd4b18, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1dc9900, ftLastWriteTime.dwHighDateTime=0x1bd4b18, nFileSizeHigh=0x0, nFileSizeLow=0x1a7c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EN00242_.WMF", cAlternateFileName="")) returned 1 [0147.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.111] GetProcessHeap () returned 0x4e0000 [0147.111] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.111] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.111] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.111] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.113] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.113] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.113] GetProcessHeap () returned 0x4e0000 [0147.113] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.113] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.113] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.113] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.113] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.113] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.113] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.113] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.114] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.114] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.114] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.114] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.114] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1a7c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1a7c, lpOverlapped=0x0) returned 1 [0147.115] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1a80, dwBufLen=0x1a80 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1a80) returned 1 [0147.115] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.115] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1a80, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1a80, lpOverlapped=0x0) returned 1 [0147.115] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.115] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1b54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.115] SetEndOfFile (hFile=0xdc) returned 1 [0147.117] GetProcessHeap () returned 0x4e0000 [0147.117] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.117] GetProcessHeap () returned 0x4e0000 [0147.117] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.117] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.118] CloseHandle (hObject=0xdc) returned 1 [0147.118] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7ec7300, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7ec7300, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x8e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EN00319_.WMF", cAlternateFileName="")) returned 1 [0147.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.118] GetProcessHeap () returned 0x4e0000 [0147.118] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.118] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.118] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.118] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.120] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.120] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.120] GetProcessHeap () returned 0x4e0000 [0147.120] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.120] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.120] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.120] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.120] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.120] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.120] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.121] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.121] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.121] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.121] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.121] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.121] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x8e8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x8e8, lpOverlapped=0x0) returned 1 [0147.121] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8f0, dwBufLen=0x8f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8f0) returned 1 [0147.121] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.121] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x8f0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x8f0, lpOverlapped=0x0) returned 1 [0147.121] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.121] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x9c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.121] SetEndOfFile (hFile=0xdc) returned 1 [0147.123] GetProcessHeap () returned 0x4e0000 [0147.123] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.123] GetProcessHeap () returned 0x4e0000 [0147.123] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.123] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.124] CloseHandle (hObject=0xdc) returned 1 [0147.124] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24bc3900, ftCreationTime.dwHighDateTime=0x1bd4af5, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x24bc3900, ftLastWriteTime.dwHighDateTime=0x1bd4af5, nFileSizeHigh=0x0, nFileSizeLow=0x2e0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EN00320_.WMF", cAlternateFileName="")) returned 1 [0147.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.124] GetProcessHeap () returned 0x4e0000 [0147.124] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.124] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.125] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.125] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.125] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.125] GetProcessHeap () returned 0x4e0000 [0147.125] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.125] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.125] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.125] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.126] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.126] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.127] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.127] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.127] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.127] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.127] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.127] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.127] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2e0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2e0, lpOverlapped=0x0) returned 1 [0147.127] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2e0) returned 1 [0147.127] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.127] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2e0, lpOverlapped=0x0) returned 1 [0147.127] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.127] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.127] SetEndOfFile (hFile=0xdc) returned 1 [0147.132] GetProcessHeap () returned 0x4e0000 [0147.132] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.132] GetProcessHeap () returned 0x4e0000 [0147.132] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.132] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.132] CloseHandle (hObject=0xdc) returned 1 [0147.132] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1131c200, ftCreationTime.dwHighDateTime=0x1bd4b37, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1131c200, ftLastWriteTime.dwHighDateTime=0x1bd4b37, nFileSizeHigh=0x0, nFileSizeLow=0x439c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EN00397_.WMF", cAlternateFileName="")) returned 1 [0147.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.133] GetProcessHeap () returned 0x4e0000 [0147.133] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.133] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.133] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.133] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.135] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.135] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.135] GetProcessHeap () returned 0x4e0000 [0147.135] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.135] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.135] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.135] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.135] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.136] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.136] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.136] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.136] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.136] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.136] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.136] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.136] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x439c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x439c, lpOverlapped=0x0) returned 1 [0147.137] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x43a0, dwBufLen=0x43a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x43a0) returned 1 [0147.137] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.137] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x43a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x43a0, lpOverlapped=0x0) returned 1 [0147.137] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.137] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.137] SetEndOfFile (hFile=0xdc) returned 1 [0147.139] GetProcessHeap () returned 0x4e0000 [0147.139] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.139] GetProcessHeap () returned 0x4e0000 [0147.139] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.140] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.140] CloseHandle (hObject=0xdc) returned 1 [0147.140] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51904f00, ftCreationTime.dwHighDateTime=0x1bd4bce, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51904f00, ftLastWriteTime.dwHighDateTime=0x1bd4bce, nFileSizeHigh=0x0, nFileSizeLow=0x1f08, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EN00902_.WMF", cAlternateFileName="")) returned 1 [0147.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.141] GetProcessHeap () returned 0x4e0000 [0147.141] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.141] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.141] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.141] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.143] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.143] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.143] GetProcessHeap () returned 0x4e0000 [0147.143] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.143] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.143] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.143] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.143] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.143] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.143] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.143] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.143] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.144] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.144] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.144] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.144] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1f08, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1f08, lpOverlapped=0x0) returned 1 [0147.144] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1f10, dwBufLen=0x1f10 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1f10) returned 1 [0147.145] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.145] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1f10, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1f10, lpOverlapped=0x0) returned 1 [0147.145] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.145] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1fe4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.145] SetEndOfFile (hFile=0xdc) returned 1 [0147.147] GetProcessHeap () returned 0x4e0000 [0147.147] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.147] GetProcessHeap () returned 0x4e0000 [0147.147] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.147] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.148] CloseHandle (hObject=0xdc) returned 1 [0147.148] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2942, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EXPLR_01.MID", cAlternateFileName="")) returned 1 [0147.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.148] GetProcessHeap () returned 0x4e0000 [0147.148] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.148] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.148] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.148] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0147.150] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.150] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.150] GetProcessHeap () returned 0x4e0000 [0147.150] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.150] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.150] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.150] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.150] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.150] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.150] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.150] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.150] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.150] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.150] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.150] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.150] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2942, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2942, lpOverlapped=0x0) returned 1 [0147.151] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2950, dwBufLen=0x2950 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2950) returned 1 [0147.151] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.151] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2950, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2950, lpOverlapped=0x0) returned 1 [0147.151] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.151] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2a24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.151] SetEndOfFile (hFile=0xdc) returned 1 [0147.153] GetProcessHeap () returned 0x4e0000 [0147.153] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.153] GetProcessHeap () returned 0x4e0000 [0147.153] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.154] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.154] CloseHandle (hObject=0xdc) returned 1 [0147.154] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x12ee, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FALL_01.MID", cAlternateFileName="")) returned 1 [0147.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.155] GetProcessHeap () returned 0x4e0000 [0147.155] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.155] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.155] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.155] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0147.157] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.157] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.157] GetProcessHeap () returned 0x4e0000 [0147.157] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.157] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.157] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.157] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.157] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.157] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.158] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.158] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.158] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.158] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.158] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.158] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.158] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x12ee, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x12ee, lpOverlapped=0x0) returned 1 [0147.161] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x12f0, dwBufLen=0x12f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x12f0) returned 1 [0147.162] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.162] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x12f0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x12f0, lpOverlapped=0x0) returned 1 [0147.162] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.162] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x13c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.162] SetEndOfFile (hFile=0xdc) returned 1 [0147.164] GetProcessHeap () returned 0x4e0000 [0147.164] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.164] GetProcessHeap () returned 0x4e0000 [0147.164] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.164] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.165] CloseHandle (hObject=0xdc) returned 1 [0147.165] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadef6200, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xadef6200, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x45ba, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00074_.WMF", cAlternateFileName="")) returned 1 [0147.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.165] GetProcessHeap () returned 0x4e0000 [0147.165] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.165] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.165] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.166] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0147.167] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.167] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.167] GetProcessHeap () returned 0x4e0000 [0147.167] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.167] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.167] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.167] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.167] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.168] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.168] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.168] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.168] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.168] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.168] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.168] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.168] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x45ba, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x45ba, lpOverlapped=0x0) returned 1 [0147.169] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x45c0, dwBufLen=0x45c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x45c0) returned 1 [0147.169] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.169] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x45c0, lpOverlapped=0x0) returned 1 [0147.169] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.169] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.169] SetEndOfFile (hFile=0xdc) returned 1 [0147.171] GetProcessHeap () returned 0x4e0000 [0147.171] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.171] GetProcessHeap () returned 0x4e0000 [0147.171] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.172] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.172] CloseHandle (hObject=0xdc) returned 1 [0147.172] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa5bdb00, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaa5bdb00, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x2eda, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00076_.WMF", cAlternateFileName="")) returned 1 [0147.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.173] GetProcessHeap () returned 0x4e0000 [0147.173] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.173] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.173] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.173] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0147.175] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.175] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.175] GetProcessHeap () returned 0x4e0000 [0147.175] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.175] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.175] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.175] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.175] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.175] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.175] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.176] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.176] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.176] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.176] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.176] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.176] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2eda, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2eda, lpOverlapped=0x0) returned 1 [0147.177] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2ee0, dwBufLen=0x2ee0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2ee0) returned 1 [0147.177] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.177] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2ee0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2ee0, lpOverlapped=0x0) returned 1 [0147.177] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.177] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2fb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.177] SetEndOfFile (hFile=0xdc) returned 1 [0147.179] GetProcessHeap () returned 0x4e0000 [0147.179] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.179] GetProcessHeap () returned 0x4e0000 [0147.179] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.179] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.180] CloseHandle (hObject=0xdc) returned 1 [0147.180] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6bb4600, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb6bb4600, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x7620, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00077_.WMF", cAlternateFileName="")) returned 1 [0147.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.181] GetProcessHeap () returned 0x4e0000 [0147.181] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.181] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.181] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.181] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.181] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.181] GetProcessHeap () returned 0x4e0000 [0147.181] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.181] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.181] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.181] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.183] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.183] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.183] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.183] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.183] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.183] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.183] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.183] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.183] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7620, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7620, lpOverlapped=0x0) returned 1 [0147.184] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7620, dwBufLen=0x7620 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7620) returned 1 [0147.185] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.185] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7620, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7620, lpOverlapped=0x0) returned 1 [0147.185] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.185] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x76f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.185] SetEndOfFile (hFile=0xdc) returned 1 [0147.187] GetProcessHeap () returned 0x4e0000 [0147.187] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.187] GetProcessHeap () returned 0x4e0000 [0147.187] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.187] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.188] CloseHandle (hObject=0xdc) returned 1 [0147.188] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb58a1900, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb58a1900, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x721c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00086_.WMF", cAlternateFileName="")) returned 1 [0147.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.188] GetProcessHeap () returned 0x4e0000 [0147.188] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.188] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.188] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.188] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.190] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.190] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.190] GetProcessHeap () returned 0x4e0000 [0147.190] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.190] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.190] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.190] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.190] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.190] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.190] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.191] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.191] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.191] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.191] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.191] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.191] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x721c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x721c, lpOverlapped=0x0) returned 1 [0147.192] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7220, dwBufLen=0x7220 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7220) returned 1 [0147.192] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.192] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7220, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7220, lpOverlapped=0x0) returned 1 [0147.192] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.192] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x72f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.192] SetEndOfFile (hFile=0xdc) returned 1 [0147.194] GetProcessHeap () returned 0x4e0000 [0147.195] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.195] GetProcessHeap () returned 0x4e0000 [0147.195] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.195] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.195] CloseHandle (hObject=0xdc) returned 1 [0147.195] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a2c1c00, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a2c1c00, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x3772, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00090_.WMF", cAlternateFileName="")) returned 1 [0147.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.196] GetProcessHeap () returned 0x4e0000 [0147.196] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.196] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.196] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.196] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0147.197] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.197] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.197] GetProcessHeap () returned 0x4e0000 [0147.197] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.197] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.197] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.198] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.198] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.198] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.198] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.198] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.198] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.198] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.198] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.198] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.198] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3772, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3772, lpOverlapped=0x0) returned 1 [0147.199] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3780, dwBufLen=0x3780 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3780) returned 1 [0147.199] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.199] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3780, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3780, lpOverlapped=0x0) returned 1 [0147.199] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.199] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3854, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.199] SetEndOfFile (hFile=0xdc) returned 1 [0147.201] GetProcessHeap () returned 0x4e0000 [0147.201] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.201] GetProcessHeap () returned 0x4e0000 [0147.201] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.202] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.202] CloseHandle (hObject=0xdc) returned 1 [0147.202] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb458ec00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb458ec00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x920e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00096_.WMF", cAlternateFileName="")) returned 1 [0147.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.203] GetProcessHeap () returned 0x4e0000 [0147.203] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.203] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.203] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.203] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0147.205] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.205] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.205] GetProcessHeap () returned 0x4e0000 [0147.205] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.205] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.205] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.205] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.205] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.205] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.205] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.205] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.205] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.205] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.205] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.205] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.205] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x920e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x920e, lpOverlapped=0x0) returned 1 [0147.206] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9210, dwBufLen=0x9210 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9210) returned 1 [0147.207] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.207] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x9210, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x9210, lpOverlapped=0x0) returned 1 [0147.207] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.207] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x92e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.207] SetEndOfFile (hFile=0xdc) returned 1 [0147.209] GetProcessHeap () returned 0x4e0000 [0147.209] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.209] GetProcessHeap () returned 0x4e0000 [0147.209] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.209] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.210] CloseHandle (hObject=0xdc) returned 1 [0147.210] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1f69200, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb1f69200, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x3df0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00296_.WMF", cAlternateFileName="")) returned 1 [0147.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.210] GetProcessHeap () returned 0x4e0000 [0147.210] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.210] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.210] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.210] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.210] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.210] GetProcessHeap () returned 0x4e0000 [0147.210] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.210] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.211] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.211] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.212] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.212] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.212] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.212] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.212] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.213] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.213] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.213] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.213] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3df0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3df0, lpOverlapped=0x0) returned 1 [0147.214] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3df0, dwBufLen=0x3df0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3df0) returned 1 [0147.214] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.214] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3df0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3df0, lpOverlapped=0x0) returned 1 [0147.214] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.214] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3ec4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.214] SetEndOfFile (hFile=0xdc) returned 1 [0147.216] GetProcessHeap () returned 0x4e0000 [0147.216] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.216] GetProcessHeap () returned 0x4e0000 [0147.216] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.216] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.217] CloseHandle (hObject=0xdc) returned 1 [0147.217] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54b40e00, ftCreationTime.dwHighDateTime=0x1bd4aee, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54b40e00, ftLastWriteTime.dwHighDateTime=0x1bd4aee, nFileSizeHigh=0x0, nFileSizeLow=0x4712, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00297_.WMF", cAlternateFileName="")) returned 1 [0147.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.218] GetProcessHeap () returned 0x4e0000 [0147.218] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.218] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.218] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.218] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0147.220] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.220] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.220] GetProcessHeap () returned 0x4e0000 [0147.220] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.220] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.220] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.220] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.220] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.220] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.220] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.220] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.221] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.221] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.221] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.221] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.221] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4712, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4712, lpOverlapped=0x0) returned 1 [0147.222] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4720, dwBufLen=0x4720 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4720) returned 1 [0147.222] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.222] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4720, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4720, lpOverlapped=0x0) returned 1 [0147.222] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.222] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x47f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.222] SetEndOfFile (hFile=0xdc) returned 1 [0147.224] GetProcessHeap () returned 0x4e0000 [0147.224] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.224] GetProcessHeap () returned 0x4e0000 [0147.224] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.224] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.225] CloseHandle (hObject=0xdc) returned 1 [0147.225] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c56500, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0c56500, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xb6de, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00306_.WMF", cAlternateFileName="")) returned 1 [0147.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.225] GetProcessHeap () returned 0x4e0000 [0147.225] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.225] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.225] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.225] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0147.229] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.229] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.229] GetProcessHeap () returned 0x4e0000 [0147.229] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.229] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.229] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.229] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.229] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.229] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.229] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.229] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.229] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.229] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.230] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.230] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.230] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb6de, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xb6de, lpOverlapped=0x0) returned 1 [0147.231] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xb6e0, dwBufLen=0xb6e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xb6e0) returned 1 [0147.231] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.231] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xb6e0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xb6e0, lpOverlapped=0x0) returned 1 [0147.231] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.231] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xb7b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.231] SetEndOfFile (hFile=0xdc) returned 1 [0147.234] GetProcessHeap () returned 0x4e0000 [0147.234] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.234] GetProcessHeap () returned 0x4e0000 [0147.234] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.234] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.234] CloseHandle (hObject=0xdc) returned 1 [0147.235] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2c8c800, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2c8c800, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x17b4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00336_.WMF", cAlternateFileName="")) returned 1 [0147.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.235] GetProcessHeap () returned 0x4e0000 [0147.235] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.235] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.235] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.235] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0147.237] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.237] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.237] GetProcessHeap () returned 0x4e0000 [0147.237] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.237] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.237] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.237] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.238] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.238] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.238] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.238] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.238] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.238] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.238] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.238] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.238] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x17b4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x17b4, lpOverlapped=0x0) returned 1 [0147.239] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x17c0, dwBufLen=0x17c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x17c0) returned 1 [0147.239] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.239] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x17c0, lpOverlapped=0x0) returned 1 [0147.239] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.239] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1894, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.239] SetEndOfFile (hFile=0xdc) returned 1 [0147.241] GetProcessHeap () returned 0x4e0000 [0147.241] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.241] GetProcessHeap () returned 0x4e0000 [0147.241] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.241] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.242] CloseHandle (hObject=0xdc) returned 1 [0147.242] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf943800, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaf943800, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xfea, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00361_.WMF", cAlternateFileName="")) returned 1 [0147.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.242] GetProcessHeap () returned 0x4e0000 [0147.242] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.242] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.242] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.242] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0147.244] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.244] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.244] GetProcessHeap () returned 0x4e0000 [0147.244] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.244] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.244] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.244] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.245] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.245] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.245] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.245] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.245] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.245] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.245] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.245] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.245] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xfea, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xfea, lpOverlapped=0x0) returned 1 [0147.245] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xff0, dwBufLen=0xff0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xff0) returned 1 [0147.245] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.245] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xff0, lpOverlapped=0x0) returned 1 [0147.245] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.245] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x10c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.245] SetEndOfFile (hFile=0xdc) returned 1 [0147.247] GetProcessHeap () returned 0x4e0000 [0147.247] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.248] GetProcessHeap () returned 0x4e0000 [0147.248] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.248] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.249] CloseHandle (hObject=0xdc) returned 1 [0147.249] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb6bcf00, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfb6bcf00, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x2168, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00369_.WMF", cAlternateFileName="")) returned 1 [0147.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.249] GetProcessHeap () returned 0x4e0000 [0147.249] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.249] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.249] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.249] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.251] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.251] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.251] GetProcessHeap () returned 0x4e0000 [0147.251] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.251] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.251] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.251] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.251] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.251] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.251] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.251] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.251] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.251] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.251] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.251] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.252] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2168, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2168, lpOverlapped=0x0) returned 1 [0147.252] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2170, dwBufLen=0x2170 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2170) returned 1 [0147.253] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.253] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2170, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2170, lpOverlapped=0x0) returned 1 [0147.253] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.253] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2244, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.253] SetEndOfFile (hFile=0xdc) returned 1 [0147.255] GetProcessHeap () returned 0x4e0000 [0147.255] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.255] GetProcessHeap () returned 0x4e0000 [0147.255] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.255] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.255] CloseHandle (hObject=0xdc) returned 1 [0147.256] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcdfcc00, ftCreationTime.dwHighDateTime=0x1bd4b1a, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfcdfcc00, ftLastWriteTime.dwHighDateTime=0x1bd4b1a, nFileSizeHigh=0x0, nFileSizeLow=0x20e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00382_.WMF", cAlternateFileName="")) returned 1 [0147.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.256] GetProcessHeap () returned 0x4e0000 [0147.256] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.256] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.256] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.256] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.258] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.258] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.258] GetProcessHeap () returned 0x4e0000 [0147.258] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.258] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.258] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.258] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.258] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.258] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.258] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.258] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.258] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.258] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.258] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.258] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.259] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x20e8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x20e8, lpOverlapped=0x0) returned 1 [0147.259] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x20f0, dwBufLen=0x20f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x20f0) returned 1 [0147.259] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.259] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x20f0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x20f0, lpOverlapped=0x0) returned 1 [0147.260] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.260] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x21c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.260] SetEndOfFile (hFile=0xdc) returned 1 [0147.262] GetProcessHeap () returned 0x4e0000 [0147.262] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.262] GetProcessHeap () returned 0x4e0000 [0147.262] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.262] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.262] CloseHandle (hObject=0xdc) returned 1 [0147.263] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae630b00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae630b00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x2a40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00397_.WMF", cAlternateFileName="")) returned 1 [0147.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.263] GetProcessHeap () returned 0x4e0000 [0147.263] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.263] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.263] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.263] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.263] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.263] GetProcessHeap () returned 0x4e0000 [0147.263] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.263] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.263] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.263] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.265] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.265] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.265] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.265] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.265] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.265] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.265] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.265] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.265] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2a40, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2a40, lpOverlapped=0x0) returned 1 [0147.266] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2a40, dwBufLen=0x2a40 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2a40) returned 1 [0147.266] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.267] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2a40, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2a40, lpOverlapped=0x0) returned 1 [0147.267] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.267] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2b14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.267] SetEndOfFile (hFile=0xdc) returned 1 [0147.269] GetProcessHeap () returned 0x4e0000 [0147.269] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.269] GetProcessHeap () returned 0x4e0000 [0147.269] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.269] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.269] CloseHandle (hObject=0xdc) returned 1 [0147.269] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad31de00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad31de00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1ec6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00403_.WMF", cAlternateFileName="")) returned 1 [0147.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.271] GetProcessHeap () returned 0x4e0000 [0147.271] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.271] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.271] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.271] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0147.273] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.273] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.273] GetProcessHeap () returned 0x4e0000 [0147.273] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.273] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.273] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.273] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.273] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.273] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.273] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.274] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.274] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.274] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.274] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.274] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.274] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1ec6, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1ec6, lpOverlapped=0x0) returned 1 [0147.275] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1ed0, dwBufLen=0x1ed0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1ed0) returned 1 [0147.275] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.275] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1ed0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1ed0, lpOverlapped=0x0) returned 1 [0147.275] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.275] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1fa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.275] SetEndOfFile (hFile=0xdc) returned 1 [0147.277] GetProcessHeap () returned 0x4e0000 [0147.277] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.277] GetProcessHeap () returned 0x4e0000 [0147.277] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.277] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.278] CloseHandle (hObject=0xdc) returned 1 [0147.278] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac00b100, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac00b100, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x2afa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00414_.WMF", cAlternateFileName="")) returned 1 [0147.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.279] GetProcessHeap () returned 0x4e0000 [0147.279] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.279] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.279] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.279] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0147.281] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.281] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.281] GetProcessHeap () returned 0x4e0000 [0147.281] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.281] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.281] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.281] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.281] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.281] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.281] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.281] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.281] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.281] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.281] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.281] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.281] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2afa, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2afa, lpOverlapped=0x0) returned 1 [0147.282] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2b00, dwBufLen=0x2b00 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2b00) returned 1 [0147.282] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.282] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2b00, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2b00, lpOverlapped=0x0) returned 1 [0147.282] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.282] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2bd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.282] SetEndOfFile (hFile=0xdc) returned 1 [0147.284] GetProcessHeap () returned 0x4e0000 [0147.285] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.285] GetProcessHeap () returned 0x4e0000 [0147.285] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.285] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.285] CloseHandle (hObject=0xdc) returned 1 [0147.285] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaacf8400, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaacf8400, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x400c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00419_.WMF", cAlternateFileName="")) returned 1 [0147.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.286] GetProcessHeap () returned 0x4e0000 [0147.286] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.286] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.286] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.286] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.287] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.287] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.287] GetProcessHeap () returned 0x4e0000 [0147.287] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.287] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.287] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.288] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.288] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.288] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.288] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.288] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.288] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.288] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.288] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.288] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.288] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x400c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x400c, lpOverlapped=0x0) returned 1 [0147.289] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4010, dwBufLen=0x4010 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4010) returned 1 [0147.289] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.289] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4010, lpOverlapped=0x0) returned 1 [0147.289] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.289] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x40e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.289] SetEndOfFile (hFile=0xdc) returned 1 [0147.291] GetProcessHeap () returned 0x4e0000 [0147.291] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.292] GetProcessHeap () returned 0x4e0000 [0147.292] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.292] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.292] CloseHandle (hObject=0xdc) returned 1 [0147.292] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa86d2a00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa86d2a00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x12bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00428_.WMF", cAlternateFileName="")) returned 1 [0147.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.293] GetProcessHeap () returned 0x4e0000 [0147.293] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.293] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.293] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.293] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.294] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.294] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.294] GetProcessHeap () returned 0x4e0000 [0147.294] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.294] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.294] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.294] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.295] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.295] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.295] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.295] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.295] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.295] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.295] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.295] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.295] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x12bc, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x12bc, lpOverlapped=0x0) returned 1 [0147.296] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x12c0, dwBufLen=0x12c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x12c0) returned 1 [0147.296] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.296] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x12c0, lpOverlapped=0x0) returned 1 [0147.296] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.296] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1394, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.296] SetEndOfFile (hFile=0xdc) returned 1 [0147.298] GetProcessHeap () returned 0x4e0000 [0147.298] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.298] GetProcessHeap () returned 0x4e0000 [0147.298] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.298] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.299] CloseHandle (hObject=0xdc) returned 1 [0147.299] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa73bfd00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa73bfd00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x83c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00435_.WMF", cAlternateFileName="")) returned 1 [0147.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.300] GetProcessHeap () returned 0x4e0000 [0147.300] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.300] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.300] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.300] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.302] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.302] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.302] GetProcessHeap () returned 0x4e0000 [0147.302] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.302] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.302] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.302] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.302] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.302] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.302] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.302] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.302] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.302] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.302] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.302] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.302] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x83c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x83c, lpOverlapped=0x0) returned 1 [0147.302] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x840, dwBufLen=0x840 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x840) returned 1 [0147.302] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.303] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x840, lpOverlapped=0x0) returned 1 [0147.303] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.303] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x914, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.303] SetEndOfFile (hFile=0xdc) returned 1 [0147.305] GetProcessHeap () returned 0x4e0000 [0147.305] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.305] GetProcessHeap () returned 0x4e0000 [0147.305] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.305] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.305] CloseHandle (hObject=0xdc) returned 1 [0147.305] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa60ad000, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa60ad000, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x13ea, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00438_.WMF", cAlternateFileName="")) returned 1 [0147.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.306] GetProcessHeap () returned 0x4e0000 [0147.306] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.306] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.306] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.306] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0147.308] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.308] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.308] GetProcessHeap () returned 0x4e0000 [0147.308] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.308] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.308] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.308] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.308] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.308] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.308] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.308] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.308] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.308] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.308] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.308] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.308] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x13ea, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x13ea, lpOverlapped=0x0) returned 1 [0147.309] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x13f0, dwBufLen=0x13f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x13f0) returned 1 [0147.309] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.309] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x13f0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x13f0, lpOverlapped=0x0) returned 1 [0147.309] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.309] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x14c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.309] SetEndOfFile (hFile=0xdc) returned 1 [0147.311] GetProcessHeap () returned 0x4e0000 [0147.312] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.312] GetProcessHeap () returned 0x4e0000 [0147.312] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.312] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.312] CloseHandle (hObject=0xdc) returned 1 [0147.312] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4d9a300, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4d9a300, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x22de, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00455_.WMF", cAlternateFileName="")) returned 1 [0147.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.313] GetProcessHeap () returned 0x4e0000 [0147.313] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.313] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.313] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.313] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0147.314] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.315] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.315] GetProcessHeap () returned 0x4e0000 [0147.315] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.315] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.315] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.315] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.315] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.315] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.315] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.315] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.315] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.315] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.315] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.315] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.315] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x22de, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x22de, lpOverlapped=0x0) returned 1 [0147.316] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x22e0, dwBufLen=0x22e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x22e0) returned 1 [0147.316] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.316] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x22e0, lpOverlapped=0x0) returned 1 [0147.316] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.316] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x23b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.316] SetEndOfFile (hFile=0xdc) returned 1 [0147.318] GetProcessHeap () returned 0x4e0000 [0147.318] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.318] GetProcessHeap () returned 0x4e0000 [0147.318] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.319] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.319] CloseHandle (hObject=0xdc) returned 1 [0147.319] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3a87600, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3a87600, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x43fe, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00459_.WMF", cAlternateFileName="")) returned 1 [0147.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.319] GetProcessHeap () returned 0x4e0000 [0147.319] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.320] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.320] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.320] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0147.321] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.321] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.321] GetProcessHeap () returned 0x4e0000 [0147.322] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.322] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.322] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.322] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.322] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.322] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.322] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.322] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.322] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.322] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.322] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.322] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.322] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x43fe, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x43fe, lpOverlapped=0x0) returned 1 [0147.323] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4400, dwBufLen=0x4400 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4400) returned 1 [0147.323] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.323] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4400, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4400, lpOverlapped=0x0) returned 1 [0147.323] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.323] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x44d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.323] SetEndOfFile (hFile=0xdc) returned 1 [0147.326] GetProcessHeap () returned 0x4e0000 [0147.326] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.326] GetProcessHeap () returned 0x4e0000 [0147.326] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.326] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.326] CloseHandle (hObject=0xdc) returned 1 [0147.326] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2774900, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2774900, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x5c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00543_.WMF", cAlternateFileName="")) returned 1 [0147.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.327] GetProcessHeap () returned 0x4e0000 [0147.327] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.327] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.327] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.327] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.327] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.327] GetProcessHeap () returned 0x4e0000 [0147.327] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.327] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.327] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.327] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.329] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.329] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.329] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.329] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.329] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.329] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.329] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.329] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.329] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5c0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x5c0, lpOverlapped=0x0) returned 1 [0147.329] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5c0, dwBufLen=0x5c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5c0) returned 1 [0147.329] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.329] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5c0, lpOverlapped=0x0) returned 1 [0147.329] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.329] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.329] SetEndOfFile (hFile=0xdc) returned 1 [0147.331] GetProcessHeap () returned 0x4e0000 [0147.331] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.331] GetProcessHeap () returned 0x4e0000 [0147.331] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.331] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.332] CloseHandle (hObject=0xdc) returned 1 [0147.332] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf50d3100, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf50d3100, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0x148c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00544_.WMF", cAlternateFileName="")) returned 1 [0147.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.333] GetProcessHeap () returned 0x4e0000 [0147.333] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.333] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.333] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.333] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.335] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.335] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.335] GetProcessHeap () returned 0x4e0000 [0147.335] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.335] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.335] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.335] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.335] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.335] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.335] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.335] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.335] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.335] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.335] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.335] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.335] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x148c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x148c, lpOverlapped=0x0) returned 1 [0147.336] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1490, dwBufLen=0x1490 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1490) returned 1 [0147.336] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.336] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1490, lpOverlapped=0x0) returned 1 [0147.336] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.336] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1564, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.336] SetEndOfFile (hFile=0xdc) returned 1 [0147.338] GetProcessHeap () returned 0x4e0000 [0147.338] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.338] GetProcessHeap () returned 0x4e0000 [0147.338] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.338] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.339] CloseHandle (hObject=0xdc) returned 1 [0147.339] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecb4f600, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xecb4f600, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0x380, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00564_.WMF", cAlternateFileName="")) returned 1 [0147.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.340] GetProcessHeap () returned 0x4e0000 [0147.340] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.340] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.340] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.340] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.340] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.340] GetProcessHeap () returned 0x4e0000 [0147.340] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.340] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.340] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.340] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.342] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.342] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.342] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.342] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.342] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.342] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.342] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.342] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.342] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x380, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x380, lpOverlapped=0x0) returned 1 [0147.342] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x380, dwBufLen=0x380 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x380) returned 1 [0147.342] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.342] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x380, lpOverlapped=0x0) returned 1 [0147.343] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.343] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x454, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.343] SetEndOfFile (hFile=0xdc) returned 1 [0147.345] GetProcessHeap () returned 0x4e0000 [0147.345] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.345] GetProcessHeap () returned 0x4e0000 [0147.345] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.345] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.345] CloseHandle (hObject=0xdc) returned 1 [0147.345] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4dd7200, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4dd7200, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0x2f0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00586_.WMF", cAlternateFileName="")) returned 1 [0147.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.346] GetProcessHeap () returned 0x4e0000 [0147.346] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.346] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.346] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.346] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.346] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.346] GetProcessHeap () returned 0x4e0000 [0147.346] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.346] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.346] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.346] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.348] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.348] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.348] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.348] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.348] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.348] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.348] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.348] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.348] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2f0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2f0, lpOverlapped=0x0) returned 1 [0147.348] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2f0, dwBufLen=0x2f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2f0) returned 1 [0147.348] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.348] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2f0, lpOverlapped=0x0) returned 1 [0147.348] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.348] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.348] SetEndOfFile (hFile=0xdc) returned 1 [0147.350] GetProcessHeap () returned 0x4e0000 [0147.350] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.351] GetProcessHeap () returned 0x4e0000 [0147.351] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.351] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.351] CloseHandle (hObject=0xdc) returned 1 [0147.351] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbef0a100, ftCreationTime.dwHighDateTime=0x1bd4b36, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbef0a100, ftLastWriteTime.dwHighDateTime=0x1bd4b36, nFileSizeHigh=0x0, nFileSizeLow=0x2b90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00775_.WMF", cAlternateFileName="")) returned 1 [0147.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.352] GetProcessHeap () returned 0x4e0000 [0147.352] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.352] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.352] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.352] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.352] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.352] GetProcessHeap () returned 0x4e0000 [0147.352] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.352] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.352] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.352] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.354] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.354] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.354] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.354] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.355] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.355] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.355] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.355] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.355] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2b90, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2b90, lpOverlapped=0x0) returned 1 [0147.359] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2b90, dwBufLen=0x2b90 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2b90) returned 1 [0147.359] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.359] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2b90, lpOverlapped=0x0) returned 1 [0147.359] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.359] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2c64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.359] SetEndOfFile (hFile=0xdc) returned 1 [0147.362] GetProcessHeap () returned 0x4e0000 [0147.362] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.362] GetProcessHeap () returned 0x4e0000 [0147.362] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.362] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.363] CloseHandle (hObject=0xdc) returned 1 [0147.363] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2364900, ftCreationTime.dwHighDateTime=0x1bd4b03, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd2364900, ftLastWriteTime.dwHighDateTime=0x1bd4b03, nFileSizeHigh=0x0, nFileSizeLow=0x2332, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00779_.WMF", cAlternateFileName="")) returned 1 [0147.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.365] GetProcessHeap () returned 0x4e0000 [0147.365] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.365] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.365] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.365] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0147.367] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.367] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.367] GetProcessHeap () returned 0x4e0000 [0147.367] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.367] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.367] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.367] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.367] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.368] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.368] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.368] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.368] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.368] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.368] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.368] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.368] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2332, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2332, lpOverlapped=0x0) returned 1 [0147.369] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2340, dwBufLen=0x2340 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2340) returned 1 [0147.369] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.369] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2340, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2340, lpOverlapped=0x0) returned 1 [0147.370] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.370] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2414, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.370] SetEndOfFile (hFile=0xdc) returned 1 [0147.372] GetProcessHeap () returned 0x4e0000 [0147.372] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.372] GetProcessHeap () returned 0x4e0000 [0147.373] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.373] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.374] CloseHandle (hObject=0xdc) returned 1 [0147.374] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4adb300, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4adb300, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0x3690, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00799_.WMF", cAlternateFileName="")) returned 1 [0147.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.374] GetProcessHeap () returned 0x4e0000 [0147.374] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.374] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.374] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.375] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.375] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.375] GetProcessHeap () returned 0x4e0000 [0147.375] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.375] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.375] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.375] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.383] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.383] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.383] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.383] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.383] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.383] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.383] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.383] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.384] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3690, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3690, lpOverlapped=0x0) returned 1 [0147.387] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3690, dwBufLen=0x3690 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3690) returned 1 [0147.387] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.387] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3690, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3690, lpOverlapped=0x0) returned 1 [0147.387] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.387] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3764, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.387] SetEndOfFile (hFile=0xdc) returned 1 [0147.390] GetProcessHeap () returned 0x4e0000 [0147.390] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.390] GetProcessHeap () returned 0x4e0000 [0147.390] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.390] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.395] CloseHandle (hObject=0xdc) returned 1 [0147.395] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad86a500, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad86a500, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0xa6d0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00814_.WMF", cAlternateFileName="")) returned 1 [0147.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.395] GetProcessHeap () returned 0x4e0000 [0147.395] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.395] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.395] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.396] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.396] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.396] GetProcessHeap () returned 0x4e0000 [0147.396] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.396] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.396] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.396] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.401] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.401] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.401] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.402] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.402] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.402] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.402] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.402] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.402] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xa6d0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xa6d0, lpOverlapped=0x0) returned 1 [0147.403] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa6d0, dwBufLen=0xa6d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa6d0) returned 1 [0147.403] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.403] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xa6d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xa6d0, lpOverlapped=0x0) returned 1 [0147.404] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.404] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xa7a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.404] SetEndOfFile (hFile=0xdc) returned 1 [0147.418] GetProcessHeap () returned 0x4e0000 [0147.418] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.418] GetProcessHeap () returned 0x4e0000 [0147.418] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.418] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.419] CloseHandle (hObject=0xdc) returned 1 [0147.419] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fdeb00, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95fdeb00, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x3b3c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00965_.WMF", cAlternateFileName="")) returned 1 [0147.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.462] GetProcessHeap () returned 0x4e0000 [0147.462] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.462] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.462] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.462] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.465] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.465] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.465] GetProcessHeap () returned 0x4e0000 [0147.465] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.465] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.465] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.465] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.465] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.465] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.465] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.465] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.465] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.465] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.465] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.466] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.466] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3b3c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3b3c, lpOverlapped=0x0) returned 1 [0147.467] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3b40, dwBufLen=0x3b40 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3b40) returned 1 [0147.467] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.467] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3b40, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3b40, lpOverlapped=0x0) returned 1 [0147.468] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.468] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3c14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.468] SetEndOfFile (hFile=0xdc) returned 1 [0147.470] GetProcessHeap () returned 0x4e0000 [0147.470] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.470] GetProcessHeap () returned 0x4e0000 [0147.471] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.471] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.472] CloseHandle (hObject=0xdc) returned 1 [0147.472] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9963a600, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9963a600, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x121a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD01074_.WMF", cAlternateFileName="")) returned 1 [0147.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.473] GetProcessHeap () returned 0x4e0000 [0147.473] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.473] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.473] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.473] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0147.475] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.475] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.475] GetProcessHeap () returned 0x4e0000 [0147.475] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.475] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.475] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.475] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.475] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.475] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.476] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.476] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.476] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.476] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.476] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.476] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.476] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x121a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x121a, lpOverlapped=0x0) returned 1 [0147.477] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1220, dwBufLen=0x1220 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1220) returned 1 [0147.477] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.477] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1220, lpOverlapped=0x0) returned 1 [0147.477] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.477] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x12f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.477] SetEndOfFile (hFile=0xdc) returned 1 [0147.480] GetProcessHeap () returned 0x4e0000 [0147.480] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.480] GetProcessHeap () returned 0x4e0000 [0147.480] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.480] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.481] CloseHandle (hObject=0xdc) returned 1 [0147.481] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf455c700, ftCreationTime.dwHighDateTime=0x1bd4be8, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf455c700, ftLastWriteTime.dwHighDateTime=0x1bd4be8, nFileSizeHigh=0x0, nFileSizeLow=0x96c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD01084_.WMF", cAlternateFileName="")) returned 1 [0147.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.482] GetProcessHeap () returned 0x4e0000 [0147.482] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.482] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.482] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.482] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.484] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.484] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.484] GetProcessHeap () returned 0x4e0000 [0147.485] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.485] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.485] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.485] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.485] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.485] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.485] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.485] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.485] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.485] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.485] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.485] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.485] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x96c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x96c, lpOverlapped=0x0) returned 1 [0147.486] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x970, dwBufLen=0x970 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x970) returned 1 [0147.486] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.486] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x970, lpOverlapped=0x0) returned 1 [0147.486] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.486] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xa44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.486] SetEndOfFile (hFile=0xdc) returned 1 [0147.489] GetProcessHeap () returned 0x4e0000 [0147.489] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.489] GetProcessHeap () returned 0x4e0000 [0147.489] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.489] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.490] CloseHandle (hObject=0xdc) returned 1 [0147.490] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ff1000, ftCreationTime.dwHighDateTime=0x1bd4bfe, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78ff1000, ftLastWriteTime.dwHighDateTime=0x1bd4bfe, nFileSizeHigh=0x0, nFileSizeLow=0x1378, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD01176_.WMF", cAlternateFileName="")) returned 1 [0147.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.490] GetProcessHeap () returned 0x4e0000 [0147.490] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.490] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.490] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.491] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.493] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.493] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.493] GetProcessHeap () returned 0x4e0000 [0147.493] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.493] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.493] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.493] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.493] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.493] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.493] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.493] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.493] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.494] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.494] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.494] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.494] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1378, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1378, lpOverlapped=0x0) returned 1 [0147.495] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1380, dwBufLen=0x1380 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1380) returned 1 [0147.495] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.495] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1380, lpOverlapped=0x0) returned 1 [0147.495] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.495] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1454, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.495] SetEndOfFile (hFile=0xdc) returned 1 [0147.498] GetProcessHeap () returned 0x4e0000 [0147.498] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.498] GetProcessHeap () returned 0x4e0000 [0147.498] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.498] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.499] CloseHandle (hObject=0xdc) returned 1 [0147.499] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d752900, ftCreationTime.dwHighDateTime=0x1bd4bf0, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d752900, ftLastWriteTime.dwHighDateTime=0x1bd4bf0, nFileSizeHigh=0x0, nFileSizeLow=0xf7c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD01191_.WMF", cAlternateFileName="")) returned 1 [0147.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.513] GetProcessHeap () returned 0x4e0000 [0147.513] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.513] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.513] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.513] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.516] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.516] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.516] GetProcessHeap () returned 0x4e0000 [0147.516] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.516] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.516] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.516] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.516] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.516] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.516] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.517] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.517] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.517] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.517] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.517] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.517] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xf7c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xf7c, lpOverlapped=0x0) returned 1 [0147.517] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xf80, dwBufLen=0xf80 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xf80) returned 1 [0147.517] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.517] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xf80, lpOverlapped=0x0) returned 1 [0147.517] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.517] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1054, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.518] SetEndOfFile (hFile=0xdc) returned 1 [0147.520] GetProcessHeap () returned 0x4e0000 [0147.520] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.520] GetProcessHeap () returned 0x4e0000 [0147.520] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.520] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.522] CloseHandle (hObject=0xdc) returned 1 [0147.522] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97014c00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97014c00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x488, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD01193_.WMF", cAlternateFileName="")) returned 1 [0147.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.523] GetProcessHeap () returned 0x4e0000 [0147.523] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.523] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.523] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.523] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.526] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.527] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.527] GetProcessHeap () returned 0x4e0000 [0147.527] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.527] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.527] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.527] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.527] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.527] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.527] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.527] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.527] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.528] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.528] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.528] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.528] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x488, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x488, lpOverlapped=0x0) returned 1 [0147.528] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x490, dwBufLen=0x490 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x490) returned 1 [0147.528] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.528] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x490, lpOverlapped=0x0) returned 1 [0147.528] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.528] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x564, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.528] SetEndOfFile (hFile=0xdc) returned 1 [0147.531] GetProcessHeap () returned 0x4e0000 [0147.531] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.531] GetProcessHeap () returned 0x4e0000 [0147.531] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.531] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.532] CloseHandle (hObject=0xdc) returned 1 [0147.532] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49e1a200, ftCreationTime.dwHighDateTime=0x1bd4bf0, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x49e1a200, ftLastWriteTime.dwHighDateTime=0x1bd4bf0, nFileSizeHigh=0x0, nFileSizeLow=0x91c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD01196_.WMF", cAlternateFileName="")) returned 1 [0147.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.533] GetProcessHeap () returned 0x4e0000 [0147.533] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.533] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.533] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.533] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.535] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.535] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.535] GetProcessHeap () returned 0x4e0000 [0147.535] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.536] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.536] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.536] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.536] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.536] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.536] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.536] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.536] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.536] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.536] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.536] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.536] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x91c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x91c, lpOverlapped=0x0) returned 1 [0147.537] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x920, dwBufLen=0x920 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x920) returned 1 [0147.537] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.537] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x920, lpOverlapped=0x0) returned 1 [0147.537] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.537] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x9f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.537] SetEndOfFile (hFile=0xdc) returned 1 [0147.540] GetProcessHeap () returned 0x4e0000 [0147.540] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.540] GetProcessHeap () returned 0x4e0000 [0147.540] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.540] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.541] CloseHandle (hObject=0xdc) returned 1 [0147.541] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cfde00, ftCreationTime.dwHighDateTime=0x1bf3242, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80cfde00, ftLastWriteTime.dwHighDateTime=0x1bf3242, nFileSizeHigh=0x0, nFileSizeLow=0x284c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD01548_.WMF", cAlternateFileName="")) returned 1 [0147.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.541] GetProcessHeap () returned 0x4e0000 [0147.541] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.541] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.541] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.542] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.544] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.544] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.544] GetProcessHeap () returned 0x4e0000 [0147.544] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.544] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.544] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.544] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.544] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.544] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.544] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.545] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.545] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.545] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.545] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.545] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.545] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x284c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x284c, lpOverlapped=0x0) returned 1 [0147.556] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2850, dwBufLen=0x2850 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2850) returned 1 [0147.557] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.557] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2850, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2850, lpOverlapped=0x0) returned 1 [0147.557] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.557] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2924, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.557] SetEndOfFile (hFile=0xdc) returned 1 [0147.560] GetProcessHeap () returned 0x4e0000 [0147.560] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.560] GetProcessHeap () returned 0x4e0000 [0147.560] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.560] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.562] CloseHandle (hObject=0xdc) returned 1 [0147.562] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4fe7000, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4fe7000, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x76ce, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD01657_.WMF", cAlternateFileName="")) returned 1 [0147.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.563] GetProcessHeap () returned 0x4e0000 [0147.563] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.563] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.563] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.563] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0147.567] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.567] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.567] GetProcessHeap () returned 0x4e0000 [0147.567] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.567] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.567] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.567] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.568] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.568] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.568] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.568] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.568] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.568] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.568] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.568] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.568] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x76ce, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x76ce, lpOverlapped=0x0) returned 1 [0147.569] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x76d0, dwBufLen=0x76d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x76d0) returned 1 [0147.570] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.570] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x76d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x76d0, lpOverlapped=0x0) returned 1 [0147.570] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.570] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x77a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.570] SetEndOfFile (hFile=0xdc) returned 1 [0147.573] GetProcessHeap () returned 0x4e0000 [0147.573] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.573] GetProcessHeap () returned 0x4e0000 [0147.573] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.573] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.574] CloseHandle (hObject=0xdc) returned 1 [0147.574] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eb44f00, ftCreationTime.dwHighDateTime=0x1bd4c0c, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4eb44f00, ftLastWriteTime.dwHighDateTime=0x1bd4c0c, nFileSizeHigh=0x0, nFileSizeLow=0x4604, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD01658_.WMF", cAlternateFileName="")) returned 1 [0147.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.576] GetProcessHeap () returned 0x4e0000 [0147.576] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.576] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.576] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.576] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0147.605] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.606] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.606] GetProcessHeap () returned 0x4e0000 [0147.606] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.606] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.606] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.606] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.606] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.606] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.606] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.606] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.606] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.606] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.606] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.607] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.607] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4604, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4604, lpOverlapped=0x0) returned 1 [0147.610] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4610, dwBufLen=0x4610 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4610) returned 1 [0147.610] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.610] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4610, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4610, lpOverlapped=0x0) returned 1 [0147.610] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.610] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x46e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.611] SetEndOfFile (hFile=0xdc) returned 1 [0147.613] GetProcessHeap () returned 0x4e0000 [0147.613] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.613] GetProcessHeap () returned 0x4e0000 [0147.613] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.614] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.615] CloseHandle (hObject=0xdc) returned 1 [0147.615] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02ca800, ftCreationTime.dwHighDateTime=0x1bd4bee, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf02ca800, ftLastWriteTime.dwHighDateTime=0x1bd4bee, nFileSizeHigh=0x0, nFileSizeLow=0x79cc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD01659_.WMF", cAlternateFileName="")) returned 1 [0147.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.616] GetProcessHeap () returned 0x4e0000 [0147.616] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.616] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.617] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.617] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.638] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.638] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.638] GetProcessHeap () returned 0x4e0000 [0147.638] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.639] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.639] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.639] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.639] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.639] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.639] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.639] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.639] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.639] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.639] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.639] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.639] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x79cc, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x79cc, lpOverlapped=0x0) returned 1 [0147.658] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x79d0, dwBufLen=0x79d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x79d0) returned 1 [0147.659] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.659] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x79d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x79d0, lpOverlapped=0x0) returned 1 [0147.659] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.659] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7aa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.659] SetEndOfFile (hFile=0xdc) returned 1 [0147.663] GetProcessHeap () returned 0x4e0000 [0147.663] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.663] GetProcessHeap () returned 0x4e0000 [0147.663] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.663] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.664] CloseHandle (hObject=0xdc) returned 1 [0147.664] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd62f9d00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd62f9d00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x329e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD01660_.WMF", cAlternateFileName="")) returned 1 [0147.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.665] GetProcessHeap () returned 0x4e0000 [0147.665] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.665] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.665] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.665] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0147.673] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.673] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.673] GetProcessHeap () returned 0x4e0000 [0147.673] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.673] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.673] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.673] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.674] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.674] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.674] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.674] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.674] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.674] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.674] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.674] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.674] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x329e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x329e, lpOverlapped=0x0) returned 1 [0147.676] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x32a0, dwBufLen=0x32a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x32a0) returned 1 [0147.676] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.676] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x32a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x32a0, lpOverlapped=0x0) returned 1 [0147.676] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.676] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3374, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.676] SetEndOfFile (hFile=0xdc) returned 1 [0147.679] GetProcessHeap () returned 0x4e0000 [0147.679] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.679] GetProcessHeap () returned 0x4e0000 [0147.679] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.679] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.680] CloseHandle (hObject=0xdc) returned 1 [0147.681] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9b8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD02068_.WMF", cAlternateFileName="")) returned 1 [0147.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.681] GetProcessHeap () returned 0x4e0000 [0147.681] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.681] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.681] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.681] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.698] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.699] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.699] GetProcessHeap () returned 0x4e0000 [0147.699] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.699] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.699] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.699] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.699] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.699] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.699] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.699] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.699] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.700] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.700] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.700] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.700] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x9b8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x9b8, lpOverlapped=0x0) returned 1 [0147.700] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9c0, dwBufLen=0x9c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9c0) returned 1 [0147.700] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.700] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x9c0, lpOverlapped=0x0) returned 1 [0147.700] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.700] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xa94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.700] SetEndOfFile (hFile=0xdc) returned 1 [0147.703] GetProcessHeap () returned 0x4e0000 [0147.703] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.703] GetProcessHeap () returned 0x4e0000 [0147.703] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.703] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.705] CloseHandle (hObject=0xdc) returned 1 [0147.705] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x88c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD02071_.WMF", cAlternateFileName="")) returned 1 [0147.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.706] GetProcessHeap () returned 0x4e0000 [0147.706] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.706] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.706] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.707] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.714] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.714] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.714] GetProcessHeap () returned 0x4e0000 [0147.714] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.714] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.714] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.714] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.714] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.714] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.715] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.715] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.715] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.715] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.715] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.715] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.715] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x88c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x88c, lpOverlapped=0x0) returned 1 [0147.715] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x890, dwBufLen=0x890 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x890) returned 1 [0147.715] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.715] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x890, lpOverlapped=0x0) returned 1 [0147.716] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.716] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x964, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.716] SetEndOfFile (hFile=0xdc) returned 1 [0147.719] GetProcessHeap () returned 0x4e0000 [0147.719] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.719] GetProcessHeap () returned 0x4e0000 [0147.719] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.719] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.720] CloseHandle (hObject=0xdc) returned 1 [0147.720] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x112c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD02075_.WMF", cAlternateFileName="")) returned 1 [0147.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.721] GetProcessHeap () returned 0x4e0000 [0147.721] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.721] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.721] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.721] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.741] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.741] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.741] GetProcessHeap () returned 0x4e0000 [0147.741] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.741] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.741] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.741] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.741] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.741] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.742] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.742] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.742] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.742] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.742] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.742] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.742] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x112c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x112c, lpOverlapped=0x0) returned 1 [0147.755] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1130, dwBufLen=0x1130 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1130) returned 1 [0147.755] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.755] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1130, lpOverlapped=0x0) returned 1 [0147.755] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.755] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.755] SetEndOfFile (hFile=0xdc) returned 1 [0147.758] GetProcessHeap () returned 0x4e0000 [0147.758] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.758] GetProcessHeap () returned 0x4e0000 [0147.758] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.758] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.760] CloseHandle (hObject=0xdc) returned 1 [0147.760] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe70, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD02088_.WMF", cAlternateFileName="")) returned 1 [0147.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.761] GetProcessHeap () returned 0x4e0000 [0147.761] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.761] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.761] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.761] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.761] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.761] GetProcessHeap () returned 0x4e0000 [0147.761] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.761] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.761] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.761] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.771] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.771] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.772] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.772] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.772] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.772] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.772] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.772] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.772] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xe70, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xe70, lpOverlapped=0x0) returned 1 [0147.772] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe70, dwBufLen=0xe70 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe70) returned 1 [0147.772] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.772] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xe70, lpOverlapped=0x0) returned 1 [0147.772] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.773] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xf44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.773] SetEndOfFile (hFile=0xdc) returned 1 [0147.775] GetProcessHeap () returned 0x4e0000 [0147.775] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.776] GetProcessHeap () returned 0x4e0000 [0147.776] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.776] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.777] CloseHandle (hObject=0xdc) returned 1 [0147.777] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x61c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD02097_.WMF", cAlternateFileName="")) returned 1 [0147.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.778] GetProcessHeap () returned 0x4e0000 [0147.778] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.778] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.778] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.778] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.784] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.784] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.784] GetProcessHeap () returned 0x4e0000 [0147.784] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.785] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.785] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.785] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.785] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.785] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.785] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.785] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.785] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.785] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.785] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.785] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.785] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x61c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x61c, lpOverlapped=0x0) returned 1 [0147.785] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x620, dwBufLen=0x620 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x620) returned 1 [0147.786] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.786] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x620, lpOverlapped=0x0) returned 1 [0147.786] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.786] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.786] SetEndOfFile (hFile=0xdc) returned 1 [0147.788] GetProcessHeap () returned 0x4e0000 [0147.788] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.789] GetProcessHeap () returned 0x4e0000 [0147.789] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.789] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.790] CloseHandle (hObject=0xdc) returned 1 [0147.790] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1234, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD02115_.WMF", cAlternateFileName="")) returned 1 [0147.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.791] GetProcessHeap () returned 0x4e0000 [0147.791] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.791] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.791] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.791] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0147.806] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.806] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.806] GetProcessHeap () returned 0x4e0000 [0147.806] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.806] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.806] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.806] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.806] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.806] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.807] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.807] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.807] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.807] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.807] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.807] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.807] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1234, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1234, lpOverlapped=0x0) returned 1 [0147.825] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1240, dwBufLen=0x1240 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1240) returned 1 [0147.825] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.825] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1240, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1240, lpOverlapped=0x0) returned 1 [0147.825] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.825] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.825] SetEndOfFile (hFile=0xdc) returned 1 [0147.828] GetProcessHeap () returned 0x4e0000 [0147.828] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.828] GetProcessHeap () returned 0x4e0000 [0147.828] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.828] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.829] CloseHandle (hObject=0xdc) returned 1 [0147.829] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xf94, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD02116_.WMF", cAlternateFileName="")) returned 1 [0147.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.831] GetProcessHeap () returned 0x4e0000 [0147.831] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.831] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.831] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.831] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0147.837] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.837] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.837] GetProcessHeap () returned 0x4e0000 [0147.837] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.837] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.837] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.837] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.838] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.838] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.838] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.838] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.838] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.838] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.838] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.838] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.838] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xf94, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xf94, lpOverlapped=0x0) returned 1 [0147.838] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xfa0, dwBufLen=0xfa0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xfa0) returned 1 [0147.839] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.839] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xfa0, lpOverlapped=0x0) returned 1 [0147.839] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.839] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1074, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.839] SetEndOfFile (hFile=0xdc) returned 1 [0147.842] GetProcessHeap () returned 0x4e0000 [0147.842] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.843] GetProcessHeap () returned 0x4e0000 [0147.843] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.843] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.844] CloseHandle (hObject=0xdc) returned 1 [0147.844] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa4c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD02141_.WMF", cAlternateFileName="")) returned 1 [0147.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.845] GetProcessHeap () returned 0x4e0000 [0147.845] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.845] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.845] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.845] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.875] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.875] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.875] GetProcessHeap () returned 0x4e0000 [0147.875] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.876] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.876] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.876] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.876] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.876] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.876] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.876] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.876] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.876] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.876] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.876] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.876] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xa4c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xa4c, lpOverlapped=0x0) returned 1 [0147.876] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa50, dwBufLen=0xa50 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa50) returned 1 [0147.877] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.877] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xa50, lpOverlapped=0x0) returned 1 [0147.877] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.877] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xb24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.877] SetEndOfFile (hFile=0xdc) returned 1 [0147.879] GetProcessHeap () returned 0x4e0000 [0147.880] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.880] GetProcessHeap () returned 0x4e0000 [0147.880] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.880] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.881] CloseHandle (hObject=0xdc) returned 1 [0147.881] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1510, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD02153_.WMF", cAlternateFileName="")) returned 1 [0147.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.882] GetProcessHeap () returned 0x4e0000 [0147.882] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.882] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.882] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.882] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.882] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.882] GetProcessHeap () returned 0x4e0000 [0147.882] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.882] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.882] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.882] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.884] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.884] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.885] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.885] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.885] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.885] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.885] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.885] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.885] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1510, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1510, lpOverlapped=0x0) returned 1 [0147.907] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1510, dwBufLen=0x1510 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1510) returned 1 [0147.907] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.907] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1510, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1510, lpOverlapped=0x0) returned 1 [0147.907] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.907] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x15e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.907] SetEndOfFile (hFile=0xdc) returned 1 [0147.910] GetProcessHeap () returned 0x4e0000 [0147.910] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.910] GetProcessHeap () returned 0x4e0000 [0147.910] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.910] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.911] CloseHandle (hObject=0xdc) returned 1 [0147.911] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x670, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD02158_.WMF", cAlternateFileName="")) returned 1 [0147.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.912] GetProcessHeap () returned 0x4e0000 [0147.912] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.912] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.912] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.912] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.912] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.912] GetProcessHeap () returned 0x4e0000 [0147.912] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.912] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.913] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.913] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.920] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.920] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.920] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.920] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.920] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.920] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.920] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.920] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.920] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x670, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x670, lpOverlapped=0x0) returned 1 [0147.921] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x670, dwBufLen=0x670 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x670) returned 1 [0147.921] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.921] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x670, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x670, lpOverlapped=0x0) returned 1 [0147.921] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.921] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x744, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.921] SetEndOfFile (hFile=0xdc) returned 1 [0147.924] GetProcessHeap () returned 0x4e0000 [0147.924] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.924] GetProcessHeap () returned 0x4e0000 [0147.924] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.924] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.925] CloseHandle (hObject=0xdc) returned 1 [0147.925] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc38, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD02161_.WMF", cAlternateFileName="")) returned 1 [0147.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.926] GetProcessHeap () returned 0x4e0000 [0147.926] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.926] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.926] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.926] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.978] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.978] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.978] GetProcessHeap () returned 0x4e0000 [0147.978] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0147.978] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0147.978] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.978] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0147.978] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0147.978] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0147.979] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0147.979] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0147.979] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0147.979] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0147.979] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0147.979] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.979] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xc38, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xc38, lpOverlapped=0x0) returned 1 [0147.979] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xc40, dwBufLen=0xc40 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xc40) returned 1 [0147.979] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.979] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xc40, lpOverlapped=0x0) returned 1 [0147.980] CryptDestroyKey (hKey=0x522f98) returned 1 [0147.980] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xd14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.980] SetEndOfFile (hFile=0xdc) returned 1 [0147.983] GetProcessHeap () returned 0x4e0000 [0147.983] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0147.983] GetProcessHeap () returned 0x4e0000 [0147.983] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0147.983] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0147.984] CloseHandle (hObject=0xdc) returned 1 [0147.984] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x32b5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FINCL_01.MID", cAlternateFileName="")) returned 1 [0147.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0147.986] GetProcessHeap () returned 0x4e0000 [0147.986] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0147.986] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0147.986] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0147.986] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xb, lpOverlapped=0x0) returned 1 [0148.025] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0148.025] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0148.025] GetProcessHeap () returned 0x4e0000 [0148.025] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0148.025] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0148.025] CryptDestroyKey (hKey=0x522f98) returned 1 [0148.025] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0148.025] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0148.026] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0148.026] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0148.026] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0148.026] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0148.026] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0148.026] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0148.026] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.026] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x32b5, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x32b5, lpOverlapped=0x0) returned 1 [0148.027] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x32c0, dwBufLen=0x32c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x32c0) returned 1 [0148.028] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.028] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x32c0, lpOverlapped=0x0) returned 1 [0148.028] CryptDestroyKey (hKey=0x522f98) returned 1 [0148.028] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3394, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.028] SetEndOfFile (hFile=0xdc) returned 1 [0148.031] GetProcessHeap () returned 0x4e0000 [0148.031] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0148.031] GetProcessHeap () returned 0x4e0000 [0148.031] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0148.031] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0148.033] CloseHandle (hObject=0xdc) returned 1 [0148.033] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2466, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FINCL_02.MID", cAlternateFileName="")) returned 1 [0148.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0148.035] GetProcessHeap () returned 0x4e0000 [0148.035] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0148.035] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0148.035] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0148.035] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0148.041] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0148.041] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0148.041] GetProcessHeap () returned 0x4e0000 [0148.041] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0148.041] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0148.041] CryptDestroyKey (hKey=0x522f98) returned 1 [0148.041] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0148.041] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0148.041] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0148.041] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0148.041] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0148.041] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0148.042] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0148.042] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0148.042] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.042] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2466, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2466, lpOverlapped=0x0) returned 1 [0148.043] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2470, dwBufLen=0x2470 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2470) returned 1 [0148.043] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.043] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2470, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2470, lpOverlapped=0x0) returned 1 [0148.043] CryptDestroyKey (hKey=0x522f98) returned 1 [0148.043] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2544, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.043] SetEndOfFile (hFile=0xdc) returned 1 [0148.046] GetProcessHeap () returned 0x4e0000 [0148.046] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0148.046] GetProcessHeap () returned 0x4e0000 [0148.046] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0148.047] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0148.064] CloseHandle (hObject=0xdc) returned 1 [0148.064] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x617e41d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x816, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FLAP.WMF", cAlternateFileName="")) returned 1 [0148.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0148.066] GetProcessHeap () returned 0x4e0000 [0148.066] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0148.066] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0148.067] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0148.067] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0148.069] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0148.069] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0148.069] GetProcessHeap () returned 0x4e0000 [0148.069] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0148.069] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0148.069] CryptDestroyKey (hKey=0x522f98) returned 1 [0148.069] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0148.069] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0148.069] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0148.069] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0148.070] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0148.070] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0148.070] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0148.070] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0148.070] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.070] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x816, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x816, lpOverlapped=0x0) returned 1 [0148.070] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x820, dwBufLen=0x820 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x820) returned 1 [0148.070] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.070] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x820, lpOverlapped=0x0) returned 1 [0148.070] CryptDestroyKey (hKey=0x522f98) returned 1 [0148.070] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x8e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.070] SetEndOfFile (hFile=0xdc) returned 1 [0148.073] GetProcessHeap () returned 0x4e0000 [0148.073] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0148.073] GetProcessHeap () returned 0x4e0000 [0148.073] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0148.073] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0148.075] CloseHandle (hObject=0xdc) returned 1 [0148.075] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x61ab7bf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1d8f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="GRDEN_01.MID", cAlternateFileName="")) returned 1 [0148.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0148.080] GetProcessHeap () returned 0x4e0000 [0148.080] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0148.080] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0148.080] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0148.080] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x1, lpOverlapped=0x0) returned 1 [0148.109] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0148.109] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0148.109] GetProcessHeap () returned 0x4e0000 [0148.109] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0148.109] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0148.110] CryptDestroyKey (hKey=0x522f98) returned 1 [0148.110] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0148.110] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0148.110] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0148.110] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0148.110] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0148.110] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0148.110] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0148.110] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0148.110] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.110] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1d8f, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1d8f, lpOverlapped=0x0) returned 1 [0148.118] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1d90, dwBufLen=0x1d90 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1d90) returned 1 [0148.118] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.119] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1d90, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1d90, lpOverlapped=0x0) returned 1 [0148.119] CryptDestroyKey (hKey=0x522f98) returned 1 [0148.119] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1e64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.119] SetEndOfFile (hFile=0xdc) returned 1 [0148.122] GetProcessHeap () returned 0x4e0000 [0148.122] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0148.122] GetProcessHeap () returned 0x4e0000 [0148.122] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0148.122] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0148.123] CloseHandle (hObject=0xdc) returned 1 [0148.124] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x52c3bfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x18bb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="GRID_01.MID", cAlternateFileName="")) returned 1 [0148.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0148.124] GetProcessHeap () returned 0x4e0000 [0148.124] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0148.124] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0148.124] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0148.125] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x5, lpOverlapped=0x0) returned 1 [0148.129] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0148.129] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0148.129] GetProcessHeap () returned 0x4e0000 [0148.129] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0148.129] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0148.129] CryptDestroyKey (hKey=0x522f98) returned 1 [0148.129] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0148.129] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0148.129] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0148.130] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0148.130] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0148.130] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0148.130] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0148.130] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0148.130] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.130] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x18bb, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x18bb, lpOverlapped=0x0) returned 1 [0148.131] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x18c0, dwBufLen=0x18c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x18c0) returned 1 [0148.131] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.131] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x18c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x18c0, lpOverlapped=0x0) returned 1 [0148.132] CryptDestroyKey (hKey=0x522f98) returned 1 [0148.132] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.132] SetEndOfFile (hFile=0xdc) returned 1 [0148.134] GetProcessHeap () returned 0x4e0000 [0148.134] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0148.134] GetProcessHeap () returned 0x4e0000 [0148.135] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0148.135] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0148.136] CloseHandle (hObject=0xdc) returned 1 [0148.136] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636ce600, ftCreationTime.dwHighDateTime=0x1bd4b2b, ftLastAccessTime.dwLowDateTime=0x61c80c70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x636ce600, ftLastWriteTime.dwHighDateTime=0x1bd4b2b, nFileSizeHigh=0x0, nFileSizeLow=0xeb4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00057_.WMF", cAlternateFileName="")) returned 1 [0148.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0148.137] GetProcessHeap () returned 0x4e0000 [0148.137] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0148.137] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0148.137] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0148.137] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0148.162] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0148.162] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0148.162] GetProcessHeap () returned 0x4e0000 [0148.162] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0148.162] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0148.162] CryptDestroyKey (hKey=0x522f98) returned 1 [0148.162] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0148.162] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0148.162] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0148.163] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0148.163] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0148.163] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0148.163] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0148.163] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0148.163] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.163] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xeb4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xeb4, lpOverlapped=0x0) returned 1 [0148.163] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xec0, dwBufLen=0xec0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xec0) returned 1 [0148.163] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.163] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xec0, lpOverlapped=0x0) returned 1 [0148.163] CryptDestroyKey (hKey=0x522f98) returned 1 [0148.163] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xf94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.164] SetEndOfFile (hFile=0xdc) returned 1 [0148.166] GetProcessHeap () returned 0x4e0000 [0148.166] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0148.166] GetProcessHeap () returned 0x4e0000 [0148.166] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0148.166] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0148.168] CloseHandle (hObject=0xdc) returned 1 [0148.168] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0af3b00, ftCreationTime.dwHighDateTime=0x1bd4b29, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf0af3b00, ftLastWriteTime.dwHighDateTime=0x1bd4b29, nFileSizeHigh=0x0, nFileSizeLow=0x9a8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00084_.WMF", cAlternateFileName="")) returned 1 [0148.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0148.169] GetProcessHeap () returned 0x4e0000 [0148.169] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0148.169] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0148.169] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0148.169] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0148.245] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0148.245] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0148.245] GetProcessHeap () returned 0x4e0000 [0148.245] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0148.245] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0148.245] CryptDestroyKey (hKey=0x522f98) returned 1 [0148.245] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0148.245] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0148.246] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0148.246] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0148.246] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0148.246] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0148.246] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0148.246] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0148.246] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.246] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x9a8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x9a8, lpOverlapped=0x0) returned 1 [0148.246] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9b0, dwBufLen=0x9b0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9b0) returned 1 [0148.246] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.246] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x9b0, lpOverlapped=0x0) returned 1 [0148.246] CryptDestroyKey (hKey=0x522f98) returned 1 [0148.246] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xa84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.247] SetEndOfFile (hFile=0xdc) returned 1 [0148.250] GetProcessHeap () returned 0x4e0000 [0148.250] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0148.250] GetProcessHeap () returned 0x4e0000 [0148.250] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0148.250] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0148.251] CloseHandle (hObject=0xdc) returned 1 [0148.251] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf81f1600, ftCreationTime.dwHighDateTime=0x1bd4b22, ftLastAccessTime.dwLowDateTime=0x61c80c70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf81f1600, ftLastWriteTime.dwHighDateTime=0x1bd4b22, nFileSizeHigh=0x0, nFileSizeLow=0x8b8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00231_.WMF", cAlternateFileName="")) returned 1 [0148.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0148.253] GetProcessHeap () returned 0x4e0000 [0148.253] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0148.253] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0148.253] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0148.253] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0148.258] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0148.258] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0148.258] GetProcessHeap () returned 0x4e0000 [0148.258] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0148.258] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0148.258] CryptDestroyKey (hKey=0x522f98) returned 1 [0148.258] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0148.258] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0148.258] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0148.258] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0148.258] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0148.258] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0148.259] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0148.259] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0148.259] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.259] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x8b8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x8b8, lpOverlapped=0x0) returned 1 [0148.259] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8c0, dwBufLen=0x8c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8c0) returned 1 [0148.259] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.259] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x8c0, lpOverlapped=0x0) returned 1 [0148.259] CryptDestroyKey (hKey=0x522f98) returned 1 [0148.259] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.259] SetEndOfFile (hFile=0xdc) returned 1 [0148.262] GetProcessHeap () returned 0x4e0000 [0148.262] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0148.262] GetProcessHeap () returned 0x4e0000 [0148.262] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0148.262] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0148.263] CloseHandle (hObject=0xdc) returned 1 [0148.263] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0c84900, ftCreationTime.dwHighDateTime=0x1bd4b22, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd0c84900, ftLastWriteTime.dwHighDateTime=0x1bd4b22, nFileSizeHigh=0x0, nFileSizeLow=0x402, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00235_.WMF", cAlternateFileName="")) returned 1 [0148.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0148.264] GetProcessHeap () returned 0x4e0000 [0148.264] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0148.264] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0148.264] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0148.264] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0148.333] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0148.333] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0148.333] GetProcessHeap () returned 0x4e0000 [0148.333] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0148.333] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0148.333] CryptDestroyKey (hKey=0x522f98) returned 1 [0148.333] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0148.333] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0148.333] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0148.333] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0148.333] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0148.333] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0148.334] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0148.334] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0148.334] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.334] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x402, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x402, lpOverlapped=0x0) returned 1 [0148.334] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x410, dwBufLen=0x410 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x410) returned 1 [0148.334] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.334] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x410, lpOverlapped=0x0) returned 1 [0148.334] CryptDestroyKey (hKey=0x522f98) returned 1 [0148.334] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.334] SetEndOfFile (hFile=0xdc) returned 1 [0148.337] GetProcessHeap () returned 0x4e0000 [0148.337] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0148.337] GetProcessHeap () returned 0x4e0000 [0148.337] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0148.337] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0148.338] CloseHandle (hObject=0xdc) returned 1 [0148.338] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf971c00, ftCreationTime.dwHighDateTime=0x1bd4b22, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf971c00, ftLastWriteTime.dwHighDateTime=0x1bd4b22, nFileSizeHigh=0x0, nFileSizeLow=0xcd6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00236_.WMF", cAlternateFileName="")) returned 1 [0148.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0148.339] GetProcessHeap () returned 0x4e0000 [0148.339] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0148.339] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0148.339] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0148.339] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0148.377] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0148.377] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0148.378] GetProcessHeap () returned 0x4e0000 [0148.378] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0148.378] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0148.378] CryptDestroyKey (hKey=0x522f98) returned 1 [0148.378] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0148.378] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0148.378] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0148.378] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0148.378] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0148.378] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0148.378] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0148.378] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0148.378] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.379] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xcd6, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xcd6, lpOverlapped=0x0) returned 1 [0148.379] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xce0, dwBufLen=0xce0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xce0) returned 1 [0148.379] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.379] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xce0, lpOverlapped=0x0) returned 1 [0148.379] CryptDestroyKey (hKey=0x522f98) returned 1 [0148.379] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xdb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.379] SetEndOfFile (hFile=0xdc) returned 1 [0148.382] GetProcessHeap () returned 0x4e0000 [0148.382] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0148.382] GetProcessHeap () returned 0x4e0000 [0148.382] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0148.382] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0148.386] CloseHandle (hObject=0xdc) returned 1 [0148.387] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cd54400, ftCreationTime.dwHighDateTime=0x1bd4b22, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8cd54400, ftLastWriteTime.dwHighDateTime=0x1bd4b22, nFileSizeHigh=0x0, nFileSizeLow=0x7a8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00241_.WMF", cAlternateFileName="")) returned 1 [0148.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0148.388] GetProcessHeap () returned 0x4e0000 [0148.388] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0148.388] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0148.388] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0148.388] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0148.390] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0148.390] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0148.390] GetProcessHeap () returned 0x4e0000 [0148.390] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0148.390] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0148.390] CryptDestroyKey (hKey=0x522f98) returned 1 [0148.390] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0148.390] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0148.390] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0148.390] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0148.390] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0148.391] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0148.391] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0148.391] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0148.391] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.391] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7a8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7a8, lpOverlapped=0x0) returned 1 [0148.391] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7b0, dwBufLen=0x7b0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7b0) returned 1 [0148.391] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.391] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7b0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7b0, lpOverlapped=0x0) returned 1 [0148.391] CryptDestroyKey (hKey=0x522f98) returned 1 [0148.391] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x884, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.391] SetEndOfFile (hFile=0xdc) returned 1 [0148.394] GetProcessHeap () returned 0x4e0000 [0148.394] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0148.394] GetProcessHeap () returned 0x4e0000 [0148.394] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0148.394] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0148.395] CloseHandle (hObject=0xdc) returned 1 [0148.395] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1461c00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa1461c00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xe4e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00260_.WMF", cAlternateFileName="")) returned 1 [0148.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0148.397] GetProcessHeap () returned 0x4e0000 [0148.397] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0148.397] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0148.397] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0148.397] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0148.401] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0148.401] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0148.401] GetProcessHeap () returned 0x4e0000 [0148.401] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0148.401] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0148.401] CryptDestroyKey (hKey=0x522f98) returned 1 [0148.401] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0148.401] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0148.401] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0148.401] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0148.401] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0148.401] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0148.401] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0148.401] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0148.401] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.402] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xe4e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xe4e, lpOverlapped=0x0) returned 1 [0148.402] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe50, dwBufLen=0xe50 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe50) returned 1 [0148.402] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.402] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe50, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xe50, lpOverlapped=0x0) returned 1 [0148.402] CryptDestroyKey (hKey=0x522f98) returned 1 [0148.402] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xf24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.402] SetEndOfFile (hFile=0xdc) returned 1 [0148.416] GetProcessHeap () returned 0x4e0000 [0148.416] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0148.416] GetProcessHeap () returned 0x4e0000 [0148.416] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0148.416] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0148.417] CloseHandle (hObject=0xdc) returned 1 [0148.417] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa014ef00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa014ef00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00276_.WMF", cAlternateFileName="")) returned 1 [0148.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0148.418] GetProcessHeap () returned 0x4e0000 [0148.418] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0148.418] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0148.418] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0148.418] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0148.422] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0148.422] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0148.422] GetProcessHeap () returned 0x4e0000 [0148.422] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0148.423] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0148.423] CryptDestroyKey (hKey=0x522f98) returned 1 [0148.423] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0148.423] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0148.423] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0148.423] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0148.423] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0148.423] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0148.423] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0148.423] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0148.423] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.423] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xbc8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xbc8, lpOverlapped=0x0) returned 1 [0148.423] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xbd0, dwBufLen=0xbd0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xbd0) returned 1 [0148.459] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.459] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xbd0, lpOverlapped=0x0) returned 1 [0148.460] CryptDestroyKey (hKey=0x522f98) returned 1 [0148.460] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xca4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.460] SetEndOfFile (hFile=0xdc) returned 1 [0148.472] GetProcessHeap () returned 0x4e0000 [0148.472] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0148.472] GetProcessHeap () returned 0x4e0000 [0148.472] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0148.472] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0148.474] CloseHandle (hObject=0xdc) returned 1 [0148.474] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10883400, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10883400, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x5f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00334_.WMF", cAlternateFileName="")) returned 1 [0148.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0148.475] GetProcessHeap () returned 0x4e0000 [0148.475] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0148.475] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0148.475] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0148.475] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0148.480] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0148.480] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0148.480] GetProcessHeap () returned 0x4e0000 [0148.480] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0148.480] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0148.480] CryptDestroyKey (hKey=0x522f98) returned 1 [0148.480] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0148.480] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0148.480] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0148.481] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0148.481] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0148.481] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0148.481] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0148.481] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0148.481] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.481] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5f8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x5f8, lpOverlapped=0x0) returned 1 [0148.481] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x600, dwBufLen=0x600 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x600) returned 1 [0148.481] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.481] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x600, lpOverlapped=0x0) returned 1 [0148.481] CryptDestroyKey (hKey=0x522f98) returned 1 [0148.481] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.482] SetEndOfFile (hFile=0xdc) returned 1 [0148.484] GetProcessHeap () returned 0x4e0000 [0148.484] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0148.484] GetProcessHeap () returned 0x4e0000 [0148.484] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0148.484] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0148.486] CloseHandle (hObject=0xdc) returned 1 [0148.486] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe38a5000, ftCreationTime.dwHighDateTime=0x1bd4b19, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe38a5000, ftLastWriteTime.dwHighDateTime=0x1bd4b19, nFileSizeHigh=0x0, nFileSizeLow=0xce2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00443_.WMF", cAlternateFileName="")) returned 1 [0148.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0148.487] GetProcessHeap () returned 0x4e0000 [0148.487] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0148.487] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0148.487] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0148.487] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0148.489] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0148.489] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0148.489] GetProcessHeap () returned 0x4e0000 [0148.489] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0148.489] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0148.490] CryptDestroyKey (hKey=0x522f98) returned 1 [0148.490] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0148.490] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0148.490] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0148.490] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0148.490] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0148.490] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0148.490] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0148.490] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0148.490] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.490] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xce2, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xce2, lpOverlapped=0x0) returned 1 [0148.490] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xcf0, dwBufLen=0xcf0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xcf0) returned 1 [0148.490] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.491] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xcf0, lpOverlapped=0x0) returned 1 [0148.491] CryptDestroyKey (hKey=0x522f98) returned 1 [0148.491] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xdc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.491] SetEndOfFile (hFile=0xdc) returned 1 [0148.493] GetProcessHeap () returned 0x4e0000 [0148.493] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0148.493] GetProcessHeap () returned 0x4e0000 [0148.494] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0148.494] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0148.495] CloseHandle (hObject=0xdc) returned 1 [0148.495] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9cafd00, ftCreationTime.dwHighDateTime=0x1bd4b16, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe9cafd00, ftLastWriteTime.dwHighDateTime=0x1bd4b16, nFileSizeHigh=0x0, nFileSizeLow=0x332, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00513_.WMF", cAlternateFileName="")) returned 1 [0148.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0148.495] GetProcessHeap () returned 0x4e0000 [0148.495] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0148.495] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0148.496] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0148.496] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0148.506] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0148.506] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0148.506] GetProcessHeap () returned 0x4e0000 [0148.506] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0148.506] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0148.506] CryptDestroyKey (hKey=0x522f98) returned 1 [0148.506] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0148.506] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0148.506] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0148.506] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0148.506] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0148.506] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0148.507] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0148.507] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0148.507] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.507] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x332, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x332, lpOverlapped=0x0) returned 1 [0148.507] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x340, dwBufLen=0x340 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x340) returned 1 [0148.507] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.507] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x340, lpOverlapped=0x0) returned 1 [0148.507] CryptDestroyKey (hKey=0x522f98) returned 1 [0148.507] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x414, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.507] SetEndOfFile (hFile=0xdc) returned 1 [0148.510] GetProcessHeap () returned 0x4e0000 [0148.510] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0148.510] GetProcessHeap () returned 0x4e0000 [0148.510] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0148.510] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0148.511] CloseHandle (hObject=0xdc) returned 1 [0148.511] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6576c00, ftCreationTime.dwHighDateTime=0x1bd4aed, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd6576c00, ftLastWriteTime.dwHighDateTime=0x1bd4aed, nFileSizeHigh=0x0, nFileSizeLow=0x3960, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00524_.WMF", cAlternateFileName="")) returned 1 [0148.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0148.512] GetProcessHeap () returned 0x4e0000 [0148.512] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0148.512] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0148.512] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0148.512] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0148.512] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0148.512] GetProcessHeap () returned 0x4e0000 [0148.512] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0148.512] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0148.513] CryptDestroyKey (hKey=0x522f98) returned 1 [0148.513] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0148.522] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0148.522] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0148.522] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0148.522] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0148.522] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0148.522] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0148.522] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0148.522] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.522] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3960, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3960, lpOverlapped=0x0) returned 1 [0148.524] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3960, dwBufLen=0x3960 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3960) returned 1 [0148.524] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.524] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3960, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3960, lpOverlapped=0x0) returned 1 [0148.524] CryptDestroyKey (hKey=0x522f98) returned 1 [0148.524] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3a34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.524] SetEndOfFile (hFile=0xdc) returned 1 [0148.528] GetProcessHeap () returned 0x4e0000 [0148.528] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0148.528] GetProcessHeap () returned 0x4e0000 [0148.528] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0148.528] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0148.530] CloseHandle (hObject=0xdc) returned 1 [0148.530] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3f51200, ftCreationTime.dwHighDateTime=0x1bd4aed, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd3f51200, ftLastWriteTime.dwHighDateTime=0x1bd4aed, nFileSizeHigh=0x0, nFileSizeLow=0x34e2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00526_.WMF", cAlternateFileName="")) returned 1 [0148.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0148.530] GetProcessHeap () returned 0x4e0000 [0148.530] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0148.530] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0148.530] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0148.531] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0148.535] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0148.535] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0148.535] GetProcessHeap () returned 0x4e0000 [0148.535] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0148.535] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0148.535] CryptDestroyKey (hKey=0x522f98) returned 1 [0148.535] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0148.535] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0148.535] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0148.535] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0148.535] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0148.535] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0148.536] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0148.536] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0148.536] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.536] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x34e2, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x34e2, lpOverlapped=0x0) returned 1 [0148.659] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x34f0, dwBufLen=0x34f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x34f0) returned 1 [0148.660] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.660] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x34f0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x34f0, lpOverlapped=0x0) returned 1 [0148.660] CryptDestroyKey (hKey=0x522f98) returned 1 [0148.660] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x35c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.660] SetEndOfFile (hFile=0xdc) returned 1 [0148.663] GetProcessHeap () returned 0x4e0000 [0148.663] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0148.663] GetProcessHeap () returned 0x4e0000 [0148.663] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0148.663] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0148.664] CloseHandle (hObject=0xdc) returned 1 [0148.664] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2c3e500, ftCreationTime.dwHighDateTime=0x1bd4aed, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd2c3e500, ftLastWriteTime.dwHighDateTime=0x1bd4aed, nFileSizeHigh=0x0, nFileSizeLow=0x16a6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00527_.WMF", cAlternateFileName="")) returned 1 [0148.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0148.666] GetProcessHeap () returned 0x4e0000 [0148.666] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0148.666] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0148.666] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0148.666] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0148.671] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0148.672] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0148.672] GetProcessHeap () returned 0x4e0000 [0148.672] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0148.672] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0148.672] CryptDestroyKey (hKey=0x522f98) returned 1 [0148.672] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0148.672] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0148.672] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0148.672] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0148.672] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0148.672] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0148.672] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0148.672] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0148.672] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.673] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x16a6, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x16a6, lpOverlapped=0x0) returned 1 [0148.677] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x16b0, dwBufLen=0x16b0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x16b0) returned 1 [0148.677] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.677] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x16b0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x16b0, lpOverlapped=0x0) returned 1 [0148.677] CryptDestroyKey (hKey=0x522f98) returned 1 [0148.677] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1784, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.677] SetEndOfFile (hFile=0xdc) returned 1 [0148.680] GetProcessHeap () returned 0x4e0000 [0148.680] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0148.680] GetProcessHeap () returned 0x4e0000 [0148.680] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0148.680] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0148.681] CloseHandle (hObject=0xdc) returned 1 [0148.681] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c49d600, ftCreationTime.dwHighDateTime=0x1bd4b33, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c49d600, ftLastWriteTime.dwHighDateTime=0x1bd4b33, nFileSizeHigh=0x0, nFileSizeLow=0xe86, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00546_.WMF", cAlternateFileName="")) returned 1 [0148.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0148.682] GetProcessHeap () returned 0x4e0000 [0148.682] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0148.682] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0148.682] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0148.682] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0148.690] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0148.690] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0148.690] GetProcessHeap () returned 0x4e0000 [0148.690] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0148.690] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0148.690] CryptDestroyKey (hKey=0x522f98) returned 1 [0148.690] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0148.690] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0148.690] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0148.690] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0148.691] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0148.691] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0148.691] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0148.691] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0148.691] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.691] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xe86, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xe86, lpOverlapped=0x0) returned 1 [0148.691] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe90, dwBufLen=0xe90 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe90) returned 1 [0148.691] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.691] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xe90, lpOverlapped=0x0) returned 1 [0148.691] CryptDestroyKey (hKey=0x522f98) returned 1 [0148.691] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xf64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.691] SetEndOfFile (hFile=0xdc) returned 1 [0148.694] GetProcessHeap () returned 0x4e0000 [0148.694] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0148.694] GetProcessHeap () returned 0x4e0000 [0148.694] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0148.694] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0148.695] CloseHandle (hObject=0xdc) returned 1 [0148.695] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48e63d00, ftCreationTime.dwHighDateTime=0x1bd4b2a, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x48e63d00, ftLastWriteTime.dwHighDateTime=0x1bd4b2a, nFileSizeHigh=0x0, nFileSizeLow=0x5bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00601_.WMF", cAlternateFileName="")) returned 1 [0148.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0148.696] GetProcessHeap () returned 0x4e0000 [0148.696] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0148.696] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0148.696] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0148.696] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0148.698] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0148.698] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0148.698] GetProcessHeap () returned 0x4e0000 [0148.698] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0148.699] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0148.699] CryptDestroyKey (hKey=0x522f98) returned 1 [0148.699] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0148.699] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0148.699] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0148.699] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0148.699] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0148.699] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0148.699] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0148.699] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0148.699] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.700] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5bc, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x5bc, lpOverlapped=0x0) returned 1 [0148.700] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5c0, dwBufLen=0x5c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5c0) returned 1 [0148.700] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.700] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5c0, lpOverlapped=0x0) returned 1 [0148.700] CryptDestroyKey (hKey=0x522f98) returned 1 [0148.700] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.700] SetEndOfFile (hFile=0xdc) returned 1 [0148.703] GetProcessHeap () returned 0x4e0000 [0148.703] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0148.703] GetProcessHeap () returned 0x4e0000 [0148.703] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0148.703] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0148.704] CloseHandle (hObject=0xdc) returned 1 [0148.704] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eb62b00, ftCreationTime.dwHighDateTime=0x1bd4b47, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5eb62b00, ftLastWriteTime.dwHighDateTime=0x1bd4b47, nFileSizeHigh=0x0, nFileSizeLow=0x578, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00602_.WMF", cAlternateFileName="")) returned 1 [0148.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0148.704] GetProcessHeap () returned 0x4e0000 [0148.704] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0148.704] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0148.704] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0148.705] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0148.707] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0148.707] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0148.707] GetProcessHeap () returned 0x4e0000 [0148.707] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0148.707] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0148.707] CryptDestroyKey (hKey=0x522f98) returned 1 [0148.707] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0148.707] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0148.708] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0148.708] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0148.708] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0148.708] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0148.708] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0148.708] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0148.708] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.708] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x578, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x578, lpOverlapped=0x0) returned 1 [0148.708] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x580, dwBufLen=0x580 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x580) returned 1 [0148.708] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.708] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x580, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x580, lpOverlapped=0x0) returned 1 [0148.708] CryptDestroyKey (hKey=0x522f98) returned 1 [0148.708] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x654, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.708] SetEndOfFile (hFile=0xdc) returned 1 [0148.711] GetProcessHeap () returned 0x4e0000 [0148.711] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0148.711] GetProcessHeap () returned 0x4e0000 [0148.711] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0148.711] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0148.712] CloseHandle (hObject=0xdc) returned 1 [0148.712] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aad3100, ftCreationTime.dwHighDateTime=0x1bd4b1b, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1aad3100, ftLastWriteTime.dwHighDateTime=0x1bd4b1b, nFileSizeHigh=0x0, nFileSizeLow=0x3158, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00612_.WMF", cAlternateFileName="")) returned 1 [0148.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0148.713] GetProcessHeap () returned 0x4e0000 [0148.713] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0148.714] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0148.714] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0148.714] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0148.976] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0148.976] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0148.976] GetProcessHeap () returned 0x4e0000 [0148.977] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0148.977] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0148.977] CryptDestroyKey (hKey=0x522f98) returned 1 [0148.977] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0148.977] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0148.977] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0148.977] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0148.977] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0148.977] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0148.977] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0148.977] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0148.977] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.977] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3158, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3158, lpOverlapped=0x0) returned 1 [0149.037] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3160, dwBufLen=0x3160 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3160) returned 1 [0149.037] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.037] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3160, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3160, lpOverlapped=0x0) returned 1 [0149.037] CryptDestroyKey (hKey=0x522f98) returned 1 [0149.037] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3234, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.037] SetEndOfFile (hFile=0xdc) returned 1 [0149.039] GetProcessHeap () returned 0x4e0000 [0149.039] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0149.039] GetProcessHeap () returned 0x4e0000 [0149.039] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0149.039] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0149.040] CloseHandle (hObject=0xdc) returned 1 [0149.040] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98237200, ftCreationTime.dwHighDateTime=0x1bd4b18, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x98237200, ftLastWriteTime.dwHighDateTime=0x1bd4b18, nFileSizeHigh=0x0, nFileSizeLow=0x2994, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00623_.WMF", cAlternateFileName="")) returned 1 [0149.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0149.041] GetProcessHeap () returned 0x4e0000 [0149.041] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0149.041] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0149.041] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0149.041] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0149.069] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0149.069] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0149.069] GetProcessHeap () returned 0x4e0000 [0149.069] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0149.069] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0149.070] CryptDestroyKey (hKey=0x522f98) returned 1 [0149.070] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0149.070] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0149.070] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0149.070] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0149.070] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0149.070] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0149.070] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0149.070] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0149.070] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.070] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2994, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2994, lpOverlapped=0x0) returned 1 [0149.075] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x29a0, dwBufLen=0x29a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x29a0) returned 1 [0149.075] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.075] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x29a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x29a0, lpOverlapped=0x0) returned 1 [0149.076] CryptDestroyKey (hKey=0x522f98) returned 1 [0149.076] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2a74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.076] SetEndOfFile (hFile=0xdc) returned 1 [0149.078] GetProcessHeap () returned 0x4e0000 [0149.078] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0149.078] GetProcessHeap () returned 0x4e0000 [0149.078] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0149.078] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0149.079] CloseHandle (hObject=0xdc) returned 1 [0149.079] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b873a00, ftCreationTime.dwHighDateTime=0x1bd4b18, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b873a00, ftLastWriteTime.dwHighDateTime=0x1bd4b18, nFileSizeHigh=0x0, nFileSizeLow=0x844, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00625_.WMF", cAlternateFileName="")) returned 1 [0149.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0149.079] GetProcessHeap () returned 0x4e0000 [0149.079] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0149.079] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0149.079] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0149.080] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0149.112] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0149.112] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0149.112] GetProcessHeap () returned 0x4e0000 [0149.112] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0149.112] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0149.112] CryptDestroyKey (hKey=0x522f98) returned 1 [0149.112] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0149.112] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0149.113] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0149.113] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0149.113] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0149.113] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0149.113] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0149.113] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0149.113] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.113] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x844, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x844, lpOverlapped=0x0) returned 1 [0149.113] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x850, dwBufLen=0x850 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x850) returned 1 [0149.113] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.113] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x850, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x850, lpOverlapped=0x0) returned 1 [0149.113] CryptDestroyKey (hKey=0x522f98) returned 1 [0149.113] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x924, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.113] SetEndOfFile (hFile=0xdc) returned 1 [0149.115] GetProcessHeap () returned 0x4e0000 [0149.115] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0149.115] GetProcessHeap () returned 0x4e0000 [0149.115] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0149.115] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0149.116] CloseHandle (hObject=0xdc) returned 1 [0149.116] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5d7f800, ftCreationTime.dwHighDateTime=0x1bd4b16, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5d7f800, ftLastWriteTime.dwHighDateTime=0x1bd4b16, nFileSizeHigh=0x0, nFileSizeLow=0x620, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00636_.WMF", cAlternateFileName="")) returned 1 [0149.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0149.118] GetProcessHeap () returned 0x4e0000 [0149.118] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0149.118] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0149.118] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0149.118] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0149.118] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0149.118] GetProcessHeap () returned 0x4e0000 [0149.118] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0149.118] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0149.118] CryptDestroyKey (hKey=0x522f98) returned 1 [0149.118] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0149.120] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0149.120] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0149.120] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0149.120] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0149.120] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0149.120] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0149.120] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0149.120] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.121] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x620, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x620, lpOverlapped=0x0) returned 1 [0149.121] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x620, dwBufLen=0x620 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x620) returned 1 [0149.121] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.121] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x620, lpOverlapped=0x0) returned 1 [0149.121] CryptDestroyKey (hKey=0x522f98) returned 1 [0149.121] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.121] SetEndOfFile (hFile=0xdc) returned 1 [0149.123] GetProcessHeap () returned 0x4e0000 [0149.123] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0149.123] GetProcessHeap () returned 0x4e0000 [0149.123] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0149.123] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0149.124] CloseHandle (hObject=0xdc) returned 1 [0149.124] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9db29500, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9db29500, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x2ce2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00669_.WMF", cAlternateFileName="")) returned 1 [0149.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0149.124] GetProcessHeap () returned 0x4e0000 [0149.124] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0149.125] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0149.125] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0149.125] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0149.126] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0149.126] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0149.126] GetProcessHeap () returned 0x4e0000 [0149.126] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0149.126] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0149.126] CryptDestroyKey (hKey=0x522f98) returned 1 [0149.126] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0149.126] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0149.126] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0149.127] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0149.127] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0149.127] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0149.127] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0149.127] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0149.127] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.127] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2ce2, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2ce2, lpOverlapped=0x0) returned 1 [0149.128] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2cf0, dwBufLen=0x2cf0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2cf0) returned 1 [0149.128] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.128] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2cf0, lpOverlapped=0x0) returned 1 [0149.128] CryptDestroyKey (hKey=0x522f98) returned 1 [0149.128] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2dc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.128] SetEndOfFile (hFile=0xdc) returned 1 [0149.130] GetProcessHeap () returned 0x4e0000 [0149.130] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0149.130] GetProcessHeap () returned 0x4e0000 [0149.130] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0149.130] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0149.131] CloseHandle (hObject=0xdc) returned 1 [0149.131] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39dc9c00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x39dc9c00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x2454, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00681_.WMF", cAlternateFileName="")) returned 1 [0149.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0149.131] GetProcessHeap () returned 0x4e0000 [0149.131] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0149.132] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0149.132] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0149.132] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0149.133] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0149.133] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0149.133] GetProcessHeap () returned 0x4e0000 [0149.133] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0149.133] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0149.133] CryptDestroyKey (hKey=0x522f98) returned 1 [0149.133] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0149.133] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0149.133] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0149.133] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0149.134] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0149.134] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0149.134] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0149.134] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0149.134] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.134] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2454, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2454, lpOverlapped=0x0) returned 1 [0149.134] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2460, dwBufLen=0x2460 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2460) returned 1 [0149.135] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.135] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2460, lpOverlapped=0x0) returned 1 [0149.135] CryptDestroyKey (hKey=0x522f98) returned 1 [0149.135] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2534, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.135] SetEndOfFile (hFile=0xdc) returned 1 [0149.137] GetProcessHeap () returned 0x4e0000 [0149.137] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0149.137] GetProcessHeap () returned 0x4e0000 [0149.137] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0149.137] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0149.138] CloseHandle (hObject=0xdc) returned 1 [0149.138] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cf47e00, ftCreationTime.dwHighDateTime=0x1bd4b1e, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3cf47e00, ftLastWriteTime.dwHighDateTime=0x1bd4b1e, nFileSizeHigh=0x0, nFileSizeLow=0xfc0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00685_.WMF", cAlternateFileName="")) returned 1 [0149.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0149.138] GetProcessHeap () returned 0x4e0000 [0149.138] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0149.138] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0149.138] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0149.138] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0149.138] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0149.138] GetProcessHeap () returned 0x4e0000 [0149.138] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0149.139] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0149.139] CryptDestroyKey (hKey=0x522f98) returned 1 [0149.139] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0149.257] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0149.257] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0149.257] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0149.257] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0149.257] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0149.258] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0149.258] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0149.258] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.258] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xfc0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xfc0, lpOverlapped=0x0) returned 1 [0149.258] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xfc0, dwBufLen=0xfc0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xfc0) returned 1 [0149.258] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.258] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xfc0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xfc0, lpOverlapped=0x0) returned 1 [0149.258] CryptDestroyKey (hKey=0x522f98) returned 1 [0149.258] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1094, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.258] SetEndOfFile (hFile=0xdc) returned 1 [0149.260] GetProcessHeap () returned 0x4e0000 [0149.260] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0149.260] GetProcessHeap () returned 0x4e0000 [0149.260] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0149.260] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0149.261] CloseHandle (hObject=0xdc) returned 1 [0149.261] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c816800, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9c816800, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x10f4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00687_.WMF", cAlternateFileName="")) returned 1 [0149.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0149.265] GetProcessHeap () returned 0x4e0000 [0149.265] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0149.266] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0149.266] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0149.266] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0149.268] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0149.268] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0149.268] GetProcessHeap () returned 0x4e0000 [0149.268] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0149.268] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0149.269] CryptDestroyKey (hKey=0x522f98) returned 1 [0149.269] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0149.269] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0149.269] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0149.269] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0149.269] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0149.269] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0149.269] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0149.269] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0149.269] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.269] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x10f4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x10f4, lpOverlapped=0x0) returned 1 [0149.281] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1100, dwBufLen=0x1100 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1100) returned 1 [0149.281] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.281] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1100, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1100, lpOverlapped=0x0) returned 1 [0149.281] CryptDestroyKey (hKey=0x522f98) returned 1 [0149.281] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x11d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.281] SetEndOfFile (hFile=0xdc) returned 1 [0149.283] GetProcessHeap () returned 0x4e0000 [0149.283] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0149.284] GetProcessHeap () returned 0x4e0000 [0149.284] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0149.284] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0149.285] CloseHandle (hObject=0xdc) returned 1 [0149.285] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x159db100, ftCreationTime.dwHighDateTime=0x1bd4b1e, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x159db100, ftLastWriteTime.dwHighDateTime=0x1bd4b1e, nFileSizeHigh=0x0, nFileSizeLow=0x1bac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00688_.WMF", cAlternateFileName="")) returned 1 [0149.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0149.285] GetProcessHeap () returned 0x4e0000 [0149.285] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0149.285] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0149.285] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0149.285] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0149.287] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0149.287] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0149.287] GetProcessHeap () returned 0x4e0000 [0149.287] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0149.287] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0149.287] CryptDestroyKey (hKey=0x522f98) returned 1 [0149.287] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0149.287] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0149.288] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0149.288] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0149.288] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0149.288] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0149.288] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0149.288] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0149.288] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.288] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1bac, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1bac, lpOverlapped=0x0) returned 1 [0149.289] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1bb0, dwBufLen=0x1bb0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1bb0) returned 1 [0149.289] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.289] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1bb0, lpOverlapped=0x0) returned 1 [0149.289] CryptDestroyKey (hKey=0x522f98) returned 1 [0149.289] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1c84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.289] SetEndOfFile (hFile=0xdc) returned 1 [0149.291] GetProcessHeap () returned 0x4e0000 [0149.291] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0149.291] GetProcessHeap () returned 0x4e0000 [0149.291] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0149.291] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0149.292] CloseHandle (hObject=0xdc) returned 1 [0149.292] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b503b00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b503b00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1bba, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00693_.WMF", cAlternateFileName="")) returned 1 [0149.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0149.292] GetProcessHeap () returned 0x4e0000 [0149.292] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0149.292] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0149.292] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0149.292] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0149.317] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0149.317] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0149.317] GetProcessHeap () returned 0x4e0000 [0149.317] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0149.317] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0149.317] CryptDestroyKey (hKey=0x522f98) returned 1 [0149.317] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0149.317] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0149.317] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0149.317] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0149.317] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0149.317] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0149.317] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0149.317] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0149.318] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.318] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1bba, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1bba, lpOverlapped=0x0) returned 1 [0149.364] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1bc0, dwBufLen=0x1bc0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1bc0) returned 1 [0149.364] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.364] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1bc0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1bc0, lpOverlapped=0x0) returned 1 [0149.364] CryptDestroyKey (hKey=0x522f98) returned 1 [0149.364] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1c94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.364] SetEndOfFile (hFile=0xdc) returned 1 [0149.366] GetProcessHeap () returned 0x4e0000 [0149.366] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0149.366] GetProcessHeap () returned 0x4e0000 [0149.366] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0149.366] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0149.367] CloseHandle (hObject=0xdc) returned 1 [0149.367] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7507bb00, ftCreationTime.dwHighDateTime=0x1bd4b36, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7507bb00, ftLastWriteTime.dwHighDateTime=0x1bd4b36, nFileSizeHigh=0x0, nFileSizeLow=0xb20, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH01013_.WMF", cAlternateFileName="")) returned 1 [0149.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0149.369] GetProcessHeap () returned 0x4e0000 [0149.369] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0149.369] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0149.369] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0149.369] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0149.369] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0149.369] GetProcessHeap () returned 0x4e0000 [0149.369] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0149.369] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0149.369] CryptDestroyKey (hKey=0x522f98) returned 1 [0149.369] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0149.370] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0149.370] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0149.371] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0149.371] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0149.371] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0149.371] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0149.371] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0149.371] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.371] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb20, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xb20, lpOverlapped=0x0) returned 1 [0149.371] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xb20, dwBufLen=0xb20 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xb20) returned 1 [0149.371] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.371] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xb20, lpOverlapped=0x0) returned 1 [0149.371] CryptDestroyKey (hKey=0x522f98) returned 1 [0149.371] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xbf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.371] SetEndOfFile (hFile=0xdc) returned 1 [0149.373] GetProcessHeap () returned 0x4e0000 [0149.373] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0149.373] GetProcessHeap () returned 0x4e0000 [0149.373] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0149.374] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0149.374] CloseHandle (hObject=0xdc) returned 1 [0149.374] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x47c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH01015_.WMF", cAlternateFileName="")) returned 1 [0149.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0149.375] GetProcessHeap () returned 0x4e0000 [0149.375] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0149.375] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0149.375] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0149.375] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0149.509] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0149.510] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0149.510] GetProcessHeap () returned 0x4e0000 [0149.510] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0149.510] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0149.510] CryptDestroyKey (hKey=0x522f98) returned 1 [0149.510] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0149.510] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0149.510] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0149.510] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0149.510] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0149.510] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0149.510] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0149.510] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0149.510] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.510] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x47c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x47c, lpOverlapped=0x0) returned 1 [0149.510] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x480, dwBufLen=0x480 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x480) returned 1 [0149.511] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.511] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x480, lpOverlapped=0x0) returned 1 [0149.511] CryptDestroyKey (hKey=0x522f98) returned 1 [0149.511] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x554, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.511] SetEndOfFile (hFile=0xdc) returned 1 [0149.513] GetProcessHeap () returned 0x4e0000 [0149.513] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0149.513] GetProcessHeap () returned 0x4e0000 [0149.513] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0149.513] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0149.514] CloseHandle (hObject=0xdc) returned 1 [0149.514] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x436e0000, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x436e0000, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0xac4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH01058_.WMF", cAlternateFileName="")) returned 1 [0149.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0149.514] GetProcessHeap () returned 0x4e0000 [0149.515] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0149.515] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0149.515] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0149.515] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0149.516] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0149.516] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0149.516] GetProcessHeap () returned 0x4e0000 [0149.516] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0149.516] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0149.516] CryptDestroyKey (hKey=0x522f98) returned 1 [0149.516] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0149.517] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0149.517] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0149.517] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0149.517] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0149.517] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0149.517] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0149.517] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0149.517] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.517] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xac4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xac4, lpOverlapped=0x0) returned 1 [0149.517] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xad0, dwBufLen=0xad0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xad0) returned 1 [0149.517] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.517] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xad0, lpOverlapped=0x0) returned 1 [0149.517] CryptDestroyKey (hKey=0x522f98) returned 1 [0149.517] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xba4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.517] SetEndOfFile (hFile=0xdc) returned 1 [0149.520] GetProcessHeap () returned 0x4e0000 [0149.520] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0149.520] GetProcessHeap () returned 0x4e0000 [0149.520] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0149.520] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0149.521] CloseHandle (hObject=0xdc) returned 1 [0149.521] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39e49800, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x39e49800, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0x4f4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH01065_.WMF", cAlternateFileName="")) returned 1 [0149.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0149.522] GetProcessHeap () returned 0x4e0000 [0149.522] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0149.522] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0149.522] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0149.522] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0149.524] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0149.524] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0149.524] GetProcessHeap () returned 0x4e0000 [0149.524] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0149.524] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0149.524] CryptDestroyKey (hKey=0x522f98) returned 1 [0149.524] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0149.524] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0149.524] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0149.524] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0149.525] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0149.525] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0149.525] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0149.525] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0149.525] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.525] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4f4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4f4, lpOverlapped=0x0) returned 1 [0149.525] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x500, dwBufLen=0x500 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x500) returned 1 [0149.525] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.525] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x500, lpOverlapped=0x0) returned 1 [0149.526] CryptDestroyKey (hKey=0x522f98) returned 1 [0149.526] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.527] SetEndOfFile (hFile=0xdc) returned 1 [0149.530] GetProcessHeap () returned 0x4e0000 [0149.530] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0149.530] GetProcessHeap () returned 0x4e0000 [0149.530] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0149.530] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0149.531] CloseHandle (hObject=0xdc) returned 1 [0149.531] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25a09b00, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x25a09b00, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0x1388, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH01080_.WMF", cAlternateFileName="")) returned 1 [0149.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0149.531] GetProcessHeap () returned 0x4e0000 [0149.531] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0149.531] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0149.531] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0149.531] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0149.533] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0149.533] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0149.533] GetProcessHeap () returned 0x4e0000 [0149.533] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0149.533] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0149.533] CryptDestroyKey (hKey=0x522f98) returned 1 [0149.533] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0149.533] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0149.533] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0149.533] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0149.533] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0149.533] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0149.534] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0149.534] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0149.534] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.534] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1388, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1388, lpOverlapped=0x0) returned 1 [0149.534] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1390, dwBufLen=0x1390 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1390) returned 1 [0149.534] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.534] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1390, lpOverlapped=0x0) returned 1 [0149.535] CryptDestroyKey (hKey=0x522f98) returned 1 [0149.535] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.535] SetEndOfFile (hFile=0xdc) returned 1 [0149.537] GetProcessHeap () returned 0x4e0000 [0149.537] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0149.537] GetProcessHeap () returned 0x4e0000 [0149.537] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0149.537] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0149.537] CloseHandle (hObject=0xdc) returned 1 [0149.538] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1cac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH01242_.WMF", cAlternateFileName="")) returned 1 [0149.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0149.539] GetProcessHeap () returned 0x4e0000 [0149.539] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0149.539] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0149.539] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0149.539] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0149.540] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0149.540] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0149.540] GetProcessHeap () returned 0x4e0000 [0149.540] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0149.540] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0149.540] CryptDestroyKey (hKey=0x522f98) returned 1 [0149.540] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0149.540] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0149.540] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0149.540] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0149.541] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0149.541] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0149.541] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0149.541] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0149.541] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.541] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1cac, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1cac, lpOverlapped=0x0) returned 1 [0149.541] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1cb0, dwBufLen=0x1cb0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1cb0) returned 1 [0149.542] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.542] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1cb0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1cb0, lpOverlapped=0x0) returned 1 [0149.542] CryptDestroyKey (hKey=0x522f98) returned 1 [0149.542] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1d84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.542] SetEndOfFile (hFile=0xdc) returned 1 [0149.544] GetProcessHeap () returned 0x4e0000 [0149.544] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0149.544] GetProcessHeap () returned 0x4e0000 [0149.544] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0149.544] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0149.545] CloseHandle (hObject=0xdc) returned 1 [0149.545] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3dbe, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH01291_.WMF", cAlternateFileName="")) returned 1 [0149.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0149.545] GetProcessHeap () returned 0x4e0000 [0149.545] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0149.545] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0149.545] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0149.545] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0149.547] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0149.547] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0149.547] GetProcessHeap () returned 0x4e0000 [0149.547] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0149.547] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0149.547] CryptDestroyKey (hKey=0x522f98) returned 1 [0149.547] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0149.547] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0149.547] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0149.547] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0149.547] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0149.547] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0149.548] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0149.548] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0149.548] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.548] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3dbe, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3dbe, lpOverlapped=0x0) returned 1 [0149.548] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3dc0, dwBufLen=0x3dc0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3dc0) returned 1 [0149.548] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.549] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3dc0, lpOverlapped=0x0) returned 1 [0149.549] CryptDestroyKey (hKey=0x522f98) returned 1 [0149.549] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.549] SetEndOfFile (hFile=0xdc) returned 1 [0149.551] GetProcessHeap () returned 0x4e0000 [0149.551] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0149.551] GetProcessHeap () returned 0x4e0000 [0149.551] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0149.551] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0149.552] CloseHandle (hObject=0xdc) returned 1 [0149.552] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1780, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH01329_.WMF", cAlternateFileName="")) returned 1 [0149.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0149.552] GetProcessHeap () returned 0x4e0000 [0149.552] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0149.552] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0149.552] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0149.552] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0149.552] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0149.552] GetProcessHeap () returned 0x4e0000 [0149.552] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0149.552] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0149.552] CryptDestroyKey (hKey=0x522f98) returned 1 [0149.552] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0149.590] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0149.590] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0149.590] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0149.590] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0149.590] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0149.590] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0149.590] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0149.590] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.590] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1780, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1780, lpOverlapped=0x0) returned 1 [0149.600] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1780, dwBufLen=0x1780 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1780) returned 1 [0149.600] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.600] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1780, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1780, lpOverlapped=0x0) returned 1 [0149.600] CryptDestroyKey (hKey=0x522f98) returned 1 [0149.600] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1854, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.600] SetEndOfFile (hFile=0xdc) returned 1 [0149.603] GetProcessHeap () returned 0x4e0000 [0149.603] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0149.603] GetProcessHeap () returned 0x4e0000 [0149.603] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0149.603] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0149.604] CloseHandle (hObject=0xdc) returned 1 [0149.604] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90080a00, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90080a00, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x1746, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH01461_.WMF", cAlternateFileName="")) returned 1 [0149.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0149.604] GetProcessHeap () returned 0x4e0000 [0149.604] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0149.604] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0149.604] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0149.605] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0149.612] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0149.612] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0149.612] GetProcessHeap () returned 0x4e0000 [0149.612] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0149.612] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0149.612] CryptDestroyKey (hKey=0x522f98) returned 1 [0149.612] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0149.612] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0149.612] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0149.612] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0149.613] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0149.613] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0149.613] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0149.613] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0149.613] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.613] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1746, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1746, lpOverlapped=0x0) returned 1 [0149.641] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1750, dwBufLen=0x1750 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1750) returned 1 [0149.641] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.641] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1750, lpOverlapped=0x0) returned 1 [0149.641] CryptDestroyKey (hKey=0x522f98) returned 1 [0149.641] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1824, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.641] SetEndOfFile (hFile=0xdc) returned 1 [0149.643] GetProcessHeap () returned 0x4e0000 [0149.643] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0149.643] GetProcessHeap () returned 0x4e0000 [0149.643] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0149.643] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0149.644] CloseHandle (hObject=0xdc) returned 1 [0149.644] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1c80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH01618_.WMF", cAlternateFileName="")) returned 1 [0149.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0149.645] GetProcessHeap () returned 0x4e0000 [0149.645] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0149.645] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0149.645] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0149.645] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0149.645] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0149.645] GetProcessHeap () returned 0x4e0000 [0149.645] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0149.645] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0149.645] CryptDestroyKey (hKey=0x522f98) returned 1 [0149.645] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0149.654] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0149.654] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0149.654] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0149.654] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0149.654] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0149.654] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0149.654] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0149.654] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.654] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1c80, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1c80, lpOverlapped=0x0) returned 1 [0149.667] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1c80, dwBufLen=0x1c80 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1c80) returned 1 [0149.667] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.667] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1c80, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1c80, lpOverlapped=0x0) returned 1 [0149.667] CryptDestroyKey (hKey=0x522f98) returned 1 [0149.667] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1d54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.667] SetEndOfFile (hFile=0xdc) returned 1 [0149.670] GetProcessHeap () returned 0x4e0000 [0149.670] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0149.670] GetProcessHeap () returned 0x4e0000 [0149.670] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0149.670] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0149.671] CloseHandle (hObject=0xdc) returned 1 [0149.671] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83101700, ftCreationTime.dwHighDateTime=0x1bd4bdc, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83101700, ftLastWriteTime.dwHighDateTime=0x1bd4bdc, nFileSizeHigh=0x0, nFileSizeLow=0x1526, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH01759_.WMF", cAlternateFileName="")) returned 1 [0149.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0149.672] GetProcessHeap () returned 0x4e0000 [0149.672] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0149.672] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0149.672] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0149.672] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0149.676] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0149.676] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0149.676] GetProcessHeap () returned 0x4e0000 [0149.676] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0149.676] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0149.676] CryptDestroyKey (hKey=0x522f98) returned 1 [0149.676] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0149.676] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0149.676] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0149.676] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0149.677] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0149.677] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0149.677] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0149.677] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0149.677] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.677] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1526, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1526, lpOverlapped=0x0) returned 1 [0149.678] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1530, dwBufLen=0x1530 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1530) returned 1 [0149.678] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.678] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1530, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1530, lpOverlapped=0x0) returned 1 [0149.678] CryptDestroyKey (hKey=0x522f98) returned 1 [0149.678] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1604, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.678] SetEndOfFile (hFile=0xdc) returned 1 [0149.683] GetProcessHeap () returned 0x4e0000 [0149.683] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0149.683] GetProcessHeap () returned 0x4e0000 [0149.683] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0149.683] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0149.684] CloseHandle (hObject=0xdc) returned 1 [0149.684] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b938600, ftCreationTime.dwHighDateTime=0x1bd4bf0, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b938600, ftLastWriteTime.dwHighDateTime=0x1bd4bf0, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH01875_.WMF", cAlternateFileName="")) returned 1 [0149.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0149.684] GetProcessHeap () returned 0x4e0000 [0149.684] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0149.684] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0149.684] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0149.684] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0149.693] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0149.693] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0149.693] GetProcessHeap () returned 0x4e0000 [0149.694] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0149.694] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0149.694] CryptDestroyKey (hKey=0x522f98) returned 1 [0149.694] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0149.694] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0149.694] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0149.694] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0149.694] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0149.694] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0149.694] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0149.694] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0149.694] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.694] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xa38, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xa38, lpOverlapped=0x0) returned 1 [0149.694] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa40, dwBufLen=0xa40 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa40) returned 1 [0149.694] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.694] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xa40, lpOverlapped=0x0) returned 1 [0149.694] CryptDestroyKey (hKey=0x522f98) returned 1 [0149.694] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xb14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.695] SetEndOfFile (hFile=0xdc) returned 1 [0149.697] GetProcessHeap () returned 0x4e0000 [0149.697] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0149.697] GetProcessHeap () returned 0x4e0000 [0149.697] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0149.697] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0149.698] CloseHandle (hObject=0xdc) returned 1 [0149.698] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71426a00, ftCreationTime.dwHighDateTime=0x1bd4c04, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71426a00, ftLastWriteTime.dwHighDateTime=0x1bd4c04, nFileSizeHigh=0x0, nFileSizeLow=0x6852, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH01923_.WMF", cAlternateFileName="")) returned 1 [0149.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0149.699] GetProcessHeap () returned 0x4e0000 [0149.699] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0149.699] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0149.699] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0149.699] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0149.701] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0149.701] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0149.701] GetProcessHeap () returned 0x4e0000 [0149.701] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0149.701] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0149.701] CryptDestroyKey (hKey=0x522f98) returned 1 [0149.701] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0149.701] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0149.701] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0149.701] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0149.701] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0149.701] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0149.702] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0149.702] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0149.702] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.702] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x6852, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x6852, lpOverlapped=0x0) returned 1 [0149.702] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6860, dwBufLen=0x6860 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6860) returned 1 [0149.703] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.703] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6860, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x6860, lpOverlapped=0x0) returned 1 [0149.703] CryptDestroyKey (hKey=0x522f98) returned 1 [0149.703] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6934, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.703] SetEndOfFile (hFile=0xdc) returned 1 [0149.705] GetProcessHeap () returned 0x4e0000 [0149.705] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0149.705] GetProcessHeap () returned 0x4e0000 [0149.705] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0149.705] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0149.706] CloseHandle (hObject=0xdc) returned 1 [0149.706] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH02155_.WMF", cAlternateFileName="")) returned 1 [0149.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0149.706] GetProcessHeap () returned 0x4e0000 [0149.706] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0149.706] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0149.706] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0149.707] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0149.707] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0149.707] GetProcessHeap () returned 0x4e0000 [0149.707] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0149.707] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0149.707] CryptDestroyKey (hKey=0x522f98) returned 1 [0149.707] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0149.708] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0149.708] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0149.708] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0149.708] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0149.708] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0149.709] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0149.709] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0149.709] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.709] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xa90, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xa90, lpOverlapped=0x0) returned 1 [0149.709] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa90, dwBufLen=0xa90 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa90) returned 1 [0149.709] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.709] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xa90, lpOverlapped=0x0) returned 1 [0149.709] CryptDestroyKey (hKey=0x522f98) returned 1 [0149.709] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xb64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.709] SetEndOfFile (hFile=0xdc) returned 1 [0149.711] GetProcessHeap () returned 0x4e0000 [0149.711] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0149.711] GetProcessHeap () returned 0x4e0000 [0149.711] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0149.711] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0149.712] CloseHandle (hObject=0xdc) returned 1 [0149.712] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b48ba00, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b48ba00, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x52c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH02166_.WMF", cAlternateFileName="")) returned 1 [0149.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0149.712] GetProcessHeap () returned 0x4e0000 [0149.712] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0149.712] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0149.712] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0149.712] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0149.731] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0149.731] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0149.731] GetProcessHeap () returned 0x4e0000 [0149.732] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0149.732] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0149.732] CryptDestroyKey (hKey=0x522f98) returned 1 [0149.732] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0149.732] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0149.732] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0149.732] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0149.732] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0149.732] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0149.732] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0149.732] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0149.732] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.732] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x52c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x52c, lpOverlapped=0x0) returned 1 [0149.732] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x530, dwBufLen=0x530 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x530) returned 1 [0149.732] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.732] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x530, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x530, lpOverlapped=0x0) returned 1 [0149.732] CryptDestroyKey (hKey=0x522f98) returned 1 [0149.732] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x604, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.733] SetEndOfFile (hFile=0xdc) returned 1 [0149.735] GetProcessHeap () returned 0x4e0000 [0149.735] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0149.735] GetProcessHeap () returned 0x4e0000 [0149.735] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0149.735] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0149.736] CloseHandle (hObject=0xdc) returned 1 [0149.736] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1e4b800, ftCreationTime.dwHighDateTime=0x1bd4bf1, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb1e4b800, ftLastWriteTime.dwHighDateTime=0x1bd4bf1, nFileSizeHigh=0x0, nFileSizeLow=0x1efc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH02282_.WMF", cAlternateFileName="")) returned 1 [0149.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0149.736] GetProcessHeap () returned 0x4e0000 [0149.736] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0149.736] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0149.736] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0149.736] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0149.746] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0149.746] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0149.746] GetProcessHeap () returned 0x4e0000 [0149.746] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0149.746] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0149.746] CryptDestroyKey (hKey=0x522f98) returned 1 [0149.746] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0149.746] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0149.746] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0149.746] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0149.746] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0149.746] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0149.746] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0149.746] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0149.746] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.747] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1efc, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1efc, lpOverlapped=0x0) returned 1 [0149.764] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1f00, dwBufLen=0x1f00 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1f00) returned 1 [0149.764] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.764] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1f00, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1f00, lpOverlapped=0x0) returned 1 [0149.765] CryptDestroyKey (hKey=0x522f98) returned 1 [0149.765] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1fd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.765] SetEndOfFile (hFile=0xdc) returned 1 [0149.767] GetProcessHeap () returned 0x4e0000 [0149.767] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0149.767] GetProcessHeap () returned 0x4e0000 [0149.767] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0149.767] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0149.768] CloseHandle (hObject=0xdc) returned 1 [0149.768] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fa59600, ftCreationTime.dwHighDateTime=0x1bd4bf5, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5fa59600, ftLastWriteTime.dwHighDateTime=0x1bd4bf5, nFileSizeHigh=0x0, nFileSizeLow=0x15b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH02298_.WMF", cAlternateFileName="")) returned 1 [0149.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0149.769] GetProcessHeap () returned 0x4e0000 [0149.769] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0149.769] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0149.769] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0149.769] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0149.769] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0149.769] GetProcessHeap () returned 0x4e0000 [0149.769] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0149.770] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0149.770] CryptDestroyKey (hKey=0x522f98) returned 1 [0149.770] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0149.771] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0149.771] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0149.771] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0149.771] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0149.771] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0149.771] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0149.771] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0149.772] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.772] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x15b0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x15b0, lpOverlapped=0x0) returned 1 [0149.772] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x15b0, dwBufLen=0x15b0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x15b0) returned 1 [0149.772] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.772] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x15b0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x15b0, lpOverlapped=0x0) returned 1 [0149.772] CryptDestroyKey (hKey=0x522f98) returned 1 [0149.772] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.772] SetEndOfFile (hFile=0xdc) returned 1 [0149.775] GetProcessHeap () returned 0x4e0000 [0149.775] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0149.775] GetProcessHeap () returned 0x4e0000 [0149.775] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0149.775] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0149.776] CloseHandle (hObject=0xdc) returned 1 [0149.776] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3cd4300, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x538bb350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd3cd4300, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x136a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH02312_.WMF", cAlternateFileName="")) returned 1 [0149.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0149.788] GetProcessHeap () returned 0x4e0000 [0149.788] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0149.788] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0149.788] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0149.788] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0149.796] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0149.796] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0149.796] GetProcessHeap () returned 0x4e0000 [0149.796] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0149.797] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0149.797] CryptDestroyKey (hKey=0x522f98) returned 1 [0149.797] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0149.797] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0149.797] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0149.797] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0149.797] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0149.797] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0149.797] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0149.797] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0149.797] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.797] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x136a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x136a, lpOverlapped=0x0) returned 1 [0149.808] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1370, dwBufLen=0x1370 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1370) returned 1 [0149.808] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.808] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1370, lpOverlapped=0x0) returned 1 [0149.808] CryptDestroyKey (hKey=0x522f98) returned 1 [0149.808] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1444, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.808] SetEndOfFile (hFile=0xdc) returned 1 [0149.810] GetProcessHeap () returned 0x4e0000 [0149.810] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0149.810] GetProcessHeap () returned 0x4e0000 [0149.810] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0149.810] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0149.811] CloseHandle (hObject=0xdc) returned 1 [0149.811] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x949ef200, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x949ef200, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0xc0a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH02313_.WMF", cAlternateFileName="")) returned 1 [0149.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0149.812] GetProcessHeap () returned 0x4e0000 [0149.812] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0149.812] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0149.812] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0149.812] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0149.814] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0149.814] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0149.814] GetProcessHeap () returned 0x4e0000 [0149.814] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0149.814] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0149.814] CryptDestroyKey (hKey=0x522f98) returned 1 [0149.814] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0149.814] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0149.814] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0149.814] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0149.814] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0149.814] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0149.814] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0149.814] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0149.814] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.814] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xc0a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xc0a, lpOverlapped=0x0) returned 1 [0149.814] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xc10, dwBufLen=0xc10 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xc10) returned 1 [0149.814] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.814] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc10, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xc10, lpOverlapped=0x0) returned 1 [0149.815] CryptDestroyKey (hKey=0x522f98) returned 1 [0149.815] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xce4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.815] SetEndOfFile (hFile=0xdc) returned 1 [0149.817] GetProcessHeap () returned 0x4e0000 [0149.817] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0149.817] GetProcessHeap () returned 0x4e0000 [0149.817] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0149.817] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0149.818] CloseHandle (hObject=0xdc) returned 1 [0149.818] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58502100, ftCreationTime.dwHighDateTime=0x1bf0ae8, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58502100, ftLastWriteTime.dwHighDateTime=0x1bf0ae8, nFileSizeHigh=0x0, nFileSizeLow=0x5b04, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HM00005_.WMF", cAlternateFileName="")) returned 1 [0149.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0149.819] GetProcessHeap () returned 0x4e0000 [0149.819] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0149.819] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0149.819] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0149.819] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0149.821] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0149.821] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0149.821] GetProcessHeap () returned 0x4e0000 [0149.821] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0149.821] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0149.821] CryptDestroyKey (hKey=0x522f98) returned 1 [0149.821] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0149.821] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0149.821] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0149.821] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0149.821] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0149.821] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0149.821] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0149.821] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0149.821] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.821] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5b04, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x5b04, lpOverlapped=0x0) returned 1 [0149.860] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5b10, dwBufLen=0x5b10 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5b10) returned 1 [0149.860] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.860] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5b10, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5b10, lpOverlapped=0x0) returned 1 [0149.860] CryptDestroyKey (hKey=0x522f98) returned 1 [0149.860] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5be4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.860] SetEndOfFile (hFile=0xdc) returned 1 [0149.863] GetProcessHeap () returned 0x4e0000 [0149.863] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0149.863] GetProcessHeap () returned 0x4e0000 [0149.863] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0149.863] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0149.864] CloseHandle (hObject=0xdc) returned 1 [0149.864] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc19dc700, ftCreationTime.dwHighDateTime=0x1bd4b33, ftLastAccessTime.dwLowDateTime=0x538bb350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc19dc700, ftLastWriteTime.dwHighDateTime=0x1bd4b33, nFileSizeHigh=0x0, nFileSizeLow=0x5664, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HM00114_.WMF", cAlternateFileName="")) returned 1 [0149.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0149.865] GetProcessHeap () returned 0x4e0000 [0149.865] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0149.865] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0149.865] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0149.865] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0149.899] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0149.899] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0149.899] GetProcessHeap () returned 0x4e0000 [0149.899] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0149.899] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0149.899] CryptDestroyKey (hKey=0x522f98) returned 1 [0149.899] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0149.899] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0149.899] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0149.899] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0149.899] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0149.899] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0149.899] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0149.899] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0149.899] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.899] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5664, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x5664, lpOverlapped=0x0) returned 1 [0149.901] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5670, dwBufLen=0x5670 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5670) returned 1 [0149.901] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.901] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5670, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5670, lpOverlapped=0x0) returned 1 [0149.901] CryptDestroyKey (hKey=0x522f98) returned 1 [0149.901] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5744, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.901] SetEndOfFile (hFile=0xdc) returned 1 [0149.904] GetProcessHeap () returned 0x4e0000 [0149.904] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0149.904] GetProcessHeap () returned 0x4e0000 [0149.904] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0149.904] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0149.905] CloseHandle (hObject=0xdc) returned 1 [0149.905] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a1f0e00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x538bb350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a1f0e00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x3dec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HM00116_.WMF", cAlternateFileName="")) returned 1 [0149.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0149.905] GetProcessHeap () returned 0x4e0000 [0149.905] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0149.905] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0149.905] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0149.906] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0149.931] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0149.931] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0149.931] GetProcessHeap () returned 0x4e0000 [0149.931] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0149.931] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0149.931] CryptDestroyKey (hKey=0x522f98) returned 1 [0149.931] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0149.932] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0149.932] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0149.932] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0149.932] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0149.932] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0149.932] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0149.932] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0149.932] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.932] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3dec, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3dec, lpOverlapped=0x0) returned 1 [0149.935] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3df0, dwBufLen=0x3df0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3df0) returned 1 [0149.935] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.935] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3df0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3df0, lpOverlapped=0x0) returned 1 [0149.936] CryptDestroyKey (hKey=0x522f98) returned 1 [0149.936] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3ec4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.936] SetEndOfFile (hFile=0xdc) returned 1 [0149.938] GetProcessHeap () returned 0x4e0000 [0149.938] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0149.938] GetProcessHeap () returned 0x4e0000 [0149.938] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0149.938] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0149.939] CloseHandle (hObject=0xdc) returned 1 [0149.939] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bef4100, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2bef4100, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0xb10, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HM00172_.WMF", cAlternateFileName="")) returned 1 [0149.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0149.939] GetProcessHeap () returned 0x4e0000 [0149.939] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0149.939] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0149.939] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0149.940] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0149.940] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0149.940] GetProcessHeap () returned 0x4e0000 [0149.940] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0149.940] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0149.940] CryptDestroyKey (hKey=0x522f98) returned 1 [0149.940] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0149.942] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0149.942] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0149.942] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0149.942] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0149.942] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0149.942] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0149.942] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0149.942] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.942] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb10, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xb10, lpOverlapped=0x0) returned 1 [0149.942] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xb10, dwBufLen=0xb10 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xb10) returned 1 [0149.943] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.943] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xb10, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xb10, lpOverlapped=0x0) returned 1 [0149.943] CryptDestroyKey (hKey=0x522f98) returned 1 [0149.943] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xbe4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.943] SetEndOfFile (hFile=0xdc) returned 1 [0149.945] GetProcessHeap () returned 0x4e0000 [0149.945] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0149.945] GetProcessHeap () returned 0x4e0000 [0149.945] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0149.945] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0149.946] CloseHandle (hObject=0xdc) returned 1 [0149.946] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7410300, ftCreationTime.dwHighDateTime=0x1bf3bd8, ftLastAccessTime.dwLowDateTime=0x538bb350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd7410300, ftLastWriteTime.dwHighDateTime=0x1bf3bd8, nFileSizeHigh=0x0, nFileSizeLow=0x10ca8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HM00426_.WMF", cAlternateFileName="")) returned 1 [0149.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0149.947] GetProcessHeap () returned 0x4e0000 [0149.947] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0149.947] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0149.947] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0149.947] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0149.951] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0149.951] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0149.951] GetProcessHeap () returned 0x4e0000 [0149.951] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0149.951] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0149.951] CryptDestroyKey (hKey=0x522f98) returned 1 [0149.951] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0149.951] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0149.951] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0149.951] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0149.951] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0149.951] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0149.951] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0149.952] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0149.952] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.952] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x10ca8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x10ca8, lpOverlapped=0x0) returned 1 [0149.955] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x10cb0, dwBufLen=0x10cb0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x10cb0) returned 1 [0149.955] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.955] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x10cb0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x10cb0, lpOverlapped=0x0) returned 1 [0149.956] CryptDestroyKey (hKey=0x522f98) returned 1 [0149.956] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x10d84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.956] SetEndOfFile (hFile=0xdc) returned 1 [0149.958] GetProcessHeap () returned 0x4e0000 [0149.958] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0149.958] GetProcessHeap () returned 0x4e0000 [0149.958] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0149.958] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0149.959] CloseHandle (hObject=0xdc) returned 1 [0149.959] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1c0a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HTECH_01.MID", cAlternateFileName="")) returned 1 [0149.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0149.960] GetProcessHeap () returned 0x4e0000 [0149.960] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0149.960] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0149.960] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0149.960] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0149.962] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0149.962] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0149.962] GetProcessHeap () returned 0x4e0000 [0149.962] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0149.962] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0149.962] CryptDestroyKey (hKey=0x522f98) returned 1 [0149.962] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0149.962] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0149.962] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0149.962] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0149.963] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0149.963] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0149.963] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0149.963] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0149.963] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.963] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1c0a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1c0a, lpOverlapped=0x0) returned 1 [0149.964] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1c10, dwBufLen=0x1c10 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1c10) returned 1 [0149.964] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.964] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1c10, lpOverlapped=0x0) returned 1 [0149.964] CryptDestroyKey (hKey=0x522f98) returned 1 [0149.964] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1ce4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.964] SetEndOfFile (hFile=0xdc) returned 1 [0149.966] GetProcessHeap () returned 0x4e0000 [0149.967] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0149.967] GetProcessHeap () returned 0x4e0000 [0149.967] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0149.967] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0149.967] CloseHandle (hObject=0xdc) returned 1 [0149.968] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c11ec00, ftCreationTime.dwHighDateTime=0x1bd4b2c, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c11ec00, ftLastWriteTime.dwHighDateTime=0x1bd4b2c, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IN00046_.WMF", cAlternateFileName="")) returned 1 [0149.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0149.969] GetProcessHeap () returned 0x4e0000 [0149.969] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0149.969] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0149.969] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0149.969] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0150.003] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0150.003] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0150.003] GetProcessHeap () returned 0x4e0000 [0150.003] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0150.003] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0150.003] CryptDestroyKey (hKey=0x522f98) returned 1 [0150.003] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0150.003] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0150.003] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0150.003] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0150.003] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0150.004] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0150.004] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0150.004] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0150.004] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.004] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x486, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x486, lpOverlapped=0x0) returned 1 [0150.004] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x490, dwBufLen=0x490 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x490) returned 1 [0150.004] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.004] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x490, lpOverlapped=0x0) returned 1 [0150.004] CryptDestroyKey (hKey=0x522f98) returned 1 [0150.004] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x564, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.004] SetEndOfFile (hFile=0xdc) returned 1 [0150.006] GetProcessHeap () returned 0x4e0000 [0150.006] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0150.006] GetProcessHeap () returned 0x4e0000 [0150.006] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0150.006] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0150.007] CloseHandle (hObject=0xdc) returned 1 [0150.007] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20f3db00, ftCreationTime.dwHighDateTime=0x1bd4b24, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x20f3db00, ftLastWriteTime.dwHighDateTime=0x1bd4b24, nFileSizeHigh=0x0, nFileSizeLow=0x318, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IN00118_.WMF", cAlternateFileName="")) returned 1 [0150.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0150.009] GetProcessHeap () returned 0x4e0000 [0150.009] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0150.009] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0150.009] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0150.009] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0150.015] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0150.015] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0150.015] GetProcessHeap () returned 0x4e0000 [0150.015] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0150.016] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0150.016] CryptDestroyKey (hKey=0x522f98) returned 1 [0150.016] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0150.016] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0150.016] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0150.016] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0150.016] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0150.016] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0150.016] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0150.016] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0150.016] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.016] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x318, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x318, lpOverlapped=0x0) returned 1 [0150.016] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x320, dwBufLen=0x320 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x320) returned 1 [0150.016] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.016] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x320, lpOverlapped=0x0) returned 1 [0150.016] CryptDestroyKey (hKey=0x522f98) returned 1 [0150.016] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.016] SetEndOfFile (hFile=0xdc) returned 1 [0150.018] GetProcessHeap () returned 0x4e0000 [0150.019] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0150.019] GetProcessHeap () returned 0x4e0000 [0150.019] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0150.019] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0150.019] CloseHandle (hObject=0xdc) returned 1 [0150.020] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x146a8500, ftCreationTime.dwHighDateTime=0x1bd4b1a, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x146a8500, ftLastWriteTime.dwHighDateTime=0x1bd4b1a, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IN00177_.WMF", cAlternateFileName="")) returned 1 [0150.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0150.020] GetProcessHeap () returned 0x4e0000 [0150.020] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0150.020] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0150.020] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0150.020] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0150.032] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0150.032] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0150.032] GetProcessHeap () returned 0x4e0000 [0150.032] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0150.032] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0150.032] CryptDestroyKey (hKey=0x522f98) returned 1 [0150.033] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0150.033] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0150.033] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0150.033] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0150.033] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0150.033] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0150.033] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0150.033] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0150.033] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.033] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x432, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x432, lpOverlapped=0x0) returned 1 [0150.033] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x440, dwBufLen=0x440 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x440) returned 1 [0150.033] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.033] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x440, lpOverlapped=0x0) returned 1 [0150.033] CryptDestroyKey (hKey=0x522f98) returned 1 [0150.033] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x514, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.033] SetEndOfFile (hFile=0xdc) returned 1 [0150.035] GetProcessHeap () returned 0x4e0000 [0150.035] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0150.035] GetProcessHeap () returned 0x4e0000 [0150.036] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0150.036] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0150.037] CloseHandle (hObject=0xdc) returned 1 [0150.037] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37eef900, ftCreationTime.dwHighDateTime=0x1bd4b35, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x37eef900, ftLastWriteTime.dwHighDateTime=0x1bd4b35, nFileSizeHigh=0x0, nFileSizeLow=0x738, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IN00204_.WMF", cAlternateFileName="")) returned 1 [0150.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0150.037] GetProcessHeap () returned 0x4e0000 [0150.037] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0150.037] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0150.037] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0150.037] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0150.043] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0150.043] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0150.043] GetProcessHeap () returned 0x4e0000 [0150.043] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0150.043] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0150.043] CryptDestroyKey (hKey=0x522f98) returned 1 [0150.043] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0150.043] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0150.043] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0150.043] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0150.044] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0150.044] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0150.044] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0150.044] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0150.044] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.044] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x738, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x738, lpOverlapped=0x0) returned 1 [0150.044] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x740, dwBufLen=0x740 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x740) returned 1 [0150.044] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.044] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x740, lpOverlapped=0x0) returned 1 [0150.044] CryptDestroyKey (hKey=0x522f98) returned 1 [0150.044] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.044] SetEndOfFile (hFile=0xdc) returned 1 [0150.046] GetProcessHeap () returned 0x4e0000 [0150.046] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0150.046] GetProcessHeap () returned 0x4e0000 [0150.046] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0150.046] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0150.047] CloseHandle (hObject=0xdc) returned 1 [0150.047] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98ede100, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x98ede100, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x2bb6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IN00233_.WMF", cAlternateFileName="")) returned 1 [0150.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0150.048] GetProcessHeap () returned 0x4e0000 [0150.048] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0150.048] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0150.048] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0150.048] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0150.050] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0150.050] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0150.050] GetProcessHeap () returned 0x4e0000 [0150.050] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0150.050] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0150.050] CryptDestroyKey (hKey=0x522f98) returned 1 [0150.050] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0150.050] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0150.050] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0150.050] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0150.050] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0150.050] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0150.050] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0150.050] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0150.050] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.051] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2bb6, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2bb6, lpOverlapped=0x0) returned 1 [0150.051] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2bc0, dwBufLen=0x2bc0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2bc0) returned 1 [0150.051] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.051] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2bc0, lpOverlapped=0x0) returned 1 [0150.051] CryptDestroyKey (hKey=0x522f98) returned 1 [0150.051] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2c94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.052] SetEndOfFile (hFile=0xdc) returned 1 [0150.054] GetProcessHeap () returned 0x4e0000 [0150.054] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0150.054] GetProcessHeap () returned 0x4e0000 [0150.054] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0150.054] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0150.054] CloseHandle (hObject=0xdc) returned 1 [0150.054] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6428b00, ftCreationTime.dwHighDateTime=0x1bd4af3, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6428b00, ftLastWriteTime.dwHighDateTime=0x1bd4af3, nFileSizeHigh=0x0, nFileSizeLow=0x764, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IN00343_.WMF", cAlternateFileName="")) returned 1 [0150.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0150.096] GetProcessHeap () returned 0x4e0000 [0150.096] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0150.097] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0150.097] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0150.097] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0150.107] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0150.107] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0150.107] GetProcessHeap () returned 0x4e0000 [0150.107] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0150.107] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0150.107] CryptDestroyKey (hKey=0x522f98) returned 1 [0150.107] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0150.107] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0150.107] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0150.107] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0150.107] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0150.107] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0150.107] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0150.107] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0150.107] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.107] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x764, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x764, lpOverlapped=0x0) returned 1 [0150.107] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x770, dwBufLen=0x770 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x770) returned 1 [0150.107] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.108] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x770, lpOverlapped=0x0) returned 1 [0150.108] CryptDestroyKey (hKey=0x522f98) returned 1 [0150.108] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x844, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.108] SetEndOfFile (hFile=0xdc) returned 1 [0150.110] GetProcessHeap () returned 0x4e0000 [0150.110] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0150.110] GetProcessHeap () returned 0x4e0000 [0150.110] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0150.110] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0150.111] CloseHandle (hObject=0xdc) returned 1 [0150.111] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc17dd700, ftCreationTime.dwHighDateTime=0x1bd4af3, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc17dd700, ftLastWriteTime.dwHighDateTime=0x1bd4af3, nFileSizeHigh=0x0, nFileSizeLow=0x2b8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IN00346_.WMF", cAlternateFileName="")) returned 1 [0150.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0150.112] GetProcessHeap () returned 0x4e0000 [0150.113] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0150.113] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0150.113] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0150.113] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0150.114] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0150.114] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0150.114] GetProcessHeap () returned 0x4e0000 [0150.114] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0150.114] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0150.114] CryptDestroyKey (hKey=0x522f98) returned 1 [0150.114] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0150.114] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0150.114] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0150.114] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0150.114] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0150.115] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0150.115] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0150.115] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0150.115] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.115] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2b8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2b8, lpOverlapped=0x0) returned 1 [0150.115] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2c0) returned 1 [0150.115] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.115] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2c0, lpOverlapped=0x0) returned 1 [0150.115] CryptDestroyKey (hKey=0x522f98) returned 1 [0150.115] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x394, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.115] SetEndOfFile (hFile=0xdc) returned 1 [0150.117] GetProcessHeap () returned 0x4e0000 [0150.117] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0150.117] GetProcessHeap () returned 0x4e0000 [0150.117] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0150.117] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0150.118] CloseHandle (hObject=0xdc) returned 1 [0150.118] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba56c900, ftCreationTime.dwHighDateTime=0x1bd4af3, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xba56c900, ftLastWriteTime.dwHighDateTime=0x1bd4af3, nFileSizeHigh=0x0, nFileSizeLow=0x788, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IN00351_.WMF", cAlternateFileName="")) returned 1 [0150.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0150.118] GetProcessHeap () returned 0x4e0000 [0150.118] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0150.118] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0150.118] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0150.119] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0150.121] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0150.121] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0150.121] GetProcessHeap () returned 0x4e0000 [0150.121] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0150.121] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0150.121] CryptDestroyKey (hKey=0x522f98) returned 1 [0150.121] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0150.121] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0150.121] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0150.121] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0150.121] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0150.121] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0150.121] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0150.121] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0150.121] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.121] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x788, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x788, lpOverlapped=0x0) returned 1 [0150.122] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x790, dwBufLen=0x790 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x790) returned 1 [0150.122] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.122] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x790, lpOverlapped=0x0) returned 1 [0150.122] CryptDestroyKey (hKey=0x522f98) returned 1 [0150.122] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x864, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.122] SetEndOfFile (hFile=0xdc) returned 1 [0150.124] GetProcessHeap () returned 0x4e0000 [0150.124] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0150.124] GetProcessHeap () returned 0x4e0000 [0150.124] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0150.124] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0150.125] CloseHandle (hObject=0xdc) returned 1 [0150.125] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0ee5f00, ftCreationTime.dwHighDateTime=0x1bd4bce, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0ee5f00, ftLastWriteTime.dwHighDateTime=0x1bd4bce, nFileSizeHigh=0x0, nFileSizeLow=0x23d4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IN00557_.WMF", cAlternateFileName="")) returned 1 [0150.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0150.125] GetProcessHeap () returned 0x4e0000 [0150.125] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0150.125] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0150.125] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0150.125] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0150.130] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0150.130] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0150.130] GetProcessHeap () returned 0x4e0000 [0150.131] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0150.131] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0150.131] CryptDestroyKey (hKey=0x522f98) returned 1 [0150.131] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0150.131] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0150.131] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0150.131] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0150.131] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0150.131] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0150.131] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0150.131] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0150.131] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.131] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x23d4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x23d4, lpOverlapped=0x0) returned 1 [0150.132] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x23e0, dwBufLen=0x23e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x23e0) returned 1 [0150.133] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.133] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x23e0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x23e0, lpOverlapped=0x0) returned 1 [0150.133] CryptDestroyKey (hKey=0x522f98) returned 1 [0150.133] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x24b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.133] SetEndOfFile (hFile=0xdc) returned 1 [0150.135] GetProcessHeap () returned 0x4e0000 [0150.135] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0150.135] GetProcessHeap () returned 0x4e0000 [0150.135] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0150.135] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0150.136] CloseHandle (hObject=0xdc) returned 1 [0150.136] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec9b2000, ftCreationTime.dwHighDateTime=0x1bd4bf2, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xec9b2000, ftLastWriteTime.dwHighDateTime=0x1bd4bf2, nFileSizeHigh=0x0, nFileSizeLow=0x31cc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IN00915_.WMF", cAlternateFileName="")) returned 1 [0150.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0150.156] GetProcessHeap () returned 0x4e0000 [0150.156] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0150.156] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0150.156] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0150.156] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0150.158] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0150.158] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0150.158] GetProcessHeap () returned 0x4e0000 [0150.158] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0150.158] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0150.158] CryptDestroyKey (hKey=0x522f98) returned 1 [0150.158] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0150.158] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0150.158] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0150.158] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0150.158] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0150.158] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0150.158] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0150.158] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0150.158] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.158] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x31cc, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x31cc, lpOverlapped=0x0) returned 1 [0150.159] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x31d0, dwBufLen=0x31d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x31d0) returned 1 [0150.159] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.159] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x31d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x31d0, lpOverlapped=0x0) returned 1 [0150.159] CryptDestroyKey (hKey=0x522f98) returned 1 [0150.159] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x32a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.160] SetEndOfFile (hFile=0xdc) returned 1 [0150.162] GetProcessHeap () returned 0x4e0000 [0150.162] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0150.162] GetProcessHeap () returned 0x4e0000 [0150.162] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0150.162] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0150.163] CloseHandle (hObject=0xdc) returned 1 [0150.163] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5570a100, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5570a100, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x1b08, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IN00919_.WMF", cAlternateFileName="")) returned 1 [0150.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0150.163] GetProcessHeap () returned 0x4e0000 [0150.163] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0150.163] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0150.163] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0150.163] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0150.165] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0150.165] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0150.165] GetProcessHeap () returned 0x4e0000 [0150.165] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0150.165] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0150.165] CryptDestroyKey (hKey=0x522f98) returned 1 [0150.165] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0150.165] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0150.165] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0150.165] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0150.166] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0150.166] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0150.166] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0150.166] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0150.166] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.166] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1b08, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1b08, lpOverlapped=0x0) returned 1 [0150.166] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1b10, dwBufLen=0x1b10 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1b10) returned 1 [0150.167] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.167] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1b10, lpOverlapped=0x0) returned 1 [0150.167] CryptDestroyKey (hKey=0x522f98) returned 1 [0150.167] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1be4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.167] SetEndOfFile (hFile=0xdc) returned 1 [0150.169] GetProcessHeap () returned 0x4e0000 [0150.169] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0150.169] GetProcessHeap () returned 0x4e0000 [0150.169] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0150.169] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0150.170] CloseHandle (hObject=0xdc) returned 1 [0150.170] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a750c00, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7a750c00, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x4e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IN00956_.WMF", cAlternateFileName="")) returned 1 [0150.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0150.170] GetProcessHeap () returned 0x4e0000 [0150.170] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0150.170] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0150.170] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0150.171] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0150.172] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0150.172] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0150.172] GetProcessHeap () returned 0x4e0000 [0150.172] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0150.172] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0150.172] CryptDestroyKey (hKey=0x522f98) returned 1 [0150.172] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0150.173] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0150.173] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0150.173] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0150.173] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0150.173] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0150.173] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0150.173] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0150.173] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.173] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4e8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4e8, lpOverlapped=0x0) returned 1 [0150.173] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4f0, dwBufLen=0x4f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4f0) returned 1 [0150.173] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.173] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4f0, lpOverlapped=0x0) returned 1 [0150.173] CryptDestroyKey (hKey=0x522f98) returned 1 [0150.173] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.173] SetEndOfFile (hFile=0xdc) returned 1 [0150.175] GetProcessHeap () returned 0x4e0000 [0150.175] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0150.175] GetProcessHeap () returned 0x4e0000 [0150.175] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0150.175] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0150.176] CloseHandle (hObject=0xdc) returned 1 [0150.176] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20e4b00, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x20e4b00, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0xb80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IN00957_.WMF", cAlternateFileName="")) returned 1 [0150.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0150.177] GetProcessHeap () returned 0x4e0000 [0150.177] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0150.177] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0150.177] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0150.177] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0150.177] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0150.177] GetProcessHeap () returned 0x4e0000 [0150.177] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0150.177] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0150.177] CryptDestroyKey (hKey=0x522f98) returned 1 [0150.177] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0150.186] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0150.186] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0150.186] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0150.186] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0150.186] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0150.186] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0150.186] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0150.186] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.187] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb80, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xb80, lpOverlapped=0x0) returned 1 [0150.187] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xb80, dwBufLen=0xb80 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xb80) returned 1 [0150.187] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.187] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xb80, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xb80, lpOverlapped=0x0) returned 1 [0150.187] CryptDestroyKey (hKey=0x522f98) returned 1 [0150.187] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xc54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.187] SetEndOfFile (hFile=0xdc) returned 1 [0150.189] GetProcessHeap () returned 0x4e0000 [0150.189] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0150.189] GetProcessHeap () returned 0x4e0000 [0150.189] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0150.189] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0150.190] CloseHandle (hObject=0xdc) returned 1 [0150.190] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2178, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="INDST_01.MID", cAlternateFileName="")) returned 1 [0150.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0150.190] GetProcessHeap () returned 0x4e0000 [0150.190] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0150.190] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0150.190] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0150.191] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0150.192] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0150.192] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0150.192] GetProcessHeap () returned 0x4e0000 [0150.192] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0150.192] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0150.192] CryptDestroyKey (hKey=0x522f98) returned 1 [0150.192] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0150.192] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0150.192] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0150.192] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0150.193] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0150.193] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0150.193] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0150.193] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0150.193] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.193] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2178, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2178, lpOverlapped=0x0) returned 1 [0150.193] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2180, dwBufLen=0x2180 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2180) returned 1 [0150.194] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.194] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2180, lpOverlapped=0x0) returned 1 [0150.194] CryptDestroyKey (hKey=0x522f98) returned 1 [0150.194] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2254, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.194] SetEndOfFile (hFile=0xdc) returned 1 [0150.196] GetProcessHeap () returned 0x4e0000 [0150.196] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0150.196] GetProcessHeap () returned 0x4e0000 [0150.196] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0150.196] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0150.197] CloseHandle (hObject=0xdc) returned 1 [0150.197] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d9b0900, ftCreationTime.dwHighDateTime=0x1bd6360, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d9b0900, ftLastWriteTime.dwHighDateTime=0x1bd6360, nFileSizeHigh=0x0, nFileSizeLow=0x4c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0075478.GIF", cAlternateFileName="")) returned 1 [0150.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0150.199] GetProcessHeap () returned 0x4e0000 [0150.199] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0150.199] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0150.199] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0150.199] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0150.213] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0150.213] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0150.213] GetProcessHeap () returned 0x4e0000 [0150.213] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0150.213] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0150.213] CryptDestroyKey (hKey=0x522f98) returned 1 [0150.213] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0150.213] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0150.213] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0150.213] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0150.213] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0150.213] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0150.213] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0150.213] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0150.213] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.214] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4c4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4c4, lpOverlapped=0x0) returned 1 [0150.214] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4d0, dwBufLen=0x4d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4d0) returned 1 [0150.214] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.214] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4d0, lpOverlapped=0x0) returned 1 [0150.214] CryptDestroyKey (hKey=0x522f98) returned 1 [0150.214] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.214] SetEndOfFile (hFile=0xdc) returned 1 [0150.216] GetProcessHeap () returned 0x4e0000 [0150.216] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0150.216] GetProcessHeap () returned 0x4e0000 [0150.216] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0150.216] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0150.217] CloseHandle (hObject=0xdc) returned 1 [0150.217] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2606, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0086384.WMF", cAlternateFileName="")) returned 1 [0150.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0150.218] GetProcessHeap () returned 0x4e0000 [0150.218] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0150.218] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0150.218] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0150.218] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0150.262] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0150.263] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0150.263] GetProcessHeap () returned 0x4e0000 [0150.263] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0150.263] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0150.263] CryptDestroyKey (hKey=0x522f98) returned 1 [0150.263] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0150.263] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0150.263] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0150.263] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0150.263] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0150.263] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0150.263] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0150.263] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0150.263] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.263] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2606, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2606, lpOverlapped=0x0) returned 1 [0150.266] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2610, dwBufLen=0x2610 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2610) returned 1 [0150.266] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.266] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2610, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2610, lpOverlapped=0x0) returned 1 [0150.266] CryptDestroyKey (hKey=0x522f98) returned 1 [0150.266] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x26e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.266] SetEndOfFile (hFile=0xdc) returned 1 [0150.268] GetProcessHeap () returned 0x4e0000 [0150.268] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0150.268] GetProcessHeap () returned 0x4e0000 [0150.268] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0150.268] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0150.269] CloseHandle (hObject=0xdc) returned 1 [0150.269] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x257c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0086420.WMF", cAlternateFileName="")) returned 1 [0150.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0150.270] GetProcessHeap () returned 0x4e0000 [0150.270] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0150.270] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0150.270] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0150.270] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0150.302] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0150.302] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0150.302] GetProcessHeap () returned 0x4e0000 [0150.302] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0150.302] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0150.302] CryptDestroyKey (hKey=0x522f98) returned 1 [0150.302] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0150.302] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0150.302] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0150.302] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0150.302] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0150.302] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0150.303] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0150.303] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0150.303] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.303] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x257c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x257c, lpOverlapped=0x0) returned 1 [0150.351] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2580, dwBufLen=0x2580 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2580) returned 1 [0150.351] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.351] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2580, lpOverlapped=0x0) returned 1 [0150.351] CryptDestroyKey (hKey=0x522f98) returned 1 [0150.351] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2654, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.352] SetEndOfFile (hFile=0xdc) returned 1 [0150.354] GetProcessHeap () returned 0x4e0000 [0150.354] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0150.354] GetProcessHeap () returned 0x4e0000 [0150.354] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0150.354] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0150.355] CloseHandle (hObject=0xdc) returned 1 [0150.355] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4278, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0086424.WMF", cAlternateFileName="")) returned 1 [0150.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0150.355] GetProcessHeap () returned 0x4e0000 [0150.356] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0150.356] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0150.356] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0150.356] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0150.358] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0150.358] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0150.358] GetProcessHeap () returned 0x4e0000 [0150.359] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0150.359] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0150.359] CryptDestroyKey (hKey=0x522f98) returned 1 [0150.359] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0150.359] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0150.359] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0150.359] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0150.359] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0150.359] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0150.359] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0150.359] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0150.359] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.359] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4278, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4278, lpOverlapped=0x0) returned 1 [0150.367] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4280, dwBufLen=0x4280 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4280) returned 1 [0150.367] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.367] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4280, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4280, lpOverlapped=0x0) returned 1 [0150.368] CryptDestroyKey (hKey=0x522f98) returned 1 [0150.368] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4354, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.368] SetEndOfFile (hFile=0xdc) returned 1 [0150.370] GetProcessHeap () returned 0x4e0000 [0150.370] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0150.370] GetProcessHeap () returned 0x4e0000 [0150.370] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0150.370] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0150.371] CloseHandle (hObject=0xdc) returned 1 [0150.371] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5516, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0086426.WMF", cAlternateFileName="")) returned 1 [0150.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0150.372] GetProcessHeap () returned 0x4e0000 [0150.372] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0150.372] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0150.372] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0150.372] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0150.412] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0150.412] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0150.412] GetProcessHeap () returned 0x4e0000 [0150.412] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0150.413] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0150.413] CryptDestroyKey (hKey=0x522f98) returned 1 [0150.413] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0150.413] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0150.413] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0150.413] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0150.413] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0150.413] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0150.413] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0150.413] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0150.413] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.413] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5516, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x5516, lpOverlapped=0x0) returned 1 [0150.428] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5520, dwBufLen=0x5520 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5520) returned 1 [0150.429] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.429] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5520, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5520, lpOverlapped=0x0) returned 1 [0150.429] CryptDestroyKey (hKey=0x522f98) returned 1 [0150.429] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x55f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.429] SetEndOfFile (hFile=0xdc) returned 1 [0150.432] GetProcessHeap () returned 0x4e0000 [0150.432] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0150.432] GetProcessHeap () returned 0x4e0000 [0150.432] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0150.432] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0150.433] CloseHandle (hObject=0xdc) returned 1 [0150.433] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8a12, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0086428.WMF", cAlternateFileName="")) returned 1 [0150.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0150.434] GetProcessHeap () returned 0x4e0000 [0150.434] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0150.434] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0150.434] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0150.434] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0150.436] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0150.436] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0150.436] GetProcessHeap () returned 0x4e0000 [0150.436] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0150.436] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0150.436] CryptDestroyKey (hKey=0x522f98) returned 1 [0150.436] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0150.441] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0150.441] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0150.441] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0150.441] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0150.441] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0150.441] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0150.441] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0150.441] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.441] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x8a12, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x8a12, lpOverlapped=0x0) returned 1 [0150.465] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8a20, dwBufLen=0x8a20 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8a20) returned 1 [0150.465] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.465] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x8a20, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x8a20, lpOverlapped=0x0) returned 1 [0150.465] CryptDestroyKey (hKey=0x522f98) returned 1 [0150.465] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x8af4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.465] SetEndOfFile (hFile=0xdc) returned 1 [0150.467] GetProcessHeap () returned 0x4e0000 [0150.468] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0150.468] GetProcessHeap () returned 0x4e0000 [0150.468] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0150.468] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0150.469] CloseHandle (hObject=0xdc) returned 1 [0150.469] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x829a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0086432.WMF", cAlternateFileName="")) returned 1 [0150.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0150.471] GetProcessHeap () returned 0x4e0000 [0150.471] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0150.471] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0150.471] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0150.471] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0150.473] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0150.473] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0150.473] GetProcessHeap () returned 0x4e0000 [0150.473] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0150.473] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0150.473] CryptDestroyKey (hKey=0x522f98) returned 1 [0150.473] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0150.473] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0150.473] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0150.473] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0150.473] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0150.473] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0150.473] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0150.474] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0150.474] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.474] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x829a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x829a, lpOverlapped=0x0) returned 1 [0150.474] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x82a0, dwBufLen=0x82a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x82a0) returned 1 [0150.475] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.475] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x82a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x82a0, lpOverlapped=0x0) returned 1 [0150.475] CryptDestroyKey (hKey=0x522f98) returned 1 [0150.475] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x8374, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.475] SetEndOfFile (hFile=0xdc) returned 1 [0150.477] GetProcessHeap () returned 0x4e0000 [0150.477] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0150.477] GetProcessHeap () returned 0x4e0000 [0150.477] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0150.477] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0150.514] CloseHandle (hObject=0xdc) returned 1 [0150.514] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x375e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0086478.WMF", cAlternateFileName="")) returned 1 [0150.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0150.514] GetProcessHeap () returned 0x4e0000 [0150.514] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0150.514] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0150.514] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0150.514] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0150.608] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0150.608] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0150.608] GetProcessHeap () returned 0x4e0000 [0150.608] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0150.608] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0150.608] CryptDestroyKey (hKey=0x522f98) returned 1 [0150.608] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0150.609] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0150.609] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0150.609] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0150.609] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0150.609] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0150.609] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0150.609] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0150.609] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.609] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x375e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x375e, lpOverlapped=0x0) returned 1 [0150.694] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3760, dwBufLen=0x3760 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3760) returned 1 [0150.694] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.694] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3760, lpOverlapped=0x0) returned 1 [0150.694] CryptDestroyKey (hKey=0x522f98) returned 1 [0150.694] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.694] SetEndOfFile (hFile=0xdc) returned 1 [0150.696] GetProcessHeap () returned 0x4e0000 [0150.697] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0150.697] GetProcessHeap () returned 0x4e0000 [0150.697] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0150.697] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0150.698] CloseHandle (hObject=0xdc) returned 1 [0150.698] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4dba, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0089945.WMF", cAlternateFileName="")) returned 1 [0150.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0150.698] GetProcessHeap () returned 0x4e0000 [0150.698] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0150.698] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0150.698] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0150.698] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0150.777] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0150.777] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0150.777] GetProcessHeap () returned 0x4e0000 [0150.777] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0150.777] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0150.777] CryptDestroyKey (hKey=0x522f98) returned 1 [0150.777] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0150.777] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0150.777] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0150.777] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0150.777] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0150.777] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0150.777] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0150.777] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0150.777] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.777] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4dba, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4dba, lpOverlapped=0x0) returned 1 [0151.009] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4dc0, dwBufLen=0x4dc0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4dc0) returned 1 [0151.009] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.009] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4dc0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4dc0, lpOverlapped=0x0) returned 1 [0151.009] CryptDestroyKey (hKey=0x522f98) returned 1 [0151.009] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.009] SetEndOfFile (hFile=0xdc) returned 1 [0151.012] GetProcessHeap () returned 0x4e0000 [0151.012] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0151.012] GetProcessHeap () returned 0x4e0000 [0151.012] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0151.012] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0151.013] CloseHandle (hObject=0xdc) returned 1 [0151.013] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3d40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0089992.WMF", cAlternateFileName="")) returned 1 [0151.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0151.014] GetProcessHeap () returned 0x4e0000 [0151.014] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0151.014] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0151.014] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0151.014] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0151.014] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0151.014] GetProcessHeap () returned 0x4e0000 [0151.014] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0151.014] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0151.014] CryptDestroyKey (hKey=0x522f98) returned 1 [0151.014] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0151.032] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0151.033] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0151.033] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0151.033] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0151.033] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0151.033] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0151.033] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0151.033] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.033] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3d40, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3d40, lpOverlapped=0x0) returned 1 [0151.039] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3d40, dwBufLen=0x3d40 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3d40) returned 1 [0151.039] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.040] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3d40, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3d40, lpOverlapped=0x0) returned 1 [0151.040] CryptDestroyKey (hKey=0x522f98) returned 1 [0151.040] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3e14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.040] SetEndOfFile (hFile=0xdc) returned 1 [0151.042] GetProcessHeap () returned 0x4e0000 [0151.042] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0151.042] GetProcessHeap () returned 0x4e0000 [0151.042] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0151.042] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0151.043] CloseHandle (hObject=0xdc) returned 1 [0151.043] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5314, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0090027.WMF", cAlternateFileName="")) returned 1 [0151.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0151.044] GetProcessHeap () returned 0x4e0000 [0151.044] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0151.044] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0151.044] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0151.044] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0151.225] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0151.225] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0151.225] GetProcessHeap () returned 0x4e0000 [0151.225] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0151.225] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0151.225] CryptDestroyKey (hKey=0x522f98) returned 1 [0151.225] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0151.225] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0151.225] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0151.225] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0151.225] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0151.225] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0151.225] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0151.226] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0151.226] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.226] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5314, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x5314, lpOverlapped=0x0) returned 1 [0151.242] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5320, dwBufLen=0x5320 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5320) returned 1 [0151.242] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.242] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5320, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5320, lpOverlapped=0x0) returned 1 [0151.243] CryptDestroyKey (hKey=0x522f98) returned 1 [0151.243] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x53f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.243] SetEndOfFile (hFile=0xdc) returned 1 [0151.245] GetProcessHeap () returned 0x4e0000 [0151.245] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0151.245] GetProcessHeap () returned 0x4e0000 [0151.245] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0151.245] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0151.246] CloseHandle (hObject=0xdc) returned 1 [0151.246] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb758, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0090087.WMF", cAlternateFileName="")) returned 1 [0151.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0151.247] GetProcessHeap () returned 0x4e0000 [0151.247] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0151.247] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0151.247] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0151.247] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0151.304] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0151.304] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0151.304] GetProcessHeap () returned 0x4e0000 [0151.304] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0151.304] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0151.305] CryptDestroyKey (hKey=0x522f98) returned 1 [0151.305] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0151.305] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0151.305] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0151.305] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0151.305] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0151.305] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0151.305] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0151.305] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0151.305] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.305] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb758, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xb758, lpOverlapped=0x0) returned 1 [0151.379] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xb760, dwBufLen=0xb760 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xb760) returned 1 [0151.379] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.379] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xb760, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xb760, lpOverlapped=0x0) returned 1 [0151.379] CryptDestroyKey (hKey=0x522f98) returned 1 [0151.379] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xb834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.379] SetEndOfFile (hFile=0xdc) returned 1 [0151.382] GetProcessHeap () returned 0x4e0000 [0151.382] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0151.382] GetProcessHeap () returned 0x4e0000 [0151.382] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0151.382] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0151.383] CloseHandle (hObject=0xdc) returned 1 [0151.383] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3d90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0090089.WMF", cAlternateFileName="")) returned 1 [0151.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0151.516] GetProcessHeap () returned 0x4e0000 [0151.516] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0151.516] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0151.516] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0151.517] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0151.517] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0151.517] GetProcessHeap () returned 0x4e0000 [0151.517] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0151.517] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0151.517] CryptDestroyKey (hKey=0x522f98) returned 1 [0151.517] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0151.605] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0151.605] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0151.605] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0151.605] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0151.605] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0151.605] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0151.605] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0151.605] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.605] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3d90, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3d90, lpOverlapped=0x0) returned 1 [0151.642] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3d90, dwBufLen=0x3d90 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3d90) returned 1 [0151.642] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.642] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3d90, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3d90, lpOverlapped=0x0) returned 1 [0151.642] CryptDestroyKey (hKey=0x522f98) returned 1 [0151.642] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3e64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.642] SetEndOfFile (hFile=0xdc) returned 1 [0151.645] GetProcessHeap () returned 0x4e0000 [0151.645] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0151.645] GetProcessHeap () returned 0x4e0000 [0151.645] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0151.645] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0151.647] CloseHandle (hObject=0xdc) returned 1 [0151.647] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6e34, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0090149.WMF", cAlternateFileName="")) returned 1 [0151.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0151.648] GetProcessHeap () returned 0x4e0000 [0151.648] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0151.648] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0151.648] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0151.648] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0151.657] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0151.657] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0151.657] GetProcessHeap () returned 0x4e0000 [0151.657] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0151.657] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0151.658] CryptDestroyKey (hKey=0x522f98) returned 1 [0151.658] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0151.658] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0151.658] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0151.658] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0151.658] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0151.658] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0151.658] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0151.658] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0151.658] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.658] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x6e34, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x6e34, lpOverlapped=0x0) returned 1 [0151.666] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6e40, dwBufLen=0x6e40 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6e40) returned 1 [0151.666] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.666] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6e40, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x6e40, lpOverlapped=0x0) returned 1 [0151.666] CryptDestroyKey (hKey=0x522f98) returned 1 [0151.666] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6f14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.666] SetEndOfFile (hFile=0xdc) returned 1 [0151.669] GetProcessHeap () returned 0x4e0000 [0151.669] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0151.669] GetProcessHeap () returned 0x4e0000 [0151.669] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0151.669] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0151.670] CloseHandle (hObject=0xdc) returned 1 [0151.670] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x44e6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0090390.WMF", cAlternateFileName="")) returned 1 [0151.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0151.672] GetProcessHeap () returned 0x4e0000 [0151.672] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0151.672] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0151.672] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0151.672] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0151.691] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0151.691] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0151.691] GetProcessHeap () returned 0x4e0000 [0151.691] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0151.691] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0151.691] CryptDestroyKey (hKey=0x522f98) returned 1 [0151.691] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0151.691] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0151.691] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0151.691] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0151.692] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0151.692] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0151.692] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0151.692] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0151.692] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.692] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x44e6, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x44e6, lpOverlapped=0x0) returned 1 [0151.776] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x44f0, dwBufLen=0x44f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x44f0) returned 1 [0151.776] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.777] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x44f0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x44f0, lpOverlapped=0x0) returned 1 [0151.777] CryptDestroyKey (hKey=0x522f98) returned 1 [0151.777] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x45c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.777] SetEndOfFile (hFile=0xdc) returned 1 [0151.779] GetProcessHeap () returned 0x4e0000 [0151.779] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0151.779] GetProcessHeap () returned 0x4e0000 [0151.779] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0151.779] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0151.780] CloseHandle (hObject=0xdc) returned 1 [0151.780] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cd6c900, ftCreationTime.dwHighDateTime=0x1bd6ced, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3cd6c900, ftLastWriteTime.dwHighDateTime=0x1bd6ced, nFileSizeHigh=0x0, nFileSizeLow=0xd04, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0090777.WMF", cAlternateFileName="")) returned 1 [0151.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0151.781] GetProcessHeap () returned 0x4e0000 [0151.781] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0151.781] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0151.781] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0151.781] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0151.782] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0151.782] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0151.782] GetProcessHeap () returned 0x4e0000 [0151.782] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0151.783] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0151.783] CryptDestroyKey (hKey=0x522f98) returned 1 [0151.783] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0151.783] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0151.783] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0151.783] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0151.783] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0151.783] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0151.783] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0151.783] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0151.783] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.783] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xd04, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xd04, lpOverlapped=0x0) returned 1 [0151.783] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xd10, dwBufLen=0xd10 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xd10) returned 1 [0151.783] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.783] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xd10, lpOverlapped=0x0) returned 1 [0151.783] CryptDestroyKey (hKey=0x522f98) returned 1 [0151.783] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xde4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.783] SetEndOfFile (hFile=0xdc) returned 1 [0151.785] GetProcessHeap () returned 0x4e0000 [0151.785] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0151.786] GetProcessHeap () returned 0x4e0000 [0151.786] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0151.786] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0151.786] CloseHandle (hObject=0xdc) returned 1 [0151.786] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e07f600, ftCreationTime.dwHighDateTime=0x1bd6ced, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3e07f600, ftLastWriteTime.dwHighDateTime=0x1bd6ced, nFileSizeHigh=0x0, nFileSizeLow=0x5b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0090779.WMF", cAlternateFileName="")) returned 1 [0151.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0151.787] GetProcessHeap () returned 0x4e0000 [0151.787] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0151.787] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0151.787] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0151.787] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0151.787] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0151.787] GetProcessHeap () returned 0x4e0000 [0151.787] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0151.787] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0151.787] CryptDestroyKey (hKey=0x522f98) returned 1 [0151.787] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0151.813] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0151.813] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0151.813] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0151.813] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0151.813] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0151.814] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0151.814] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0151.814] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.814] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5b0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x5b0, lpOverlapped=0x0) returned 1 [0151.814] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5b0) returned 1 [0151.814] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.814] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5b0, lpOverlapped=0x0) returned 1 [0151.814] CryptDestroyKey (hKey=0x522f98) returned 1 [0151.814] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.814] SetEndOfFile (hFile=0xdc) returned 1 [0151.817] GetProcessHeap () returned 0x4e0000 [0151.817] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0151.817] GetProcessHeap () returned 0x4e0000 [0151.817] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0151.817] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0151.818] CloseHandle (hObject=0xdc) returned 1 [0151.818] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e07f600, ftCreationTime.dwHighDateTime=0x1bd6ced, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3e07f600, ftLastWriteTime.dwHighDateTime=0x1bd6ced, nFileSizeHigh=0x0, nFileSizeLow=0x14c2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0090781.WMF", cAlternateFileName="")) returned 1 [0151.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0151.819] GetProcessHeap () returned 0x4e0000 [0151.820] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0151.820] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0151.820] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0151.820] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0151.838] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0151.838] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0151.838] GetProcessHeap () returned 0x4e0000 [0151.838] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0151.838] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0151.838] CryptDestroyKey (hKey=0x522f98) returned 1 [0151.838] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0151.838] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0151.838] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0151.838] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0151.838] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0151.838] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0151.838] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0151.838] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0151.839] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.839] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x14c2, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x14c2, lpOverlapped=0x0) returned 1 [0151.861] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x14d0, dwBufLen=0x14d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x14d0) returned 1 [0151.861] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.861] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x14d0, lpOverlapped=0x0) returned 1 [0151.864] CryptDestroyKey (hKey=0x522f98) returned 1 [0151.864] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x15a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.864] SetEndOfFile (hFile=0xdc) returned 1 [0151.866] GetProcessHeap () returned 0x4e0000 [0151.866] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0151.866] GetProcessHeap () returned 0x4e0000 [0151.866] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0151.866] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0151.867] CloseHandle (hObject=0xdc) returned 1 [0151.867] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e07f600, ftCreationTime.dwHighDateTime=0x1bd6ced, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3e07f600, ftLastWriteTime.dwHighDateTime=0x1bd6ced, nFileSizeHigh=0x0, nFileSizeLow=0x1b16, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0090783.WMF", cAlternateFileName="")) returned 1 [0151.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0151.868] GetProcessHeap () returned 0x4e0000 [0151.868] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0151.868] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0151.868] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0151.868] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0151.893] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0151.893] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0151.893] GetProcessHeap () returned 0x4e0000 [0151.893] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0151.893] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0151.893] CryptDestroyKey (hKey=0x522f98) returned 1 [0151.893] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0151.893] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0151.893] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0151.893] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0151.893] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0151.893] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0151.893] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0151.893] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0151.893] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.893] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1b16, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1b16, lpOverlapped=0x0) returned 1 [0151.985] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1b20, dwBufLen=0x1b20 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1b20) returned 1 [0151.985] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.986] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1b20, lpOverlapped=0x0) returned 1 [0151.986] CryptDestroyKey (hKey=0x522f98) returned 1 [0151.986] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1bf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.986] SetEndOfFile (hFile=0xdc) returned 1 [0151.988] GetProcessHeap () returned 0x4e0000 [0151.988] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0151.988] GetProcessHeap () returned 0x4e0000 [0151.988] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0151.988] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0151.989] CloseHandle (hObject=0xdc) returned 1 [0151.989] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa442, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0093905.WMF", cAlternateFileName="")) returned 1 [0151.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0151.990] GetProcessHeap () returned 0x4e0000 [0151.990] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0151.990] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0151.991] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0151.991] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0152.001] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0152.001] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0152.001] GetProcessHeap () returned 0x4e0000 [0152.001] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0152.001] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0152.001] CryptDestroyKey (hKey=0x522f98) returned 1 [0152.001] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0152.001] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0152.001] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0152.001] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0152.001] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0152.001] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0152.001] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0152.001] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0152.001] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.001] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xa442, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xa442, lpOverlapped=0x0) returned 1 [0152.014] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa450, dwBufLen=0xa450 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa450) returned 1 [0152.015] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.015] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xa450, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xa450, lpOverlapped=0x0) returned 1 [0152.015] CryptDestroyKey (hKey=0x522f98) returned 1 [0152.015] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xa524, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.015] SetEndOfFile (hFile=0xdc) returned 1 [0152.018] GetProcessHeap () returned 0x4e0000 [0152.018] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0152.018] GetProcessHeap () returned 0x4e0000 [0152.018] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0152.018] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0152.019] CloseHandle (hObject=0xdc) returned 1 [0152.019] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x136a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0098497.WMF", cAlternateFileName="")) returned 1 [0152.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0152.019] GetProcessHeap () returned 0x4e0000 [0152.019] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0152.020] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0152.020] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0152.020] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0152.060] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0152.060] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0152.060] GetProcessHeap () returned 0x4e0000 [0152.060] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0152.060] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0152.060] CryptDestroyKey (hKey=0x522f98) returned 1 [0152.060] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0152.060] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0152.060] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0152.060] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0152.060] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0152.060] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0152.060] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0152.060] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0152.060] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.061] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x136a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x136a, lpOverlapped=0x0) returned 1 [0152.084] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1370, dwBufLen=0x1370 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1370) returned 1 [0152.084] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.085] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1370, lpOverlapped=0x0) returned 1 [0152.085] CryptDestroyKey (hKey=0x522f98) returned 1 [0152.086] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1444, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.086] SetEndOfFile (hFile=0xdc) returned 1 [0152.088] GetProcessHeap () returned 0x4e0000 [0152.088] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0152.088] GetProcessHeap () returned 0x4e0000 [0152.088] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0152.088] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0152.089] CloseHandle (hObject=0xdc) returned 1 [0152.089] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x60b7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099145.JPG", cAlternateFileName="")) returned 1 [0152.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0152.090] GetProcessHeap () returned 0x4e0000 [0152.090] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0152.090] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0152.090] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0152.090] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x9, lpOverlapped=0x0) returned 1 [0152.110] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0152.110] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0152.110] GetProcessHeap () returned 0x4e0000 [0152.110] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0152.110] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0152.110] CryptDestroyKey (hKey=0x522f98) returned 1 [0152.110] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0152.110] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0152.110] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0152.110] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0152.110] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0152.110] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0152.110] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0152.110] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0152.110] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.110] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x60b7, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x60b7, lpOverlapped=0x0) returned 1 [0152.121] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x60c0, dwBufLen=0x60c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x60c0) returned 1 [0152.121] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.122] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x60c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x60c0, lpOverlapped=0x0) returned 1 [0152.122] CryptDestroyKey (hKey=0x522f98) returned 1 [0152.122] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.122] SetEndOfFile (hFile=0xdc) returned 1 [0152.124] GetProcessHeap () returned 0x4e0000 [0152.124] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0152.124] GetProcessHeap () returned 0x4e0000 [0152.125] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0152.125] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0152.126] CloseHandle (hObject=0xdc) returned 1 [0152.126] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x40d4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099146.WMF", cAlternateFileName="")) returned 1 [0152.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0152.127] GetProcessHeap () returned 0x4e0000 [0152.127] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0152.127] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0152.127] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0152.127] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0152.143] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0152.143] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0152.143] GetProcessHeap () returned 0x4e0000 [0152.143] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0152.143] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0152.143] CryptDestroyKey (hKey=0x522f98) returned 1 [0152.143] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0152.143] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0152.143] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0152.143] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0152.143] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0152.143] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0152.144] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0152.144] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0152.144] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.144] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40d4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x40d4, lpOverlapped=0x0) returned 1 [0152.165] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x40e0, dwBufLen=0x40e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x40e0) returned 1 [0152.165] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.165] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40e0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x40e0, lpOverlapped=0x0) returned 1 [0152.165] CryptDestroyKey (hKey=0x522f98) returned 1 [0152.165] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x41b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.165] SetEndOfFile (hFile=0xdc) returned 1 [0152.167] GetProcessHeap () returned 0x4e0000 [0152.167] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0152.167] GetProcessHeap () returned 0x4e0000 [0152.167] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0152.167] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0152.168] CloseHandle (hObject=0xdc) returned 1 [0152.169] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x5f39, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099147.JPG", cAlternateFileName="")) returned 1 [0152.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0152.169] GetProcessHeap () returned 0x4e0000 [0152.169] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0152.169] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0152.169] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0152.169] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x7, lpOverlapped=0x0) returned 1 [0152.257] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0152.257] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0152.257] GetProcessHeap () returned 0x4e0000 [0152.257] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0152.257] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0152.257] CryptDestroyKey (hKey=0x522f98) returned 1 [0152.257] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0152.257] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0152.257] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0152.257] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0152.257] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0152.257] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0152.258] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0152.258] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0152.258] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.258] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5f39, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x5f39, lpOverlapped=0x0) returned 1 [0152.258] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5f40, dwBufLen=0x5f40 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5f40) returned 1 [0152.259] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.259] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5f40, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5f40, lpOverlapped=0x0) returned 1 [0152.259] CryptDestroyKey (hKey=0x522f98) returned 1 [0152.259] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.259] SetEndOfFile (hFile=0xdc) returned 1 [0152.261] GetProcessHeap () returned 0x4e0000 [0152.261] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0152.261] GetProcessHeap () returned 0x4e0000 [0152.261] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0152.261] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0152.262] CloseHandle (hObject=0xdc) returned 1 [0152.262] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x4752, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099148.JPG", cAlternateFileName="")) returned 1 [0152.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0152.263] GetProcessHeap () returned 0x4e0000 [0152.263] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0152.263] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0152.263] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0152.263] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0152.372] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0152.373] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0152.373] GetProcessHeap () returned 0x4e0000 [0152.373] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0152.373] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0152.373] CryptDestroyKey (hKey=0x522f98) returned 1 [0152.373] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0152.373] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0152.373] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0152.373] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0152.373] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0152.373] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0152.373] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0152.373] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0152.373] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.373] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4752, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4752, lpOverlapped=0x0) returned 1 [0152.375] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4760, dwBufLen=0x4760 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4760) returned 1 [0152.375] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.375] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4760, lpOverlapped=0x0) returned 1 [0152.376] CryptDestroyKey (hKey=0x522f98) returned 1 [0152.376] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.376] SetEndOfFile (hFile=0xdc) returned 1 [0152.379] GetProcessHeap () returned 0x4e0000 [0152.379] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0152.379] GetProcessHeap () returned 0x4e0000 [0152.379] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0152.379] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0152.380] CloseHandle (hObject=0xdc) returned 1 [0152.380] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x11dfe, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099149.WMF", cAlternateFileName="")) returned 1 [0152.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0152.382] GetProcessHeap () returned 0x4e0000 [0152.382] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0152.382] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0152.382] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0152.382] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0152.651] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0152.651] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0152.651] GetProcessHeap () returned 0x4e0000 [0152.652] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0152.652] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0152.652] CryptDestroyKey (hKey=0x522f98) returned 1 [0152.652] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0152.652] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0152.652] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0152.652] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0152.652] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0152.652] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0152.652] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0152.652] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0152.652] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.652] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x11dfe, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x11dfe, lpOverlapped=0x0) returned 1 [0152.775] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x11e00, dwBufLen=0x11e00 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x11e00) returned 1 [0152.776] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.776] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x11e00, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x11e00, lpOverlapped=0x0) returned 1 [0152.777] CryptDestroyKey (hKey=0x522f98) returned 1 [0152.777] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x11ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.777] SetEndOfFile (hFile=0xdc) returned 1 [0152.781] GetProcessHeap () returned 0x4e0000 [0152.781] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0152.781] GetProcessHeap () returned 0x4e0000 [0152.781] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0152.781] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0152.782] CloseHandle (hObject=0xdc) returned 1 [0152.782] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x559a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099150.JPG", cAlternateFileName="")) returned 1 [0152.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0152.784] GetProcessHeap () returned 0x4e0000 [0152.784] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0152.785] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0152.785] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0152.785] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0152.925] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0152.925] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0152.925] GetProcessHeap () returned 0x4e0000 [0152.925] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0152.925] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0152.925] CryptDestroyKey (hKey=0x522f98) returned 1 [0152.926] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0152.926] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0152.926] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0152.926] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0152.926] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0152.926] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0152.926] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0152.926] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0152.926] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.926] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x559a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x559a, lpOverlapped=0x0) returned 1 [0152.929] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x55a0, dwBufLen=0x55a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x55a0) returned 1 [0152.929] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.930] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x55a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x55a0, lpOverlapped=0x0) returned 1 [0152.930] CryptDestroyKey (hKey=0x522f98) returned 1 [0152.930] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5674, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.930] SetEndOfFile (hFile=0xdc) returned 1 [0152.933] GetProcessHeap () returned 0x4e0000 [0152.933] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0152.933] GetProcessHeap () returned 0x4e0000 [0152.933] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0152.933] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0152.993] CloseHandle (hObject=0xdc) returned 1 [0152.993] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x65e6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099151.WMF", cAlternateFileName="")) returned 1 [0152.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0152.994] GetProcessHeap () returned 0x4e0000 [0152.994] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0152.994] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0152.994] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0152.994] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0153.055] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0153.055] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0153.055] GetProcessHeap () returned 0x4e0000 [0153.055] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0153.055] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0153.056] CryptDestroyKey (hKey=0x522f98) returned 1 [0153.056] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0153.056] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0153.056] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0153.056] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0153.056] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0153.056] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0153.056] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0153.056] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0153.056] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.056] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x65e6, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x65e6, lpOverlapped=0x0) returned 1 [0153.171] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x65f0, dwBufLen=0x65f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x65f0) returned 1 [0153.171] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.171] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x65f0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x65f0, lpOverlapped=0x0) returned 1 [0153.171] CryptDestroyKey (hKey=0x522f98) returned 1 [0153.171] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x66c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.172] SetEndOfFile (hFile=0xdc) returned 1 [0153.174] GetProcessHeap () returned 0x4e0000 [0153.174] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0153.174] GetProcessHeap () returned 0x4e0000 [0153.174] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0153.174] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0153.175] CloseHandle (hObject=0xdc) returned 1 [0153.175] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x2dae, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099152.JPG", cAlternateFileName="")) returned 1 [0153.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0153.176] GetProcessHeap () returned 0x4e0000 [0153.176] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0153.176] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0153.176] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0153.176] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0153.254] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0153.254] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0153.254] GetProcessHeap () returned 0x4e0000 [0153.254] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0153.254] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0153.254] CryptDestroyKey (hKey=0x522f98) returned 1 [0153.255] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0153.255] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0153.255] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0153.255] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0153.255] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0153.255] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0153.255] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0153.255] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0153.255] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.255] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2dae, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2dae, lpOverlapped=0x0) returned 1 [0153.262] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2db0, dwBufLen=0x2db0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2db0) returned 1 [0153.262] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.262] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2db0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2db0, lpOverlapped=0x0) returned 1 [0153.262] CryptDestroyKey (hKey=0x522f98) returned 1 [0153.262] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2e84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.262] SetEndOfFile (hFile=0xdc) returned 1 [0153.264] GetProcessHeap () returned 0x4e0000 [0153.264] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0153.264] GetProcessHeap () returned 0x4e0000 [0153.264] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0153.264] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0153.266] CloseHandle (hObject=0xdc) returned 1 [0153.266] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x3632, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099153.WMF", cAlternateFileName="")) returned 1 [0153.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0153.267] GetProcessHeap () returned 0x4e0000 [0153.267] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0153.267] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0153.267] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0153.267] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0153.273] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0153.273] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0153.273] GetProcessHeap () returned 0x4e0000 [0153.273] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0153.273] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0153.273] CryptDestroyKey (hKey=0x522f98) returned 1 [0153.273] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0153.273] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0153.273] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0153.273] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0153.276] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0153.276] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0153.276] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0153.276] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0153.276] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.276] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3632, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3632, lpOverlapped=0x0) returned 1 [0153.297] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3640, dwBufLen=0x3640 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3640) returned 1 [0153.297] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.297] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3640, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3640, lpOverlapped=0x0) returned 1 [0153.297] CryptDestroyKey (hKey=0x522f98) returned 1 [0153.297] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.297] SetEndOfFile (hFile=0xdc) returned 1 [0153.301] GetProcessHeap () returned 0x4e0000 [0153.301] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0153.301] GetProcessHeap () returned 0x4e0000 [0153.301] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0153.301] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0153.303] CloseHandle (hObject=0xdc) returned 1 [0153.303] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1b11, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099154.JPG", cAlternateFileName="")) returned 1 [0153.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0153.310] GetProcessHeap () returned 0x4e0000 [0153.310] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0153.310] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0153.310] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0153.310] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xf, lpOverlapped=0x0) returned 1 [0153.312] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0153.312] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0153.312] GetProcessHeap () returned 0x4e0000 [0153.312] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0153.313] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0153.313] CryptDestroyKey (hKey=0x522f98) returned 1 [0153.313] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0153.313] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0153.313] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0153.313] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0153.313] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0153.313] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0153.313] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0153.313] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0153.313] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.313] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1b11, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1b11, lpOverlapped=0x0) returned 1 [0153.325] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1b20, dwBufLen=0x1b20 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1b20) returned 1 [0153.325] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.325] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1b20, lpOverlapped=0x0) returned 1 [0153.326] CryptDestroyKey (hKey=0x522f98) returned 1 [0153.326] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1bf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.326] SetEndOfFile (hFile=0xdc) returned 1 [0153.328] GetProcessHeap () returned 0x4e0000 [0153.328] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0153.328] GetProcessHeap () returned 0x4e0000 [0153.328] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0153.328] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0153.329] CloseHandle (hObject=0xdc) returned 1 [0153.329] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x227a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099155.JPG", cAlternateFileName="")) returned 1 [0153.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0153.330] GetProcessHeap () returned 0x4e0000 [0153.330] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0153.330] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0153.330] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0153.330] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0153.354] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0153.354] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0153.354] GetProcessHeap () returned 0x4e0000 [0153.354] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0153.354] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0153.354] CryptDestroyKey (hKey=0x522f98) returned 1 [0153.354] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0153.354] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0153.354] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0153.354] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0153.354] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0153.354] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0153.354] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0153.355] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0153.355] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.355] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x227a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x227a, lpOverlapped=0x0) returned 1 [0153.359] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2280, dwBufLen=0x2280 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2280) returned 1 [0153.360] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.360] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2280, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2280, lpOverlapped=0x0) returned 1 [0153.360] CryptDestroyKey (hKey=0x522f98) returned 1 [0153.360] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2354, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.360] SetEndOfFile (hFile=0xdc) returned 1 [0153.362] GetProcessHeap () returned 0x4e0000 [0153.362] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0153.362] GetProcessHeap () returned 0x4e0000 [0153.362] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0153.362] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0153.366] CloseHandle (hObject=0xdc) returned 1 [0153.366] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x3682, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099156.JPG", cAlternateFileName="")) returned 1 [0153.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0153.366] GetProcessHeap () returned 0x4e0000 [0153.366] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0153.366] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0153.366] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0153.366] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0153.397] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0153.397] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0153.397] GetProcessHeap () returned 0x4e0000 [0153.397] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0153.397] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0153.397] CryptDestroyKey (hKey=0x522f98) returned 1 [0153.397] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0153.397] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0153.397] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0153.397] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0153.397] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0153.397] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0153.397] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0153.397] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0153.397] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.397] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3682, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3682, lpOverlapped=0x0) returned 1 [0153.406] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3690, dwBufLen=0x3690 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3690) returned 1 [0153.406] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.406] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3690, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3690, lpOverlapped=0x0) returned 1 [0153.406] CryptDestroyKey (hKey=0x522f98) returned 1 [0153.406] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3764, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.406] SetEndOfFile (hFile=0xdc) returned 1 [0153.408] GetProcessHeap () returned 0x4e0000 [0153.408] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0153.408] GetProcessHeap () returned 0x4e0000 [0153.408] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0153.408] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0153.410] CloseHandle (hObject=0xdc) returned 1 [0153.410] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x25c7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099157.JPG", cAlternateFileName="")) returned 1 [0153.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0153.410] GetProcessHeap () returned 0x4e0000 [0153.410] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0153.420] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0153.420] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0153.420] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x9, lpOverlapped=0x0) returned 1 [0153.422] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0153.422] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0153.422] GetProcessHeap () returned 0x4e0000 [0153.422] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0153.422] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0153.422] CryptDestroyKey (hKey=0x522f98) returned 1 [0153.422] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0153.422] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0153.422] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0153.422] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0153.423] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0153.423] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0153.423] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0153.423] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0153.423] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.423] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x25c7, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x25c7, lpOverlapped=0x0) returned 1 [0153.424] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x25d0, dwBufLen=0x25d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x25d0) returned 1 [0153.424] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.424] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x25d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x25d0, lpOverlapped=0x0) returned 1 [0153.424] CryptDestroyKey (hKey=0x522f98) returned 1 [0153.424] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x26a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.424] SetEndOfFile (hFile=0xdc) returned 1 [0153.427] GetProcessHeap () returned 0x4e0000 [0153.427] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0153.427] GetProcessHeap () returned 0x4e0000 [0153.427] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0153.427] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0153.428] CloseHandle (hObject=0xdc) returned 1 [0153.428] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x6630, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099158.WMF", cAlternateFileName="")) returned 1 [0153.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0153.429] GetProcessHeap () returned 0x4e0000 [0153.429] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0153.429] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0153.429] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0153.429] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0153.429] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0153.429] GetProcessHeap () returned 0x4e0000 [0153.429] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0153.429] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0153.429] CryptDestroyKey (hKey=0x522f98) returned 1 [0153.429] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0153.478] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0153.478] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0153.478] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0153.478] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0153.478] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0153.478] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0153.478] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0153.478] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.478] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x6630, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x6630, lpOverlapped=0x0) returned 1 [0153.480] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6630, dwBufLen=0x6630 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6630) returned 1 [0153.480] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.480] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6630, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x6630, lpOverlapped=0x0) returned 1 [0153.481] CryptDestroyKey (hKey=0x522f98) returned 1 [0153.481] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6704, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.481] SetEndOfFile (hFile=0xdc) returned 1 [0153.484] GetProcessHeap () returned 0x4e0000 [0153.484] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0153.484] GetProcessHeap () returned 0x4e0000 [0153.484] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0153.484] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0153.485] CloseHandle (hObject=0xdc) returned 1 [0153.485] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x6b9a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099159.WMF", cAlternateFileName="")) returned 1 [0153.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0153.486] GetProcessHeap () returned 0x4e0000 [0153.486] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0153.486] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0153.486] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0153.486] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0153.744] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0153.744] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0153.744] GetProcessHeap () returned 0x4e0000 [0153.744] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0153.745] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0153.745] CryptDestroyKey (hKey=0x522f98) returned 1 [0153.745] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0153.745] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0153.745] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0153.745] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0153.745] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0153.745] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0153.745] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0153.745] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0153.745] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.745] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x6b9a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x6b9a, lpOverlapped=0x0) returned 1 [0153.982] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6ba0, dwBufLen=0x6ba0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6ba0) returned 1 [0153.982] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.982] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6ba0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x6ba0, lpOverlapped=0x0) returned 1 [0153.983] CryptDestroyKey (hKey=0x522f98) returned 1 [0153.983] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6c74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.983] SetEndOfFile (hFile=0xdc) returned 1 [0153.986] GetProcessHeap () returned 0x4e0000 [0153.986] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0153.986] GetProcessHeap () returned 0x4e0000 [0153.986] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0153.986] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0153.987] CloseHandle (hObject=0xdc) returned 1 [0153.987] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x3b29, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099160.JPG", cAlternateFileName="")) returned 1 [0153.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0153.989] GetProcessHeap () returned 0x4e0000 [0153.989] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0153.989] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0153.989] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0153.990] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x7, lpOverlapped=0x0) returned 1 [0154.011] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0154.011] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0154.011] GetProcessHeap () returned 0x4e0000 [0154.011] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0154.011] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0154.011] CryptDestroyKey (hKey=0x522f98) returned 1 [0154.011] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0154.011] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0154.011] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0154.011] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0154.012] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0154.012] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0154.012] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0154.012] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0154.012] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.012] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3b29, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3b29, lpOverlapped=0x0) returned 1 [0154.043] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3b30, dwBufLen=0x3b30 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3b30) returned 1 [0154.043] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.043] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3b30, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3b30, lpOverlapped=0x0) returned 1 [0154.043] CryptDestroyKey (hKey=0x522f98) returned 1 [0154.043] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3c04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.043] SetEndOfFile (hFile=0xdc) returned 1 [0154.046] GetProcessHeap () returned 0x4e0000 [0154.046] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0154.046] GetProcessHeap () returned 0x4e0000 [0154.046] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0154.046] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0154.047] CloseHandle (hObject=0xdc) returned 1 [0154.048] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1bf2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099161.JPG", cAlternateFileName="")) returned 1 [0154.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0154.048] GetProcessHeap () returned 0x4e0000 [0154.048] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0154.048] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0154.048] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0154.049] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0154.068] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0154.068] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0154.068] GetProcessHeap () returned 0x4e0000 [0154.068] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0154.068] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0154.068] CryptDestroyKey (hKey=0x522f98) returned 1 [0154.068] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0154.068] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0154.068] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0154.068] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0154.069] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0154.069] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0154.069] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0154.069] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0154.069] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.069] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1bf2, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1bf2, lpOverlapped=0x0) returned 1 [0154.115] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1c00, dwBufLen=0x1c00 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1c00) returned 1 [0154.115] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.115] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1c00, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1c00, lpOverlapped=0x0) returned 1 [0154.115] CryptDestroyKey (hKey=0x522f98) returned 1 [0154.115] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1cd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.115] SetEndOfFile (hFile=0xdc) returned 1 [0154.118] GetProcessHeap () returned 0x4e0000 [0154.118] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0154.118] GetProcessHeap () returned 0x4e0000 [0154.118] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0154.118] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0154.119] CloseHandle (hObject=0xdc) returned 1 [0154.119] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x4cc8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099162.JPG", cAlternateFileName="")) returned 1 [0154.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0154.120] GetProcessHeap () returned 0x4e0000 [0154.120] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0154.120] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0154.120] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0154.120] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0154.169] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0154.170] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0154.170] GetProcessHeap () returned 0x4e0000 [0154.170] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0154.170] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0154.170] CryptDestroyKey (hKey=0x522f98) returned 1 [0154.170] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0154.170] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0154.170] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0154.170] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0154.170] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0154.170] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0154.171] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0154.171] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0154.171] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.171] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4cc8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4cc8, lpOverlapped=0x0) returned 1 [0154.300] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4cd0, dwBufLen=0x4cd0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4cd0) returned 1 [0154.300] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.301] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4cd0, lpOverlapped=0x0) returned 1 [0154.301] CryptDestroyKey (hKey=0x522f98) returned 1 [0154.301] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4da4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.301] SetEndOfFile (hFile=0xdc) returned 1 [0154.303] GetProcessHeap () returned 0x4e0000 [0154.303] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0154.303] GetProcessHeap () returned 0x4e0000 [0154.303] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0154.303] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0154.304] CloseHandle (hObject=0xdc) returned 1 [0154.304] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x5754, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099163.WMF", cAlternateFileName="")) returned 1 [0154.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0154.305] GetProcessHeap () returned 0x4e0000 [0154.305] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0154.305] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0154.305] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0154.305] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0154.308] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0154.308] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0154.308] GetProcessHeap () returned 0x4e0000 [0154.308] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0154.308] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0154.308] CryptDestroyKey (hKey=0x522f98) returned 1 [0154.308] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0154.308] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0154.308] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0154.309] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0154.309] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0154.309] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0154.309] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0154.309] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0154.309] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.309] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5754, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x5754, lpOverlapped=0x0) returned 1 [0154.312] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5760, dwBufLen=0x5760 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5760) returned 1 [0154.312] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.312] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5760, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5760, lpOverlapped=0x0) returned 1 [0154.313] CryptDestroyKey (hKey=0x522f98) returned 1 [0154.313] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.313] SetEndOfFile (hFile=0xdc) returned 1 [0154.315] GetProcessHeap () returned 0x4e0000 [0154.315] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0154.315] GetProcessHeap () returned 0x4e0000 [0154.315] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0154.315] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0154.316] CloseHandle (hObject=0xdc) returned 1 [0154.316] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x55ba, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099164.WMF", cAlternateFileName="")) returned 1 [0154.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0154.317] GetProcessHeap () returned 0x4e0000 [0154.317] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0154.317] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0154.317] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0154.317] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0154.321] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0154.321] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0154.321] GetProcessHeap () returned 0x4e0000 [0154.321] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0154.321] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0154.322] CryptDestroyKey (hKey=0x522f98) returned 1 [0154.322] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0154.322] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0154.322] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0154.322] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0154.322] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0154.322] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0154.322] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0154.322] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0154.322] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.322] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x55ba, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x55ba, lpOverlapped=0x0) returned 1 [0154.350] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x55c0, dwBufLen=0x55c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x55c0) returned 1 [0154.350] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.350] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x55c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x55c0, lpOverlapped=0x0) returned 1 [0154.351] CryptDestroyKey (hKey=0x522f98) returned 1 [0154.351] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.351] SetEndOfFile (hFile=0xdc) returned 1 [0154.353] GetProcessHeap () returned 0x4e0000 [0154.353] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0154.353] GetProcessHeap () returned 0x4e0000 [0154.353] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0154.353] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0154.354] CloseHandle (hObject=0xdc) returned 1 [0154.354] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xc53a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099165.JPG", cAlternateFileName="")) returned 1 [0154.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0154.355] GetProcessHeap () returned 0x4e0000 [0154.355] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0154.355] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0154.355] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0154.355] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0154.375] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0154.375] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0154.375] GetProcessHeap () returned 0x4e0000 [0154.375] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0154.375] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0154.375] CryptDestroyKey (hKey=0x522f98) returned 1 [0154.375] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0154.375] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0154.376] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0154.376] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0154.376] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0154.376] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0154.376] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0154.376] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0154.376] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.376] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xc53a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xc53a, lpOverlapped=0x0) returned 1 [0154.386] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xc540, dwBufLen=0xc540 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xc540) returned 1 [0154.386] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.386] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc540, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xc540, lpOverlapped=0x0) returned 1 [0154.386] CryptDestroyKey (hKey=0x522f98) returned 1 [0154.386] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xc614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.387] SetEndOfFile (hFile=0xdc) returned 1 [0154.389] GetProcessHeap () returned 0x4e0000 [0154.389] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0154.389] GetProcessHeap () returned 0x4e0000 [0154.389] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0154.389] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0154.390] CloseHandle (hObject=0xdc) returned 1 [0154.390] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xfcff, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099166.JPG", cAlternateFileName="")) returned 1 [0154.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0154.391] GetProcessHeap () returned 0x4e0000 [0154.391] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0154.392] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0154.392] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0154.392] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x1, lpOverlapped=0x0) returned 1 [0154.458] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0154.458] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0154.458] GetProcessHeap () returned 0x4e0000 [0154.458] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0154.458] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0154.458] CryptDestroyKey (hKey=0x522f98) returned 1 [0154.458] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0154.459] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0154.459] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0154.459] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0154.459] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0154.459] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0154.459] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0154.459] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0154.459] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.459] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xfcff, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xfcff, lpOverlapped=0x0) returned 1 [0154.473] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xfd00, dwBufLen=0xfd00 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xfd00) returned 1 [0154.474] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.474] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xfd00, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xfd00, lpOverlapped=0x0) returned 1 [0154.474] CryptDestroyKey (hKey=0x522f98) returned 1 [0154.474] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xfdd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.474] SetEndOfFile (hFile=0xdc) returned 1 [0154.477] GetProcessHeap () returned 0x4e0000 [0154.477] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0154.477] GetProcessHeap () returned 0x4e0000 [0154.477] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0154.477] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0154.478] CloseHandle (hObject=0xdc) returned 1 [0154.478] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xabad, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099167.JPG", cAlternateFileName="")) returned 1 [0154.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0154.478] GetProcessHeap () returned 0x4e0000 [0154.478] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0154.478] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0154.479] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0154.479] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x3, lpOverlapped=0x0) returned 1 [0154.545] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0154.545] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0154.545] GetProcessHeap () returned 0x4e0000 [0154.545] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0154.545] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0154.545] CryptDestroyKey (hKey=0x522f98) returned 1 [0154.545] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0154.546] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0154.546] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0154.546] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0154.546] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0154.546] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0154.546] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0154.546] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0154.546] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.547] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xabad, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xabad, lpOverlapped=0x0) returned 1 [0154.552] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xabb0, dwBufLen=0xabb0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xabb0) returned 1 [0154.553] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.553] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xabb0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xabb0, lpOverlapped=0x0) returned 1 [0154.553] CryptDestroyKey (hKey=0x522f98) returned 1 [0154.553] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xac84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.553] SetEndOfFile (hFile=0xdc) returned 1 [0154.556] GetProcessHeap () returned 0x4e0000 [0154.556] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0154.556] GetProcessHeap () returned 0x4e0000 [0154.556] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0154.556] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0154.557] CloseHandle (hObject=0xdc) returned 1 [0154.557] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x4ed3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099168.JPG", cAlternateFileName="")) returned 1 [0154.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0154.558] GetProcessHeap () returned 0x4e0000 [0154.558] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0154.558] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0154.558] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0154.558] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xd, lpOverlapped=0x0) returned 1 [0154.565] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0154.565] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0154.565] GetProcessHeap () returned 0x4e0000 [0154.565] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0154.565] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0154.565] CryptDestroyKey (hKey=0x522f98) returned 1 [0154.565] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0154.565] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0154.565] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0154.566] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0154.566] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0154.566] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0154.566] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0154.566] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0154.566] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.566] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4ed3, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4ed3, lpOverlapped=0x0) returned 1 [0154.642] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4ee0, dwBufLen=0x4ee0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4ee0) returned 1 [0154.642] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.642] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4ee0, lpOverlapped=0x0) returned 1 [0154.643] CryptDestroyKey (hKey=0x522f98) returned 1 [0154.643] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4fb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.643] SetEndOfFile (hFile=0xdc) returned 1 [0154.646] GetProcessHeap () returned 0x4e0000 [0154.646] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0154.646] GetProcessHeap () returned 0x4e0000 [0154.646] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0154.646] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0154.647] CloseHandle (hObject=0xdc) returned 1 [0154.647] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x27d0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099169.WMF", cAlternateFileName="")) returned 1 [0154.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0154.648] GetProcessHeap () returned 0x4e0000 [0154.648] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0154.648] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0154.648] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0154.648] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0154.648] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0154.648] GetProcessHeap () returned 0x4e0000 [0154.648] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0154.648] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0154.648] CryptDestroyKey (hKey=0x522f98) returned 1 [0154.648] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0154.698] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0154.698] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0154.698] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0154.698] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0154.698] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0154.698] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0154.698] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0154.698] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.698] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x27d0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x27d0, lpOverlapped=0x0) returned 1 [0154.702] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x27d0, dwBufLen=0x27d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x27d0) returned 1 [0154.702] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.702] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x27d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x27d0, lpOverlapped=0x0) returned 1 [0154.712] CryptDestroyKey (hKey=0x522f98) returned 1 [0154.712] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x28a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.712] SetEndOfFile (hFile=0xdc) returned 1 [0154.715] GetProcessHeap () returned 0x4e0000 [0154.715] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0154.715] GetProcessHeap () returned 0x4e0000 [0154.715] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0154.715] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0154.716] CloseHandle (hObject=0xdc) returned 1 [0154.716] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x5ee4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099170.WMF", cAlternateFileName="")) returned 1 [0154.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0154.717] GetProcessHeap () returned 0x4e0000 [0154.717] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0154.717] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0154.717] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0154.717] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0154.775] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0154.775] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0154.775] GetProcessHeap () returned 0x4e0000 [0154.775] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0154.775] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0154.775] CryptDestroyKey (hKey=0x522f98) returned 1 [0154.776] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0154.776] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0154.776] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0154.776] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0154.776] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0154.776] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0154.776] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0154.776] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0154.776] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.776] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5ee4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x5ee4, lpOverlapped=0x0) returned 1 [0154.828] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5ef0, dwBufLen=0x5ef0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5ef0) returned 1 [0154.828] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.828] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5ef0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5ef0, lpOverlapped=0x0) returned 1 [0154.828] CryptDestroyKey (hKey=0x522f98) returned 1 [0154.829] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5fc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.829] SetEndOfFile (hFile=0xdc) returned 1 [0154.832] GetProcessHeap () returned 0x4e0000 [0154.832] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0154.832] GetProcessHeap () returned 0x4e0000 [0154.832] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0154.832] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0154.833] CloseHandle (hObject=0xdc) returned 1 [0154.833] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x2232, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099171.WMF", cAlternateFileName="")) returned 1 [0154.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0154.834] GetProcessHeap () returned 0x4e0000 [0154.834] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0154.834] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0154.834] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0154.834] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0154.863] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0154.863] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0154.863] GetProcessHeap () returned 0x4e0000 [0154.863] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0154.863] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0154.863] CryptDestroyKey (hKey=0x522f98) returned 1 [0154.863] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0154.863] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0154.863] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0154.864] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0154.864] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0154.864] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0154.864] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0154.864] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0154.864] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.864] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2232, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2232, lpOverlapped=0x0) returned 1 [0154.879] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2240, dwBufLen=0x2240 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2240) returned 1 [0154.879] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.879] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2240, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2240, lpOverlapped=0x0) returned 1 [0154.879] CryptDestroyKey (hKey=0x522f98) returned 1 [0154.879] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.879] SetEndOfFile (hFile=0xdc) returned 1 [0154.881] GetProcessHeap () returned 0x4e0000 [0154.882] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0154.882] GetProcessHeap () returned 0x4e0000 [0154.882] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0154.882] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0154.883] CloseHandle (hObject=0xdc) returned 1 [0154.883] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xe392, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099172.WMF", cAlternateFileName="")) returned 1 [0154.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0154.884] GetProcessHeap () returned 0x4e0000 [0154.884] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0154.884] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0154.884] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0154.884] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0155.152] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0155.153] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0155.153] GetProcessHeap () returned 0x4e0000 [0155.153] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0155.153] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0155.153] CryptDestroyKey (hKey=0x522f98) returned 1 [0155.153] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0155.153] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0155.153] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0155.153] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0155.153] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0155.153] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0155.153] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0155.153] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0155.154] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.154] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xe392, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xe392, lpOverlapped=0x0) returned 1 [0155.191] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe3a0, dwBufLen=0xe3a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe3a0) returned 1 [0155.191] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.192] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe3a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xe3a0, lpOverlapped=0x0) returned 1 [0155.192] CryptDestroyKey (hKey=0x522f98) returned 1 [0155.192] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xe474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.192] SetEndOfFile (hFile=0xdc) returned 1 [0155.195] GetProcessHeap () returned 0x4e0000 [0155.195] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0155.195] GetProcessHeap () returned 0x4e0000 [0155.195] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0155.195] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0155.198] CloseHandle (hObject=0xdc) returned 1 [0155.198] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x9114, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099173.WMF", cAlternateFileName="")) returned 1 [0155.198] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0155.198] GetProcessHeap () returned 0x4e0000 [0155.198] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0155.198] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0155.198] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0155.199] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0155.243] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0155.243] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0155.243] GetProcessHeap () returned 0x4e0000 [0155.243] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0155.243] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0155.243] CryptDestroyKey (hKey=0x522f98) returned 1 [0155.243] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0155.243] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0155.244] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0155.244] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0155.244] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0155.244] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0155.244] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0155.244] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0155.244] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.244] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x9114, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x9114, lpOverlapped=0x0) returned 1 [0155.513] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9120, dwBufLen=0x9120 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9120) returned 1 [0155.514] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.514] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x9120, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x9120, lpOverlapped=0x0) returned 1 [0155.514] CryptDestroyKey (hKey=0x522f98) returned 1 [0155.514] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x91f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.514] SetEndOfFile (hFile=0xdc) returned 1 [0155.517] GetProcessHeap () returned 0x4e0000 [0155.517] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0155.517] GetProcessHeap () returned 0x4e0000 [0155.517] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0155.517] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0155.519] CloseHandle (hObject=0xdc) returned 1 [0155.519] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1846, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099174.WMF", cAlternateFileName="")) returned 1 [0155.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0155.519] GetProcessHeap () returned 0x4e0000 [0155.519] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0155.519] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0155.519] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0155.519] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0155.521] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0155.521] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0155.521] GetProcessHeap () returned 0x4e0000 [0155.521] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0155.521] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0155.521] CryptDestroyKey (hKey=0x522f98) returned 1 [0155.521] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0155.521] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0155.522] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0155.522] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0155.522] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0155.522] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0155.522] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0155.522] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0155.522] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.522] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1846, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1846, lpOverlapped=0x0) returned 1 [0155.523] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1850, dwBufLen=0x1850 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1850) returned 1 [0155.523] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.523] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1850, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1850, lpOverlapped=0x0) returned 1 [0155.523] CryptDestroyKey (hKey=0x522f98) returned 1 [0155.523] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1924, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.523] SetEndOfFile (hFile=0xdc) returned 1 [0155.526] GetProcessHeap () returned 0x4e0000 [0155.526] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0155.526] GetProcessHeap () returned 0x4e0000 [0155.526] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0155.526] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0155.528] CloseHandle (hObject=0xdc) returned 1 [0155.528] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x2610, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099175.WMF", cAlternateFileName="")) returned 1 [0155.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0155.530] GetProcessHeap () returned 0x4e0000 [0155.530] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0155.530] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0155.530] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0155.530] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0155.530] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0155.530] GetProcessHeap () returned 0x4e0000 [0155.530] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0155.530] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0155.530] CryptDestroyKey (hKey=0x522f98) returned 1 [0155.530] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0155.551] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0155.552] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0155.552] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0155.552] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0155.552] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0155.552] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0155.552] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0155.552] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.552] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2610, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2610, lpOverlapped=0x0) returned 1 [0155.803] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2610, dwBufLen=0x2610 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2610) returned 1 [0155.803] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.803] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2610, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2610, lpOverlapped=0x0) returned 1 [0155.803] CryptDestroyKey (hKey=0x522f98) returned 1 [0155.803] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x26e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.803] SetEndOfFile (hFile=0xdc) returned 1 [0155.805] GetProcessHeap () returned 0x4e0000 [0155.805] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0155.806] GetProcessHeap () returned 0x4e0000 [0155.806] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0155.806] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0155.807] CloseHandle (hObject=0xdc) returned 1 [0155.807] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x9b8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099176.WMF", cAlternateFileName="")) returned 1 [0155.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0155.807] GetProcessHeap () returned 0x4e0000 [0155.807] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0155.807] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0155.807] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0155.807] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0155.819] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0155.819] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0155.819] GetProcessHeap () returned 0x4e0000 [0155.819] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0155.820] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0155.820] CryptDestroyKey (hKey=0x522f98) returned 1 [0155.820] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0155.820] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0155.820] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0155.820] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0155.820] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0155.820] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0155.820] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0155.820] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0155.820] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.820] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x9b8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x9b8, lpOverlapped=0x0) returned 1 [0155.820] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9c0, dwBufLen=0x9c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9c0) returned 1 [0155.821] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.821] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x9c0, lpOverlapped=0x0) returned 1 [0155.821] CryptDestroyKey (hKey=0x522f98) returned 1 [0155.821] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xa94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.821] SetEndOfFile (hFile=0xdc) returned 1 [0155.823] GetProcessHeap () returned 0x4e0000 [0155.823] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0155.824] GetProcessHeap () returned 0x4e0000 [0155.824] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0155.824] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0155.825] CloseHandle (hObject=0xdc) returned 1 [0155.825] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x150a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099177.WMF", cAlternateFileName="")) returned 1 [0155.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0155.826] GetProcessHeap () returned 0x4e0000 [0155.826] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0155.826] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0155.826] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0155.826] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0155.972] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0155.972] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0155.972] GetProcessHeap () returned 0x4e0000 [0155.972] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0155.972] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0155.972] CryptDestroyKey (hKey=0x522f98) returned 1 [0155.972] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0155.972] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0155.972] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0155.972] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0155.972] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0155.972] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0155.972] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0155.972] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0155.972] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.973] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x150a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x150a, lpOverlapped=0x0) returned 1 [0155.973] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1510, dwBufLen=0x1510 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1510) returned 1 [0155.973] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.974] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1510, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1510, lpOverlapped=0x0) returned 1 [0155.974] CryptDestroyKey (hKey=0x522f98) returned 1 [0155.974] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x15e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.974] SetEndOfFile (hFile=0xdc) returned 1 [0155.976] GetProcessHeap () returned 0x4e0000 [0155.976] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0155.976] GetProcessHeap () returned 0x4e0000 [0155.976] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0155.976] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0155.977] CloseHandle (hObject=0xdc) returned 1 [0155.977] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xe16, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099178.WMF", cAlternateFileName="")) returned 1 [0155.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0155.978] GetProcessHeap () returned 0x4e0000 [0155.978] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0155.978] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0155.978] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0155.978] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0155.980] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0155.980] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0155.980] GetProcessHeap () returned 0x4e0000 [0155.980] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0155.980] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0155.980] CryptDestroyKey (hKey=0x522f98) returned 1 [0155.980] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0155.980] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0155.980] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0155.980] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0155.980] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0155.980] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0155.980] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0155.980] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0155.981] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.981] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xe16, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xe16, lpOverlapped=0x0) returned 1 [0155.981] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe20, dwBufLen=0xe20 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe20) returned 1 [0155.981] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.981] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xe20, lpOverlapped=0x0) returned 1 [0155.981] CryptDestroyKey (hKey=0x522f98) returned 1 [0155.981] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.981] SetEndOfFile (hFile=0xdc) returned 1 [0155.983] GetProcessHeap () returned 0x4e0000 [0155.983] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0155.983] GetProcessHeap () returned 0x4e0000 [0155.983] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0155.983] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0155.984] CloseHandle (hObject=0xdc) returned 1 [0155.984] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x23c2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099179.WMF", cAlternateFileName="")) returned 1 [0155.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0155.985] GetProcessHeap () returned 0x4e0000 [0155.985] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0155.985] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0155.985] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0155.985] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0156.009] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.009] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.009] GetProcessHeap () returned 0x4e0000 [0156.009] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0156.009] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0156.009] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.009] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0156.010] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0156.010] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0156.010] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0156.010] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0156.010] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.010] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.010] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.010] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.010] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x23c2, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x23c2, lpOverlapped=0x0) returned 1 [0156.011] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x23d0, dwBufLen=0x23d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x23d0) returned 1 [0156.011] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.011] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x23d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x23d0, lpOverlapped=0x0) returned 1 [0156.011] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.011] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x24a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.011] SetEndOfFile (hFile=0xdc) returned 1 [0156.013] GetProcessHeap () returned 0x4e0000 [0156.013] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0156.013] GetProcessHeap () returned 0x4e0000 [0156.013] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0156.013] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0156.014] CloseHandle (hObject=0xdc) returned 1 [0156.014] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xd42, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099180.WMF", cAlternateFileName="")) returned 1 [0156.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0156.015] GetProcessHeap () returned 0x4e0000 [0156.015] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0156.015] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0156.015] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0156.015] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0156.017] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.017] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.017] GetProcessHeap () returned 0x4e0000 [0156.017] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0156.017] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0156.017] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.017] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0156.017] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0156.017] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0156.018] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0156.018] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0156.018] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.018] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.018] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.018] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.018] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xd42, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xd42, lpOverlapped=0x0) returned 1 [0156.018] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xd50, dwBufLen=0xd50 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xd50) returned 1 [0156.018] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.018] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xd50, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xd50, lpOverlapped=0x0) returned 1 [0156.024] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.024] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xe24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.024] SetEndOfFile (hFile=0xdc) returned 1 [0156.026] GetProcessHeap () returned 0x4e0000 [0156.026] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0156.026] GetProcessHeap () returned 0x4e0000 [0156.026] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0156.026] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0156.027] CloseHandle (hObject=0xdc) returned 1 [0156.027] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x4ae, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099181.WMF", cAlternateFileName="")) returned 1 [0156.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0156.028] GetProcessHeap () returned 0x4e0000 [0156.028] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0156.028] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0156.028] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0156.028] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0156.030] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.030] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.030] GetProcessHeap () returned 0x4e0000 [0156.030] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0156.030] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0156.030] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.030] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0156.030] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0156.030] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0156.030] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0156.030] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0156.030] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.030] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.030] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.031] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.031] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4ae, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4ae, lpOverlapped=0x0) returned 1 [0156.031] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4b0, dwBufLen=0x4b0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4b0) returned 1 [0156.031] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.031] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4b0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4b0, lpOverlapped=0x0) returned 1 [0156.031] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.031] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x584, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.031] SetEndOfFile (hFile=0xdc) returned 1 [0156.033] GetProcessHeap () returned 0x4e0000 [0156.033] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0156.033] GetProcessHeap () returned 0x4e0000 [0156.033] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0156.033] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0156.034] CloseHandle (hObject=0xdc) returned 1 [0156.034] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xf00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099182.WMF", cAlternateFileName="")) returned 1 [0156.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0156.034] GetProcessHeap () returned 0x4e0000 [0156.034] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0156.034] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0156.034] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0156.034] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.034] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.034] GetProcessHeap () returned 0x4e0000 [0156.034] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0156.034] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0156.034] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.034] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0156.041] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0156.041] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0156.041] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0156.041] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0156.041] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.041] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.041] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.041] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.041] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xf00, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xf00, lpOverlapped=0x0) returned 1 [0156.041] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xf00, dwBufLen=0xf00 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xf00) returned 1 [0156.041] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.041] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xf00, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xf00, lpOverlapped=0x0) returned 1 [0156.042] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.042] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xfd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.042] SetEndOfFile (hFile=0xdc) returned 1 [0156.044] GetProcessHeap () returned 0x4e0000 [0156.044] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0156.044] GetProcessHeap () returned 0x4e0000 [0156.044] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0156.044] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0156.045] CloseHandle (hObject=0xdc) returned 1 [0156.045] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1352, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099183.WMF", cAlternateFileName="")) returned 1 [0156.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0156.046] GetProcessHeap () returned 0x4e0000 [0156.046] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0156.046] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0156.046] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0156.046] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0156.056] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.056] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.056] GetProcessHeap () returned 0x4e0000 [0156.056] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0156.056] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0156.056] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.056] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0156.056] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0156.056] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0156.056] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0156.056] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0156.056] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.057] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.057] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.057] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.057] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1352, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1352, lpOverlapped=0x0) returned 1 [0156.066] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1360, dwBufLen=0x1360 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1360) returned 1 [0156.066] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.066] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1360, lpOverlapped=0x0) returned 1 [0156.066] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.066] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1434, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.066] SetEndOfFile (hFile=0xdc) returned 1 [0156.068] GetProcessHeap () returned 0x4e0000 [0156.068] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0156.068] GetProcessHeap () returned 0x4e0000 [0156.068] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0156.068] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0156.069] CloseHandle (hObject=0xdc) returned 1 [0156.069] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1016, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099184.WMF", cAlternateFileName="")) returned 1 [0156.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0156.070] GetProcessHeap () returned 0x4e0000 [0156.070] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0156.070] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0156.070] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0156.070] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0156.072] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.073] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.073] GetProcessHeap () returned 0x4e0000 [0156.073] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0156.073] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0156.073] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.073] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0156.073] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0156.073] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0156.073] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0156.073] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0156.073] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.073] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.073] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.073] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.073] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1016, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1016, lpOverlapped=0x0) returned 1 [0156.074] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1020, dwBufLen=0x1020 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1020) returned 1 [0156.074] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.074] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1020, lpOverlapped=0x0) returned 1 [0156.074] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.074] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x10f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.074] SetEndOfFile (hFile=0xdc) returned 1 [0156.076] GetProcessHeap () returned 0x4e0000 [0156.076] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0156.076] GetProcessHeap () returned 0x4e0000 [0156.076] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0156.076] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0156.077] CloseHandle (hObject=0xdc) returned 1 [0156.077] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xcd2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099185.JPG", cAlternateFileName="")) returned 1 [0156.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0156.078] GetProcessHeap () returned 0x4e0000 [0156.078] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0156.078] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0156.078] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0156.078] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0156.080] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.080] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.080] GetProcessHeap () returned 0x4e0000 [0156.080] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0156.080] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0156.080] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.080] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0156.080] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0156.080] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0156.080] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0156.080] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0156.081] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.081] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.081] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.081] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.081] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xcd2, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xcd2, lpOverlapped=0x0) returned 1 [0156.081] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xce0, dwBufLen=0xce0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xce0) returned 1 [0156.081] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.081] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xce0, lpOverlapped=0x0) returned 1 [0156.081] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.081] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xdb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.081] SetEndOfFile (hFile=0xdc) returned 1 [0156.083] GetProcessHeap () returned 0x4e0000 [0156.083] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0156.083] GetProcessHeap () returned 0x4e0000 [0156.083] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0156.083] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0156.084] CloseHandle (hObject=0xdc) returned 1 [0156.084] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x183cef00, ftCreationTime.dwHighDateTime=0x1bdbf74, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x183cef00, ftLastWriteTime.dwHighDateTime=0x1bdbf74, nFileSizeHigh=0x0, nFileSizeLow=0x4162, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099186.JPG", cAlternateFileName="")) returned 1 [0156.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0156.084] GetProcessHeap () returned 0x4e0000 [0156.084] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0156.084] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0156.084] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0156.084] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0156.086] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.086] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.086] GetProcessHeap () returned 0x4e0000 [0156.086] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0156.086] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0156.086] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.086] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0156.086] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0156.086] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0156.086] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0156.086] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0156.087] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.087] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.087] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.087] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.087] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4162, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4162, lpOverlapped=0x0) returned 1 [0156.087] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4170, dwBufLen=0x4170 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4170) returned 1 [0156.088] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.088] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4170, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4170, lpOverlapped=0x0) returned 1 [0156.088] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.088] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4244, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.088] SetEndOfFile (hFile=0xdc) returned 1 [0156.090] GetProcessHeap () returned 0x4e0000 [0156.090] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0156.090] GetProcessHeap () returned 0x4e0000 [0156.090] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0156.090] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0156.091] CloseHandle (hObject=0xdc) returned 1 [0156.091] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe4b400, ftCreationTime.dwHighDateTime=0x1bdbf74, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe4b400, ftLastWriteTime.dwHighDateTime=0x1bdbf74, nFileSizeHigh=0x0, nFileSizeLow=0x5fd0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099187.JPG", cAlternateFileName="")) returned 1 [0156.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0156.091] GetProcessHeap () returned 0x4e0000 [0156.091] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0156.091] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0156.091] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0156.092] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.092] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.092] GetProcessHeap () returned 0x4e0000 [0156.092] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0156.092] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0156.092] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.092] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0156.105] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0156.105] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0156.105] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0156.105] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0156.106] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.106] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.106] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.106] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.106] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5fd0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x5fd0, lpOverlapped=0x0) returned 1 [0156.107] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5fd0, dwBufLen=0x5fd0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5fd0) returned 1 [0156.107] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.107] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5fd0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5fd0, lpOverlapped=0x0) returned 1 [0156.107] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.107] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x60a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.107] SetEndOfFile (hFile=0xdc) returned 1 [0156.110] GetProcessHeap () returned 0x4e0000 [0156.110] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0156.110] GetProcessHeap () returned 0x4e0000 [0156.110] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0156.110] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0156.111] CloseHandle (hObject=0xdc) returned 1 [0156.111] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x2378, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099188.JPG", cAlternateFileName="")) returned 1 [0156.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0156.111] GetProcessHeap () returned 0x4e0000 [0156.111] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0156.111] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0156.111] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0156.111] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.113] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.113] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.113] GetProcessHeap () returned 0x4e0000 [0156.113] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0156.113] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0156.113] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.113] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0156.113] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0156.113] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0156.113] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0156.113] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0156.114] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.114] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.114] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.114] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.114] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2378, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2378, lpOverlapped=0x0) returned 1 [0156.115] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2380, dwBufLen=0x2380 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2380) returned 1 [0156.115] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.115] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2380, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2380, lpOverlapped=0x0) returned 1 [0156.115] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.115] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2454, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.115] SetEndOfFile (hFile=0xdc) returned 1 [0156.117] GetProcessHeap () returned 0x4e0000 [0156.117] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0156.117] GetProcessHeap () returned 0x4e0000 [0156.117] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0156.117] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0156.118] CloseHandle (hObject=0xdc) returned 1 [0156.118] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1f8c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099189.JPG", cAlternateFileName="")) returned 1 [0156.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0156.119] GetProcessHeap () returned 0x4e0000 [0156.119] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0156.119] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0156.119] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0156.119] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0156.121] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.121] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.121] GetProcessHeap () returned 0x4e0000 [0156.121] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0156.121] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0156.121] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.121] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0156.121] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0156.121] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0156.121] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0156.121] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0156.121] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.121] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.121] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.121] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.121] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1f8c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1f8c, lpOverlapped=0x0) returned 1 [0156.122] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1f90, dwBufLen=0x1f90 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1f90) returned 1 [0156.122] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.122] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1f90, lpOverlapped=0x0) returned 1 [0156.122] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.122] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2064, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.123] SetEndOfFile (hFile=0xdc) returned 1 [0156.125] GetProcessHeap () returned 0x4e0000 [0156.125] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0156.125] GetProcessHeap () returned 0x4e0000 [0156.125] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0156.125] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0156.125] CloseHandle (hObject=0xdc) returned 1 [0156.126] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xab74, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099190.JPG", cAlternateFileName="")) returned 1 [0156.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0156.126] GetProcessHeap () returned 0x4e0000 [0156.126] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0156.126] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0156.127] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0156.127] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0156.128] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.129] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.129] GetProcessHeap () returned 0x4e0000 [0156.129] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0156.129] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0156.129] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.129] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0156.129] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0156.129] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0156.129] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0156.129] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0156.129] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.129] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.129] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.129] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.129] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xab74, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xab74, lpOverlapped=0x0) returned 1 [0156.131] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xab80, dwBufLen=0xab80 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xab80) returned 1 [0156.131] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.131] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xab80, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xab80, lpOverlapped=0x0) returned 1 [0156.132] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.132] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xac54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.132] SetEndOfFile (hFile=0xdc) returned 1 [0156.134] GetProcessHeap () returned 0x4e0000 [0156.134] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0156.134] GetProcessHeap () returned 0x4e0000 [0156.134] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0156.134] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0156.135] CloseHandle (hObject=0xdc) returned 1 [0156.135] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xf39f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099191.JPG", cAlternateFileName="")) returned 1 [0156.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0156.135] GetProcessHeap () returned 0x4e0000 [0156.135] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0156.135] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0156.135] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0156.135] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x1, lpOverlapped=0x0) returned 1 [0156.137] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.137] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.137] GetProcessHeap () returned 0x4e0000 [0156.137] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0156.137] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0156.137] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.137] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0156.137] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0156.137] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0156.137] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0156.137] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0156.137] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.137] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.138] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.138] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.138] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xf39f, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xf39f, lpOverlapped=0x0) returned 1 [0156.139] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xf3a0, dwBufLen=0xf3a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xf3a0) returned 1 [0156.139] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.139] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xf3a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xf3a0, lpOverlapped=0x0) returned 1 [0156.140] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.140] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xf474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.140] SetEndOfFile (hFile=0xdc) returned 1 [0156.142] GetProcessHeap () returned 0x4e0000 [0156.142] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0156.142] GetProcessHeap () returned 0x4e0000 [0156.142] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0156.142] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0156.143] CloseHandle (hObject=0xdc) returned 1 [0156.143] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x462c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099192.GIF", cAlternateFileName="")) returned 1 [0156.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0156.144] GetProcessHeap () returned 0x4e0000 [0156.144] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0156.144] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0156.144] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0156.144] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0156.146] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.146] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.146] GetProcessHeap () returned 0x4e0000 [0156.146] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0156.146] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0156.146] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.146] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0156.146] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0156.146] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0156.146] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0156.146] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0156.146] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.146] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.146] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.146] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.146] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x462c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x462c, lpOverlapped=0x0) returned 1 [0156.147] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4630, dwBufLen=0x4630 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4630) returned 1 [0156.147] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.147] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4630, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4630, lpOverlapped=0x0) returned 1 [0156.148] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.148] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4704, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.148] SetEndOfFile (hFile=0xdc) returned 1 [0156.150] GetProcessHeap () returned 0x4e0000 [0156.150] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0156.150] GetProcessHeap () returned 0x4e0000 [0156.150] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0156.150] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0156.150] CloseHandle (hObject=0xdc) returned 1 [0156.150] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x8ada, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099193.GIF", cAlternateFileName="")) returned 1 [0156.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0156.151] GetProcessHeap () returned 0x4e0000 [0156.151] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0156.151] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0156.151] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0156.151] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0156.153] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.153] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.153] GetProcessHeap () returned 0x4e0000 [0156.153] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0156.153] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0156.153] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.153] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0156.153] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0156.153] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0156.153] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0156.153] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0156.153] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.153] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.153] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.153] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.153] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x8ada, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x8ada, lpOverlapped=0x0) returned 1 [0156.155] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8ae0, dwBufLen=0x8ae0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8ae0) returned 1 [0156.155] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.155] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x8ae0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x8ae0, lpOverlapped=0x0) returned 1 [0156.155] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.155] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x8bb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.155] SetEndOfFile (hFile=0xdc) returned 1 [0156.158] GetProcessHeap () returned 0x4e0000 [0156.158] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0156.158] GetProcessHeap () returned 0x4e0000 [0156.158] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0156.158] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0156.159] CloseHandle (hObject=0xdc) returned 1 [0156.159] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x62b1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099194.GIF", cAlternateFileName="")) returned 1 [0156.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0156.160] GetProcessHeap () returned 0x4e0000 [0156.160] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0156.160] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0156.160] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0156.160] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xf, lpOverlapped=0x0) returned 1 [0156.164] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.164] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.164] GetProcessHeap () returned 0x4e0000 [0156.164] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0156.164] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0156.164] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.164] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0156.164] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0156.164] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0156.164] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0156.164] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0156.164] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.164] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.165] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.165] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.165] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x62b1, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x62b1, lpOverlapped=0x0) returned 1 [0156.166] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x62c0, dwBufLen=0x62c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x62c0) returned 1 [0156.166] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.166] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x62c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x62c0, lpOverlapped=0x0) returned 1 [0156.166] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.166] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6394, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.166] SetEndOfFile (hFile=0xdc) returned 1 [0156.168] GetProcessHeap () returned 0x4e0000 [0156.168] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0156.168] GetProcessHeap () returned 0x4e0000 [0156.168] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0156.168] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0156.169] CloseHandle (hObject=0xdc) returned 1 [0156.169] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x4dd3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099195.GIF", cAlternateFileName="")) returned 1 [0156.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0156.170] GetProcessHeap () returned 0x4e0000 [0156.170] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0156.170] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0156.170] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0156.170] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xd, lpOverlapped=0x0) returned 1 [0156.172] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.172] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.172] GetProcessHeap () returned 0x4e0000 [0156.172] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0156.172] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0156.172] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.172] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0156.172] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0156.172] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0156.172] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0156.172] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0156.173] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.173] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.173] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.173] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.173] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4dd3, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4dd3, lpOverlapped=0x0) returned 1 [0156.173] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4de0, dwBufLen=0x4de0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4de0) returned 1 [0156.174] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.174] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4de0, lpOverlapped=0x0) returned 1 [0156.174] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.174] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4eb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.174] SetEndOfFile (hFile=0xdc) returned 1 [0156.176] GetProcessHeap () returned 0x4e0000 [0156.176] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0156.176] GetProcessHeap () returned 0x4e0000 [0156.176] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0156.176] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0156.177] CloseHandle (hObject=0xdc) returned 1 [0156.177] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x3801, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099196.GIF", cAlternateFileName="")) returned 1 [0156.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0156.178] GetProcessHeap () returned 0x4e0000 [0156.178] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0156.178] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0156.178] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0156.178] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xf, lpOverlapped=0x0) returned 1 [0156.295] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.295] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.295] GetProcessHeap () returned 0x4e0000 [0156.295] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0156.295] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0156.295] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.295] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0156.295] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0156.295] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0156.295] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0156.295] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0156.296] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.296] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.296] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.296] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.296] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3801, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3801, lpOverlapped=0x0) returned 1 [0156.299] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3810, dwBufLen=0x3810 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3810) returned 1 [0156.299] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.299] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3810, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3810, lpOverlapped=0x0) returned 1 [0156.300] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.300] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x38e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.300] SetEndOfFile (hFile=0xdc) returned 1 [0156.303] GetProcessHeap () returned 0x4e0000 [0156.303] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0156.303] GetProcessHeap () returned 0x4e0000 [0156.303] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0156.303] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0156.304] CloseHandle (hObject=0xdc) returned 1 [0156.305] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x2a92, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099197.GIF", cAlternateFileName="")) returned 1 [0156.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0156.305] GetProcessHeap () returned 0x4e0000 [0156.305] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0156.306] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0156.306] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0156.306] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0156.347] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.347] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.347] GetProcessHeap () returned 0x4e0000 [0156.347] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0156.347] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0156.347] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.347] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0156.347] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0156.348] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0156.348] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0156.348] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0156.348] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.348] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.348] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.348] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.348] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2a92, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2a92, lpOverlapped=0x0) returned 1 [0156.365] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2aa0, dwBufLen=0x2aa0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2aa0) returned 1 [0156.365] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.365] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2aa0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2aa0, lpOverlapped=0x0) returned 1 [0156.365] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.365] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2b74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.365] SetEndOfFile (hFile=0xdc) returned 1 [0156.368] GetProcessHeap () returned 0x4e0000 [0156.368] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0156.368] GetProcessHeap () returned 0x4e0000 [0156.368] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0156.368] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0156.370] CloseHandle (hObject=0xdc) returned 1 [0156.370] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x148b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099198.GIF", cAlternateFileName="")) returned 1 [0156.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0156.371] GetProcessHeap () returned 0x4e0000 [0156.371] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0156.371] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0156.371] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0156.371] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x5, lpOverlapped=0x0) returned 1 [0156.419] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.419] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.419] GetProcessHeap () returned 0x4e0000 [0156.420] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0156.420] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0156.420] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.420] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0156.420] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0156.420] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0156.420] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0156.420] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0156.420] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.420] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.420] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.420] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.420] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x148b, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x148b, lpOverlapped=0x0) returned 1 [0156.474] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1490, dwBufLen=0x1490 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1490) returned 1 [0156.474] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.475] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1490, lpOverlapped=0x0) returned 1 [0156.475] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.475] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1564, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.475] SetEndOfFile (hFile=0xdc) returned 1 [0156.477] GetProcessHeap () returned 0x4e0000 [0156.477] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0156.477] GetProcessHeap () returned 0x4e0000 [0156.477] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0156.477] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0156.478] CloseHandle (hObject=0xdc) returned 1 [0156.478] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x84b7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099199.GIF", cAlternateFileName="")) returned 1 [0156.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0156.479] GetProcessHeap () returned 0x4e0000 [0156.479] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0156.479] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0156.479] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0156.479] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x9, lpOverlapped=0x0) returned 1 [0156.502] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.502] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.502] GetProcessHeap () returned 0x4e0000 [0156.503] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0156.503] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0156.503] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.503] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0156.503] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0156.503] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0156.503] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0156.503] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0156.503] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.503] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.503] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.503] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.504] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x84b7, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x84b7, lpOverlapped=0x0) returned 1 [0156.545] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x84c0, dwBufLen=0x84c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x84c0) returned 1 [0156.545] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.545] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x84c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x84c0, lpOverlapped=0x0) returned 1 [0156.545] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.546] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x8594, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.546] SetEndOfFile (hFile=0xdc) returned 1 [0156.548] GetProcessHeap () returned 0x4e0000 [0156.548] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0156.548] GetProcessHeap () returned 0x4e0000 [0156.548] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0156.548] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0156.549] CloseHandle (hObject=0xdc) returned 1 [0156.549] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x409f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099200.GIF", cAlternateFileName="")) returned 1 [0156.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0156.551] GetProcessHeap () returned 0x4e0000 [0156.551] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0156.551] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0156.551] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0156.551] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x1, lpOverlapped=0x0) returned 1 [0156.555] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.555] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.555] GetProcessHeap () returned 0x4e0000 [0156.555] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0156.555] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0156.555] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.555] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0156.556] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0156.556] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0156.556] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0156.556] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0156.556] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.556] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.556] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.556] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.556] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x409f, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x409f, lpOverlapped=0x0) returned 1 [0156.557] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x40a0, dwBufLen=0x40a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x40a0) returned 1 [0156.557] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.557] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x40a0, lpOverlapped=0x0) returned 1 [0156.557] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.557] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4174, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.557] SetEndOfFile (hFile=0xdc) returned 1 [0156.560] GetProcessHeap () returned 0x4e0000 [0156.560] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0156.560] GetProcessHeap () returned 0x4e0000 [0156.560] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0156.560] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0156.561] CloseHandle (hObject=0xdc) returned 1 [0156.561] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xc8c9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099201.GIF", cAlternateFileName="")) returned 1 [0156.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0156.562] GetProcessHeap () returned 0x4e0000 [0156.562] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0156.562] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0156.562] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0156.562] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x7, lpOverlapped=0x0) returned 1 [0156.569] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.569] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.569] GetProcessHeap () returned 0x4e0000 [0156.569] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0156.569] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0156.569] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.569] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0156.569] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0156.569] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0156.569] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0156.569] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0156.570] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.570] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.570] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.570] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.570] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xc8c9, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xc8c9, lpOverlapped=0x0) returned 1 [0156.571] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xc8d0, dwBufLen=0xc8d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xc8d0) returned 1 [0156.572] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.572] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc8d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xc8d0, lpOverlapped=0x0) returned 1 [0156.572] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.572] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xc9a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.572] SetEndOfFile (hFile=0xdc) returned 1 [0156.574] GetProcessHeap () returned 0x4e0000 [0156.574] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0156.574] GetProcessHeap () returned 0x4e0000 [0156.574] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0156.575] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0156.575] CloseHandle (hObject=0xdc) returned 1 [0156.576] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1367, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099202.GIF", cAlternateFileName="")) returned 1 [0156.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0156.576] GetProcessHeap () returned 0x4e0000 [0156.576] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0156.576] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0156.576] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0156.576] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x9, lpOverlapped=0x0) returned 1 [0156.579] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.579] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.579] GetProcessHeap () returned 0x4e0000 [0156.579] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0156.579] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0156.579] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.579] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0156.579] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0156.579] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0156.579] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0156.579] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0156.579] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.579] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.579] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.579] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.579] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1367, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1367, lpOverlapped=0x0) returned 1 [0156.580] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1370, dwBufLen=0x1370 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1370) returned 1 [0156.580] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.580] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1370, lpOverlapped=0x0) returned 1 [0156.581] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.581] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1444, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.581] SetEndOfFile (hFile=0xdc) returned 1 [0156.583] GetProcessHeap () returned 0x4e0000 [0156.583] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0156.583] GetProcessHeap () returned 0x4e0000 [0156.583] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0156.583] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0156.584] CloseHandle (hObject=0xdc) returned 1 [0156.584] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65df6970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xf40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099203.GIF", cAlternateFileName="")) returned 1 [0156.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0156.585] GetProcessHeap () returned 0x4e0000 [0156.585] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0156.585] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0156.585] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0156.585] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.585] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.585] GetProcessHeap () returned 0x4e0000 [0156.585] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0156.585] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0156.585] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.585] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0156.587] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0156.587] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0156.587] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0156.587] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0156.587] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.587] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.587] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.587] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.587] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xf40, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xf40, lpOverlapped=0x0) returned 1 [0156.587] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xf40, dwBufLen=0xf40 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xf40) returned 1 [0156.588] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.588] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xf40, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xf40, lpOverlapped=0x0) returned 1 [0156.588] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.588] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.588] SetEndOfFile (hFile=0xdc) returned 1 [0156.590] GetProcessHeap () returned 0x4e0000 [0156.590] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0156.590] GetProcessHeap () returned 0x4e0000 [0156.590] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0156.590] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0156.591] CloseHandle (hObject=0xdc) returned 1 [0156.591] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65df6970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x45be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099204.WMF", cAlternateFileName="")) returned 1 [0156.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0156.592] GetProcessHeap () returned 0x4e0000 [0156.592] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0156.592] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0156.592] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0156.592] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0156.594] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.594] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.594] GetProcessHeap () returned 0x4e0000 [0156.594] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0156.594] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0156.594] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.594] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0156.594] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0156.594] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0156.594] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0156.595] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0156.595] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.595] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.595] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.595] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.595] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x45be, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x45be, lpOverlapped=0x0) returned 1 [0156.596] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x45c0, dwBufLen=0x45c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x45c0) returned 1 [0156.596] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.596] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x45c0, lpOverlapped=0x0) returned 1 [0156.596] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.596] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.597] SetEndOfFile (hFile=0xdc) returned 1 [0156.599] GetProcessHeap () returned 0x4e0000 [0156.599] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0156.599] GetProcessHeap () returned 0x4e0000 [0156.599] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0156.599] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0156.600] CloseHandle (hObject=0xdc) returned 1 [0156.600] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x45be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099205.WMF", cAlternateFileName="")) returned 1 [0156.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0156.600] GetProcessHeap () returned 0x4e0000 [0156.600] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0156.601] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0156.601] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0156.601] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0156.603] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.603] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.603] GetProcessHeap () returned 0x4e0000 [0156.603] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0156.603] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0156.603] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.603] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0156.603] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0156.603] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0156.603] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0156.603] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0156.603] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.603] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.603] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.603] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.603] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x45be, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x45be, lpOverlapped=0x0) returned 1 [0156.605] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x45c0, dwBufLen=0x45c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x45c0) returned 1 [0156.605] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.605] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x45c0, lpOverlapped=0x0) returned 1 [0156.605] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.605] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.605] SetEndOfFile (hFile=0xdc) returned 1 [0156.607] GetProcessHeap () returned 0x4e0000 [0156.607] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0156.607] GetProcessHeap () returned 0x4e0000 [0156.607] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0156.607] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0156.608] CloseHandle (hObject=0xdc) returned 1 [0156.608] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd20ae00, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbd20ae00, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x133f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0101856.BMP", cAlternateFileName="")) returned 1 [0156.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0156.610] GetProcessHeap () returned 0x4e0000 [0156.610] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0156.610] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0156.610] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0156.610] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.612] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.612] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.612] GetProcessHeap () returned 0x4e0000 [0156.612] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0156.612] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0156.612] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.612] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0156.612] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0156.612] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0156.612] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0156.612] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0156.612] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.612] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.612] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.612] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.613] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x133f8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x133f8, lpOverlapped=0x0) returned 1 [0156.614] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x13400, dwBufLen=0x13400 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x13400) returned 1 [0156.615] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.615] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x13400, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x13400, lpOverlapped=0x0) returned 1 [0156.615] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.615] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x134d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.615] SetEndOfFile (hFile=0xdc) returned 1 [0156.618] GetProcessHeap () returned 0x4e0000 [0156.618] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0156.618] GetProcessHeap () returned 0x4e0000 [0156.618] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0156.619] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0156.620] CloseHandle (hObject=0xdc) returned 1 [0156.620] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf830800, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x65df6970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf830800, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0101857.BMP", cAlternateFileName="")) returned 1 [0156.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0156.620] GetProcessHeap () returned 0x4e0000 [0156.620] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0156.620] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0156.620] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0156.620] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.622] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.623] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.623] GetProcessHeap () returned 0x4e0000 [0156.623] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0156.623] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0156.623] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.623] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0156.623] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0156.623] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0156.623] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0156.623] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0156.623] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.623] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.623] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.623] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.623] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7db8, lpOverlapped=0x0) returned 1 [0156.624] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7dc0) returned 1 [0156.625] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.625] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7dc0, lpOverlapped=0x0) returned 1 [0156.625] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.625] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.625] SetEndOfFile (hFile=0xdc) returned 1 [0156.627] GetProcessHeap () returned 0x4e0000 [0156.627] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0156.627] GetProcessHeap () returned 0x4e0000 [0156.627] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0156.627] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0156.629] CloseHandle (hObject=0xdc) returned 1 [0156.629] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6aa1600, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x65df6970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6aa1600, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0101858.BMP", cAlternateFileName="")) returned 1 [0156.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0156.629] GetProcessHeap () returned 0x4e0000 [0156.629] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0156.629] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0156.629] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0156.629] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.631] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.631] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.631] GetProcessHeap () returned 0x4e0000 [0156.631] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0156.631] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0156.631] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.631] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0156.632] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0156.632] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0156.632] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0156.632] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0156.632] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.632] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.632] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.632] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.632] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7db8, lpOverlapped=0x0) returned 1 [0156.633] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7dc0) returned 1 [0156.633] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.633] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7dc0, lpOverlapped=0x0) returned 1 [0156.634] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.634] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.634] SetEndOfFile (hFile=0xdc) returned 1 [0156.636] GetProcessHeap () returned 0x4e0000 [0156.636] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0156.636] GetProcessHeap () returned 0x4e0000 [0156.636] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0156.636] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0156.637] CloseHandle (hObject=0xdc) returned 1 [0156.637] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac703800, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x65df6970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac703800, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0101859.BMP", cAlternateFileName="")) returned 1 [0156.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0156.638] GetProcessHeap () returned 0x4e0000 [0156.638] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0156.638] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0156.638] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0156.638] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.638] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.638] GetProcessHeap () returned 0x4e0000 [0156.638] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0156.638] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0156.638] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.638] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0156.650] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0156.650] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0156.650] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0156.650] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0156.650] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.650] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.650] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.650] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.651] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7ce0, lpOverlapped=0x0) returned 1 [0156.652] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7ce0, dwBufLen=0x7ce0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7ce0) returned 1 [0156.652] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.652] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7ce0, lpOverlapped=0x0) returned 1 [0156.652] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.652] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.652] SetEndOfFile (hFile=0xdc) returned 1 [0156.654] GetProcessHeap () returned 0x4e0000 [0156.654] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0156.655] GetProcessHeap () returned 0x4e0000 [0156.655] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0156.655] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0156.656] CloseHandle (hObject=0xdc) returned 1 [0156.656] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaed29200, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaed29200, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0101860.BMP", cAlternateFileName="")) returned 1 [0156.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0156.656] GetProcessHeap () returned 0x4e0000 [0156.656] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0156.657] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0156.657] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0156.657] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.668] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.668] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.668] GetProcessHeap () returned 0x4e0000 [0156.668] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0156.668] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0156.668] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.668] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0156.668] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0156.668] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0156.668] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0156.668] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0156.668] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.668] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.669] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.669] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.669] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7db8, lpOverlapped=0x0) returned 1 [0156.670] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7dc0) returned 1 [0156.670] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.670] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7dc0, lpOverlapped=0x0) returned 1 [0156.670] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.670] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.670] SetEndOfFile (hFile=0xdc) returned 1 [0156.673] GetProcessHeap () returned 0x4e0000 [0156.673] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0156.673] GetProcessHeap () returned 0x4e0000 [0156.673] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0156.673] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0156.674] CloseHandle (hObject=0xdc) returned 1 [0156.674] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2661900, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x65df6970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2661900, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0101861.BMP", cAlternateFileName="")) returned 1 [0156.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0156.676] GetProcessHeap () returned 0x4e0000 [0156.676] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0156.676] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0156.676] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0156.676] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.678] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.678] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.678] GetProcessHeap () returned 0x4e0000 [0156.678] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0156.678] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0156.678] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.678] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0156.678] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0156.678] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0156.678] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0156.678] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0156.678] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.679] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.679] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.679] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.679] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7db8, lpOverlapped=0x0) returned 1 [0156.680] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7dc0) returned 1 [0156.680] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.680] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7dc0, lpOverlapped=0x0) returned 1 [0156.680] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.680] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.680] SetEndOfFile (hFile=0xdc) returned 1 [0156.683] GetProcessHeap () returned 0x4e0000 [0156.683] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0156.683] GetProcessHeap () returned 0x4e0000 [0156.683] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0156.683] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0156.684] CloseHandle (hObject=0xdc) returned 1 [0156.684] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5f9a000, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5f9a000, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0101862.BMP", cAlternateFileName="")) returned 1 [0156.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0156.684] GetProcessHeap () returned 0x4e0000 [0156.685] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0156.685] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0156.685] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0156.685] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.687] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.687] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.687] GetProcessHeap () returned 0x4e0000 [0156.687] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0156.687] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0156.687] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.687] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0156.687] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0156.687] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0156.687] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0156.687] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0156.687] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.688] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.688] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.688] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.688] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7db8, lpOverlapped=0x0) returned 1 [0156.689] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7dc0) returned 1 [0156.689] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.689] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7dc0, lpOverlapped=0x0) returned 1 [0156.689] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.689] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.690] SetEndOfFile (hFile=0xdc) returned 1 [0156.692] GetProcessHeap () returned 0x4e0000 [0156.692] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0156.692] GetProcessHeap () returned 0x4e0000 [0156.692] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0156.692] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0156.699] CloseHandle (hObject=0xdc) returned 1 [0156.699] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1e56200, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1e56200, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0101863.BMP", cAlternateFileName="")) returned 1 [0156.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0156.700] GetProcessHeap () returned 0x4e0000 [0156.700] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0156.700] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0156.700] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0156.700] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.702] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.702] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.702] GetProcessHeap () returned 0x4e0000 [0156.702] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0156.702] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0156.702] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.702] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0156.703] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0156.703] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0156.703] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0156.703] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0156.703] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.703] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.703] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.703] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.703] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7db8, lpOverlapped=0x0) returned 1 [0156.705] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7dc0) returned 1 [0156.705] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.705] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7dc0, lpOverlapped=0x0) returned 1 [0156.705] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.705] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.705] SetEndOfFile (hFile=0xdc) returned 1 [0156.708] GetProcessHeap () returned 0x4e0000 [0156.708] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0156.708] GetProcessHeap () returned 0x4e0000 [0156.708] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0156.708] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0156.709] CloseHandle (hObject=0xdc) returned 1 [0156.709] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc447bc00, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x65df6970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc447bc00, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0101864.BMP", cAlternateFileName="")) returned 1 [0156.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0156.709] GetProcessHeap () returned 0x4e0000 [0156.709] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0156.710] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0156.710] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0156.710] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.710] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.710] GetProcessHeap () returned 0x4e0000 [0156.710] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0156.710] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0156.710] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.710] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0156.712] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0156.712] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0156.712] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0156.712] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0156.712] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.712] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.712] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.712] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.712] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7ce0, lpOverlapped=0x0) returned 1 [0156.713] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7ce0, dwBufLen=0x7ce0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7ce0) returned 1 [0156.714] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.714] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7ce0, lpOverlapped=0x0) returned 1 [0156.714] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.714] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.714] SetEndOfFile (hFile=0xdc) returned 1 [0156.717] GetProcessHeap () returned 0x4e0000 [0156.717] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0156.717] GetProcessHeap () returned 0x4e0000 [0156.717] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0156.717] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0156.718] CloseHandle (hObject=0xdc) returned 1 [0156.718] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb98d2700, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb98d2700, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0101865.BMP", cAlternateFileName="")) returned 1 [0156.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0156.719] GetProcessHeap () returned 0x4e0000 [0156.719] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0156.719] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0156.719] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0156.719] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.722] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.722] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.722] GetProcessHeap () returned 0x4e0000 [0156.722] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0156.722] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0156.722] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.722] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0156.722] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0156.722] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0156.722] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0156.722] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0156.722] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.722] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.722] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.723] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.723] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7db8, lpOverlapped=0x0) returned 1 [0156.724] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7dc0) returned 1 [0156.724] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.724] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7dc0, lpOverlapped=0x0) returned 1 [0156.725] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.725] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.725] SetEndOfFile (hFile=0xdc) returned 1 [0156.728] GetProcessHeap () returned 0x4e0000 [0156.728] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0156.728] GetProcessHeap () returned 0x4e0000 [0156.728] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0156.728] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0156.729] CloseHandle (hObject=0xdc) returned 1 [0156.729] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbabe5400, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbabe5400, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0101866.BMP", cAlternateFileName="")) returned 1 [0156.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0156.730] GetProcessHeap () returned 0x4e0000 [0156.730] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0156.730] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0156.730] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0156.730] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.732] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.732] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.732] GetProcessHeap () returned 0x4e0000 [0156.732] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0156.732] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0156.733] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.733] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0156.733] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0156.733] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0156.733] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0156.733] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0156.733] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.733] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.733] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.733] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.734] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7db8, lpOverlapped=0x0) returned 1 [0156.735] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7dc0) returned 1 [0156.735] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.736] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7dc0, lpOverlapped=0x0) returned 1 [0156.736] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.736] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.736] SetEndOfFile (hFile=0xdc) returned 1 [0156.739] GetProcessHeap () returned 0x4e0000 [0156.739] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0156.739] GetProcessHeap () returned 0x4e0000 [0156.739] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0156.739] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0156.740] CloseHandle (hObject=0xdc) returned 1 [0156.740] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa0dde00, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaa0dde00, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7f68, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0101867.BMP", cAlternateFileName="")) returned 1 [0156.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0156.741] GetProcessHeap () returned 0x4e0000 [0156.741] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0156.742] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0156.742] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0156.742] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.744] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.744] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.744] GetProcessHeap () returned 0x4e0000 [0156.744] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0156.744] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0156.744] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.744] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0156.744] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0156.744] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0156.744] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0156.745] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0156.745] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.745] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.745] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.745] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.745] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7f68, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7f68, lpOverlapped=0x0) returned 1 [0156.746] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7f70, dwBufLen=0x7f70 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7f70) returned 1 [0156.747] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.747] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7f70, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7f70, lpOverlapped=0x0) returned 1 [0156.747] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.747] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x8044, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.747] SetEndOfFile (hFile=0xdc) returned 1 [0156.751] GetProcessHeap () returned 0x4e0000 [0156.751] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0156.751] GetProcessHeap () returned 0x4e0000 [0156.751] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0156.751] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0156.752] CloseHandle (hObject=0xdc) returned 1 [0156.752] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3ee8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0101980.WMF", cAlternateFileName="")) returned 1 [0156.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0156.755] GetProcessHeap () returned 0x4e0000 [0156.755] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0156.755] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0156.755] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0156.755] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.757] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.757] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.757] GetProcessHeap () returned 0x4e0000 [0156.757] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0156.758] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0156.758] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.758] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0156.758] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0156.758] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0156.758] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0156.758] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0156.758] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.758] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.758] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.758] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.758] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3ee8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3ee8, lpOverlapped=0x0) returned 1 [0156.759] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3ef0, dwBufLen=0x3ef0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3ef0) returned 1 [0156.760] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.760] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3ef0, lpOverlapped=0x0) returned 1 [0156.760] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.760] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3fc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.760] SetEndOfFile (hFile=0xdc) returned 1 [0156.763] GetProcessHeap () returned 0x4e0000 [0156.763] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0156.763] GetProcessHeap () returned 0x4e0000 [0156.763] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0156.763] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0156.764] CloseHandle (hObject=0xdc) returned 1 [0156.764] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3e74, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0102002.WMF", cAlternateFileName="")) returned 1 [0156.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0156.765] GetProcessHeap () returned 0x4e0000 [0156.765] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0156.765] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0156.765] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0156.765] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0156.767] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.767] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.767] GetProcessHeap () returned 0x4e0000 [0156.767] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0156.768] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0156.768] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.768] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0156.768] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0156.768] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0156.768] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0156.768] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0156.768] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.768] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.768] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.768] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.768] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3e74, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3e74, lpOverlapped=0x0) returned 1 [0156.769] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3e80, dwBufLen=0x3e80 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3e80) returned 1 [0156.769] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.769] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3e80, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3e80, lpOverlapped=0x0) returned 1 [0156.769] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.769] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3f54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.769] SetEndOfFile (hFile=0xdc) returned 1 [0156.771] GetProcessHeap () returned 0x4e0000 [0156.772] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0156.772] GetProcessHeap () returned 0x4e0000 [0156.772] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0156.772] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0156.773] CloseHandle (hObject=0xdc) returned 1 [0156.773] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6978, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0102594.WMF", cAlternateFileName="")) returned 1 [0156.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0156.773] GetProcessHeap () returned 0x4e0000 [0156.773] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0156.773] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0156.773] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0156.773] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.775] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.775] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.775] GetProcessHeap () returned 0x4e0000 [0156.775] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0156.775] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0156.775] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.775] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0156.775] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0156.775] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0156.775] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0156.776] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0156.776] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.776] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.776] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.776] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.776] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x6978, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x6978, lpOverlapped=0x0) returned 1 [0156.777] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6980, dwBufLen=0x6980 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6980) returned 1 [0156.777] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.777] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6980, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x6980, lpOverlapped=0x0) returned 1 [0156.777] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.777] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6a54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.777] SetEndOfFile (hFile=0xdc) returned 1 [0156.779] GetProcessHeap () returned 0x4e0000 [0156.780] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0156.780] GetProcessHeap () returned 0x4e0000 [0156.780] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0156.780] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0156.780] CloseHandle (hObject=0xdc) returned 1 [0156.780] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2bd0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0102762.WMF", cAlternateFileName="")) returned 1 [0156.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0156.781] GetProcessHeap () returned 0x4e0000 [0156.781] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0156.781] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0156.781] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0156.781] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.781] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.781] GetProcessHeap () returned 0x4e0000 [0156.781] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0156.781] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0156.781] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.781] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0156.783] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0156.783] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0156.783] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0156.783] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0156.783] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.784] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.784] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.784] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.784] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2bd0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2bd0, lpOverlapped=0x0) returned 1 [0156.784] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2bd0, dwBufLen=0x2bd0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2bd0) returned 1 [0156.785] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.785] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2bd0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2bd0, lpOverlapped=0x0) returned 1 [0156.785] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.785] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2ca4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.785] SetEndOfFile (hFile=0xdc) returned 1 [0156.787] GetProcessHeap () returned 0x4e0000 [0156.787] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0156.787] GetProcessHeap () returned 0x4e0000 [0156.787] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0156.787] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0156.788] CloseHandle (hObject=0xdc) returned 1 [0156.788] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4290, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0102984.WMF", cAlternateFileName="")) returned 1 [0156.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0156.788] GetProcessHeap () returned 0x4e0000 [0156.788] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0156.789] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0156.789] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0156.789] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.789] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.789] GetProcessHeap () returned 0x4e0000 [0156.789] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0156.789] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0156.789] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.789] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0156.791] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0156.791] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0156.791] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0156.791] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0156.791] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.791] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.791] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.791] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.791] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4290, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4290, lpOverlapped=0x0) returned 1 [0156.792] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4290, dwBufLen=0x4290 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4290) returned 1 [0156.792] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.792] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4290, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4290, lpOverlapped=0x0) returned 1 [0156.792] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.792] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4364, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.793] SetEndOfFile (hFile=0xdc) returned 1 [0156.795] GetProcessHeap () returned 0x4e0000 [0156.795] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0156.795] GetProcessHeap () returned 0x4e0000 [0156.795] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0156.795] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0156.795] CloseHandle (hObject=0xdc) returned 1 [0156.796] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x43c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0103058.WMF", cAlternateFileName="")) returned 1 [0156.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0156.796] GetProcessHeap () returned 0x4e0000 [0156.796] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0156.796] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0156.796] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0156.796] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.796] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.796] GetProcessHeap () returned 0x4e0000 [0156.796] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0156.796] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0156.796] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.797] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0156.798] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0156.798] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0156.798] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0156.798] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0156.799] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.799] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.799] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.799] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.799] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x43c0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x43c0, lpOverlapped=0x0) returned 1 [0156.800] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x43c0, dwBufLen=0x43c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x43c0) returned 1 [0156.800] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.800] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x43c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x43c0, lpOverlapped=0x0) returned 1 [0156.800] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.800] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.800] SetEndOfFile (hFile=0xdc) returned 1 [0156.802] GetProcessHeap () returned 0x4e0000 [0156.802] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0156.802] GetProcessHeap () returned 0x4e0000 [0156.802] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0156.802] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0156.803] CloseHandle (hObject=0xdc) returned 1 [0156.803] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3264, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0103262.WMF", cAlternateFileName="")) returned 1 [0156.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0156.804] GetProcessHeap () returned 0x4e0000 [0156.804] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0156.804] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0156.804] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0156.804] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0156.806] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.806] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.806] GetProcessHeap () returned 0x4e0000 [0156.806] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0156.806] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0156.807] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.807] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0156.807] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0156.807] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0156.807] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0156.807] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0156.807] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.807] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.807] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.807] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.807] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3264, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3264, lpOverlapped=0x0) returned 1 [0156.808] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3270, dwBufLen=0x3270 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3270) returned 1 [0156.808] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.808] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3270, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3270, lpOverlapped=0x0) returned 1 [0156.808] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.808] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3344, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.808] SetEndOfFile (hFile=0xdc) returned 1 [0156.811] GetProcessHeap () returned 0x4e0000 [0156.811] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0156.811] GetProcessHeap () returned 0x4e0000 [0156.811] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0156.811] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0156.812] CloseHandle (hObject=0xdc) returned 1 [0156.812] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaf94, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0103402.WMF", cAlternateFileName="")) returned 1 [0156.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0156.815] GetProcessHeap () returned 0x4e0000 [0156.815] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0156.815] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0156.815] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0156.815] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0156.817] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.817] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.817] GetProcessHeap () returned 0x4e0000 [0156.817] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0156.817] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0156.817] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.817] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0156.817] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0156.817] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0156.817] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0156.817] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0156.817] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.817] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.818] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.818] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.818] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xaf94, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xaf94, lpOverlapped=0x0) returned 1 [0156.819] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xafa0, dwBufLen=0xafa0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xafa0) returned 1 [0156.819] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.819] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xafa0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xafa0, lpOverlapped=0x0) returned 1 [0156.820] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.820] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xb074, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.820] SetEndOfFile (hFile=0xdc) returned 1 [0156.822] GetProcessHeap () returned 0x4e0000 [0156.822] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0156.822] GetProcessHeap () returned 0x4e0000 [0156.822] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0156.822] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0156.823] CloseHandle (hObject=0xdc) returned 1 [0156.823] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1714, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0103812.WMF", cAlternateFileName="")) returned 1 [0156.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0156.824] GetProcessHeap () returned 0x4e0000 [0156.824] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0156.824] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0156.824] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0156.824] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0156.826] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.826] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.826] GetProcessHeap () returned 0x4e0000 [0156.826] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0156.826] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0156.826] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.826] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0156.826] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0156.826] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0156.826] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0156.827] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0156.827] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.827] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.827] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.827] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.827] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1714, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1714, lpOverlapped=0x0) returned 1 [0156.828] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1720, dwBufLen=0x1720 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1720) returned 1 [0156.828] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.828] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1720, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1720, lpOverlapped=0x0) returned 1 [0156.828] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.828] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x17f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.828] SetEndOfFile (hFile=0xdc) returned 1 [0156.830] GetProcessHeap () returned 0x4e0000 [0156.830] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0156.830] GetProcessHeap () returned 0x4e0000 [0156.830] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0156.830] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0156.831] CloseHandle (hObject=0xdc) returned 1 [0156.832] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5c2c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0103850.WMF", cAlternateFileName="")) returned 1 [0156.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0156.832] GetProcessHeap () returned 0x4e0000 [0156.832] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0156.832] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0156.832] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0156.832] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0156.834] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.834] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.834] GetProcessHeap () returned 0x4e0000 [0156.834] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0156.834] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0156.834] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.834] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0156.835] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0156.835] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0156.835] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0156.835] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0156.835] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.835] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.835] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.835] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.835] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5c2c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x5c2c, lpOverlapped=0x0) returned 1 [0156.836] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5c30, dwBufLen=0x5c30 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5c30) returned 1 [0156.836] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.836] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5c30, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5c30, lpOverlapped=0x0) returned 1 [0156.837] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.837] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5d04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.837] SetEndOfFile (hFile=0xdc) returned 1 [0156.839] GetProcessHeap () returned 0x4e0000 [0156.839] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0156.839] GetProcessHeap () returned 0x4e0000 [0156.839] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0156.839] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0156.840] CloseHandle (hObject=0xdc) returned 1 [0156.840] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1434, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105230.WMF", cAlternateFileName="")) returned 1 [0156.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0156.841] GetProcessHeap () returned 0x4e0000 [0156.841] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0156.841] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0156.841] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0156.841] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0156.843] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.843] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.843] GetProcessHeap () returned 0x4e0000 [0156.843] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0156.843] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0156.843] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.843] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0156.843] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0156.843] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0156.843] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0156.843] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0156.843] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.843] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.843] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.843] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.843] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1434, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1434, lpOverlapped=0x0) returned 1 [0156.844] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1440, dwBufLen=0x1440 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1440) returned 1 [0156.844] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.844] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1440, lpOverlapped=0x0) returned 1 [0156.844] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.844] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1514, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.844] SetEndOfFile (hFile=0xdc) returned 1 [0156.846] GetProcessHeap () returned 0x4e0000 [0156.846] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0156.847] GetProcessHeap () returned 0x4e0000 [0156.847] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0156.847] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0156.848] CloseHandle (hObject=0xdc) returned 1 [0156.848] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105232.WMF", cAlternateFileName="")) returned 1 [0156.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0156.849] GetProcessHeap () returned 0x4e0000 [0156.849] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0156.849] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0156.849] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0156.849] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.849] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.849] GetProcessHeap () returned 0x4e0000 [0156.849] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0156.849] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0156.849] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.849] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0156.851] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0156.851] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0156.851] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0156.851] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0156.852] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.852] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.852] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.852] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.852] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1600, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1600, lpOverlapped=0x0) returned 1 [0156.853] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1600, dwBufLen=0x1600 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1600) returned 1 [0156.853] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.853] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1600, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1600, lpOverlapped=0x0) returned 1 [0156.853] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.853] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x16d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.853] SetEndOfFile (hFile=0xdc) returned 1 [0156.855] GetProcessHeap () returned 0x4e0000 [0156.855] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0156.855] GetProcessHeap () returned 0x4e0000 [0156.855] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0156.855] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0156.856] CloseHandle (hObject=0xdc) returned 1 [0156.856] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd74, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105234.WMF", cAlternateFileName="")) returned 1 [0156.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0156.857] GetProcessHeap () returned 0x4e0000 [0156.857] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0156.857] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0156.857] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0156.858] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0156.860] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.860] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.860] GetProcessHeap () returned 0x4e0000 [0156.860] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0156.860] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0156.860] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.860] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0156.860] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0156.860] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0156.860] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0156.860] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0156.860] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.860] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.860] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.860] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.860] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xd74, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xd74, lpOverlapped=0x0) returned 1 [0156.860] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xd80, dwBufLen=0xd80 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xd80) returned 1 [0156.861] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.861] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xd80, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xd80, lpOverlapped=0x0) returned 1 [0156.861] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.861] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xe54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.861] SetEndOfFile (hFile=0xdc) returned 1 [0156.863] GetProcessHeap () returned 0x4e0000 [0156.863] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0156.863] GetProcessHeap () returned 0x4e0000 [0156.863] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0156.863] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0156.864] CloseHandle (hObject=0xdc) returned 1 [0156.864] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4314, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105238.WMF", cAlternateFileName="")) returned 1 [0156.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0156.865] GetProcessHeap () returned 0x4e0000 [0156.865] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0156.865] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0156.865] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0156.865] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0156.867] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.867] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.867] GetProcessHeap () returned 0x4e0000 [0156.867] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0156.867] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0156.867] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.867] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0156.867] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0156.867] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0156.867] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0156.867] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0156.867] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.867] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.867] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.867] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.868] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4314, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4314, lpOverlapped=0x0) returned 1 [0156.869] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4320, dwBufLen=0x4320 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4320) returned 1 [0156.869] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.869] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4320, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4320, lpOverlapped=0x0) returned 1 [0156.869] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.869] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x43f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.869] SetEndOfFile (hFile=0xdc) returned 1 [0156.872] GetProcessHeap () returned 0x4e0000 [0156.872] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0156.872] GetProcessHeap () returned 0x4e0000 [0156.872] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0156.872] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0156.873] CloseHandle (hObject=0xdc) returned 1 [0156.873] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2d0c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105240.WMF", cAlternateFileName="")) returned 1 [0156.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0156.874] GetProcessHeap () returned 0x4e0000 [0156.874] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0156.874] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0156.874] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0156.874] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0156.876] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.876] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.876] GetProcessHeap () returned 0x4e0000 [0156.876] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0156.876] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0156.876] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.876] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0156.876] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0156.876] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0156.877] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0156.877] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0156.877] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.877] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.877] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.877] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.877] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2d0c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2d0c, lpOverlapped=0x0) returned 1 [0156.880] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2d10, dwBufLen=0x2d10 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2d10) returned 1 [0156.880] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.881] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2d10, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2d10, lpOverlapped=0x0) returned 1 [0156.881] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.881] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2de4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.881] SetEndOfFile (hFile=0xdc) returned 1 [0156.883] GetProcessHeap () returned 0x4e0000 [0156.884] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0156.884] GetProcessHeap () returned 0x4e0000 [0156.884] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0156.884] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0156.885] CloseHandle (hObject=0xdc) returned 1 [0156.885] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2bdc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105244.WMF", cAlternateFileName="")) returned 1 [0156.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0156.886] GetProcessHeap () returned 0x4e0000 [0156.886] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0156.886] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0156.886] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0156.886] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0156.888] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.888] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.888] GetProcessHeap () returned 0x4e0000 [0156.888] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0156.888] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0156.888] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.888] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0156.888] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0156.889] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0156.889] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0156.889] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0156.889] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.889] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.889] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.889] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.889] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2bdc, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2bdc, lpOverlapped=0x0) returned 1 [0156.890] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2be0, dwBufLen=0x2be0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2be0) returned 1 [0156.891] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.891] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2be0, lpOverlapped=0x0) returned 1 [0156.891] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.891] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2cb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.891] SetEndOfFile (hFile=0xdc) returned 1 [0156.894] GetProcessHeap () returned 0x4e0000 [0156.894] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0156.894] GetProcessHeap () returned 0x4e0000 [0156.894] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0156.894] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0156.895] CloseHandle (hObject=0xdc) returned 1 [0156.895] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105246.WMF", cAlternateFileName="")) returned 1 [0156.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0156.896] GetProcessHeap () returned 0x4e0000 [0156.896] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0156.896] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0156.896] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0156.896] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.896] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.896] GetProcessHeap () returned 0x4e0000 [0156.896] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0156.896] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0156.896] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.896] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0156.899] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0156.899] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0156.899] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0156.899] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0156.899] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.899] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.899] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.899] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.899] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4b80, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4b80, lpOverlapped=0x0) returned 1 [0156.900] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4b80, dwBufLen=0x4b80 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4b80) returned 1 [0156.901] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.901] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4b80, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4b80, lpOverlapped=0x0) returned 1 [0156.901] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.901] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4c54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.901] SetEndOfFile (hFile=0xdc) returned 1 [0156.904] GetProcessHeap () returned 0x4e0000 [0156.904] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0156.904] GetProcessHeap () returned 0x4e0000 [0156.904] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0156.904] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0156.905] CloseHandle (hObject=0xdc) returned 1 [0156.905] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1214, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105250.WMF", cAlternateFileName="")) returned 1 [0156.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0156.907] GetProcessHeap () returned 0x4e0000 [0156.907] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0156.907] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0156.907] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0156.907] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0156.909] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.909] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.909] GetProcessHeap () returned 0x4e0000 [0156.909] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0156.909] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0156.909] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.909] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0156.909] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0156.909] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0156.910] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0156.910] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0156.910] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.910] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.910] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.910] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.910] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1214, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1214, lpOverlapped=0x0) returned 1 [0156.911] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1220, dwBufLen=0x1220 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1220) returned 1 [0156.911] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.911] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1220, lpOverlapped=0x0) returned 1 [0156.911] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.911] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x12f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.911] SetEndOfFile (hFile=0xdc) returned 1 [0156.914] GetProcessHeap () returned 0x4e0000 [0156.914] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0156.914] GetProcessHeap () returned 0x4e0000 [0156.914] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0156.914] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0156.915] CloseHandle (hObject=0xdc) returned 1 [0156.915] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1714, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105266.WMF", cAlternateFileName="")) returned 1 [0156.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0156.916] GetProcessHeap () returned 0x4e0000 [0156.916] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0156.916] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0156.916] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0156.916] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0156.918] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.918] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.918] GetProcessHeap () returned 0x4e0000 [0156.918] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0156.918] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0156.919] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.919] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0156.919] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0156.919] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0156.919] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0156.919] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0156.919] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.919] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.919] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.919] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.919] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1714, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1714, lpOverlapped=0x0) returned 1 [0156.920] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1720, dwBufLen=0x1720 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1720) returned 1 [0156.921] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.921] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1720, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1720, lpOverlapped=0x0) returned 1 [0156.921] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.921] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x17f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.921] SetEndOfFile (hFile=0xdc) returned 1 [0156.924] GetProcessHeap () returned 0x4e0000 [0156.924] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0156.924] GetProcessHeap () returned 0x4e0000 [0156.924] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0156.924] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0156.925] CloseHandle (hObject=0xdc) returned 1 [0156.925] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e42c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4540, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105272.WMF", cAlternateFileName="")) returned 1 [0156.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0156.926] GetProcessHeap () returned 0x4e0000 [0156.926] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0156.926] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0156.926] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0156.926] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.926] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.926] GetProcessHeap () returned 0x4e0000 [0156.926] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0156.926] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0156.926] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.926] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0156.929] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0156.929] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0156.929] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0156.929] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0156.929] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.929] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.929] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.929] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.929] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4540, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4540, lpOverlapped=0x0) returned 1 [0156.930] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4540, dwBufLen=0x4540 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4540) returned 1 [0156.930] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.931] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4540, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4540, lpOverlapped=0x0) returned 1 [0156.931] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.931] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.931] SetEndOfFile (hFile=0xdc) returned 1 [0156.934] GetProcessHeap () returned 0x4e0000 [0156.934] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0156.934] GetProcessHeap () returned 0x4e0000 [0156.934] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0156.934] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0156.935] CloseHandle (hObject=0xdc) returned 1 [0156.935] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e42c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b28, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105276.WMF", cAlternateFileName="")) returned 1 [0156.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0156.936] GetProcessHeap () returned 0x4e0000 [0156.936] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0156.936] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0156.936] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0156.936] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.938] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.938] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.938] GetProcessHeap () returned 0x4e0000 [0156.938] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0156.939] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0156.939] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.939] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0156.939] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0156.939] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0156.939] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0156.939] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0156.939] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.939] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.939] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.939] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.939] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4b28, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4b28, lpOverlapped=0x0) returned 1 [0156.940] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4b30, dwBufLen=0x4b30 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4b30) returned 1 [0156.941] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.941] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4b30, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4b30, lpOverlapped=0x0) returned 1 [0156.941] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.941] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4c04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.941] SetEndOfFile (hFile=0xdc) returned 1 [0156.944] GetProcessHeap () returned 0x4e0000 [0156.944] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0156.944] GetProcessHeap () returned 0x4e0000 [0156.944] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0156.944] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0156.945] CloseHandle (hObject=0xdc) returned 1 [0156.945] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e42c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2d14, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105280.WMF", cAlternateFileName="")) returned 1 [0156.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0156.947] GetProcessHeap () returned 0x4e0000 [0156.947] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0156.947] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0156.947] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0156.947] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0156.949] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.949] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.949] GetProcessHeap () returned 0x4e0000 [0156.949] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0156.950] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0156.950] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.950] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0156.950] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0156.950] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0156.950] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0156.950] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0156.950] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.950] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.950] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.950] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.950] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2d14, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2d14, lpOverlapped=0x0) returned 1 [0156.952] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2d20, dwBufLen=0x2d20 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2d20) returned 1 [0156.952] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.952] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2d20, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2d20, lpOverlapped=0x0) returned 1 [0156.952] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.952] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2df4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.952] SetEndOfFile (hFile=0xdc) returned 1 [0156.955] GetProcessHeap () returned 0x4e0000 [0156.955] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0156.955] GetProcessHeap () returned 0x4e0000 [0156.955] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0156.955] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0156.957] CloseHandle (hObject=0xdc) returned 1 [0156.957] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x12bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105282.WMF", cAlternateFileName="")) returned 1 [0156.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0156.958] GetProcessHeap () returned 0x4e0000 [0156.958] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0156.958] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0156.958] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0156.958] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0156.960] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.960] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.960] GetProcessHeap () returned 0x4e0000 [0156.960] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0156.961] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0156.961] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.961] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0156.961] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0156.961] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0156.961] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0156.961] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0156.961] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.961] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.961] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.962] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.962] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x12bc, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x12bc, lpOverlapped=0x0) returned 1 [0156.963] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x12c0, dwBufLen=0x12c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x12c0) returned 1 [0156.963] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.963] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x12c0, lpOverlapped=0x0) returned 1 [0156.963] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.963] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1394, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.963] SetEndOfFile (hFile=0xdc) returned 1 [0156.966] GetProcessHeap () returned 0x4e0000 [0156.966] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0156.966] GetProcessHeap () returned 0x4e0000 [0156.966] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0156.966] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0156.968] CloseHandle (hObject=0xdc) returned 1 [0156.968] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x19a8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105286.WMF", cAlternateFileName="")) returned 1 [0156.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0156.969] GetProcessHeap () returned 0x4e0000 [0156.969] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0156.969] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0156.969] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0156.969] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.971] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.971] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.971] GetProcessHeap () returned 0x4e0000 [0156.972] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0156.972] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0156.972] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.972] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0156.972] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0156.972] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0156.972] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0156.972] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0156.972] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.972] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.972] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.972] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.972] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x19a8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x19a8, lpOverlapped=0x0) returned 1 [0156.973] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x19b0, dwBufLen=0x19b0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x19b0) returned 1 [0156.973] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.974] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x19b0, lpOverlapped=0x0) returned 1 [0156.974] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.974] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1a84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.974] SetEndOfFile (hFile=0xdc) returned 1 [0156.976] GetProcessHeap () returned 0x4e0000 [0156.976] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0156.977] GetProcessHeap () returned 0x4e0000 [0156.977] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0156.977] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0156.978] CloseHandle (hObject=0xdc) returned 1 [0156.978] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3dd8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105288.WMF", cAlternateFileName="")) returned 1 [0156.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0156.979] GetProcessHeap () returned 0x4e0000 [0156.979] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0156.979] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0156.979] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0156.979] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.981] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.981] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.981] GetProcessHeap () returned 0x4e0000 [0156.981] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0156.982] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0156.982] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.982] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0156.982] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0156.982] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0156.982] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0156.982] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0156.982] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.982] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.982] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.982] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.982] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3dd8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3dd8, lpOverlapped=0x0) returned 1 [0156.983] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3de0, dwBufLen=0x3de0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3de0) returned 1 [0156.984] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.984] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3de0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3de0, lpOverlapped=0x0) returned 1 [0156.984] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.984] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3eb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.984] SetEndOfFile (hFile=0xdc) returned 1 [0156.987] GetProcessHeap () returned 0x4e0000 [0156.987] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0156.987] GetProcessHeap () returned 0x4e0000 [0156.987] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0156.987] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0156.988] CloseHandle (hObject=0xdc) returned 1 [0156.988] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3a14, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105292.WMF", cAlternateFileName="")) returned 1 [0156.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0156.989] GetProcessHeap () returned 0x4e0000 [0156.989] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0156.989] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0156.989] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0156.989] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0156.992] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.992] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.992] GetProcessHeap () returned 0x4e0000 [0156.992] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0156.992] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0156.992] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.992] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0156.992] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0156.992] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0156.992] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0156.992] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0156.992] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0156.993] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0156.993] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0156.993] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.993] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3a14, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3a14, lpOverlapped=0x0) returned 1 [0156.994] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3a20, dwBufLen=0x3a20 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3a20) returned 1 [0156.994] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.994] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3a20, lpOverlapped=0x0) returned 1 [0156.994] CryptDestroyKey (hKey=0x522f98) returned 1 [0156.994] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3af4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.994] SetEndOfFile (hFile=0xdc) returned 1 [0156.997] GetProcessHeap () returned 0x4e0000 [0156.997] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0156.997] GetProcessHeap () returned 0x4e0000 [0156.997] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0156.997] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0156.998] CloseHandle (hObject=0xdc) returned 1 [0156.999] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1580, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105294.WMF", cAlternateFileName="")) returned 1 [0156.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0156.999] GetProcessHeap () returned 0x4e0000 [0156.999] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0156.999] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0156.999] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0156.999] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.000] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.000] GetProcessHeap () returned 0x4e0000 [0157.000] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.000] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.000] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.000] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.002] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.002] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.002] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.002] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.002] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.002] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.002] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.003] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.003] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1580, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1580, lpOverlapped=0x0) returned 1 [0157.003] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1580, dwBufLen=0x1580 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1580) returned 1 [0157.004] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.004] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1580, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1580, lpOverlapped=0x0) returned 1 [0157.004] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.004] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1654, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.004] SetEndOfFile (hFile=0xdc) returned 1 [0157.007] GetProcessHeap () returned 0x4e0000 [0157.007] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.007] GetProcessHeap () returned 0x4e0000 [0157.007] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.007] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.008] CloseHandle (hObject=0xdc) returned 1 [0157.008] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x18b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105298.WMF", cAlternateFileName="")) returned 1 [0157.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.010] GetProcessHeap () returned 0x4e0000 [0157.010] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.010] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.010] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.011] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.011] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.011] GetProcessHeap () returned 0x4e0000 [0157.011] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.011] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.011] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.011] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.013] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.013] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.013] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.013] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.013] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.014] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.014] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.014] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.014] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x18b0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x18b0, lpOverlapped=0x0) returned 1 [0157.015] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x18b0, dwBufLen=0x18b0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x18b0) returned 1 [0157.015] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.015] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x18b0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x18b0, lpOverlapped=0x0) returned 1 [0157.015] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.015] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1984, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.015] SetEndOfFile (hFile=0xdc) returned 1 [0157.018] GetProcessHeap () returned 0x4e0000 [0157.018] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.018] GetProcessHeap () returned 0x4e0000 [0157.018] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.018] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.019] CloseHandle (hObject=0xdc) returned 1 [0157.029] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x10e0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105306.WMF", cAlternateFileName="")) returned 1 [0157.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.029] GetProcessHeap () returned 0x4e0000 [0157.030] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.030] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.030] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.030] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.030] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.030] GetProcessHeap () returned 0x4e0000 [0157.030] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.030] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.030] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.030] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.032] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.032] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.032] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.033] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.033] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.033] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.033] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.033] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.033] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x10e0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x10e0, lpOverlapped=0x0) returned 1 [0157.034] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x10e0, dwBufLen=0x10e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x10e0) returned 1 [0157.034] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.034] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x10e0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x10e0, lpOverlapped=0x0) returned 1 [0157.034] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.034] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x11b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.034] SetEndOfFile (hFile=0xdc) returned 1 [0157.037] GetProcessHeap () returned 0x4e0000 [0157.037] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.037] GetProcessHeap () returned 0x4e0000 [0157.037] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.037] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.039] CloseHandle (hObject=0xdc) returned 1 [0157.039] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7e4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105320.WMF", cAlternateFileName="")) returned 1 [0157.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.040] GetProcessHeap () returned 0x4e0000 [0157.040] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.040] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.040] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.040] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0157.042] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.042] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.043] GetProcessHeap () returned 0x4e0000 [0157.043] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.043] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.043] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.043] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.043] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.043] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.043] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.043] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.043] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.043] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.043] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.043] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.043] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7e4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7e4, lpOverlapped=0x0) returned 1 [0157.044] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7f0, dwBufLen=0x7f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7f0) returned 1 [0157.044] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.044] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7f0, lpOverlapped=0x0) returned 1 [0157.044] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.044] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x8c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.044] SetEndOfFile (hFile=0xdc) returned 1 [0157.047] GetProcessHeap () returned 0x4e0000 [0157.047] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.047] GetProcessHeap () returned 0x4e0000 [0157.047] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.047] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.048] CloseHandle (hObject=0xdc) returned 1 [0157.048] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f38, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105328.WMF", cAlternateFileName="")) returned 1 [0157.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.049] GetProcessHeap () returned 0x4e0000 [0157.049] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.049] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.049] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.049] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.051] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.051] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.051] GetProcessHeap () returned 0x4e0000 [0157.051] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.052] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.052] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.052] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.052] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.052] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.052] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.052] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.052] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.052] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.052] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.052] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.053] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1f38, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1f38, lpOverlapped=0x0) returned 1 [0157.053] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1f40, dwBufLen=0x1f40 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1f40) returned 1 [0157.054] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.054] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1f40, lpOverlapped=0x0) returned 1 [0157.054] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.054] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.054] SetEndOfFile (hFile=0xdc) returned 1 [0157.057] GetProcessHeap () returned 0x4e0000 [0157.057] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.057] GetProcessHeap () returned 0x4e0000 [0157.057] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.057] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.058] CloseHandle (hObject=0xdc) returned 1 [0157.058] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x290c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105332.WMF", cAlternateFileName="")) returned 1 [0157.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.059] GetProcessHeap () returned 0x4e0000 [0157.059] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.059] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.059] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.059] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.061] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.061] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.061] GetProcessHeap () returned 0x4e0000 [0157.061] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.061] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.061] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.061] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.062] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.062] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.062] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.062] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.062] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.062] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.062] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.062] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.062] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x290c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x290c, lpOverlapped=0x0) returned 1 [0157.063] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2910, dwBufLen=0x2910 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2910) returned 1 [0157.063] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.063] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2910, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2910, lpOverlapped=0x0) returned 1 [0157.064] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.064] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x29e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.064] SetEndOfFile (hFile=0xdc) returned 1 [0157.066] GetProcessHeap () returned 0x4e0000 [0157.066] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.066] GetProcessHeap () returned 0x4e0000 [0157.066] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.066] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.067] CloseHandle (hObject=0xdc) returned 1 [0157.067] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb54, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105336.WMF", cAlternateFileName="")) returned 1 [0157.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.068] GetProcessHeap () returned 0x4e0000 [0157.068] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.068] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.068] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.068] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0157.070] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.070] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.070] GetProcessHeap () returned 0x4e0000 [0157.071] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.071] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.071] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.071] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.071] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.071] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.071] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.071] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.071] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.071] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.071] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.071] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.071] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb54, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xb54, lpOverlapped=0x0) returned 1 [0157.071] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xb60, dwBufLen=0xb60 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xb60) returned 1 [0157.072] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.072] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xb60, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xb60, lpOverlapped=0x0) returned 1 [0157.072] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.072] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xc34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.072] SetEndOfFile (hFile=0xdc) returned 1 [0157.074] GetProcessHeap () returned 0x4e0000 [0157.074] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.074] GetProcessHeap () returned 0x4e0000 [0157.074] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.075] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.076] CloseHandle (hObject=0xdc) returned 1 [0157.076] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2d40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105338.WMF", cAlternateFileName="")) returned 1 [0157.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.076] GetProcessHeap () returned 0x4e0000 [0157.077] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.077] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.077] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.077] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.077] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.077] GetProcessHeap () returned 0x4e0000 [0157.077] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.077] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.077] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.077] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.079] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.079] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.079] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.080] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.080] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.080] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.080] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.080] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.080] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2d40, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2d40, lpOverlapped=0x0) returned 1 [0157.081] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2d40, dwBufLen=0x2d40 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2d40) returned 1 [0157.081] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.081] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2d40, lpOverlapped=0x0) returned 1 [0157.081] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.081] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2e14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.081] SetEndOfFile (hFile=0xdc) returned 1 [0157.084] GetProcessHeap () returned 0x4e0000 [0157.084] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.084] GetProcessHeap () returned 0x4e0000 [0157.084] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.084] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.085] CloseHandle (hObject=0xdc) returned 1 [0157.085] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x42a4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105348.WMF", cAlternateFileName="")) returned 1 [0157.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.087] GetProcessHeap () returned 0x4e0000 [0157.087] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.087] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.087] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.087] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0157.089] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.089] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.089] GetProcessHeap () returned 0x4e0000 [0157.089] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.089] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.089] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.089] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.090] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.090] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.090] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.090] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.090] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.090] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.090] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.090] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.090] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x42a4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x42a4, lpOverlapped=0x0) returned 1 [0157.091] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x42b0, dwBufLen=0x42b0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x42b0) returned 1 [0157.091] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.092] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x42b0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x42b0, lpOverlapped=0x0) returned 1 [0157.092] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.092] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4384, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.092] SetEndOfFile (hFile=0xdc) returned 1 [0157.095] GetProcessHeap () returned 0x4e0000 [0157.095] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.095] GetProcessHeap () returned 0x4e0000 [0157.095] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.095] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.097] CloseHandle (hObject=0xdc) returned 1 [0157.097] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x229c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105360.WMF", cAlternateFileName="")) returned 1 [0157.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.098] GetProcessHeap () returned 0x4e0000 [0157.098] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.098] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.098] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.098] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.115] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.115] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.115] GetProcessHeap () returned 0x4e0000 [0157.115] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.115] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.115] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.115] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.115] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.116] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.116] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.116] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.116] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.116] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.116] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.116] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.116] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x229c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x229c, lpOverlapped=0x0) returned 1 [0157.117] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x22a0, dwBufLen=0x22a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x22a0) returned 1 [0157.117] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.117] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x22a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x22a0, lpOverlapped=0x0) returned 1 [0157.118] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.118] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2374, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.118] SetEndOfFile (hFile=0xdc) returned 1 [0157.120] GetProcessHeap () returned 0x4e0000 [0157.120] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.120] GetProcessHeap () returned 0x4e0000 [0157.120] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.120] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.122] CloseHandle (hObject=0xdc) returned 1 [0157.122] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x305c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105368.WMF", cAlternateFileName="")) returned 1 [0157.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.124] GetProcessHeap () returned 0x4e0000 [0157.124] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.124] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.124] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.124] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.126] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.126] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.126] GetProcessHeap () returned 0x4e0000 [0157.126] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.126] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.126] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.126] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.127] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.127] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.127] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.127] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.127] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.127] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.127] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.127] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.127] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x305c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x305c, lpOverlapped=0x0) returned 1 [0157.128] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3060, dwBufLen=0x3060 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3060) returned 1 [0157.128] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.128] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3060, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3060, lpOverlapped=0x0) returned 1 [0157.129] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.129] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3134, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.129] SetEndOfFile (hFile=0xdc) returned 1 [0157.131] GetProcessHeap () returned 0x4e0000 [0157.131] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.131] GetProcessHeap () returned 0x4e0000 [0157.131] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.132] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.133] CloseHandle (hObject=0xdc) returned 1 [0157.133] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1364, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105376.WMF", cAlternateFileName="")) returned 1 [0157.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.133] GetProcessHeap () returned 0x4e0000 [0157.134] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.134] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.134] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.134] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0157.136] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.136] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.136] GetProcessHeap () returned 0x4e0000 [0157.136] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.136] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.136] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.137] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.137] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.137] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.137] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.137] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.137] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.137] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.137] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.137] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.137] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1364, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1364, lpOverlapped=0x0) returned 1 [0157.140] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1370, dwBufLen=0x1370 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1370) returned 1 [0157.141] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.141] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1370, lpOverlapped=0x0) returned 1 [0157.141] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.141] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1444, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.141] SetEndOfFile (hFile=0xdc) returned 1 [0157.144] GetProcessHeap () returned 0x4e0000 [0157.144] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.144] GetProcessHeap () returned 0x4e0000 [0157.144] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.144] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.145] CloseHandle (hObject=0xdc) returned 1 [0157.145] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1364, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105378.WMF", cAlternateFileName="")) returned 1 [0157.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.146] GetProcessHeap () returned 0x4e0000 [0157.146] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.146] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.146] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.146] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0157.148] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.148] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.148] GetProcessHeap () returned 0x4e0000 [0157.148] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.149] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.149] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.149] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.149] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.149] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.149] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.149] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.149] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.149] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.149] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.149] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.149] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1364, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1364, lpOverlapped=0x0) returned 1 [0157.150] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1370, dwBufLen=0x1370 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1370) returned 1 [0157.150] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.150] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1370, lpOverlapped=0x0) returned 1 [0157.151] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.151] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1444, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.151] SetEndOfFile (hFile=0xdc) returned 1 [0157.153] GetProcessHeap () returned 0x4e0000 [0157.153] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.153] GetProcessHeap () returned 0x4e0000 [0157.153] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.154] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.156] CloseHandle (hObject=0xdc) returned 1 [0157.156] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1210, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105380.WMF", cAlternateFileName="")) returned 1 [0157.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.156] GetProcessHeap () returned 0x4e0000 [0157.156] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.156] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.157] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.157] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.157] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.157] GetProcessHeap () returned 0x4e0000 [0157.157] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.157] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.157] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.157] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.159] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.159] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.159] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.160] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.160] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.160] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.160] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.160] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.160] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1210, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1210, lpOverlapped=0x0) returned 1 [0157.161] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1210, dwBufLen=0x1210 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1210) returned 1 [0157.161] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.161] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1210, lpOverlapped=0x0) returned 1 [0157.161] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.161] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x12e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.161] SetEndOfFile (hFile=0xdc) returned 1 [0157.164] GetProcessHeap () returned 0x4e0000 [0157.164] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.164] GetProcessHeap () returned 0x4e0000 [0157.164] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.164] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.165] CloseHandle (hObject=0xdc) returned 1 [0157.165] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105384.WMF", cAlternateFileName="")) returned 1 [0157.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.166] GetProcessHeap () returned 0x4e0000 [0157.166] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.166] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.166] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.166] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.168] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.169] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.169] GetProcessHeap () returned 0x4e0000 [0157.169] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.169] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.169] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.169] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.169] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.169] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.169] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.169] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.169] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.169] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.169] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.169] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.170] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x16f8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x16f8, lpOverlapped=0x0) returned 1 [0157.171] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1700, dwBufLen=0x1700 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1700) returned 1 [0157.171] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.171] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1700, lpOverlapped=0x0) returned 1 [0157.171] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.171] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x17d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.171] SetEndOfFile (hFile=0xdc) returned 1 [0157.174] GetProcessHeap () returned 0x4e0000 [0157.174] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.174] GetProcessHeap () returned 0x4e0000 [0157.174] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.174] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.176] CloseHandle (hObject=0xdc) returned 1 [0157.176] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x175c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105386.WMF", cAlternateFileName="")) returned 1 [0157.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.177] GetProcessHeap () returned 0x4e0000 [0157.177] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.177] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.177] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.177] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.180] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.180] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.180] GetProcessHeap () returned 0x4e0000 [0157.180] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.180] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.180] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.180] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.180] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.180] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.180] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.180] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.180] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.181] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.181] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.181] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.181] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x175c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x175c, lpOverlapped=0x0) returned 1 [0157.182] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1760, dwBufLen=0x1760 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1760) returned 1 [0157.182] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.182] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1760, lpOverlapped=0x0) returned 1 [0157.182] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.182] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.182] SetEndOfFile (hFile=0xdc) returned 1 [0157.185] GetProcessHeap () returned 0x4e0000 [0157.185] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.185] GetProcessHeap () returned 0x4e0000 [0157.185] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.185] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.186] CloseHandle (hObject=0xdc) returned 1 [0157.186] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x203c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105388.WMF", cAlternateFileName="")) returned 1 [0157.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.188] GetProcessHeap () returned 0x4e0000 [0157.188] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.188] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.188] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.188] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.190] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.190] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.190] GetProcessHeap () returned 0x4e0000 [0157.190] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.190] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.190] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.190] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.190] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.191] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.191] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.191] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.191] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.191] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.191] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.191] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.191] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x203c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x203c, lpOverlapped=0x0) returned 1 [0157.192] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2040, dwBufLen=0x2040 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2040) returned 1 [0157.192] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.192] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2040, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2040, lpOverlapped=0x0) returned 1 [0157.192] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.192] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2114, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.193] SetEndOfFile (hFile=0xdc) returned 1 [0157.195] GetProcessHeap () returned 0x4e0000 [0157.195] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.195] GetProcessHeap () returned 0x4e0000 [0157.195] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.195] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.196] CloseHandle (hObject=0xdc) returned 1 [0157.196] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1350, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105390.WMF", cAlternateFileName="")) returned 1 [0157.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.197] GetProcessHeap () returned 0x4e0000 [0157.197] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.197] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.197] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.197] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.197] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.197] GetProcessHeap () returned 0x4e0000 [0157.197] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.197] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.198] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.198] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.200] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.200] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.200] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.200] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.200] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.200] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.200] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.200] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.200] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1350, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1350, lpOverlapped=0x0) returned 1 [0157.201] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1350, dwBufLen=0x1350 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1350) returned 1 [0157.202] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.202] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1350, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1350, lpOverlapped=0x0) returned 1 [0157.202] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.202] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1424, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.202] SetEndOfFile (hFile=0xdc) returned 1 [0157.205] GetProcessHeap () returned 0x4e0000 [0157.205] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.205] GetProcessHeap () returned 0x4e0000 [0157.205] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.205] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.206] CloseHandle (hObject=0xdc) returned 1 [0157.206] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2b04, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105396.WMF", cAlternateFileName="")) returned 1 [0157.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.207] GetProcessHeap () returned 0x4e0000 [0157.207] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.207] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.207] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.207] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0157.209] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.209] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.209] GetProcessHeap () returned 0x4e0000 [0157.209] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.209] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.209] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.209] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.209] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.209] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.210] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.210] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.210] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.210] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.210] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.210] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.210] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2b04, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2b04, lpOverlapped=0x0) returned 1 [0157.211] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2b10, dwBufLen=0x2b10 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2b10) returned 1 [0157.211] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.211] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2b10, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2b10, lpOverlapped=0x0) returned 1 [0157.211] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.211] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2be4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.211] SetEndOfFile (hFile=0xdc) returned 1 [0157.214] GetProcessHeap () returned 0x4e0000 [0157.214] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.214] GetProcessHeap () returned 0x4e0000 [0157.214] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.214] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.215] CloseHandle (hObject=0xdc) returned 1 [0157.215] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105398.WMF", cAlternateFileName="")) returned 1 [0157.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.217] GetProcessHeap () returned 0x4e0000 [0157.217] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.217] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.217] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.217] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.217] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.217] GetProcessHeap () returned 0x4e0000 [0157.217] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.217] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.217] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.217] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.219] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.220] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.220] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.220] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.220] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.220] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.220] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.220] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.220] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xd00, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xd00, lpOverlapped=0x0) returned 1 [0157.220] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xd00, dwBufLen=0xd00 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xd00) returned 1 [0157.220] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.220] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xd00, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xd00, lpOverlapped=0x0) returned 1 [0157.221] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.221] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xdd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.221] SetEndOfFile (hFile=0xdc) returned 1 [0157.223] GetProcessHeap () returned 0x4e0000 [0157.223] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.223] GetProcessHeap () returned 0x4e0000 [0157.223] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.223] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.225] CloseHandle (hObject=0xdc) returned 1 [0157.225] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4fdc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105410.WMF", cAlternateFileName="")) returned 1 [0157.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.225] GetProcessHeap () returned 0x4e0000 [0157.225] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.226] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.226] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.226] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.228] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.228] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.228] GetProcessHeap () returned 0x4e0000 [0157.228] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.228] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.228] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.228] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.228] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.228] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.229] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.229] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.229] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.229] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.229] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.229] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.229] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4fdc, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4fdc, lpOverlapped=0x0) returned 1 [0157.230] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4fe0, dwBufLen=0x4fe0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4fe0) returned 1 [0157.230] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.230] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4fe0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4fe0, lpOverlapped=0x0) returned 1 [0157.231] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.231] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x50b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.231] SetEndOfFile (hFile=0xdc) returned 1 [0157.234] GetProcessHeap () returned 0x4e0000 [0157.234] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.234] GetProcessHeap () returned 0x4e0000 [0157.234] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.234] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.235] CloseHandle (hObject=0xdc) returned 1 [0157.235] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x24b8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105412.WMF", cAlternateFileName="")) returned 1 [0157.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.236] GetProcessHeap () returned 0x4e0000 [0157.236] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.236] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.236] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.236] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.239] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.239] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.239] GetProcessHeap () returned 0x4e0000 [0157.239] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.239] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.239] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.239] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.239] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.239] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.239] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.239] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.239] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.240] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.240] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.240] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.240] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x24b8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x24b8, lpOverlapped=0x0) returned 1 [0157.241] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x24c0, dwBufLen=0x24c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x24c0) returned 1 [0157.241] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.241] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x24c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x24c0, lpOverlapped=0x0) returned 1 [0157.241] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.241] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2594, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.241] SetEndOfFile (hFile=0xdc) returned 1 [0157.244] GetProcessHeap () returned 0x4e0000 [0157.244] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.244] GetProcessHeap () returned 0x4e0000 [0157.244] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.244] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.245] CloseHandle (hObject=0xdc) returned 1 [0157.245] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1864, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105414.WMF", cAlternateFileName="")) returned 1 [0157.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.246] GetProcessHeap () returned 0x4e0000 [0157.246] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.246] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.246] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.246] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0157.249] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.249] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.249] GetProcessHeap () returned 0x4e0000 [0157.249] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.249] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.249] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.249] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.249] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.249] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.249] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.249] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.249] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.249] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.249] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.249] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.250] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1864, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1864, lpOverlapped=0x0) returned 1 [0157.250] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1870, dwBufLen=0x1870 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1870) returned 1 [0157.251] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.251] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1870, lpOverlapped=0x0) returned 1 [0157.251] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.251] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1944, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.251] SetEndOfFile (hFile=0xdc) returned 1 [0157.253] GetProcessHeap () returned 0x4e0000 [0157.254] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.254] GetProcessHeap () returned 0x4e0000 [0157.254] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.254] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.255] CloseHandle (hObject=0xdc) returned 1 [0157.255] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4928, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105490.WMF", cAlternateFileName="")) returned 1 [0157.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.256] GetProcessHeap () returned 0x4e0000 [0157.256] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.256] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.256] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.256] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.258] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.258] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.258] GetProcessHeap () returned 0x4e0000 [0157.258] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.259] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.259] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.259] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.259] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.259] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.259] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.259] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.259] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.259] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.259] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.259] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.259] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4928, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4928, lpOverlapped=0x0) returned 1 [0157.260] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4930, dwBufLen=0x4930 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4930) returned 1 [0157.261] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.261] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4930, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4930, lpOverlapped=0x0) returned 1 [0157.261] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.261] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4a04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.261] SetEndOfFile (hFile=0xdc) returned 1 [0157.264] GetProcessHeap () returned 0x4e0000 [0157.264] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.264] GetProcessHeap () returned 0x4e0000 [0157.264] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.264] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.265] CloseHandle (hObject=0xdc) returned 1 [0157.265] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1424, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105496.WMF", cAlternateFileName="")) returned 1 [0157.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.266] GetProcessHeap () returned 0x4e0000 [0157.266] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.266] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.266] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.266] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0157.270] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.270] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.270] GetProcessHeap () returned 0x4e0000 [0157.270] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.270] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.270] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.270] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.270] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.270] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.271] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.271] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.271] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.271] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.271] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.271] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.271] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1424, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1424, lpOverlapped=0x0) returned 1 [0157.272] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1430, dwBufLen=0x1430 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1430) returned 1 [0157.272] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.272] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1430, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1430, lpOverlapped=0x0) returned 1 [0157.272] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.272] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1504, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.272] SetEndOfFile (hFile=0xdc) returned 1 [0157.275] GetProcessHeap () returned 0x4e0000 [0157.275] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.275] GetProcessHeap () returned 0x4e0000 [0157.275] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.275] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.276] CloseHandle (hObject=0xdc) returned 1 [0157.276] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1560, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105502.WMF", cAlternateFileName="")) returned 1 [0157.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.278] GetProcessHeap () returned 0x4e0000 [0157.278] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.278] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.278] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.278] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.278] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.278] GetProcessHeap () returned 0x4e0000 [0157.278] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.278] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.278] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.278] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.281] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.281] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.281] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.281] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.281] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.281] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.281] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.281] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.281] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1560, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1560, lpOverlapped=0x0) returned 1 [0157.282] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1560, dwBufLen=0x1560 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1560) returned 1 [0157.282] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.282] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1560, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1560, lpOverlapped=0x0) returned 1 [0157.283] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.283] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1634, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.283] SetEndOfFile (hFile=0xdc) returned 1 [0157.285] GetProcessHeap () returned 0x4e0000 [0157.285] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.285] GetProcessHeap () returned 0x4e0000 [0157.285] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.285] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.287] CloseHandle (hObject=0xdc) returned 1 [0157.287] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1034, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105504.WMF", cAlternateFileName="")) returned 1 [0157.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.289] GetProcessHeap () returned 0x4e0000 [0157.289] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.289] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.289] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.289] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0157.291] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.291] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.291] GetProcessHeap () returned 0x4e0000 [0157.291] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.291] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.291] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.291] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.291] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.291] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.292] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.292] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.292] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.292] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.292] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.292] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.292] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1034, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1034, lpOverlapped=0x0) returned 1 [0157.293] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1040, dwBufLen=0x1040 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1040) returned 1 [0157.293] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.293] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1040, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1040, lpOverlapped=0x0) returned 1 [0157.293] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.293] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1114, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.293] SetEndOfFile (hFile=0xdc) returned 1 [0157.296] GetProcessHeap () returned 0x4e0000 [0157.296] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.296] GetProcessHeap () returned 0x4e0000 [0157.296] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.296] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.297] CloseHandle (hObject=0xdc) returned 1 [0157.298] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb60, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105506.WMF", cAlternateFileName="")) returned 1 [0157.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.298] GetProcessHeap () returned 0x4e0000 [0157.298] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.298] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.298] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.299] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.299] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.299] GetProcessHeap () returned 0x4e0000 [0157.299] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.299] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.299] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.299] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.301] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.301] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.301] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.301] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.301] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.301] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.302] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.302] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.302] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb60, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xb60, lpOverlapped=0x0) returned 1 [0157.302] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xb60, dwBufLen=0xb60 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xb60) returned 1 [0157.302] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.302] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xb60, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xb60, lpOverlapped=0x0) returned 1 [0157.302] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.302] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xc34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.302] SetEndOfFile (hFile=0xdc) returned 1 [0157.305] GetProcessHeap () returned 0x4e0000 [0157.305] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.305] GetProcessHeap () returned 0x4e0000 [0157.305] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.305] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.306] CloseHandle (hObject=0xdc) returned 1 [0157.306] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7c44, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105520.WMF", cAlternateFileName="")) returned 1 [0157.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.307] GetProcessHeap () returned 0x4e0000 [0157.307] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.307] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.307] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.307] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0157.309] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.309] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.310] GetProcessHeap () returned 0x4e0000 [0157.310] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.310] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.310] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.310] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.310] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.310] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.310] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.310] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.310] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.310] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.311] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.311] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.311] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7c44, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7c44, lpOverlapped=0x0) returned 1 [0157.312] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7c50, dwBufLen=0x7c50 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7c50) returned 1 [0157.312] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.312] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7c50, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7c50, lpOverlapped=0x0) returned 1 [0157.313] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.313] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7d24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.313] SetEndOfFile (hFile=0xdc) returned 1 [0157.316] GetProcessHeap () returned 0x4e0000 [0157.316] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.316] GetProcessHeap () returned 0x4e0000 [0157.316] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.316] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.317] CloseHandle (hObject=0xdc) returned 1 [0157.317] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x43b4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105526.WMF", cAlternateFileName="")) returned 1 [0157.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.318] GetProcessHeap () returned 0x4e0000 [0157.318] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.318] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.318] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.318] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0157.320] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.320] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.320] GetProcessHeap () returned 0x4e0000 [0157.321] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.321] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.321] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.321] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.321] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.321] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.321] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.321] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.321] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.321] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.321] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.321] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.321] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x43b4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x43b4, lpOverlapped=0x0) returned 1 [0157.323] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x43c0, dwBufLen=0x43c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x43c0) returned 1 [0157.323] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.323] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x43c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x43c0, lpOverlapped=0x0) returned 1 [0157.323] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.323] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.323] SetEndOfFile (hFile=0xdc) returned 1 [0157.326] GetProcessHeap () returned 0x4e0000 [0157.326] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.326] GetProcessHeap () returned 0x4e0000 [0157.326] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.326] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.328] CloseHandle (hObject=0xdc) returned 1 [0157.328] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1cd8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105530.WMF", cAlternateFileName="")) returned 1 [0157.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.329] GetProcessHeap () returned 0x4e0000 [0157.329] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.329] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.329] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.329] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.331] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.331] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.331] GetProcessHeap () returned 0x4e0000 [0157.331] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.331] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.331] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.331] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.331] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.331] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.332] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.332] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.332] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.332] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.332] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.332] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.332] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1cd8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1cd8, lpOverlapped=0x0) returned 1 [0157.335] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1ce0, dwBufLen=0x1ce0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1ce0) returned 1 [0157.335] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.335] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1ce0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1ce0, lpOverlapped=0x0) returned 1 [0157.336] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.336] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.336] SetEndOfFile (hFile=0xdc) returned 1 [0157.338] GetProcessHeap () returned 0x4e0000 [0157.338] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.338] GetProcessHeap () returned 0x4e0000 [0157.338] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.338] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.340] CloseHandle (hObject=0xdc) returned 1 [0157.340] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x542c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105588.WMF", cAlternateFileName="")) returned 1 [0157.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.340] GetProcessHeap () returned 0x4e0000 [0157.341] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.341] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.341] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.341] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.343] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.343] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.343] GetProcessHeap () returned 0x4e0000 [0157.343] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.343] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.343] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.343] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.343] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.343] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.343] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.344] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.344] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.344] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.344] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.344] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.344] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x542c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x542c, lpOverlapped=0x0) returned 1 [0157.345] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5430, dwBufLen=0x5430 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5430) returned 1 [0157.345] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.345] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5430, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5430, lpOverlapped=0x0) returned 1 [0157.346] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.346] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5504, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.346] SetEndOfFile (hFile=0xdc) returned 1 [0157.348] GetProcessHeap () returned 0x4e0000 [0157.348] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.348] GetProcessHeap () returned 0x4e0000 [0157.348] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.349] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.350] CloseHandle (hObject=0xdc) returned 1 [0157.350] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x21e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105600.WMF", cAlternateFileName="")) returned 1 [0157.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.352] GetProcessHeap () returned 0x4e0000 [0157.352] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.352] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.352] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.352] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.354] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.354] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.354] GetProcessHeap () returned 0x4e0000 [0157.354] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.354] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.354] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.354] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.354] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.355] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.355] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.355] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.355] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.355] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.355] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.355] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.355] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x21e8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x21e8, lpOverlapped=0x0) returned 1 [0157.356] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x21f0, dwBufLen=0x21f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x21f0) returned 1 [0157.356] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.356] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x21f0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x21f0, lpOverlapped=0x0) returned 1 [0157.356] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.356] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x22c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.357] SetEndOfFile (hFile=0xdc) returned 1 [0157.360] GetProcessHeap () returned 0x4e0000 [0157.360] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.360] GetProcessHeap () returned 0x4e0000 [0157.360] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.360] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.361] CloseHandle (hObject=0xdc) returned 1 [0157.361] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x287c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105638.WMF", cAlternateFileName="")) returned 1 [0157.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.362] GetProcessHeap () returned 0x4e0000 [0157.362] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.362] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.362] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.362] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.364] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.364] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.365] GetProcessHeap () returned 0x4e0000 [0157.365] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.365] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.365] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.365] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.365] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.365] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.365] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.365] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.365] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.365] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.365] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.365] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.365] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x287c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x287c, lpOverlapped=0x0) returned 1 [0157.366] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2880, dwBufLen=0x2880 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2880) returned 1 [0157.367] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.367] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2880, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2880, lpOverlapped=0x0) returned 1 [0157.367] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.367] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2954, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.367] SetEndOfFile (hFile=0xdc) returned 1 [0157.370] GetProcessHeap () returned 0x4e0000 [0157.370] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.370] GetProcessHeap () returned 0x4e0000 [0157.370] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.370] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.371] CloseHandle (hObject=0xdc) returned 1 [0157.371] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x35f0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105710.WMF", cAlternateFileName="")) returned 1 [0157.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.372] GetProcessHeap () returned 0x4e0000 [0157.372] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.372] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.372] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.372] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.372] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.372] GetProcessHeap () returned 0x4e0000 [0157.372] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.372] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.372] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.372] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.375] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.375] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.375] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.375] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.375] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.375] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.375] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.375] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.376] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x35f0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x35f0, lpOverlapped=0x0) returned 1 [0157.377] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x35f0, dwBufLen=0x35f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x35f0) returned 1 [0157.377] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.377] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x35f0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x35f0, lpOverlapped=0x0) returned 1 [0157.377] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.377] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x36c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.377] SetEndOfFile (hFile=0xdc) returned 1 [0157.380] GetProcessHeap () returned 0x4e0000 [0157.380] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.380] GetProcessHeap () returned 0x4e0000 [0157.380] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.380] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.382] CloseHandle (hObject=0xdc) returned 1 [0157.382] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2030, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105846.WMF", cAlternateFileName="")) returned 1 [0157.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.383] GetProcessHeap () returned 0x4e0000 [0157.383] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.383] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.383] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.384] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.384] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.384] GetProcessHeap () returned 0x4e0000 [0157.384] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.384] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.384] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.384] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.386] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.386] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.386] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.386] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.386] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.387] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.387] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.387] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.387] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2030, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2030, lpOverlapped=0x0) returned 1 [0157.388] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2030, dwBufLen=0x2030 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2030) returned 1 [0157.388] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.388] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2030, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2030, lpOverlapped=0x0) returned 1 [0157.388] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.388] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2104, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.388] SetEndOfFile (hFile=0xdc) returned 1 [0157.402] GetProcessHeap () returned 0x4e0000 [0157.402] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.402] GetProcessHeap () returned 0x4e0000 [0157.402] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.402] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.403] CloseHandle (hObject=0xdc) returned 1 [0157.403] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2dc8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105912.WMF", cAlternateFileName="")) returned 1 [0157.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.417] GetProcessHeap () returned 0x4e0000 [0157.417] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.417] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.417] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.418] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.439] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.439] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.439] GetProcessHeap () returned 0x4e0000 [0157.439] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.439] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.440] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.440] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.440] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.440] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.440] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.440] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.440] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.440] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.440] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.440] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.440] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2dc8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2dc8, lpOverlapped=0x0) returned 1 [0157.441] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2dd0, dwBufLen=0x2dd0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2dd0) returned 1 [0157.442] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.442] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2dd0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2dd0, lpOverlapped=0x0) returned 1 [0157.442] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.442] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2ea4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.442] SetEndOfFile (hFile=0xdc) returned 1 [0157.445] GetProcessHeap () returned 0x4e0000 [0157.445] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.445] GetProcessHeap () returned 0x4e0000 [0157.445] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.445] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.446] CloseHandle (hObject=0xdc) returned 1 [0157.446] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1204, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105974.WMF", cAlternateFileName="")) returned 1 [0157.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.447] GetProcessHeap () returned 0x4e0000 [0157.447] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.447] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.447] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.447] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0157.450] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.450] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.450] GetProcessHeap () returned 0x4e0000 [0157.450] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.450] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.450] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.450] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.450] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.450] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.450] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.450] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.451] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.451] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.451] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.451] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.451] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1204, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1204, lpOverlapped=0x0) returned 1 [0157.452] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1210, dwBufLen=0x1210 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1210) returned 1 [0157.452] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.452] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1210, lpOverlapped=0x0) returned 1 [0157.452] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.452] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x12e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.452] SetEndOfFile (hFile=0xdc) returned 1 [0157.455] GetProcessHeap () returned 0x4e0000 [0157.455] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.455] GetProcessHeap () returned 0x4e0000 [0157.455] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.455] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.456] CloseHandle (hObject=0xdc) returned 1 [0157.457] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x274c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0106020.WMF", cAlternateFileName="")) returned 1 [0157.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.457] GetProcessHeap () returned 0x4e0000 [0157.457] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.457] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.457] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.458] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.460] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.460] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.460] GetProcessHeap () returned 0x4e0000 [0157.460] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.460] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.460] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.460] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.461] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.461] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.461] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.461] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.461] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.461] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.461] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.461] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.461] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x274c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x274c, lpOverlapped=0x0) returned 1 [0157.462] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2750, dwBufLen=0x2750 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2750) returned 1 [0157.462] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.462] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2750, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2750, lpOverlapped=0x0) returned 1 [0157.463] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.463] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2824, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.463] SetEndOfFile (hFile=0xdc) returned 1 [0157.465] GetProcessHeap () returned 0x4e0000 [0157.465] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.465] GetProcessHeap () returned 0x4e0000 [0157.465] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.466] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.467] CloseHandle (hObject=0xdc) returned 1 [0157.467] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16b4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0106124.WMF", cAlternateFileName="")) returned 1 [0157.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.468] GetProcessHeap () returned 0x4e0000 [0157.468] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.468] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.468] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.468] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0157.470] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.470] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.470] GetProcessHeap () returned 0x4e0000 [0157.470] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.470] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.470] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.470] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.470] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.470] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.471] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.471] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.471] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.471] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.471] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.471] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.471] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x16b4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x16b4, lpOverlapped=0x0) returned 1 [0157.472] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x16c0, dwBufLen=0x16c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x16c0) returned 1 [0157.472] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.472] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x16c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x16c0, lpOverlapped=0x0) returned 1 [0157.472] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.472] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1794, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.472] SetEndOfFile (hFile=0xdc) returned 1 [0157.475] GetProcessHeap () returned 0x4e0000 [0157.475] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.475] GetProcessHeap () returned 0x4e0000 [0157.475] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.475] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.476] CloseHandle (hObject=0xdc) returned 1 [0157.476] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5bfc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0106146.WMF", cAlternateFileName="")) returned 1 [0157.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.477] GetProcessHeap () returned 0x4e0000 [0157.477] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.477] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.477] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.477] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.479] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.479] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.480] GetProcessHeap () returned 0x4e0000 [0157.480] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.480] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.480] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.480] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.480] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.480] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.480] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.480] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.480] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.480] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.480] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.480] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.480] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5bfc, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x5bfc, lpOverlapped=0x0) returned 1 [0157.482] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5c00, dwBufLen=0x5c00 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5c00) returned 1 [0157.482] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.482] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5c00, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5c00, lpOverlapped=0x0) returned 1 [0157.482] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.482] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5cd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.482] SetEndOfFile (hFile=0xdc) returned 1 [0157.485] GetProcessHeap () returned 0x4e0000 [0157.485] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.485] GetProcessHeap () returned 0x4e0000 [0157.485] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.485] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.487] CloseHandle (hObject=0xdc) returned 1 [0157.487] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2e7c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0106208.WMF", cAlternateFileName="")) returned 1 [0157.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.488] GetProcessHeap () returned 0x4e0000 [0157.488] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.488] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.488] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.489] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.491] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.491] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.491] GetProcessHeap () returned 0x4e0000 [0157.491] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.491] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.491] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.491] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.491] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.491] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.491] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.491] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.491] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.492] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.492] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.492] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.492] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2e7c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2e7c, lpOverlapped=0x0) returned 1 [0157.493] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2e80, dwBufLen=0x2e80 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2e80) returned 1 [0157.493] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.493] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2e80, lpOverlapped=0x0) returned 1 [0157.493] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.493] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2f54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.493] SetEndOfFile (hFile=0xdc) returned 1 [0157.496] GetProcessHeap () returned 0x4e0000 [0157.496] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.496] GetProcessHeap () returned 0x4e0000 [0157.496] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.496] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.497] CloseHandle (hObject=0xdc) returned 1 [0157.497] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4c90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0106222.WMF", cAlternateFileName="")) returned 1 [0157.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.499] GetProcessHeap () returned 0x4e0000 [0157.499] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.499] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.499] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.499] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.499] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.499] GetProcessHeap () returned 0x4e0000 [0157.499] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.499] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.499] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.499] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.501] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.502] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.502] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.502] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.502] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.502] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.502] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.502] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.502] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4c90, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4c90, lpOverlapped=0x0) returned 1 [0157.503] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4c90, dwBufLen=0x4c90 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4c90) returned 1 [0157.503] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.503] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4c90, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4c90, lpOverlapped=0x0) returned 1 [0157.504] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.504] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4d64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.504] SetEndOfFile (hFile=0xdc) returned 1 [0157.506] GetProcessHeap () returned 0x4e0000 [0157.506] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.506] GetProcessHeap () returned 0x4e0000 [0157.507] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.507] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.508] CloseHandle (hObject=0xdc) returned 1 [0157.508] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x864, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0106572.WMF", cAlternateFileName="")) returned 1 [0157.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.510] GetProcessHeap () returned 0x4e0000 [0157.510] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.510] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.510] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.510] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0157.512] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.512] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.512] GetProcessHeap () returned 0x4e0000 [0157.512] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.512] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.512] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.512] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.512] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.512] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.513] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.513] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.513] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.513] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.513] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.513] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.513] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x864, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x864, lpOverlapped=0x0) returned 1 [0157.513] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x870, dwBufLen=0x870 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x870) returned 1 [0157.513] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.513] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x870, lpOverlapped=0x0) returned 1 [0157.514] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.514] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x944, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.514] SetEndOfFile (hFile=0xdc) returned 1 [0157.516] GetProcessHeap () returned 0x4e0000 [0157.516] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.516] GetProcessHeap () returned 0x4e0000 [0157.516] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.516] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.518] CloseHandle (hObject=0xdc) returned 1 [0157.518] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd04, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0106816.WMF", cAlternateFileName="")) returned 1 [0157.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.519] GetProcessHeap () returned 0x4e0000 [0157.519] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.519] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.519] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.519] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0157.521] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.521] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.521] GetProcessHeap () returned 0x4e0000 [0157.521] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.521] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.521] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.521] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.521] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.521] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.521] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.522] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.522] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.522] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.522] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.522] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.522] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xd04, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xd04, lpOverlapped=0x0) returned 1 [0157.522] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xd10, dwBufLen=0xd10 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xd10) returned 1 [0157.522] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.522] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xd10, lpOverlapped=0x0) returned 1 [0157.522] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.522] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xde4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.522] SetEndOfFile (hFile=0xdc) returned 1 [0157.525] GetProcessHeap () returned 0x4e0000 [0157.526] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.526] GetProcessHeap () returned 0x4e0000 [0157.526] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.526] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.527] CloseHandle (hObject=0xdc) returned 1 [0157.527] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x35d8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0106958.WMF", cAlternateFileName="")) returned 1 [0157.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.528] GetProcessHeap () returned 0x4e0000 [0157.528] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.528] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.529] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.529] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.534] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.534] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.534] GetProcessHeap () returned 0x4e0000 [0157.534] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.534] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.534] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.534] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.534] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.534] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.534] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.534] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.534] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.535] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.535] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.535] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.535] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x35d8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x35d8, lpOverlapped=0x0) returned 1 [0157.536] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x35e0, dwBufLen=0x35e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x35e0) returned 1 [0157.536] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.536] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x35e0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x35e0, lpOverlapped=0x0) returned 1 [0157.536] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.536] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x36b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.536] SetEndOfFile (hFile=0xdc) returned 1 [0157.539] GetProcessHeap () returned 0x4e0000 [0157.539] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.539] GetProcessHeap () returned 0x4e0000 [0157.539] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.539] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.540] CloseHandle (hObject=0xdc) returned 1 [0157.540] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbcc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107024.WMF", cAlternateFileName="")) returned 1 [0157.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.541] GetProcessHeap () returned 0x4e0000 [0157.541] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.541] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.541] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.541] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.543] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.543] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.543] GetProcessHeap () returned 0x4e0000 [0157.543] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.543] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.543] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.543] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.543] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.543] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.543] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.543] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.543] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.543] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.544] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.544] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.544] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xbcc, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xbcc, lpOverlapped=0x0) returned 1 [0157.544] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xbd0, dwBufLen=0xbd0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xbd0) returned 1 [0157.544] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.544] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xbd0, lpOverlapped=0x0) returned 1 [0157.544] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.544] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xca4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.544] SetEndOfFile (hFile=0xdc) returned 1 [0157.546] GetProcessHeap () returned 0x4e0000 [0157.546] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.546] GetProcessHeap () returned 0x4e0000 [0157.546] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.546] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.547] CloseHandle (hObject=0xdc) returned 1 [0157.547] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1dd0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107026.WMF", cAlternateFileName="")) returned 1 [0157.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.548] GetProcessHeap () returned 0x4e0000 [0157.548] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.548] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.548] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.548] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.548] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.548] GetProcessHeap () returned 0x4e0000 [0157.548] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.548] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.548] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.548] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.550] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.550] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.550] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.550] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.550] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.550] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.550] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.550] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.550] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1dd0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1dd0, lpOverlapped=0x0) returned 1 [0157.551] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1dd0, dwBufLen=0x1dd0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1dd0) returned 1 [0157.551] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.551] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1dd0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1dd0, lpOverlapped=0x0) returned 1 [0157.552] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.552] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1ea4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.552] SetEndOfFile (hFile=0xdc) returned 1 [0157.554] GetProcessHeap () returned 0x4e0000 [0157.554] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.554] GetProcessHeap () returned 0x4e0000 [0157.554] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.554] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.555] CloseHandle (hObject=0xdc) returned 1 [0157.555] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2358, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107042.WMF", cAlternateFileName="")) returned 1 [0157.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.556] GetProcessHeap () returned 0x4e0000 [0157.556] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.556] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.556] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.556] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.558] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.558] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.558] GetProcessHeap () returned 0x4e0000 [0157.558] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.558] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.558] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.558] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.558] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.559] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.559] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.559] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.559] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.559] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.559] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.559] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.559] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2358, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2358, lpOverlapped=0x0) returned 1 [0157.560] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2360, dwBufLen=0x2360 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2360) returned 1 [0157.560] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.560] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2360, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2360, lpOverlapped=0x0) returned 1 [0157.561] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.561] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2434, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.561] SetEndOfFile (hFile=0xdc) returned 1 [0157.563] GetProcessHeap () returned 0x4e0000 [0157.563] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.563] GetProcessHeap () returned 0x4e0000 [0157.563] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.563] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.564] CloseHandle (hObject=0xdc) returned 1 [0157.564] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3734, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107090.WMF", cAlternateFileName="")) returned 1 [0157.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.565] GetProcessHeap () returned 0x4e0000 [0157.565] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.565] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.565] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.565] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0157.575] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.575] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.575] GetProcessHeap () returned 0x4e0000 [0157.575] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.575] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.575] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.575] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.576] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.576] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.576] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.576] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.576] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.576] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.576] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.576] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.576] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3734, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3734, lpOverlapped=0x0) returned 1 [0157.577] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3740, dwBufLen=0x3740 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3740) returned 1 [0157.577] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.577] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3740, lpOverlapped=0x0) returned 1 [0157.577] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.578] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.578] SetEndOfFile (hFile=0xdc) returned 1 [0157.580] GetProcessHeap () returned 0x4e0000 [0157.580] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.580] GetProcessHeap () returned 0x4e0000 [0157.580] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.580] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.582] CloseHandle (hObject=0xdc) returned 1 [0157.582] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x69cc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107130.WMF", cAlternateFileName="")) returned 1 [0157.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.583] GetProcessHeap () returned 0x4e0000 [0157.583] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.583] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.583] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.583] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.585] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.585] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.585] GetProcessHeap () returned 0x4e0000 [0157.585] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.585] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.585] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.585] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.585] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.585] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.585] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.585] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.585] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.585] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.585] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.585] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.585] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x69cc, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x69cc, lpOverlapped=0x0) returned 1 [0157.598] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x69d0, dwBufLen=0x69d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x69d0) returned 1 [0157.598] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.598] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x69d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x69d0, lpOverlapped=0x0) returned 1 [0157.599] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.599] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6aa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.599] SetEndOfFile (hFile=0xdc) returned 1 [0157.601] GetProcessHeap () returned 0x4e0000 [0157.601] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.601] GetProcessHeap () returned 0x4e0000 [0157.601] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.601] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.602] CloseHandle (hObject=0xdc) returned 1 [0157.602] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbcfc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107132.WMF", cAlternateFileName="")) returned 1 [0157.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.603] GetProcessHeap () returned 0x4e0000 [0157.603] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.603] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.603] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.603] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.607] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.607] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.607] GetProcessHeap () returned 0x4e0000 [0157.607] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.608] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.608] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.608] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.608] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.608] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.608] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.608] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.608] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.608] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.608] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.608] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.608] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xbcfc, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xbcfc, lpOverlapped=0x0) returned 1 [0157.609] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xbd00, dwBufLen=0xbd00 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xbd00) returned 1 [0157.610] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.610] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xbd00, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xbd00, lpOverlapped=0x0) returned 1 [0157.610] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.610] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xbdd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.610] SetEndOfFile (hFile=0xdc) returned 1 [0157.612] GetProcessHeap () returned 0x4e0000 [0157.612] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.612] GetProcessHeap () returned 0x4e0000 [0157.613] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.613] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.614] CloseHandle (hObject=0xdc) returned 1 [0157.614] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbd04, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107134.WMF", cAlternateFileName="")) returned 1 [0157.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.614] GetProcessHeap () returned 0x4e0000 [0157.615] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.615] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.615] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.615] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0157.616] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.617] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.617] GetProcessHeap () returned 0x4e0000 [0157.617] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.617] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.617] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.617] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.617] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.617] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.617] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.617] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.617] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.617] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.617] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.617] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.617] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xbd04, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xbd04, lpOverlapped=0x0) returned 1 [0157.618] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xbd10, dwBufLen=0xbd10 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xbd10) returned 1 [0157.619] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.619] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xbd10, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xbd10, lpOverlapped=0x0) returned 1 [0157.619] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.619] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xbde4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.619] SetEndOfFile (hFile=0xdc) returned 1 [0157.621] GetProcessHeap () returned 0x4e0000 [0157.621] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.622] GetProcessHeap () returned 0x4e0000 [0157.622] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.622] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.623] CloseHandle (hObject=0xdc) returned 1 [0157.623] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4330, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107138.WMF", cAlternateFileName="")) returned 1 [0157.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.624] GetProcessHeap () returned 0x4e0000 [0157.624] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.624] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.624] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.624] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.624] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.624] GetProcessHeap () returned 0x4e0000 [0157.624] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.624] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.624] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.624] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.627] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.627] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.627] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.627] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.627] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.627] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.627] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.627] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.627] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4330, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4330, lpOverlapped=0x0) returned 1 [0157.628] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4330, dwBufLen=0x4330 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4330) returned 1 [0157.629] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.629] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4330, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4330, lpOverlapped=0x0) returned 1 [0157.629] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.629] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4404, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.629] SetEndOfFile (hFile=0xdc) returned 1 [0157.631] GetProcessHeap () returned 0x4e0000 [0157.631] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.631] GetProcessHeap () returned 0x4e0000 [0157.631] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.631] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.632] CloseHandle (hObject=0xdc) returned 1 [0157.632] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3a94, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107146.WMF", cAlternateFileName="")) returned 1 [0157.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.633] GetProcessHeap () returned 0x4e0000 [0157.633] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.633] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.633] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.633] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0157.635] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.635] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.635] GetProcessHeap () returned 0x4e0000 [0157.635] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.635] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.635] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.635] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.635] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.635] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.635] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.635] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.635] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.635] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.635] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.636] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.636] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3a94, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3a94, lpOverlapped=0x0) returned 1 [0157.636] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3aa0, dwBufLen=0x3aa0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3aa0) returned 1 [0157.637] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.637] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3aa0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3aa0, lpOverlapped=0x0) returned 1 [0157.637] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.637] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3b74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.637] SetEndOfFile (hFile=0xdc) returned 1 [0157.639] GetProcessHeap () returned 0x4e0000 [0157.639] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.639] GetProcessHeap () returned 0x4e0000 [0157.639] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.639] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.640] CloseHandle (hObject=0xdc) returned 1 [0157.640] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4ea8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107148.WMF", cAlternateFileName="")) returned 1 [0157.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.641] GetProcessHeap () returned 0x4e0000 [0157.641] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.641] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.641] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.641] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.651] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.651] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.652] GetProcessHeap () returned 0x4e0000 [0157.652] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.652] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.652] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.652] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.652] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.652] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.652] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.652] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.652] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.652] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.652] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.652] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.652] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4ea8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4ea8, lpOverlapped=0x0) returned 1 [0157.653] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4eb0, dwBufLen=0x4eb0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4eb0) returned 1 [0157.653] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.654] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4eb0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4eb0, lpOverlapped=0x0) returned 1 [0157.654] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.654] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4f84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.654] SetEndOfFile (hFile=0xdc) returned 1 [0157.656] GetProcessHeap () returned 0x4e0000 [0157.656] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.656] GetProcessHeap () returned 0x4e0000 [0157.656] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.656] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.657] CloseHandle (hObject=0xdc) returned 1 [0157.657] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3490, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107150.WMF", cAlternateFileName="")) returned 1 [0157.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.658] GetProcessHeap () returned 0x4e0000 [0157.658] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.658] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.658] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.658] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.658] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.658] GetProcessHeap () returned 0x4e0000 [0157.658] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.658] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.658] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.658] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.673] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.673] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.673] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.673] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.674] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.674] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.674] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.674] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.674] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3490, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3490, lpOverlapped=0x0) returned 1 [0157.675] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3490, dwBufLen=0x3490 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3490) returned 1 [0157.675] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.675] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3490, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3490, lpOverlapped=0x0) returned 1 [0157.675] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.675] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3564, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.676] SetEndOfFile (hFile=0xdc) returned 1 [0157.678] GetProcessHeap () returned 0x4e0000 [0157.678] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.678] GetProcessHeap () returned 0x4e0000 [0157.678] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.678] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.680] CloseHandle (hObject=0xdc) returned 1 [0157.680] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5804, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107152.WMF", cAlternateFileName="")) returned 1 [0157.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.681] GetProcessHeap () returned 0x4e0000 [0157.681] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.681] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.681] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.681] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0157.683] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.683] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.683] GetProcessHeap () returned 0x4e0000 [0157.683] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.683] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.683] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.683] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.684] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.684] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.684] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.684] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.684] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.684] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.684] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.684] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.684] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5804, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x5804, lpOverlapped=0x0) returned 1 [0157.685] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5810, dwBufLen=0x5810 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5810) returned 1 [0157.686] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.686] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5810, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5810, lpOverlapped=0x0) returned 1 [0157.686] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.686] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x58e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.686] SetEndOfFile (hFile=0xdc) returned 1 [0157.689] GetProcessHeap () returned 0x4e0000 [0157.689] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.689] GetProcessHeap () returned 0x4e0000 [0157.689] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.689] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.690] CloseHandle (hObject=0xdc) returned 1 [0157.690] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x571c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107154.WMF", cAlternateFileName="")) returned 1 [0157.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.691] GetProcessHeap () returned 0x4e0000 [0157.691] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.691] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.691] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.691] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.693] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.694] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.694] GetProcessHeap () returned 0x4e0000 [0157.694] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.694] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.694] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.694] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.694] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.694] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.694] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.694] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.694] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.694] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.694] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.694] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.694] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x571c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x571c, lpOverlapped=0x0) returned 1 [0157.696] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5720, dwBufLen=0x5720 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5720) returned 1 [0157.696] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.696] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5720, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5720, lpOverlapped=0x0) returned 1 [0157.696] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.696] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x57f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.696] SetEndOfFile (hFile=0xdc) returned 1 [0157.699] GetProcessHeap () returned 0x4e0000 [0157.699] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.699] GetProcessHeap () returned 0x4e0000 [0157.699] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.699] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.700] CloseHandle (hObject=0xdc) returned 1 [0157.700] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x614c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107158.WMF", cAlternateFileName="")) returned 1 [0157.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.702] GetProcessHeap () returned 0x4e0000 [0157.702] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.702] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.702] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.702] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.704] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.704] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.704] GetProcessHeap () returned 0x4e0000 [0157.704] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.705] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.705] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.705] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.705] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.705] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.705] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.705] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.705] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.705] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.705] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.705] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.705] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x614c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x614c, lpOverlapped=0x0) returned 1 [0157.706] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6150, dwBufLen=0x6150 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6150) returned 1 [0157.707] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.707] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6150, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x6150, lpOverlapped=0x0) returned 1 [0157.707] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.707] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.707] SetEndOfFile (hFile=0xdc) returned 1 [0157.710] GetProcessHeap () returned 0x4e0000 [0157.710] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.710] GetProcessHeap () returned 0x4e0000 [0157.710] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.710] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.711] CloseHandle (hObject=0xdc) returned 1 [0157.711] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3ee4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107182.WMF", cAlternateFileName="")) returned 1 [0157.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.712] GetProcessHeap () returned 0x4e0000 [0157.712] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.712] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.712] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.712] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0157.715] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.715] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.715] GetProcessHeap () returned 0x4e0000 [0157.715] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.715] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.715] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.715] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.715] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.715] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.715] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.715] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.715] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.715] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.715] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.715] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.716] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3ee4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3ee4, lpOverlapped=0x0) returned 1 [0157.717] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3ef0, dwBufLen=0x3ef0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3ef0) returned 1 [0157.717] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.717] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3ef0, lpOverlapped=0x0) returned 1 [0157.717] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.717] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3fc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.717] SetEndOfFile (hFile=0xdc) returned 1 [0157.720] GetProcessHeap () returned 0x4e0000 [0157.720] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.720] GetProcessHeap () returned 0x4e0000 [0157.720] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.720] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.721] CloseHandle (hObject=0xdc) returned 1 [0157.721] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x11b8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107188.WMF", cAlternateFileName="")) returned 1 [0157.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.722] GetProcessHeap () returned 0x4e0000 [0157.722] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.722] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.722] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.722] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.724] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.724] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.724] GetProcessHeap () returned 0x4e0000 [0157.724] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.724] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.724] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.724] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.725] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.725] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.725] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.725] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.725] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.725] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.725] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.725] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.725] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x11b8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x11b8, lpOverlapped=0x0) returned 1 [0157.728] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x11c0, dwBufLen=0x11c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x11c0) returned 1 [0157.728] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.729] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x11c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x11c0, lpOverlapped=0x0) returned 1 [0157.729] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.729] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1294, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.729] SetEndOfFile (hFile=0xdc) returned 1 [0157.732] GetProcessHeap () returned 0x4e0000 [0157.732] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.732] GetProcessHeap () returned 0x4e0000 [0157.732] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.732] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.733] CloseHandle (hObject=0xdc) returned 1 [0157.733] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x26f0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107192.WMF", cAlternateFileName="")) returned 1 [0157.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.734] GetProcessHeap () returned 0x4e0000 [0157.734] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.734] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.734] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.734] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.734] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.734] GetProcessHeap () returned 0x4e0000 [0157.734] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.734] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.734] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.734] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.737] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.737] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.737] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.737] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.737] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.737] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.737] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.737] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.738] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x26f0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x26f0, lpOverlapped=0x0) returned 1 [0157.738] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x26f0, dwBufLen=0x26f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x26f0) returned 1 [0157.739] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.739] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x26f0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x26f0, lpOverlapped=0x0) returned 1 [0157.739] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.739] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x27c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.739] SetEndOfFile (hFile=0xdc) returned 1 [0157.742] GetProcessHeap () returned 0x4e0000 [0157.742] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.742] GetProcessHeap () returned 0x4e0000 [0157.742] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.742] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.743] CloseHandle (hObject=0xdc) returned 1 [0157.743] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4ef4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107254.WMF", cAlternateFileName="")) returned 1 [0157.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.744] GetProcessHeap () returned 0x4e0000 [0157.744] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.744] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.744] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.744] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0157.746] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.746] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.746] GetProcessHeap () returned 0x4e0000 [0157.746] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.746] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.746] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.746] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.747] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.747] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.747] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.747] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.747] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.747] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.747] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.747] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.747] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4ef4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4ef4, lpOverlapped=0x0) returned 1 [0157.749] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4f00, dwBufLen=0x4f00 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4f00) returned 1 [0157.749] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.749] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4f00, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4f00, lpOverlapped=0x0) returned 1 [0157.749] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.749] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4fd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.749] SetEndOfFile (hFile=0xdc) returned 1 [0157.752] GetProcessHeap () returned 0x4e0000 [0157.752] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.752] GetProcessHeap () returned 0x4e0000 [0157.752] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.752] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.753] CloseHandle (hObject=0xdc) returned 1 [0157.754] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2168, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107258.WMF", cAlternateFileName="")) returned 1 [0157.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.755] GetProcessHeap () returned 0x4e0000 [0157.755] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.755] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.755] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.755] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.757] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.757] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.757] GetProcessHeap () returned 0x4e0000 [0157.757] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.758] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.758] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.758] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.758] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.758] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.758] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.758] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.758] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.758] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.758] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.758] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.758] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2168, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2168, lpOverlapped=0x0) returned 1 [0157.759] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2170, dwBufLen=0x2170 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2170) returned 1 [0157.759] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.759] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2170, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2170, lpOverlapped=0x0) returned 1 [0157.759] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.759] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2244, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.760] SetEndOfFile (hFile=0xdc) returned 1 [0157.762] GetProcessHeap () returned 0x4e0000 [0157.762] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.762] GetProcessHeap () returned 0x4e0000 [0157.762] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.762] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.764] CloseHandle (hObject=0xdc) returned 1 [0157.764] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f3c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107262.WMF", cAlternateFileName="")) returned 1 [0157.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.765] GetProcessHeap () returned 0x4e0000 [0157.765] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.765] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.765] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.765] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.767] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.767] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.767] GetProcessHeap () returned 0x4e0000 [0157.767] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.768] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.768] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.768] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.768] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.768] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.768] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.768] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.768] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.768] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.768] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.768] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.769] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1f3c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1f3c, lpOverlapped=0x0) returned 1 [0157.769] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1f40, dwBufLen=0x1f40 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1f40) returned 1 [0157.770] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.770] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1f40, lpOverlapped=0x0) returned 1 [0157.770] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.770] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.770] SetEndOfFile (hFile=0xdc) returned 1 [0157.773] GetProcessHeap () returned 0x4e0000 [0157.773] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.773] GetProcessHeap () returned 0x4e0000 [0157.773] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.773] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.774] CloseHandle (hObject=0xdc) returned 1 [0157.774] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1498, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107264.WMF", cAlternateFileName="")) returned 1 [0157.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.776] GetProcessHeap () returned 0x4e0000 [0157.776] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.776] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.776] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.776] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.779] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.779] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.779] GetProcessHeap () returned 0x4e0000 [0157.779] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.779] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.779] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.779] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.779] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.779] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.779] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.779] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.779] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.780] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.780] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.780] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.780] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1498, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1498, lpOverlapped=0x0) returned 1 [0157.781] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x14a0, dwBufLen=0x14a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x14a0) returned 1 [0157.781] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.781] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x14a0, lpOverlapped=0x0) returned 1 [0157.781] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.781] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1574, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.781] SetEndOfFile (hFile=0xdc) returned 1 [0157.784] GetProcessHeap () returned 0x4e0000 [0157.784] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.784] GetProcessHeap () returned 0x4e0000 [0157.784] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.784] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.785] CloseHandle (hObject=0xdc) returned 1 [0157.785] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16ec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107266.WMF", cAlternateFileName="")) returned 1 [0157.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.786] GetProcessHeap () returned 0x4e0000 [0157.786] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.786] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.786] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.786] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.789] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.789] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.789] GetProcessHeap () returned 0x4e0000 [0157.789] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.789] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.789] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.789] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.789] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.789] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.789] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.789] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.789] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.789] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.790] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.790] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.790] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x16ec, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x16ec, lpOverlapped=0x0) returned 1 [0157.793] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x16f0, dwBufLen=0x16f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x16f0) returned 1 [0157.794] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.794] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x16f0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x16f0, lpOverlapped=0x0) returned 1 [0157.794] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.794] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x17c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.794] SetEndOfFile (hFile=0xdc) returned 1 [0157.797] GetProcessHeap () returned 0x4e0000 [0157.797] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.797] GetProcessHeap () returned 0x4e0000 [0157.797] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.797] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.806] CloseHandle (hObject=0xdc) returned 1 [0157.806] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2b64, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107280.WMF", cAlternateFileName="")) returned 1 [0157.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.807] GetProcessHeap () returned 0x4e0000 [0157.807] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.807] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.807] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.807] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0157.810] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.810] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.810] GetProcessHeap () returned 0x4e0000 [0157.810] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.810] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.810] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.810] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.810] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.810] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.810] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.810] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.811] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.811] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.811] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.811] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.811] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2b64, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2b64, lpOverlapped=0x0) returned 1 [0157.812] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2b70, dwBufLen=0x2b70 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2b70) returned 1 [0157.812] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.812] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2b70, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2b70, lpOverlapped=0x0) returned 1 [0157.812] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.812] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2c44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.812] SetEndOfFile (hFile=0xdc) returned 1 [0157.815] GetProcessHeap () returned 0x4e0000 [0157.815] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.815] GetProcessHeap () returned 0x4e0000 [0157.815] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.815] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.816] CloseHandle (hObject=0xdc) returned 1 [0157.816] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3734, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107282.WMF", cAlternateFileName="")) returned 1 [0157.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.817] GetProcessHeap () returned 0x4e0000 [0157.817] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.817] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.817] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.817] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0157.819] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.819] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.820] GetProcessHeap () returned 0x4e0000 [0157.820] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.820] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.820] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.820] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.820] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.820] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.820] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.820] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.820] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.820] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.820] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.820] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.820] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3734, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3734, lpOverlapped=0x0) returned 1 [0157.821] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3740, dwBufLen=0x3740 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3740) returned 1 [0157.822] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.822] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3740, lpOverlapped=0x0) returned 1 [0157.822] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.822] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.822] SetEndOfFile (hFile=0xdc) returned 1 [0157.825] GetProcessHeap () returned 0x4e0000 [0157.825] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.825] GetProcessHeap () returned 0x4e0000 [0157.825] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.825] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.826] CloseHandle (hObject=0xdc) returned 1 [0157.826] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x347c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107288.WMF", cAlternateFileName="")) returned 1 [0157.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.827] GetProcessHeap () returned 0x4e0000 [0157.827] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.827] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.827] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.827] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.830] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.830] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.830] GetProcessHeap () returned 0x4e0000 [0157.830] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.830] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.830] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.830] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.830] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.830] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.830] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.830] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.830] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.830] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.830] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.831] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.831] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x347c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x347c, lpOverlapped=0x0) returned 1 [0157.832] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3480, dwBufLen=0x3480 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3480) returned 1 [0157.832] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.832] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3480, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3480, lpOverlapped=0x0) returned 1 [0157.832] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.832] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3554, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.832] SetEndOfFile (hFile=0xdc) returned 1 [0157.835] GetProcessHeap () returned 0x4e0000 [0157.835] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.835] GetProcessHeap () returned 0x4e0000 [0157.835] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.835] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.837] CloseHandle (hObject=0xdc) returned 1 [0157.837] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3014, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107290.WMF", cAlternateFileName="")) returned 1 [0157.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.838] GetProcessHeap () returned 0x4e0000 [0157.838] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.838] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.838] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.838] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0157.840] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.840] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.840] GetProcessHeap () returned 0x4e0000 [0157.840] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.840] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.840] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.840] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.840] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.840] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.841] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.841] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.841] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.841] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.841] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.841] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.841] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3014, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3014, lpOverlapped=0x0) returned 1 [0157.842] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3020, dwBufLen=0x3020 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3020) returned 1 [0157.842] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.842] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3020, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3020, lpOverlapped=0x0) returned 1 [0157.842] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.843] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x30f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.843] SetEndOfFile (hFile=0xdc) returned 1 [0157.845] GetProcessHeap () returned 0x4e0000 [0157.845] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.845] GetProcessHeap () returned 0x4e0000 [0157.845] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.845] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.847] CloseHandle (hObject=0xdc) returned 1 [0157.847] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x99c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107300.WMF", cAlternateFileName="")) returned 1 [0157.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.848] GetProcessHeap () returned 0x4e0000 [0157.848] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.848] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.848] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.848] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.853] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.853] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.853] GetProcessHeap () returned 0x4e0000 [0157.853] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.854] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.854] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.854] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.854] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.854] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.854] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.854] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.854] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.854] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.854] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.854] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.854] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x99c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x99c, lpOverlapped=0x0) returned 1 [0157.854] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9a0, dwBufLen=0x9a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9a0) returned 1 [0157.855] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.855] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x9a0, lpOverlapped=0x0) returned 1 [0157.855] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.855] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xa74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.855] SetEndOfFile (hFile=0xdc) returned 1 [0157.857] GetProcessHeap () returned 0x4e0000 [0157.857] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.858] GetProcessHeap () returned 0x4e0000 [0157.858] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.858] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.859] CloseHandle (hObject=0xdc) returned 1 [0157.859] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56393f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1028, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107302.WMF", cAlternateFileName="")) returned 1 [0157.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.861] GetProcessHeap () returned 0x4e0000 [0157.861] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.861] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.861] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.861] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.886] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.886] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.886] GetProcessHeap () returned 0x4e0000 [0157.886] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.886] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.886] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.886] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.886] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.886] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.886] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.886] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.887] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.887] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.887] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.887] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.887] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1028, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1028, lpOverlapped=0x0) returned 1 [0157.888] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1030, dwBufLen=0x1030 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1030) returned 1 [0157.888] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.888] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1030, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1030, lpOverlapped=0x0) returned 1 [0157.888] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.888] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1104, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.888] SetEndOfFile (hFile=0xdc) returned 1 [0157.891] GetProcessHeap () returned 0x4e0000 [0157.891] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.891] GetProcessHeap () returned 0x4e0000 [0157.891] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.891] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.893] CloseHandle (hObject=0xdc) returned 1 [0157.893] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56393f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3e10, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107308.WMF", cAlternateFileName="")) returned 1 [0157.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.893] GetProcessHeap () returned 0x4e0000 [0157.893] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.894] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.894] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.894] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.894] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.894] GetProcessHeap () returned 0x4e0000 [0157.894] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.894] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.894] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.894] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.896] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.896] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.896] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.897] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.897] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.897] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.897] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.897] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.897] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3e10, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3e10, lpOverlapped=0x0) returned 1 [0157.898] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3e10, dwBufLen=0x3e10 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3e10) returned 1 [0157.898] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.898] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3e10, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3e10, lpOverlapped=0x0) returned 1 [0157.898] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.898] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3ee4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.898] SetEndOfFile (hFile=0xdc) returned 1 [0157.901] GetProcessHeap () returned 0x4e0000 [0157.901] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.901] GetProcessHeap () returned 0x4e0000 [0157.901] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.901] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.902] CloseHandle (hObject=0xdc) returned 1 [0157.903] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56393f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2a64, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107314.WMF", cAlternateFileName="")) returned 1 [0157.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.904] GetProcessHeap () returned 0x4e0000 [0157.904] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.904] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.904] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.904] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0157.906] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.906] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.906] GetProcessHeap () returned 0x4e0000 [0157.906] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.906] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.906] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.906] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.906] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.906] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.907] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.907] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.907] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.907] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.907] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.907] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.907] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2a64, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2a64, lpOverlapped=0x0) returned 1 [0157.908] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2a70, dwBufLen=0x2a70 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2a70) returned 1 [0157.908] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.908] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2a70, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2a70, lpOverlapped=0x0) returned 1 [0157.908] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.908] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2b44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.909] SetEndOfFile (hFile=0xdc) returned 1 [0157.911] GetProcessHeap () returned 0x4e0000 [0157.911] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.911] GetProcessHeap () returned 0x4e0000 [0157.911] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.911] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.913] CloseHandle (hObject=0xdc) returned 1 [0157.913] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56393f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2c18, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107316.WMF", cAlternateFileName="")) returned 1 [0157.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.914] GetProcessHeap () returned 0x4e0000 [0157.914] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.914] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.914] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.914] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.916] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.916] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.916] GetProcessHeap () returned 0x4e0000 [0157.917] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.917] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.917] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.917] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.917] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.917] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.917] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.917] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.917] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.917] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.917] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.917] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.917] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2c18, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2c18, lpOverlapped=0x0) returned 1 [0157.918] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2c20, dwBufLen=0x2c20 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2c20) returned 1 [0157.919] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.919] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2c20, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2c20, lpOverlapped=0x0) returned 1 [0157.919] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.919] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2cf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.919] SetEndOfFile (hFile=0xdc) returned 1 [0157.922] GetProcessHeap () returned 0x4e0000 [0157.922] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.922] GetProcessHeap () returned 0x4e0000 [0157.922] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.922] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.923] CloseHandle (hObject=0xdc) returned 1 [0157.923] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56393f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1984, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107328.WMF", cAlternateFileName="")) returned 1 [0157.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.925] GetProcessHeap () returned 0x4e0000 [0157.925] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.925] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.925] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.925] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0157.927] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.927] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.927] GetProcessHeap () returned 0x4e0000 [0157.927] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.927] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.927] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.927] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.927] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.927] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.928] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.928] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.928] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.928] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.928] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.928] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.928] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1984, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1984, lpOverlapped=0x0) returned 1 [0157.929] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1990, dwBufLen=0x1990 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1990) returned 1 [0157.929] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.929] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1990, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1990, lpOverlapped=0x0) returned 1 [0157.929] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.929] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1a64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.929] SetEndOfFile (hFile=0xdc) returned 1 [0157.932] GetProcessHeap () returned 0x4e0000 [0157.932] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.932] GetProcessHeap () returned 0x4e0000 [0157.932] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.932] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.933] CloseHandle (hObject=0xdc) returned 1 [0157.933] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56393f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1094, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107342.WMF", cAlternateFileName="")) returned 1 [0157.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.934] GetProcessHeap () returned 0x4e0000 [0157.934] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.934] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.934] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.934] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0157.937] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.937] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.937] GetProcessHeap () returned 0x4e0000 [0157.937] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.937] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.937] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.937] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.937] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.937] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.937] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.937] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.937] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.937] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.938] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.938] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.938] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1094, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1094, lpOverlapped=0x0) returned 1 [0157.939] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x10a0, dwBufLen=0x10a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x10a0) returned 1 [0157.939] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.939] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x10a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x10a0, lpOverlapped=0x0) returned 1 [0157.939] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.939] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1174, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.939] SetEndOfFile (hFile=0xdc) returned 1 [0157.942] GetProcessHeap () returned 0x4e0000 [0157.942] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.942] GetProcessHeap () returned 0x4e0000 [0157.942] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.942] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.943] CloseHandle (hObject=0xdc) returned 1 [0157.943] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56393f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x13d4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107344.WMF", cAlternateFileName="")) returned 1 [0157.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.943] GetProcessHeap () returned 0x4e0000 [0157.944] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.944] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.944] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.944] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0157.946] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.946] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.946] GetProcessHeap () returned 0x4e0000 [0157.946] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.946] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.946] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.946] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.946] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.946] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.946] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.947] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.947] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.947] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.947] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.947] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.947] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x13d4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x13d4, lpOverlapped=0x0) returned 1 [0157.948] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x13e0, dwBufLen=0x13e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x13e0) returned 1 [0157.948] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.948] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x13e0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x13e0, lpOverlapped=0x0) returned 1 [0157.948] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.948] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x14b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.948] SetEndOfFile (hFile=0xdc) returned 1 [0157.951] GetProcessHeap () returned 0x4e0000 [0157.951] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.951] GetProcessHeap () returned 0x4e0000 [0157.951] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.951] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.952] CloseHandle (hObject=0xdc) returned 1 [0157.953] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5c78, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107350.WMF", cAlternateFileName="")) returned 1 [0157.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.954] GetProcessHeap () returned 0x4e0000 [0157.954] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.954] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.954] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.954] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.956] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.956] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.957] GetProcessHeap () returned 0x4e0000 [0157.957] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.957] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.957] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.957] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.957] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.957] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.957] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.957] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.957] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.957] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.957] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.957] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.957] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5c78, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x5c78, lpOverlapped=0x0) returned 1 [0157.959] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5c80, dwBufLen=0x5c80 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5c80) returned 1 [0157.959] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.959] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5c80, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5c80, lpOverlapped=0x0) returned 1 [0157.959] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.959] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5d54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.959] SetEndOfFile (hFile=0xdc) returned 1 [0157.962] GetProcessHeap () returned 0x4e0000 [0157.962] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.962] GetProcessHeap () returned 0x4e0000 [0157.962] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.962] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.963] CloseHandle (hObject=0xdc) returned 1 [0157.963] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f1c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107358.WMF", cAlternateFileName="")) returned 1 [0157.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.964] GetProcessHeap () returned 0x4e0000 [0157.964] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.964] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.964] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.964] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.967] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.967] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.967] GetProcessHeap () returned 0x4e0000 [0157.967] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.967] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.967] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.967] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.967] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.967] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.967] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.967] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.967] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.967] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.967] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.967] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.968] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1f1c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1f1c, lpOverlapped=0x0) returned 1 [0157.968] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1f20, dwBufLen=0x1f20 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1f20) returned 1 [0157.969] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.969] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1f20, lpOverlapped=0x0) returned 1 [0157.969] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.969] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1ff4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.969] SetEndOfFile (hFile=0xdc) returned 1 [0157.972] GetProcessHeap () returned 0x4e0000 [0157.972] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.972] GetProcessHeap () returned 0x4e0000 [0157.972] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.972] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.973] CloseHandle (hObject=0xdc) returned 1 [0157.973] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x40cc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107364.WMF", cAlternateFileName="")) returned 1 [0157.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.974] GetProcessHeap () returned 0x4e0000 [0157.974] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.974] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.974] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.974] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.977] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.977] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.977] GetProcessHeap () returned 0x4e0000 [0157.977] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.977] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.977] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.977] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.977] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.977] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.977] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.977] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.977] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.978] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.978] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.978] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.978] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40cc, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x40cc, lpOverlapped=0x0) returned 1 [0157.979] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x40d0, dwBufLen=0x40d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x40d0) returned 1 [0157.979] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.979] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x40d0, lpOverlapped=0x0) returned 1 [0157.979] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.979] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x41a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.979] SetEndOfFile (hFile=0xdc) returned 1 [0157.983] GetProcessHeap () returned 0x4e0000 [0157.983] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.983] GetProcessHeap () returned 0x4e0000 [0157.983] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.983] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.984] CloseHandle (hObject=0xdc) returned 1 [0157.984] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2ce4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107426.WMF", cAlternateFileName="")) returned 1 [0157.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.985] GetProcessHeap () returned 0x4e0000 [0157.985] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.985] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.985] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.985] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0157.989] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.989] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.989] GetProcessHeap () returned 0x4e0000 [0157.989] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.989] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.989] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.989] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.989] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.989] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.989] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.989] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.989] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.990] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.990] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.990] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.990] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2ce4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2ce4, lpOverlapped=0x0) returned 1 [0157.990] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2cf0, dwBufLen=0x2cf0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2cf0) returned 1 [0157.991] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.991] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2cf0, lpOverlapped=0x0) returned 1 [0157.991] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.991] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2dc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.991] SetEndOfFile (hFile=0xdc) returned 1 [0157.993] GetProcessHeap () returned 0x4e0000 [0157.993] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0157.993] GetProcessHeap () returned 0x4e0000 [0157.993] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0157.993] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0157.994] CloseHandle (hObject=0xdc) returned 1 [0157.994] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7680, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107446.WMF", cAlternateFileName="")) returned 1 [0157.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.995] GetProcessHeap () returned 0x4e0000 [0157.995] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0157.995] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0157.995] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0157.995] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.995] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.995] GetProcessHeap () returned 0x4e0000 [0157.995] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0157.995] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0157.995] CryptDestroyKey (hKey=0x522f98) returned 1 [0157.995] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0157.997] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0157.997] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0157.997] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0157.997] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0157.997] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0157.997] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0157.998] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0157.998] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.998] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7680, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7680, lpOverlapped=0x0) returned 1 [0158.001] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7680, dwBufLen=0x7680 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7680) returned 1 [0158.001] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.001] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7680, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7680, lpOverlapped=0x0) returned 1 [0158.001] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.001] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7754, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.001] SetEndOfFile (hFile=0xdc) returned 1 [0158.003] GetProcessHeap () returned 0x4e0000 [0158.004] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0158.004] GetProcessHeap () returned 0x4e0000 [0158.004] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0158.004] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0158.004] CloseHandle (hObject=0xdc) returned 1 [0158.005] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1338, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107450.WMF", cAlternateFileName="")) returned 1 [0158.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0158.006] GetProcessHeap () returned 0x4e0000 [0158.006] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0158.006] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0158.006] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0158.006] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.008] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.008] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.008] GetProcessHeap () returned 0x4e0000 [0158.008] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0158.008] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0158.008] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.008] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0158.008] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.008] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0158.008] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0158.008] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0158.008] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.008] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.008] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.008] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.008] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1338, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1338, lpOverlapped=0x0) returned 1 [0158.009] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1340, dwBufLen=0x1340 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1340) returned 1 [0158.009] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.009] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1340, lpOverlapped=0x0) returned 1 [0158.009] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.009] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1414, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.009] SetEndOfFile (hFile=0xdc) returned 1 [0158.011] GetProcessHeap () returned 0x4e0000 [0158.012] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0158.012] GetProcessHeap () returned 0x4e0000 [0158.012] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0158.012] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0158.012] CloseHandle (hObject=0xdc) returned 1 [0158.013] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x52e0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107452.WMF", cAlternateFileName="")) returned 1 [0158.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0158.014] GetProcessHeap () returned 0x4e0000 [0158.014] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0158.014] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0158.014] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0158.014] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.014] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.014] GetProcessHeap () returned 0x4e0000 [0158.014] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0158.014] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0158.014] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.014] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0158.015] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.016] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0158.016] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0158.016] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0158.016] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.016] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.016] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.016] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.016] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x52e0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x52e0, lpOverlapped=0x0) returned 1 [0158.017] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x52e0, dwBufLen=0x52e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x52e0) returned 1 [0158.017] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.017] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x52e0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x52e0, lpOverlapped=0x0) returned 1 [0158.017] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.017] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x53b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.017] SetEndOfFile (hFile=0xdc) returned 1 [0158.019] GetProcessHeap () returned 0x4e0000 [0158.019] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0158.019] GetProcessHeap () returned 0x4e0000 [0158.019] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0158.019] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0158.020] CloseHandle (hObject=0xdc) returned 1 [0158.020] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe8c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107456.WMF", cAlternateFileName="")) returned 1 [0158.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0158.021] GetProcessHeap () returned 0x4e0000 [0158.021] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0158.021] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0158.021] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0158.021] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.023] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.023] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.023] GetProcessHeap () returned 0x4e0000 [0158.023] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0158.023] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0158.023] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.023] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0158.023] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.023] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0158.023] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0158.023] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0158.023] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.023] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.023] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.023] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.023] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xe8c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xe8c, lpOverlapped=0x0) returned 1 [0158.023] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe90, dwBufLen=0xe90 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe90) returned 1 [0158.023] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.023] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xe90, lpOverlapped=0x0) returned 1 [0158.024] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.024] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xf64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.024] SetEndOfFile (hFile=0xdc) returned 1 [0158.026] GetProcessHeap () returned 0x4e0000 [0158.026] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0158.026] GetProcessHeap () returned 0x4e0000 [0158.026] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0158.026] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0158.027] CloseHandle (hObject=0xdc) returned 1 [0158.027] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xdf0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107458.WMF", cAlternateFileName="")) returned 1 [0158.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0158.027] GetProcessHeap () returned 0x4e0000 [0158.027] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0158.027] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0158.027] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0158.027] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.027] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.027] GetProcessHeap () returned 0x4e0000 [0158.027] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0158.027] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0158.028] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.028] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0158.029] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.029] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0158.029] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0158.030] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0158.030] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.030] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.030] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.030] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.030] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xdf0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xdf0, lpOverlapped=0x0) returned 1 [0158.030] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xdf0, dwBufLen=0xdf0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xdf0) returned 1 [0158.030] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.030] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xdf0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xdf0, lpOverlapped=0x0) returned 1 [0158.030] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.030] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xec4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.030] SetEndOfFile (hFile=0xdc) returned 1 [0158.032] GetProcessHeap () returned 0x4e0000 [0158.032] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0158.032] GetProcessHeap () returned 0x4e0000 [0158.032] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0158.032] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0158.033] CloseHandle (hObject=0xdc) returned 1 [0158.033] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x258c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107468.WMF", cAlternateFileName="")) returned 1 [0158.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0158.034] GetProcessHeap () returned 0x4e0000 [0158.034] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0158.034] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0158.034] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0158.034] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.036] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.036] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.036] GetProcessHeap () returned 0x4e0000 [0158.036] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0158.036] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0158.036] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.036] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0158.036] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.036] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0158.036] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0158.036] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0158.036] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.036] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.036] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.036] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.037] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x258c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x258c, lpOverlapped=0x0) returned 1 [0158.037] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2590, dwBufLen=0x2590 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2590) returned 1 [0158.037] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.038] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2590, lpOverlapped=0x0) returned 1 [0158.038] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.038] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2664, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.038] SetEndOfFile (hFile=0xdc) returned 1 [0158.040] GetProcessHeap () returned 0x4e0000 [0158.040] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0158.040] GetProcessHeap () returned 0x4e0000 [0158.040] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0158.040] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0158.041] CloseHandle (hObject=0xdc) returned 1 [0158.041] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1788, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107480.WMF", cAlternateFileName="")) returned 1 [0158.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0158.041] GetProcessHeap () returned 0x4e0000 [0158.041] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0158.041] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0158.041] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0158.042] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.043] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.043] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.044] GetProcessHeap () returned 0x4e0000 [0158.044] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0158.044] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0158.044] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.044] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0158.044] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.044] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0158.044] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0158.044] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0158.044] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.044] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.044] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.044] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.044] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1788, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1788, lpOverlapped=0x0) returned 1 [0158.045] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1790, dwBufLen=0x1790 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1790) returned 1 [0158.045] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.045] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1790, lpOverlapped=0x0) returned 1 [0158.045] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.045] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1864, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.045] SetEndOfFile (hFile=0xdc) returned 1 [0158.047] GetProcessHeap () returned 0x4e0000 [0158.047] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0158.047] GetProcessHeap () returned 0x4e0000 [0158.047] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0158.048] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0158.048] CloseHandle (hObject=0xdc) returned 1 [0158.049] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1374, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107482.WMF", cAlternateFileName="")) returned 1 [0158.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0158.049] GetProcessHeap () returned 0x4e0000 [0158.049] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0158.049] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0158.049] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0158.049] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0158.054] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.054] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.054] GetProcessHeap () returned 0x4e0000 [0158.054] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0158.054] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0158.054] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.054] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0158.054] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.054] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0158.054] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0158.054] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0158.054] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.054] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.054] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.054] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.054] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1374, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1374, lpOverlapped=0x0) returned 1 [0158.055] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1380, dwBufLen=0x1380 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1380) returned 1 [0158.055] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.055] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1380, lpOverlapped=0x0) returned 1 [0158.055] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.055] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1454, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.055] SetEndOfFile (hFile=0xdc) returned 1 [0158.057] GetProcessHeap () returned 0x4e0000 [0158.057] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0158.057] GetProcessHeap () returned 0x4e0000 [0158.058] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0158.058] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0158.058] CloseHandle (hObject=0xdc) returned 1 [0158.059] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbe0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107484.WMF", cAlternateFileName="")) returned 1 [0158.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0158.060] GetProcessHeap () returned 0x4e0000 [0158.060] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0158.060] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0158.060] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0158.060] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.060] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.060] GetProcessHeap () returned 0x4e0000 [0158.060] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0158.060] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0158.060] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.060] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0158.062] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.062] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0158.062] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0158.062] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0158.062] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.062] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.062] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.062] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.062] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xbe0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xbe0, lpOverlapped=0x0) returned 1 [0158.062] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xbe0, dwBufLen=0xbe0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xbe0) returned 1 [0158.062] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.062] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xbe0, lpOverlapped=0x0) returned 1 [0158.063] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.063] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xcb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.063] SetEndOfFile (hFile=0xdc) returned 1 [0158.065] GetProcessHeap () returned 0x4e0000 [0158.065] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0158.065] GetProcessHeap () returned 0x4e0000 [0158.065] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0158.065] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0158.066] CloseHandle (hObject=0xdc) returned 1 [0158.066] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107488.WMF", cAlternateFileName="")) returned 1 [0158.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0158.066] GetProcessHeap () returned 0x4e0000 [0158.066] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0158.066] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0158.066] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0158.066] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.066] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.066] GetProcessHeap () returned 0x4e0000 [0158.066] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0158.066] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0158.066] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.066] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0158.068] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.068] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0158.068] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0158.069] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0158.069] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.069] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.069] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.069] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.069] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1f40, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1f40, lpOverlapped=0x0) returned 1 [0158.070] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1f40, dwBufLen=0x1f40 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1f40) returned 1 [0158.070] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.070] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1f40, lpOverlapped=0x0) returned 1 [0158.070] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.070] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.070] SetEndOfFile (hFile=0xdc) returned 1 [0158.072] GetProcessHeap () returned 0x4e0000 [0158.072] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0158.072] GetProcessHeap () returned 0x4e0000 [0158.072] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0158.072] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0158.073] CloseHandle (hObject=0xdc) returned 1 [0158.073] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4054, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107490.WMF", cAlternateFileName="")) returned 1 [0158.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0158.074] GetProcessHeap () returned 0x4e0000 [0158.074] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0158.074] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0158.074] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0158.074] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0158.076] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.076] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.076] GetProcessHeap () returned 0x4e0000 [0158.076] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0158.076] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0158.076] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.076] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0158.076] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.076] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0158.077] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0158.077] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0158.077] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.077] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.077] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.077] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.077] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4054, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4054, lpOverlapped=0x0) returned 1 [0158.078] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4060, dwBufLen=0x4060 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4060) returned 1 [0158.078] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.078] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4060, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4060, lpOverlapped=0x0) returned 1 [0158.078] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.078] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4134, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.078] SetEndOfFile (hFile=0xdc) returned 1 [0158.080] GetProcessHeap () returned 0x4e0000 [0158.080] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0158.080] GetProcessHeap () returned 0x4e0000 [0158.080] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0158.080] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0158.081] CloseHandle (hObject=0xdc) returned 1 [0158.081] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1acc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107492.WMF", cAlternateFileName="")) returned 1 [0158.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0158.082] GetProcessHeap () returned 0x4e0000 [0158.082] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0158.082] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0158.083] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0158.083] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.084] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.084] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.084] GetProcessHeap () returned 0x4e0000 [0158.084] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0158.084] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0158.085] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.085] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0158.085] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.085] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0158.085] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0158.085] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0158.085] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.085] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.085] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.085] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.085] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1acc, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1acc, lpOverlapped=0x0) returned 1 [0158.087] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1ad0, dwBufLen=0x1ad0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1ad0) returned 1 [0158.087] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.087] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1ad0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1ad0, lpOverlapped=0x0) returned 1 [0158.087] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.087] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1ba4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.087] SetEndOfFile (hFile=0xdc) returned 1 [0158.090] GetProcessHeap () returned 0x4e0000 [0158.090] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0158.090] GetProcessHeap () returned 0x4e0000 [0158.090] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0158.090] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0158.091] CloseHandle (hObject=0xdc) returned 1 [0158.091] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1918, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107494.WMF", cAlternateFileName="")) returned 1 [0158.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0158.092] GetProcessHeap () returned 0x4e0000 [0158.092] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0158.092] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0158.092] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0158.092] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.098] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.098] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.098] GetProcessHeap () returned 0x4e0000 [0158.098] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0158.098] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0158.098] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.098] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0158.098] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.098] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0158.098] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0158.098] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0158.099] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.099] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.099] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.099] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.099] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1918, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1918, lpOverlapped=0x0) returned 1 [0158.100] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1920, dwBufLen=0x1920 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1920) returned 1 [0158.100] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.100] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1920, lpOverlapped=0x0) returned 1 [0158.100] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.100] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x19f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.100] SetEndOfFile (hFile=0xdc) returned 1 [0158.102] GetProcessHeap () returned 0x4e0000 [0158.102] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0158.102] GetProcessHeap () returned 0x4e0000 [0158.102] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0158.102] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0158.103] CloseHandle (hObject=0xdc) returned 1 [0158.103] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x22a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107496.WMF", cAlternateFileName="")) returned 1 [0158.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0158.104] GetProcessHeap () returned 0x4e0000 [0158.104] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0158.104] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0158.104] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0158.104] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.104] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.104] GetProcessHeap () returned 0x4e0000 [0158.104] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0158.104] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0158.104] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.104] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0158.110] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.110] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0158.111] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0158.111] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0158.111] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.111] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.111] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.111] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.111] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x22a0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x22a0, lpOverlapped=0x0) returned 1 [0158.112] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x22a0, dwBufLen=0x22a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x22a0) returned 1 [0158.112] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.112] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x22a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x22a0, lpOverlapped=0x0) returned 1 [0158.112] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.112] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2374, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.112] SetEndOfFile (hFile=0xdc) returned 1 [0158.114] GetProcessHeap () returned 0x4e0000 [0158.114] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0158.114] GetProcessHeap () returned 0x4e0000 [0158.114] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0158.114] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0158.115] CloseHandle (hObject=0xdc) returned 1 [0158.115] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1068, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107500.WMF", cAlternateFileName="")) returned 1 [0158.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0158.116] GetProcessHeap () returned 0x4e0000 [0158.116] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0158.116] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0158.116] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0158.116] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.118] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.118] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.118] GetProcessHeap () returned 0x4e0000 [0158.118] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0158.118] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0158.118] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.118] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0158.118] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.118] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0158.119] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0158.119] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0158.119] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.119] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.119] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.119] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.119] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1068, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1068, lpOverlapped=0x0) returned 1 [0158.120] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1070, dwBufLen=0x1070 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1070) returned 1 [0158.120] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.120] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1070, lpOverlapped=0x0) returned 1 [0158.120] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.120] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1144, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.120] SetEndOfFile (hFile=0xdc) returned 1 [0158.122] GetProcessHeap () returned 0x4e0000 [0158.122] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0158.122] GetProcessHeap () returned 0x4e0000 [0158.122] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0158.122] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0158.123] CloseHandle (hObject=0xdc) returned 1 [0158.123] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2a54, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107502.WMF", cAlternateFileName="")) returned 1 [0158.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0158.124] GetProcessHeap () returned 0x4e0000 [0158.124] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0158.124] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0158.124] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0158.124] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0158.126] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.126] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.126] GetProcessHeap () returned 0x4e0000 [0158.126] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0158.126] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0158.126] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.126] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0158.126] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.126] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0158.126] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0158.126] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0158.126] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.126] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.126] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.126] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.127] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2a54, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2a54, lpOverlapped=0x0) returned 1 [0158.127] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2a60, dwBufLen=0x2a60 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2a60) returned 1 [0158.127] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.127] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2a60, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2a60, lpOverlapped=0x0) returned 1 [0158.128] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.128] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2b34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.128] SetEndOfFile (hFile=0xdc) returned 1 [0158.130] GetProcessHeap () returned 0x4e0000 [0158.130] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0158.130] GetProcessHeap () returned 0x4e0000 [0158.130] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0158.130] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0158.131] CloseHandle (hObject=0xdc) returned 1 [0158.131] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2c8c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107512.WMF", cAlternateFileName="")) returned 1 [0158.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0158.131] GetProcessHeap () returned 0x4e0000 [0158.131] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0158.131] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0158.131] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0158.131] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.133] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.133] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.133] GetProcessHeap () returned 0x4e0000 [0158.133] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0158.133] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0158.133] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.133] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0158.133] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.133] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0158.134] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0158.134] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0158.134] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.134] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.134] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.134] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.134] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2c8c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2c8c, lpOverlapped=0x0) returned 1 [0158.135] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2c90, dwBufLen=0x2c90 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2c90) returned 1 [0158.135] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.135] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2c90, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2c90, lpOverlapped=0x0) returned 1 [0158.135] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.135] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2d64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.135] SetEndOfFile (hFile=0xdc) returned 1 [0158.137] GetProcessHeap () returned 0x4e0000 [0158.137] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0158.137] GetProcessHeap () returned 0x4e0000 [0158.137] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0158.137] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0158.138] CloseHandle (hObject=0xdc) returned 1 [0158.138] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2fac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107514.WMF", cAlternateFileName="")) returned 1 [0158.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0158.139] GetProcessHeap () returned 0x4e0000 [0158.139] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0158.139] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0158.139] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0158.139] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.141] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.141] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.141] GetProcessHeap () returned 0x4e0000 [0158.141] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0158.141] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0158.141] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.141] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0158.141] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.142] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0158.142] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0158.142] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0158.142] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.142] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.142] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.142] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.142] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2fac, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2fac, lpOverlapped=0x0) returned 1 [0158.143] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2fb0, dwBufLen=0x2fb0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2fb0) returned 1 [0158.143] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.143] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2fb0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2fb0, lpOverlapped=0x0) returned 1 [0158.149] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.149] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3084, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.149] SetEndOfFile (hFile=0xdc) returned 1 [0158.152] GetProcessHeap () returned 0x4e0000 [0158.152] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0158.152] GetProcessHeap () returned 0x4e0000 [0158.152] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0158.152] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0158.153] CloseHandle (hObject=0xdc) returned 1 [0158.153] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x36b8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107516.WMF", cAlternateFileName="")) returned 1 [0158.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0158.171] GetProcessHeap () returned 0x4e0000 [0158.171] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0158.171] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0158.171] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0158.171] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.173] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.173] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.173] GetProcessHeap () returned 0x4e0000 [0158.173] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0158.174] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0158.174] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.174] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0158.174] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.174] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0158.174] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0158.174] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0158.174] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.174] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.174] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.174] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.174] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x36b8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x36b8, lpOverlapped=0x0) returned 1 [0158.175] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x36c0, dwBufLen=0x36c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x36c0) returned 1 [0158.175] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.175] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x36c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x36c0, lpOverlapped=0x0) returned 1 [0158.175] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.175] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3794, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.176] SetEndOfFile (hFile=0xdc) returned 1 [0158.178] GetProcessHeap () returned 0x4e0000 [0158.178] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0158.178] GetProcessHeap () returned 0x4e0000 [0158.178] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0158.178] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0158.179] CloseHandle (hObject=0xdc) returned 1 [0158.179] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f0c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107526.WMF", cAlternateFileName="")) returned 1 [0158.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0158.180] GetProcessHeap () returned 0x4e0000 [0158.180] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0158.180] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0158.180] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0158.180] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.182] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.182] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.182] GetProcessHeap () returned 0x4e0000 [0158.182] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0158.182] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0158.182] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.182] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0158.182] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.182] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0158.183] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0158.183] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0158.183] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.183] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.183] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.183] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.183] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1f0c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1f0c, lpOverlapped=0x0) returned 1 [0158.184] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1f10, dwBufLen=0x1f10 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1f10) returned 1 [0158.184] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.184] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1f10, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1f10, lpOverlapped=0x0) returned 1 [0158.184] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.184] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1fe4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.184] SetEndOfFile (hFile=0xdc) returned 1 [0158.186] GetProcessHeap () returned 0x4e0000 [0158.186] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0158.187] GetProcessHeap () returned 0x4e0000 [0158.187] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0158.187] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0158.188] CloseHandle (hObject=0xdc) returned 1 [0158.188] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1a88, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107528.WMF", cAlternateFileName="")) returned 1 [0158.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0158.189] GetProcessHeap () returned 0x4e0000 [0158.189] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0158.189] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0158.189] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0158.189] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.191] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.191] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.191] GetProcessHeap () returned 0x4e0000 [0158.191] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0158.191] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0158.191] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.191] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0158.191] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.191] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0158.191] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0158.192] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0158.192] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.192] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.192] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.192] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.192] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1a88, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1a88, lpOverlapped=0x0) returned 1 [0158.193] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1a90, dwBufLen=0x1a90 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1a90) returned 1 [0158.193] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.193] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1a90, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1a90, lpOverlapped=0x0) returned 1 [0158.193] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.193] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1b64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.193] SetEndOfFile (hFile=0xdc) returned 1 [0158.196] GetProcessHeap () returned 0x4e0000 [0158.196] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0158.196] GetProcessHeap () returned 0x4e0000 [0158.196] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0158.196] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0158.197] CloseHandle (hObject=0xdc) returned 1 [0158.197] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6890, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107544.WMF", cAlternateFileName="")) returned 1 [0158.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0158.197] GetProcessHeap () returned 0x4e0000 [0158.197] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0158.197] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0158.198] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0158.198] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.198] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.198] GetProcessHeap () returned 0x4e0000 [0158.198] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0158.198] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0158.198] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.198] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0158.200] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.200] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0158.200] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0158.200] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0158.200] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.200] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.200] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.200] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.200] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x6890, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x6890, lpOverlapped=0x0) returned 1 [0158.201] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6890, dwBufLen=0x6890 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6890) returned 1 [0158.201] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.201] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6890, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x6890, lpOverlapped=0x0) returned 1 [0158.202] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.202] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6964, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.202] SetEndOfFile (hFile=0xdc) returned 1 [0158.204] GetProcessHeap () returned 0x4e0000 [0158.204] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0158.204] GetProcessHeap () returned 0x4e0000 [0158.204] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0158.204] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0158.205] CloseHandle (hObject=0xdc) returned 1 [0158.205] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ba0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107658.WMF", cAlternateFileName="")) returned 1 [0158.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0158.206] GetProcessHeap () returned 0x4e0000 [0158.206] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0158.206] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0158.206] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0158.206] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.206] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.206] GetProcessHeap () returned 0x4e0000 [0158.206] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0158.206] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0158.206] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.206] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0158.208] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.208] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0158.208] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0158.208] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0158.208] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.208] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.208] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.209] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.209] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1ba0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1ba0, lpOverlapped=0x0) returned 1 [0158.209] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1ba0, dwBufLen=0x1ba0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1ba0) returned 1 [0158.209] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.209] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1ba0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1ba0, lpOverlapped=0x0) returned 1 [0158.210] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.210] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1c74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.210] SetEndOfFile (hFile=0xdc) returned 1 [0158.212] GetProcessHeap () returned 0x4e0000 [0158.212] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0158.212] GetProcessHeap () returned 0x4e0000 [0158.212] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0158.212] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0158.213] CloseHandle (hObject=0xdc) returned 1 [0158.213] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x12c8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107708.WMF", cAlternateFileName="")) returned 1 [0158.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0158.214] GetProcessHeap () returned 0x4e0000 [0158.214] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0158.214] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0158.214] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0158.214] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.216] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.216] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.216] GetProcessHeap () returned 0x4e0000 [0158.216] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0158.216] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0158.216] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.216] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0158.216] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.216] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0158.216] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0158.216] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0158.216] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.216] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.216] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.216] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.216] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x12c8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x12c8, lpOverlapped=0x0) returned 1 [0158.217] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x12d0, dwBufLen=0x12d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x12d0) returned 1 [0158.217] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.217] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x12d0, lpOverlapped=0x0) returned 1 [0158.217] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.217] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x13a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.217] SetEndOfFile (hFile=0xdc) returned 1 [0158.219] GetProcessHeap () returned 0x4e0000 [0158.219] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0158.219] GetProcessHeap () returned 0x4e0000 [0158.219] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0158.219] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0158.220] CloseHandle (hObject=0xdc) returned 1 [0158.220] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x121c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107712.WMF", cAlternateFileName="")) returned 1 [0158.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0158.221] GetProcessHeap () returned 0x4e0000 [0158.221] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0158.221] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0158.221] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0158.221] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.223] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.223] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.223] GetProcessHeap () returned 0x4e0000 [0158.223] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0158.223] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0158.223] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.223] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0158.223] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.223] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0158.223] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0158.223] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0158.223] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.224] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.224] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.224] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.224] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x121c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x121c, lpOverlapped=0x0) returned 1 [0158.224] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1220, dwBufLen=0x1220 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1220) returned 1 [0158.224] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.225] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1220, lpOverlapped=0x0) returned 1 [0158.225] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.225] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x12f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.225] SetEndOfFile (hFile=0xdc) returned 1 [0158.227] GetProcessHeap () returned 0x4e0000 [0158.227] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0158.227] GetProcessHeap () returned 0x4e0000 [0158.227] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0158.227] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0158.228] CloseHandle (hObject=0xdc) returned 1 [0158.228] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xed8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107718.WMF", cAlternateFileName="")) returned 1 [0158.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0158.229] GetProcessHeap () returned 0x4e0000 [0158.229] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0158.229] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0158.229] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0158.229] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.231] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.231] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.231] GetProcessHeap () returned 0x4e0000 [0158.231] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0158.231] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0158.231] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.231] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0158.231] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.231] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0158.231] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0158.231] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0158.231] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.231] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.231] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.231] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.232] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xed8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xed8, lpOverlapped=0x0) returned 1 [0158.232] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xee0, dwBufLen=0xee0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xee0) returned 1 [0158.232] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.232] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xee0, lpOverlapped=0x0) returned 1 [0158.232] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.232] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xfb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.232] SetEndOfFile (hFile=0xdc) returned 1 [0158.234] GetProcessHeap () returned 0x4e0000 [0158.234] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0158.234] GetProcessHeap () returned 0x4e0000 [0158.234] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0158.234] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0158.235] CloseHandle (hObject=0xdc) returned 1 [0158.235] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2044, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107722.WMF", cAlternateFileName="")) returned 1 [0158.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0158.237] GetProcessHeap () returned 0x4e0000 [0158.237] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0158.237] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0158.237] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0158.237] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0158.238] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.238] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.238] GetProcessHeap () returned 0x4e0000 [0158.238] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0158.239] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0158.239] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.239] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0158.239] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.239] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0158.239] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0158.239] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0158.239] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.239] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.239] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.239] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.239] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2044, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2044, lpOverlapped=0x0) returned 1 [0158.240] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2050, dwBufLen=0x2050 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2050) returned 1 [0158.240] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.240] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2050, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2050, lpOverlapped=0x0) returned 1 [0158.240] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.240] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2124, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.240] SetEndOfFile (hFile=0xdc) returned 1 [0158.242] GetProcessHeap () returned 0x4e0000 [0158.243] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0158.243] GetProcessHeap () returned 0x4e0000 [0158.243] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0158.243] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0158.244] CloseHandle (hObject=0xdc) returned 1 [0158.244] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b68, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107724.WMF", cAlternateFileName="")) returned 1 [0158.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0158.244] GetProcessHeap () returned 0x4e0000 [0158.244] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0158.244] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0158.244] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0158.244] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.246] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.246] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.246] GetProcessHeap () returned 0x4e0000 [0158.246] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0158.247] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0158.247] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.247] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0158.247] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.247] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0158.247] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0158.247] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0158.247] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.247] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.247] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.247] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.247] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1b68, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1b68, lpOverlapped=0x0) returned 1 [0158.248] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1b70, dwBufLen=0x1b70 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1b70) returned 1 [0158.248] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.248] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1b70, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1b70, lpOverlapped=0x0) returned 1 [0158.248] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.248] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1c44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.248] SetEndOfFile (hFile=0xdc) returned 1 [0158.251] GetProcessHeap () returned 0x4e0000 [0158.251] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0158.251] GetProcessHeap () returned 0x4e0000 [0158.251] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0158.251] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0158.252] CloseHandle (hObject=0xdc) returned 1 [0158.252] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1574, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107728.WMF", cAlternateFileName="")) returned 1 [0158.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0158.253] GetProcessHeap () returned 0x4e0000 [0158.253] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0158.253] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0158.253] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0158.253] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0158.255] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.255] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.255] GetProcessHeap () returned 0x4e0000 [0158.255] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0158.255] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0158.255] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.255] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0158.255] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.255] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0158.255] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0158.255] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0158.255] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.256] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.256] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.256] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.256] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1574, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1574, lpOverlapped=0x0) returned 1 [0158.257] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1580, dwBufLen=0x1580 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1580) returned 1 [0158.257] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.257] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1580, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1580, lpOverlapped=0x0) returned 1 [0158.257] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.257] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1654, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.257] SetEndOfFile (hFile=0xdc) returned 1 [0158.259] GetProcessHeap () returned 0x4e0000 [0158.259] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0158.259] GetProcessHeap () returned 0x4e0000 [0158.259] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0158.259] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0158.260] CloseHandle (hObject=0xdc) returned 1 [0158.260] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563e0210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbf4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107730.WMF", cAlternateFileName="")) returned 1 [0158.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0158.261] GetProcessHeap () returned 0x4e0000 [0158.261] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0158.261] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0158.261] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0158.261] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0158.263] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.263] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.263] GetProcessHeap () returned 0x4e0000 [0158.263] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0158.263] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0158.263] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.263] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0158.263] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.264] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0158.264] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0158.264] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0158.264] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.264] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.264] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.264] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.264] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xbf4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xbf4, lpOverlapped=0x0) returned 1 [0158.264] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xc00, dwBufLen=0xc00 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xc00) returned 1 [0158.264] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.264] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc00, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xc00, lpOverlapped=0x0) returned 1 [0158.264] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.264] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xcd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.264] SetEndOfFile (hFile=0xdc) returned 1 [0158.266] GetProcessHeap () returned 0x4e0000 [0158.266] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0158.266] GetProcessHeap () returned 0x4e0000 [0158.266] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0158.266] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0158.267] CloseHandle (hObject=0xdc) returned 1 [0158.267] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563e0210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc44, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107734.WMF", cAlternateFileName="")) returned 1 [0158.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0158.268] GetProcessHeap () returned 0x4e0000 [0158.268] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0158.268] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0158.268] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0158.268] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0158.270] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.270] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.270] GetProcessHeap () returned 0x4e0000 [0158.270] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0158.270] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0158.270] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.270] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0158.270] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.270] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0158.270] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0158.270] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0158.271] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.271] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.271] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.271] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.271] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xc44, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xc44, lpOverlapped=0x0) returned 1 [0158.271] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xc50, dwBufLen=0xc50 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xc50) returned 1 [0158.271] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.271] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xc50, lpOverlapped=0x0) returned 1 [0158.271] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.271] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xd24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.271] SetEndOfFile (hFile=0xdc) returned 1 [0158.273] GetProcessHeap () returned 0x4e0000 [0158.273] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0158.273] GetProcessHeap () returned 0x4e0000 [0158.273] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0158.273] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0158.274] CloseHandle (hObject=0xdc) returned 1 [0158.274] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563e0210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe3c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107742.WMF", cAlternateFileName="")) returned 1 [0158.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0158.275] GetProcessHeap () returned 0x4e0000 [0158.275] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0158.275] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0158.275] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0158.275] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.277] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.277] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.277] GetProcessHeap () returned 0x4e0000 [0158.277] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0158.277] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0158.277] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.277] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0158.277] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.277] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0158.277] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0158.277] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0158.277] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.278] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.278] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.278] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.278] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xe3c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xe3c, lpOverlapped=0x0) returned 1 [0158.278] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe40, dwBufLen=0xe40 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe40) returned 1 [0158.278] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.278] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xe40, lpOverlapped=0x0) returned 1 [0158.278] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.278] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xf14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.278] SetEndOfFile (hFile=0xdc) returned 1 [0158.280] GetProcessHeap () returned 0x4e0000 [0158.280] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0158.280] GetProcessHeap () returned 0x4e0000 [0158.280] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0158.280] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0158.281] CloseHandle (hObject=0xdc) returned 1 [0158.281] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x138c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107744.WMF", cAlternateFileName="")) returned 1 [0158.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0158.282] GetProcessHeap () returned 0x4e0000 [0158.282] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0158.282] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0158.282] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0158.283] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.284] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.284] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.284] GetProcessHeap () returned 0x4e0000 [0158.284] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0158.284] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0158.284] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.284] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0158.285] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.285] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0158.285] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0158.285] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0158.285] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.285] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.285] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.285] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.285] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x138c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x138c, lpOverlapped=0x0) returned 1 [0158.287] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1390, dwBufLen=0x1390 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1390) returned 1 [0158.287] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.287] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1390, lpOverlapped=0x0) returned 1 [0158.287] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.287] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.287] SetEndOfFile (hFile=0xdc) returned 1 [0158.289] GetProcessHeap () returned 0x4e0000 [0158.289] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0158.289] GetProcessHeap () returned 0x4e0000 [0158.289] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0158.289] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0158.290] CloseHandle (hObject=0xdc) returned 1 [0158.290] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563e0210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x12b4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107746.WMF", cAlternateFileName="")) returned 1 [0158.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0158.291] GetProcessHeap () returned 0x4e0000 [0158.291] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0158.291] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0158.291] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0158.291] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0158.293] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.293] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.293] GetProcessHeap () returned 0x4e0000 [0158.293] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0158.293] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0158.293] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.293] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0158.293] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.293] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0158.294] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0158.294] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0158.294] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.294] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.294] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.294] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.294] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x12b4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x12b4, lpOverlapped=0x0) returned 1 [0158.295] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x12c0, dwBufLen=0x12c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x12c0) returned 1 [0158.295] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.295] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x12c0, lpOverlapped=0x0) returned 1 [0158.295] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.295] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1394, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.295] SetEndOfFile (hFile=0xdc) returned 1 [0158.297] GetProcessHeap () returned 0x4e0000 [0158.297] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0158.297] GetProcessHeap () returned 0x4e0000 [0158.297] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0158.297] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0158.298] CloseHandle (hObject=0xdc) returned 1 [0158.298] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2020, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107748.WMF", cAlternateFileName="")) returned 1 [0158.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0158.298] GetProcessHeap () returned 0x4e0000 [0158.299] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0158.299] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0158.299] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0158.299] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.299] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.299] GetProcessHeap () returned 0x4e0000 [0158.299] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0158.299] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0158.299] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.299] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0158.301] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.301] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0158.301] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0158.301] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0158.301] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.301] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.301] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.301] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.301] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2020, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2020, lpOverlapped=0x0) returned 1 [0158.302] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2020, dwBufLen=0x2020 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2020) returned 1 [0158.302] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.302] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2020, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2020, lpOverlapped=0x0) returned 1 [0158.302] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.302] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x20f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.302] SetEndOfFile (hFile=0xdc) returned 1 [0158.304] GetProcessHeap () returned 0x4e0000 [0158.304] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0158.304] GetProcessHeap () returned 0x4e0000 [0158.304] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0158.304] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0158.305] CloseHandle (hObject=0xdc) returned 1 [0158.305] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x126c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107750.WMF", cAlternateFileName="")) returned 1 [0158.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0158.306] GetProcessHeap () returned 0x4e0000 [0158.306] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0158.306] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0158.306] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0158.306] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.308] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.308] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.308] GetProcessHeap () returned 0x4e0000 [0158.308] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0158.308] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0158.308] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.308] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0158.308] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.308] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0158.308] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0158.308] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0158.308] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.308] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.308] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.308] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.309] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x126c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x126c, lpOverlapped=0x0) returned 1 [0158.309] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1270, dwBufLen=0x1270 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1270) returned 1 [0158.309] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.309] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1270, lpOverlapped=0x0) returned 1 [0158.310] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.310] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1344, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.310] SetEndOfFile (hFile=0xdc) returned 1 [0158.312] GetProcessHeap () returned 0x4e0000 [0158.312] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0158.312] GetProcessHeap () returned 0x4e0000 [0158.312] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0158.312] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0158.313] CloseHandle (hObject=0xdc) returned 1 [0158.313] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4146, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0136865.WMF", cAlternateFileName="")) returned 1 [0158.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0158.314] GetProcessHeap () returned 0x4e0000 [0158.314] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0158.314] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0158.314] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0158.314] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0158.316] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.316] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.317] GetProcessHeap () returned 0x4e0000 [0158.317] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0158.317] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0158.317] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.317] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0158.317] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.317] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0158.317] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0158.317] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0158.317] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.317] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.317] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.317] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.317] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4146, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4146, lpOverlapped=0x0) returned 1 [0158.318] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4150, dwBufLen=0x4150 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4150) returned 1 [0158.318] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.318] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4150, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4150, lpOverlapped=0x0) returned 1 [0158.319] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.319] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.319] SetEndOfFile (hFile=0xdc) returned 1 [0158.321] GetProcessHeap () returned 0x4e0000 [0158.321] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0158.321] GetProcessHeap () returned 0x4e0000 [0158.321] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0158.321] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0158.322] CloseHandle (hObject=0xdc) returned 1 [0158.322] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55eb4900, ftCreationTime.dwHighDateTime=0x1bdbf6f, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x55eb4900, ftLastWriteTime.dwHighDateTime=0x1bdbf6f, nFileSizeHigh=0x0, nFileSizeLow=0x9d27, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0144773.JPG", cAlternateFileName="")) returned 1 [0158.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0158.323] GetProcessHeap () returned 0x4e0000 [0158.323] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0158.323] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0158.323] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0158.323] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x9, lpOverlapped=0x0) returned 1 [0158.326] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.326] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.326] GetProcessHeap () returned 0x4e0000 [0158.326] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0158.326] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0158.326] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.326] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0158.326] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.326] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0158.326] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0158.326] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0158.326] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.327] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.327] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.327] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.327] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x9d27, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x9d27, lpOverlapped=0x0) returned 1 [0158.328] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9d30, dwBufLen=0x9d30 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9d30) returned 1 [0158.328] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.328] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x9d30, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x9d30, lpOverlapped=0x0) returned 1 [0158.328] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.328] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x9e04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.329] SetEndOfFile (hFile=0xdc) returned 1 [0158.331] GetProcessHeap () returned 0x4e0000 [0158.331] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0158.331] GetProcessHeap () returned 0x4e0000 [0158.331] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0158.331] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0158.332] CloseHandle (hObject=0xdc) returned 1 [0158.332] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8379, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0145168.JPG", cAlternateFileName="")) returned 1 [0158.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0158.332] GetProcessHeap () returned 0x4e0000 [0158.332] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0158.332] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0158.332] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0158.333] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x7, lpOverlapped=0x0) returned 1 [0158.334] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.334] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.334] GetProcessHeap () returned 0x4e0000 [0158.334] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0158.335] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0158.335] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.335] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0158.335] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.335] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0158.335] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0158.335] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0158.335] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.335] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.335] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.335] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.335] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x8379, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x8379, lpOverlapped=0x0) returned 1 [0158.336] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8380, dwBufLen=0x8380 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8380) returned 1 [0158.336] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.337] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x8380, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x8380, lpOverlapped=0x0) returned 1 [0158.337] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.337] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x8454, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.337] SetEndOfFile (hFile=0xdc) returned 1 [0158.339] GetProcessHeap () returned 0x4e0000 [0158.339] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0158.339] GetProcessHeap () returned 0x4e0000 [0158.339] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0158.339] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0158.340] CloseHandle (hObject=0xdc) returned 1 [0158.340] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xf0c1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0145212.JPG", cAlternateFileName="")) returned 1 [0158.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0158.341] GetProcessHeap () returned 0x4e0000 [0158.341] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0158.341] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0158.341] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0158.341] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xf, lpOverlapped=0x0) returned 1 [0158.343] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.343] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.343] GetProcessHeap () returned 0x4e0000 [0158.343] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0158.343] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0158.343] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.343] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0158.343] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.343] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0158.344] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0158.344] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0158.344] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.344] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.344] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.344] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.344] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xf0c1, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xf0c1, lpOverlapped=0x0) returned 1 [0158.345] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xf0d0, dwBufLen=0xf0d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xf0d0) returned 1 [0158.346] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.346] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xf0d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xf0d0, lpOverlapped=0x0) returned 1 [0158.346] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.346] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xf1a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.346] SetEndOfFile (hFile=0xdc) returned 1 [0158.349] GetProcessHeap () returned 0x4e0000 [0158.349] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0158.349] GetProcessHeap () returned 0x4e0000 [0158.349] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0158.349] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0158.349] CloseHandle (hObject=0xdc) returned 1 [0158.350] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc056, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0145272.JPG", cAlternateFileName="")) returned 1 [0158.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0158.350] GetProcessHeap () returned 0x4e0000 [0158.350] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0158.350] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0158.350] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0158.350] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0158.352] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.352] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.352] GetProcessHeap () returned 0x4e0000 [0158.352] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0158.352] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0158.352] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.352] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0158.352] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.353] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0158.353] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0158.353] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0158.353] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.353] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.353] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.353] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.353] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xc056, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xc056, lpOverlapped=0x0) returned 1 [0158.354] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xc060, dwBufLen=0xc060 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xc060) returned 1 [0158.355] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.355] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc060, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xc060, lpOverlapped=0x0) returned 1 [0158.355] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.355] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xc134, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.355] SetEndOfFile (hFile=0xdc) returned 1 [0158.358] GetProcessHeap () returned 0x4e0000 [0158.358] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0158.358] GetProcessHeap () returned 0x4e0000 [0158.358] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0158.358] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0158.359] CloseHandle (hObject=0xdc) returned 1 [0158.359] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5285, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0145361.JPG", cAlternateFileName="")) returned 1 [0158.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0158.359] GetProcessHeap () returned 0x4e0000 [0158.359] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0158.359] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0158.359] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0158.359] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xb, lpOverlapped=0x0) returned 1 [0158.361] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.361] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.361] GetProcessHeap () returned 0x4e0000 [0158.361] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0158.361] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0158.361] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.361] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0158.361] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.362] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0158.362] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0158.362] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0158.362] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.362] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.362] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.362] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.362] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5285, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x5285, lpOverlapped=0x0) returned 1 [0158.363] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5290, dwBufLen=0x5290 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5290) returned 1 [0158.363] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.363] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5290, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5290, lpOverlapped=0x0) returned 1 [0158.363] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.363] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5364, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.363] SetEndOfFile (hFile=0xdc) returned 1 [0158.366] GetProcessHeap () returned 0x4e0000 [0158.366] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0158.366] GetProcessHeap () returned 0x4e0000 [0158.366] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0158.366] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0158.366] CloseHandle (hObject=0xdc) returned 1 [0158.366] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5c5e300, ftCreationTime.dwHighDateTime=0x1bdbf70, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5c5e300, ftLastWriteTime.dwHighDateTime=0x1bdbf70, nFileSizeHigh=0x0, nFileSizeLow=0x45cb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0145373.JPG", cAlternateFileName="")) returned 1 [0158.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0158.367] GetProcessHeap () returned 0x4e0000 [0158.367] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0158.367] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0158.367] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0158.367] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x5, lpOverlapped=0x0) returned 1 [0158.369] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.369] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.369] GetProcessHeap () returned 0x4e0000 [0158.369] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0158.370] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0158.370] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.370] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0158.370] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.370] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0158.370] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0158.370] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0158.370] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.370] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.370] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.370] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.370] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x45cb, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x45cb, lpOverlapped=0x0) returned 1 [0158.371] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x45d0, dwBufLen=0x45d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x45d0) returned 1 [0158.371] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.371] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x45d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x45d0, lpOverlapped=0x0) returned 1 [0158.372] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.372] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x46a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.372] SetEndOfFile (hFile=0xdc) returned 1 [0158.374] GetProcessHeap () returned 0x4e0000 [0158.374] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0158.374] GetProcessHeap () returned 0x4e0000 [0158.374] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0158.374] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0158.375] CloseHandle (hObject=0xdc) returned 1 [0158.375] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17a35900, ftCreationTime.dwHighDateTime=0x1bdbf72, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17a35900, ftLastWriteTime.dwHighDateTime=0x1bdbf72, nFileSizeHigh=0x0, nFileSizeLow=0x7c6a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0145669.JPG", cAlternateFileName="")) returned 1 [0158.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0158.375] GetProcessHeap () returned 0x4e0000 [0158.375] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0158.375] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0158.375] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0158.375] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0158.377] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.377] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.377] GetProcessHeap () returned 0x4e0000 [0158.377] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0158.377] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0158.377] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.377] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0158.377] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.377] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0158.377] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0158.378] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0158.378] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.378] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.378] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.378] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.378] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7c6a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7c6a, lpOverlapped=0x0) returned 1 [0158.379] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7c70, dwBufLen=0x7c70 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7c70) returned 1 [0158.379] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.379] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7c70, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7c70, lpOverlapped=0x0) returned 1 [0158.379] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.379] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7d44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.379] SetEndOfFile (hFile=0xdc) returned 1 [0158.382] GetProcessHeap () returned 0x4e0000 [0158.382] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0158.382] GetProcessHeap () returned 0x4e0000 [0158.382] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0158.382] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0158.383] CloseHandle (hObject=0xdc) returned 1 [0158.383] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a05b300, ftCreationTime.dwHighDateTime=0x1bdbf72, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1a05b300, ftLastWriteTime.dwHighDateTime=0x1bdbf72, nFileSizeHigh=0x0, nFileSizeLow=0x8fd4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0145707.JPG", cAlternateFileName="")) returned 1 [0158.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0158.383] GetProcessHeap () returned 0x4e0000 [0158.383] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0158.383] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0158.383] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0158.383] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0158.385] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.385] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.385] GetProcessHeap () returned 0x4e0000 [0158.385] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0158.385] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0158.385] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.385] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0158.386] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.386] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0158.386] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0158.386] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0158.386] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.386] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.386] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.386] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.386] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x8fd4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x8fd4, lpOverlapped=0x0) returned 1 [0158.387] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8fe0, dwBufLen=0x8fe0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8fe0) returned 1 [0158.388] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.388] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x8fe0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x8fe0, lpOverlapped=0x0) returned 1 [0158.388] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.388] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x90b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.388] SetEndOfFile (hFile=0xdc) returned 1 [0158.390] GetProcessHeap () returned 0x4e0000 [0158.391] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0158.391] GetProcessHeap () returned 0x4e0000 [0158.391] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0158.391] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0158.392] CloseHandle (hObject=0xdc) returned 1 [0158.392] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50dbc900, ftCreationTime.dwHighDateTime=0x1bdbf72, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50dbc900, ftLastWriteTime.dwHighDateTime=0x1bdbf72, nFileSizeHigh=0x0, nFileSizeLow=0x8fb8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0145810.JPG", cAlternateFileName="")) returned 1 [0158.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0158.394] GetProcessHeap () returned 0x4e0000 [0158.394] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0158.394] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0158.394] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0158.394] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.396] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.396] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.396] GetProcessHeap () returned 0x4e0000 [0158.396] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0158.396] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0158.396] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.396] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0158.396] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.396] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0158.396] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0158.396] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0158.396] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.396] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.396] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.396] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.397] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x8fb8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x8fb8, lpOverlapped=0x0) returned 1 [0158.398] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8fc0, dwBufLen=0x8fc0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8fc0) returned 1 [0158.398] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.398] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x8fc0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x8fc0, lpOverlapped=0x0) returned 1 [0158.398] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.398] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x9094, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.398] SetEndOfFile (hFile=0xdc) returned 1 [0158.427] GetProcessHeap () returned 0x4e0000 [0158.427] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0158.427] GetProcessHeap () returned 0x4e0000 [0158.427] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0158.427] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0158.429] CloseHandle (hObject=0xdc) returned 1 [0158.429] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5d84e00, ftCreationTime.dwHighDateTime=0x1c026b6, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5d84e00, ftLastWriteTime.dwHighDateTime=0x1c026b6, nFileSizeHigh=0x0, nFileSizeLow=0x8a5b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0145879.JPG", cAlternateFileName="")) returned 1 [0158.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0158.430] GetProcessHeap () returned 0x4e0000 [0158.430] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0158.430] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0158.430] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0158.430] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x5, lpOverlapped=0x0) returned 1 [0158.482] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.482] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.482] GetProcessHeap () returned 0x4e0000 [0158.482] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0158.482] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0158.483] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.483] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0158.483] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.483] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0158.483] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0158.483] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0158.483] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.483] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.483] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.483] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.483] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x8a5b, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x8a5b, lpOverlapped=0x0) returned 1 [0158.485] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8a60, dwBufLen=0x8a60 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8a60) returned 1 [0158.485] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.485] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x8a60, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x8a60, lpOverlapped=0x0) returned 1 [0158.486] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.486] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x8b34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.486] SetEndOfFile (hFile=0xdc) returned 1 [0158.488] GetProcessHeap () returned 0x4e0000 [0158.488] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0158.488] GetProcessHeap () returned 0x4e0000 [0158.488] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0158.489] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0158.490] CloseHandle (hObject=0xdc) returned 1 [0158.490] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7962500, ftCreationTime.dwHighDateTime=0x1c03d89, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7962500, ftLastWriteTime.dwHighDateTime=0x1c03d89, nFileSizeHigh=0x0, nFileSizeLow=0x84a6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0145895.JPG", cAlternateFileName="")) returned 1 [0158.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0158.490] GetProcessHeap () returned 0x4e0000 [0158.490] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0158.490] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0158.491] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0158.491] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0158.492] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.493] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.493] GetProcessHeap () returned 0x4e0000 [0158.493] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0158.493] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0158.493] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.493] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0158.493] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.493] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0158.493] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0158.493] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0158.493] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.493] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.493] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.493] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.493] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x84a6, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x84a6, lpOverlapped=0x0) returned 1 [0158.494] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x84b0, dwBufLen=0x84b0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x84b0) returned 1 [0158.495] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.495] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x84b0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x84b0, lpOverlapped=0x0) returned 1 [0158.495] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.495] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x8584, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.495] SetEndOfFile (hFile=0xdc) returned 1 [0158.497] GetProcessHeap () returned 0x4e0000 [0158.497] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0158.497] GetProcessHeap () returned 0x4e0000 [0158.497] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0158.498] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0158.501] CloseHandle (hObject=0xdc) returned 1 [0158.501] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa912cb00, ftCreationTime.dwHighDateTime=0x1bdbf72, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa912cb00, ftLastWriteTime.dwHighDateTime=0x1bdbf72, nFileSizeHigh=0x0, nFileSizeLow=0x9a76, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0145904.JPG", cAlternateFileName="")) returned 1 [0158.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0158.501] GetProcessHeap () returned 0x4e0000 [0158.501] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0158.501] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0158.502] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0158.502] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0158.504] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.504] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.504] GetProcessHeap () returned 0x4e0000 [0158.504] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0158.504] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0158.504] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.504] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0158.504] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.504] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0158.504] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0158.505] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0158.505] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.505] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.505] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.505] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.505] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x9a76, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x9a76, lpOverlapped=0x0) returned 1 [0158.506] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9a80, dwBufLen=0x9a80 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9a80) returned 1 [0158.507] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.507] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x9a80, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x9a80, lpOverlapped=0x0) returned 1 [0158.507] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.507] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x9b54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.507] SetEndOfFile (hFile=0xdc) returned 1 [0158.510] GetProcessHeap () returned 0x4e0000 [0158.510] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0158.510] GetProcessHeap () returned 0x4e0000 [0158.510] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0158.510] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0158.512] CloseHandle (hObject=0xdc) returned 1 [0158.512] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb5ac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0146142.JPG", cAlternateFileName="")) returned 1 [0158.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0158.513] GetProcessHeap () returned 0x4e0000 [0158.513] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0158.513] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0158.513] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0158.513] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.515] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.515] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.515] GetProcessHeap () returned 0x4e0000 [0158.515] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0158.515] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0158.515] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.515] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0158.516] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.516] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0158.516] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0158.516] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0158.516] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.516] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.516] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.516] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.516] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb5ac, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xb5ac, lpOverlapped=0x0) returned 1 [0158.518] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xb5b0, dwBufLen=0xb5b0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xb5b0) returned 1 [0158.518] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.518] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xb5b0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xb5b0, lpOverlapped=0x0) returned 1 [0158.519] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.519] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xb684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.519] SetEndOfFile (hFile=0xdc) returned 1 [0158.522] GetProcessHeap () returned 0x4e0000 [0158.522] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0158.522] GetProcessHeap () returned 0x4e0000 [0158.522] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0158.522] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0158.523] CloseHandle (hObject=0xdc) returned 1 [0158.523] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaa9a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0148309.JPG", cAlternateFileName="")) returned 1 [0158.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0158.524] GetProcessHeap () returned 0x4e0000 [0158.524] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0158.524] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0158.524] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0158.524] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0158.528] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.528] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.528] GetProcessHeap () returned 0x4e0000 [0158.528] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0158.529] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0158.529] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.529] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0158.529] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.529] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0158.529] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0158.529] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0158.529] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.529] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.529] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.529] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.529] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xaa9a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xaa9a, lpOverlapped=0x0) returned 1 [0158.531] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xaaa0, dwBufLen=0xaaa0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xaaa0) returned 1 [0158.532] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.532] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xaaa0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xaaa0, lpOverlapped=0x0) returned 1 [0158.532] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.532] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xab74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.532] SetEndOfFile (hFile=0xdc) returned 1 [0158.535] GetProcessHeap () returned 0x4e0000 [0158.535] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0158.535] GetProcessHeap () returned 0x4e0000 [0158.535] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0158.535] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0158.536] CloseHandle (hObject=0xdc) returned 1 [0158.536] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x107d4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0148757.JPG", cAlternateFileName="")) returned 1 [0158.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0158.537] GetProcessHeap () returned 0x4e0000 [0158.537] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0158.537] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0158.537] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0158.537] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0158.540] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.540] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.540] GetProcessHeap () returned 0x4e0000 [0158.540] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0158.540] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0158.540] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.540] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0158.540] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.540] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0158.540] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0158.540] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0158.540] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.541] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.541] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.541] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.541] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x107d4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x107d4, lpOverlapped=0x0) returned 1 [0158.542] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x107e0, dwBufLen=0x107e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x107e0) returned 1 [0158.543] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.544] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x107e0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x107e0, lpOverlapped=0x0) returned 1 [0158.544] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.544] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x108b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.544] SetEndOfFile (hFile=0xdc) returned 1 [0158.547] GetProcessHeap () returned 0x4e0000 [0158.547] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0158.547] GetProcessHeap () returned 0x4e0000 [0158.547] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0158.547] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0158.549] CloseHandle (hObject=0xdc) returned 1 [0158.549] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x955d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0148798.JPG", cAlternateFileName="")) returned 1 [0158.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0158.549] GetProcessHeap () returned 0x4e0000 [0158.549] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0158.549] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0158.549] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0158.550] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x3, lpOverlapped=0x0) returned 1 [0158.552] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.552] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.552] GetProcessHeap () returned 0x4e0000 [0158.552] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0158.552] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0158.552] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.552] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0158.552] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.552] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0158.553] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0158.553] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0158.553] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.553] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.553] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.553] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.553] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x955d, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x955d, lpOverlapped=0x0) returned 1 [0158.554] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9560, dwBufLen=0x9560 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9560) returned 1 [0158.555] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.555] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x9560, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x9560, lpOverlapped=0x0) returned 1 [0158.555] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.555] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x9634, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.555] SetEndOfFile (hFile=0xdc) returned 1 [0158.558] GetProcessHeap () returned 0x4e0000 [0158.558] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0158.558] GetProcessHeap () returned 0x4e0000 [0158.558] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0158.558] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0158.560] CloseHandle (hObject=0xdc) returned 1 [0158.560] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6b01, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0149018.JPG", cAlternateFileName="")) returned 1 [0158.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0158.561] GetProcessHeap () returned 0x4e0000 [0158.561] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0158.561] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0158.561] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0158.562] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xf, lpOverlapped=0x0) returned 1 [0158.579] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.579] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.579] GetProcessHeap () returned 0x4e0000 [0158.579] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0158.579] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0158.579] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.579] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0158.579] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.580] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0158.580] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0158.580] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0158.580] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.580] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.580] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.580] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.580] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x6b01, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x6b01, lpOverlapped=0x0) returned 1 [0158.581] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6b10, dwBufLen=0x6b10 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6b10) returned 1 [0158.582] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.582] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6b10, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x6b10, lpOverlapped=0x0) returned 1 [0158.582] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.582] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6be4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.582] SetEndOfFile (hFile=0xdc) returned 1 [0158.585] GetProcessHeap () returned 0x4e0000 [0158.585] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0158.585] GetProcessHeap () returned 0x4e0000 [0158.585] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0158.585] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0158.586] CloseHandle (hObject=0xdc) returned 1 [0158.587] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xfd22, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0149118.JPG", cAlternateFileName="")) returned 1 [0158.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0158.590] GetProcessHeap () returned 0x4e0000 [0158.590] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0158.590] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0158.590] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0158.590] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0158.592] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.592] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.592] GetProcessHeap () returned 0x4e0000 [0158.592] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0158.593] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0158.593] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.593] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0158.593] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.593] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0158.593] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0158.593] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0158.593] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.593] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.593] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.593] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.593] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xfd22, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xfd22, lpOverlapped=0x0) returned 1 [0158.595] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xfd30, dwBufLen=0xfd30 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xfd30) returned 1 [0158.596] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.596] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xfd30, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xfd30, lpOverlapped=0x0) returned 1 [0158.596] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.597] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xfe04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.597] SetEndOfFile (hFile=0xdc) returned 1 [0158.600] GetProcessHeap () returned 0x4e0000 [0158.600] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0158.600] GetProcessHeap () returned 0x4e0000 [0158.600] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0158.600] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0158.601] CloseHandle (hObject=0xdc) returned 1 [0158.601] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb544, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0150150.WMF", cAlternateFileName="")) returned 1 [0158.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150150.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0158.602] GetProcessHeap () returned 0x4e0000 [0158.602] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0158.602] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0158.602] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0158.602] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0158.604] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.605] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.605] GetProcessHeap () returned 0x4e0000 [0158.605] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0158.605] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0158.605] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.605] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0158.605] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.605] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0158.605] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0158.605] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0158.605] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.606] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.606] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.606] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.606] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb544, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xb544, lpOverlapped=0x0) returned 1 [0158.607] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xb550, dwBufLen=0xb550 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xb550) returned 1 [0158.608] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.608] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xb550, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xb550, lpOverlapped=0x0) returned 1 [0158.608] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.608] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xb624, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.608] SetEndOfFile (hFile=0xdc) returned 1 [0158.611] GetProcessHeap () returned 0x4e0000 [0158.611] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0158.611] GetProcessHeap () returned 0x4e0000 [0158.611] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0158.611] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150150.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150150.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0158.613] CloseHandle (hObject=0xdc) returned 1 [0158.613] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x212e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0150861.WMF", cAlternateFileName="")) returned 1 [0158.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150861.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0158.614] GetProcessHeap () returned 0x4e0000 [0158.614] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0158.614] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0158.614] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0158.614] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0158.616] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.616] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.616] GetProcessHeap () returned 0x4e0000 [0158.616] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0158.616] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0158.616] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.616] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0158.616] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.617] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0158.617] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0158.617] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0158.617] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.617] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.617] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.617] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.617] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x212e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x212e, lpOverlapped=0x0) returned 1 [0158.618] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2130, dwBufLen=0x2130 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2130) returned 1 [0158.618] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.618] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2130, lpOverlapped=0x0) returned 1 [0158.618] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.619] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.619] SetEndOfFile (hFile=0xdc) returned 1 [0158.621] GetProcessHeap () returned 0x4e0000 [0158.621] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0158.622] GetProcessHeap () returned 0x4e0000 [0158.622] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0158.622] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150861.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150861.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0158.623] CloseHandle (hObject=0xdc) returned 1 [0158.623] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1104, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0151041.WMF", cAlternateFileName="")) returned 1 [0158.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151041.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0158.624] GetProcessHeap () returned 0x4e0000 [0158.624] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0158.625] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0158.625] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0158.625] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0158.627] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.627] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.627] GetProcessHeap () returned 0x4e0000 [0158.627] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0158.627] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0158.627] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.627] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0158.627] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.627] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0158.627] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0158.628] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0158.628] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.628] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.628] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.628] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.628] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1104, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1104, lpOverlapped=0x0) returned 1 [0158.629] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1110, dwBufLen=0x1110 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1110) returned 1 [0158.629] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.629] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1110, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1110, lpOverlapped=0x0) returned 1 [0158.629] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.629] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x11e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.629] SetEndOfFile (hFile=0xdc) returned 1 [0158.632] GetProcessHeap () returned 0x4e0000 [0158.632] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0158.632] GetProcessHeap () returned 0x4e0000 [0158.632] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0158.632] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151041.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151041.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0158.633] CloseHandle (hObject=0xdc) returned 1 [0158.633] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3c68, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0151045.WMF", cAlternateFileName="")) returned 1 [0158.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151045.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0158.634] GetProcessHeap () returned 0x4e0000 [0158.634] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0158.634] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0158.634] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0158.634] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.636] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.637] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.637] GetProcessHeap () returned 0x4e0000 [0158.637] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0158.637] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0158.637] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.637] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0158.637] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.637] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0158.637] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0158.637] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0158.637] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.637] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.637] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.637] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.637] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3c68, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3c68, lpOverlapped=0x0) returned 1 [0158.638] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3c70, dwBufLen=0x3c70 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3c70) returned 1 [0158.639] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.639] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3c70, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3c70, lpOverlapped=0x0) returned 1 [0158.639] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.639] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3d44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.639] SetEndOfFile (hFile=0xdc) returned 1 [0158.642] GetProcessHeap () returned 0x4e0000 [0158.642] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0158.642] GetProcessHeap () returned 0x4e0000 [0158.642] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0158.642] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151045.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151045.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0158.643] CloseHandle (hObject=0xdc) returned 1 [0158.643] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4844, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0151047.WMF", cAlternateFileName="")) returned 1 [0158.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151047.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0158.644] GetProcessHeap () returned 0x4e0000 [0158.644] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0158.644] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0158.644] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0158.644] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0158.646] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.646] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.646] GetProcessHeap () returned 0x4e0000 [0158.646] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0158.646] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0158.646] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.646] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0158.646] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.647] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0158.647] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0158.647] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0158.647] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.647] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.647] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.647] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.647] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4844, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4844, lpOverlapped=0x0) returned 1 [0158.648] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4850, dwBufLen=0x4850 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4850) returned 1 [0158.648] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.648] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4850, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4850, lpOverlapped=0x0) returned 1 [0158.649] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.649] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4924, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.649] SetEndOfFile (hFile=0xdc) returned 1 [0158.651] GetProcessHeap () returned 0x4e0000 [0158.651] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0158.651] GetProcessHeap () returned 0x4e0000 [0158.651] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0158.652] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151047.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151047.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0158.678] CloseHandle (hObject=0xdc) returned 1 [0158.678] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3928, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0151055.WMF", cAlternateFileName="")) returned 1 [0158.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151055.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0158.681] GetProcessHeap () returned 0x4e0000 [0158.681] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0158.681] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0158.681] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0158.681] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.684] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.684] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.684] GetProcessHeap () returned 0x4e0000 [0158.684] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0158.684] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0158.684] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.684] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0158.684] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.684] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0158.684] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0158.684] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0158.684] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.685] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.685] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.685] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.685] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3928, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3928, lpOverlapped=0x0) returned 1 [0158.686] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3930, dwBufLen=0x3930 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3930) returned 1 [0158.686] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.686] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3930, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3930, lpOverlapped=0x0) returned 1 [0158.686] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.686] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3a04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.686] SetEndOfFile (hFile=0xdc) returned 1 [0158.689] GetProcessHeap () returned 0x4e0000 [0158.689] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0158.689] GetProcessHeap () returned 0x4e0000 [0158.690] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0158.690] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151055.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151055.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0158.691] CloseHandle (hObject=0xdc) returned 1 [0158.691] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1a60, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0151061.WMF", cAlternateFileName="")) returned 1 [0158.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151061.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0158.692] GetProcessHeap () returned 0x4e0000 [0158.692] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0158.692] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0158.692] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0158.693] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.693] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.693] GetProcessHeap () returned 0x4e0000 [0158.693] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0158.693] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0158.693] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.693] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0158.696] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.696] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0158.696] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0158.696] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0158.696] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.696] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.696] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.696] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.696] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1a60, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1a60, lpOverlapped=0x0) returned 1 [0158.697] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1a60, dwBufLen=0x1a60 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1a60) returned 1 [0158.697] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.697] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1a60, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1a60, lpOverlapped=0x0) returned 1 [0158.698] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.698] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1b34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.698] SetEndOfFile (hFile=0xdc) returned 1 [0158.701] GetProcessHeap () returned 0x4e0000 [0158.701] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0158.701] GetProcessHeap () returned 0x4e0000 [0158.701] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0158.701] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151061.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151061.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0158.702] CloseHandle (hObject=0xdc) returned 1 [0158.702] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2988, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0151063.WMF", cAlternateFileName="")) returned 1 [0158.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151063.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0158.703] GetProcessHeap () returned 0x4e0000 [0158.703] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0158.703] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0158.703] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0158.703] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.851] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.851] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.851] GetProcessHeap () returned 0x4e0000 [0158.851] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0158.852] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0158.852] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.852] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0158.852] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.852] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0158.852] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0158.852] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0158.852] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.852] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.852] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.852] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.852] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2988, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2988, lpOverlapped=0x0) returned 1 [0158.853] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2990, dwBufLen=0x2990 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2990) returned 1 [0158.854] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.854] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2990, lpOverlapped=0x0) returned 1 [0158.854] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.854] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2a64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.854] SetEndOfFile (hFile=0xdc) returned 1 [0158.857] GetProcessHeap () returned 0x4e0000 [0158.857] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0158.857] GetProcessHeap () returned 0x4e0000 [0158.857] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0158.857] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151063.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151063.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0158.858] CloseHandle (hObject=0xdc) returned 1 [0158.858] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3394, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0151067.WMF", cAlternateFileName="")) returned 1 [0158.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151067.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0158.859] GetProcessHeap () returned 0x4e0000 [0158.859] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0158.859] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0158.859] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0158.859] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0158.862] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.862] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.862] GetProcessHeap () returned 0x4e0000 [0158.862] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0158.862] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0158.862] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.862] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0158.862] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.862] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0158.862] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0158.862] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0158.862] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.863] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.863] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.863] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.863] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3394, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3394, lpOverlapped=0x0) returned 1 [0158.864] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x33a0, dwBufLen=0x33a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x33a0) returned 1 [0158.864] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.864] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x33a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x33a0, lpOverlapped=0x0) returned 1 [0158.865] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.865] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.865] SetEndOfFile (hFile=0xdc) returned 1 [0158.867] GetProcessHeap () returned 0x4e0000 [0158.867] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0158.867] GetProcessHeap () returned 0x4e0000 [0158.868] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0158.868] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151067.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151067.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0158.869] CloseHandle (hObject=0xdc) returned 1 [0158.869] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3418, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0151073.WMF", cAlternateFileName="")) returned 1 [0158.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151073.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0158.870] GetProcessHeap () returned 0x4e0000 [0158.870] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0158.870] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0158.870] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0158.870] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.874] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.874] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.874] GetProcessHeap () returned 0x4e0000 [0158.874] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0158.874] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0158.874] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.874] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0158.875] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.875] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0158.875] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0158.875] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0158.875] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.875] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.875] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.875] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.875] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3418, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3418, lpOverlapped=0x0) returned 1 [0158.876] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3420, dwBufLen=0x3420 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3420) returned 1 [0158.877] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.877] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3420, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3420, lpOverlapped=0x0) returned 1 [0158.877] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.877] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x34f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.877] SetEndOfFile (hFile=0xdc) returned 1 [0158.880] GetProcessHeap () returned 0x4e0000 [0158.880] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0158.880] GetProcessHeap () returned 0x4e0000 [0158.880] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0158.880] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151073.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151073.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0158.881] CloseHandle (hObject=0xdc) returned 1 [0158.881] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0151581.WMF", cAlternateFileName="")) returned 1 [0158.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151581.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0158.883] GetProcessHeap () returned 0x4e0000 [0158.883] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0158.883] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0158.883] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0158.883] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.883] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.883] GetProcessHeap () returned 0x4e0000 [0158.883] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0158.883] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0158.883] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.883] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0158.969] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.969] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0158.969] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0158.969] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0158.970] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.970] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.970] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.970] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.970] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2a00, lpOverlapped=0x0) returned 1 [0158.971] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2a00, dwBufLen=0x2a00 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2a00) returned 1 [0158.971] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.971] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2a00, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2a00, lpOverlapped=0x0) returned 1 [0158.971] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.971] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2ad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.971] SetEndOfFile (hFile=0xdc) returned 1 [0158.974] GetProcessHeap () returned 0x4e0000 [0158.974] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0158.974] GetProcessHeap () returned 0x4e0000 [0158.974] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0158.974] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151581.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151581.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0158.976] CloseHandle (hObject=0xdc) returned 1 [0158.976] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x610c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152414.WMF", cAlternateFileName="")) returned 1 [0158.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152414.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0158.977] GetProcessHeap () returned 0x4e0000 [0158.977] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0158.977] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0158.977] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0158.977] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.979] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.979] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.979] GetProcessHeap () returned 0x4e0000 [0158.979] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0158.980] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0158.980] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.980] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0158.980] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.980] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0158.980] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0158.980] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0158.980] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.980] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.980] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.980] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.981] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x610c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x610c, lpOverlapped=0x0) returned 1 [0158.982] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6110, dwBufLen=0x6110 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6110) returned 1 [0158.982] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.982] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6110, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x6110, lpOverlapped=0x0) returned 1 [0158.982] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.982] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x61e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.982] SetEndOfFile (hFile=0xdc) returned 1 [0158.985] GetProcessHeap () returned 0x4e0000 [0158.985] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0158.985] GetProcessHeap () returned 0x4e0000 [0158.985] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0158.985] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152414.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152414.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0158.987] CloseHandle (hObject=0xdc) returned 1 [0158.987] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3734, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152430.WMF", cAlternateFileName="")) returned 1 [0158.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0158.988] GetProcessHeap () returned 0x4e0000 [0158.988] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0158.988] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0158.988] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0158.988] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0158.991] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.991] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.991] GetProcessHeap () returned 0x4e0000 [0158.991] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0158.991] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0158.991] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.991] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0158.991] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0158.991] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0158.992] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0158.992] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0158.992] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0158.992] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0158.992] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0158.992] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.992] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3734, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3734, lpOverlapped=0x0) returned 1 [0158.993] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3740, dwBufLen=0x3740 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3740) returned 1 [0158.993] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.993] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3740, lpOverlapped=0x0) returned 1 [0158.994] CryptDestroyKey (hKey=0x522f98) returned 1 [0158.994] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.994] SetEndOfFile (hFile=0xdc) returned 1 [0158.997] GetProcessHeap () returned 0x4e0000 [0158.997] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0158.997] GetProcessHeap () returned 0x4e0000 [0158.997] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0158.997] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0158.998] CloseHandle (hObject=0xdc) returned 1 [0158.999] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x406c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152432.WMF", cAlternateFileName="")) returned 1 [0158.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152432.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0158.999] GetProcessHeap () returned 0x4e0000 [0158.999] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0158.999] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0159.000] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0159.000] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0159.002] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0159.002] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0159.002] GetProcessHeap () returned 0x4e0000 [0159.002] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0159.002] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0159.002] CryptDestroyKey (hKey=0x522f98) returned 1 [0159.002] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0159.002] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0159.002] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0159.002] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0159.003] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0159.003] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0159.003] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0159.003] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0159.003] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.003] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x406c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x406c, lpOverlapped=0x0) returned 1 [0159.004] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4070, dwBufLen=0x4070 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4070) returned 1 [0159.004] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.004] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4070, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4070, lpOverlapped=0x0) returned 1 [0159.005] CryptDestroyKey (hKey=0x522f98) returned 1 [0159.005] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4144, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.005] SetEndOfFile (hFile=0xdc) returned 1 [0159.007] GetProcessHeap () returned 0x4e0000 [0159.007] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0159.007] GetProcessHeap () returned 0x4e0000 [0159.008] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0159.008] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152432.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152432.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0159.009] CloseHandle (hObject=0xdc) returned 1 [0159.009] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2c4c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152436.WMF", cAlternateFileName="")) returned 1 [0159.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152436.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0159.010] GetProcessHeap () returned 0x4e0000 [0159.010] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0159.010] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0159.010] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0159.010] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0159.012] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0159.012] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0159.012] GetProcessHeap () returned 0x4e0000 [0159.012] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0159.012] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0159.012] CryptDestroyKey (hKey=0x522f98) returned 1 [0159.013] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0159.013] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0159.013] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0159.013] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0159.013] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0159.013] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0159.013] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0159.013] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0159.013] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.013] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2c4c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2c4c, lpOverlapped=0x0) returned 1 [0159.014] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2c50, dwBufLen=0x2c50 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2c50) returned 1 [0159.014] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.015] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2c50, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2c50, lpOverlapped=0x0) returned 1 [0159.015] CryptDestroyKey (hKey=0x522f98) returned 1 [0159.015] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2d24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.015] SetEndOfFile (hFile=0xdc) returned 1 [0159.017] GetProcessHeap () returned 0x4e0000 [0159.018] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0159.018] GetProcessHeap () returned 0x4e0000 [0159.018] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0159.018] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152436.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152436.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0159.019] CloseHandle (hObject=0xdc) returned 1 [0159.019] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4030, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152556.WMF", cAlternateFileName="")) returned 1 [0159.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152556.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0159.019] GetProcessHeap () returned 0x4e0000 [0159.020] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0159.020] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0159.020] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0159.020] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0159.020] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0159.020] GetProcessHeap () returned 0x4e0000 [0159.020] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0159.020] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0159.020] CryptDestroyKey (hKey=0x522f98) returned 1 [0159.020] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0159.023] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0159.023] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0159.023] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0159.023] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0159.023] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0159.023] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0159.023] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0159.023] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.023] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4030, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4030, lpOverlapped=0x0) returned 1 [0159.024] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4030, dwBufLen=0x4030 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4030) returned 1 [0159.025] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.025] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4030, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4030, lpOverlapped=0x0) returned 1 [0159.025] CryptDestroyKey (hKey=0x522f98) returned 1 [0159.025] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4104, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.025] SetEndOfFile (hFile=0xdc) returned 1 [0159.028] GetProcessHeap () returned 0x4e0000 [0159.028] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0159.028] GetProcessHeap () returned 0x4e0000 [0159.028] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0159.028] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152556.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152556.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0159.029] CloseHandle (hObject=0xdc) returned 1 [0159.029] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3eb4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152558.WMF", cAlternateFileName="")) returned 1 [0159.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152558.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0159.030] GetProcessHeap () returned 0x4e0000 [0159.030] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0159.030] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0159.030] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0159.030] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0159.084] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0159.084] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0159.084] GetProcessHeap () returned 0x4e0000 [0159.084] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0159.085] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0159.085] CryptDestroyKey (hKey=0x522f98) returned 1 [0159.085] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0159.085] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0159.085] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0159.085] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0159.085] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0159.085] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0159.085] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0159.085] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0159.085] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.085] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3eb4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3eb4, lpOverlapped=0x0) returned 1 [0159.087] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3ec0, dwBufLen=0x3ec0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3ec0) returned 1 [0159.087] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.087] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3ec0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3ec0, lpOverlapped=0x0) returned 1 [0159.087] CryptDestroyKey (hKey=0x522f98) returned 1 [0159.087] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3f94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.087] SetEndOfFile (hFile=0xdc) returned 1 [0159.090] GetProcessHeap () returned 0x4e0000 [0159.090] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0159.090] GetProcessHeap () returned 0x4e0000 [0159.090] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0159.090] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152558.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152558.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0159.092] CloseHandle (hObject=0xdc) returned 1 [0159.092] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2a80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152560.WMF", cAlternateFileName="")) returned 1 [0159.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152560.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0159.093] GetProcessHeap () returned 0x4e0000 [0159.093] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0159.093] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0159.093] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0159.093] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0159.093] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0159.093] GetProcessHeap () returned 0x4e0000 [0159.093] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0159.093] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0159.093] CryptDestroyKey (hKey=0x522f98) returned 1 [0159.093] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0159.097] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0159.097] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0159.097] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0159.097] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0159.097] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0159.097] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0159.097] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0159.097] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.097] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2a80, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2a80, lpOverlapped=0x0) returned 1 [0159.099] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2a80, dwBufLen=0x2a80 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2a80) returned 1 [0159.099] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.099] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2a80, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2a80, lpOverlapped=0x0) returned 1 [0159.099] CryptDestroyKey (hKey=0x522f98) returned 1 [0159.099] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2b54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.099] SetEndOfFile (hFile=0xdc) returned 1 [0159.102] GetProcessHeap () returned 0x4e0000 [0159.102] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0159.102] GetProcessHeap () returned 0x4e0000 [0159.102] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0159.102] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152560.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152560.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0159.103] CloseHandle (hObject=0xdc) returned 1 [0159.103] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe70, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152568.WMF", cAlternateFileName="")) returned 1 [0159.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152568.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0159.105] GetProcessHeap () returned 0x4e0000 [0159.105] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0159.105] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0159.105] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0159.105] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0159.105] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0159.106] GetProcessHeap () returned 0x4e0000 [0159.106] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0159.106] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0159.106] CryptDestroyKey (hKey=0x522f98) returned 1 [0159.106] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0159.110] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0159.110] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0159.110] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0159.110] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0159.110] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0159.110] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0159.111] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0159.111] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.111] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xe70, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xe70, lpOverlapped=0x0) returned 1 [0159.111] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe70, dwBufLen=0xe70 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe70) returned 1 [0159.111] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.111] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xe70, lpOverlapped=0x0) returned 1 [0159.111] CryptDestroyKey (hKey=0x522f98) returned 1 [0159.111] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xf44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.111] SetEndOfFile (hFile=0xdc) returned 1 [0159.114] GetProcessHeap () returned 0x4e0000 [0159.114] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0159.114] GetProcessHeap () returned 0x4e0000 [0159.114] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0159.114] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152568.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152568.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0159.115] CloseHandle (hObject=0xdc) returned 1 [0159.115] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd28, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152570.WMF", cAlternateFileName="")) returned 1 [0159.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152570.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0159.117] GetProcessHeap () returned 0x4e0000 [0159.117] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0159.117] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0159.117] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0159.117] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0159.131] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0159.131] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0159.131] GetProcessHeap () returned 0x4e0000 [0159.131] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0159.132] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0159.132] CryptDestroyKey (hKey=0x522f98) returned 1 [0159.132] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0159.132] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0159.132] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0159.132] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0159.132] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0159.132] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0159.132] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0159.132] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0159.132] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.132] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xd28, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xd28, lpOverlapped=0x0) returned 1 [0159.132] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xd30, dwBufLen=0xd30 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xd30) returned 1 [0159.133] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.133] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xd30, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xd30, lpOverlapped=0x0) returned 1 [0159.133] CryptDestroyKey (hKey=0x522f98) returned 1 [0159.133] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xe04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.133] SetEndOfFile (hFile=0xdc) returned 1 [0159.136] GetProcessHeap () returned 0x4e0000 [0159.136] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0159.136] GetProcessHeap () returned 0x4e0000 [0159.136] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0159.136] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152570.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152570.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0159.137] CloseHandle (hObject=0xdc) returned 1 [0159.137] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2ab4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152590.WMF", cAlternateFileName="")) returned 1 [0159.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152590.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0159.138] GetProcessHeap () returned 0x4e0000 [0159.138] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0159.138] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0159.138] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0159.138] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0159.147] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0159.147] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0159.147] GetProcessHeap () returned 0x4e0000 [0159.147] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0159.147] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0159.147] CryptDestroyKey (hKey=0x522f98) returned 1 [0159.147] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0159.148] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0159.148] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0159.148] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0159.148] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0159.148] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0159.148] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0159.148] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0159.148] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.148] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2ab4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2ab4, lpOverlapped=0x0) returned 1 [0159.149] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2ac0, dwBufLen=0x2ac0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2ac0) returned 1 [0159.150] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.150] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2ac0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2ac0, lpOverlapped=0x0) returned 1 [0159.150] CryptDestroyKey (hKey=0x522f98) returned 1 [0159.150] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2b94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.150] SetEndOfFile (hFile=0xdc) returned 1 [0159.153] GetProcessHeap () returned 0x4e0000 [0159.153] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0159.153] GetProcessHeap () returned 0x4e0000 [0159.153] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0159.153] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152590.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152590.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0159.154] CloseHandle (hObject=0xdc) returned 1 [0159.154] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x18c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152594.WMF", cAlternateFileName="")) returned 1 [0159.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152594.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0159.155] GetProcessHeap () returned 0x4e0000 [0159.155] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0159.155] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0159.155] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0159.155] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0159.171] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0159.171] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0159.171] GetProcessHeap () returned 0x4e0000 [0159.171] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0159.171] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0159.171] CryptDestroyKey (hKey=0x522f98) returned 1 [0159.171] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0159.171] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0159.172] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0159.172] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0159.172] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0159.172] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0159.172] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0159.172] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0159.172] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.172] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x18c4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x18c4, lpOverlapped=0x0) returned 1 [0159.175] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x18d0, dwBufLen=0x18d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x18d0) returned 1 [0159.175] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.175] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x18d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x18d0, lpOverlapped=0x0) returned 1 [0159.175] CryptDestroyKey (hKey=0x522f98) returned 1 [0159.175] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x19a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.175] SetEndOfFile (hFile=0xdc) returned 1 [0159.177] GetProcessHeap () returned 0x4e0000 [0159.178] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0159.178] GetProcessHeap () returned 0x4e0000 [0159.178] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0159.178] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152594.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152594.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0159.179] CloseHandle (hObject=0xdc) returned 1 [0159.179] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2628, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152600.WMF", cAlternateFileName="")) returned 1 [0159.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152600.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0159.180] GetProcessHeap () returned 0x4e0000 [0159.180] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0159.180] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0159.180] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0159.180] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0159.189] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0159.189] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0159.189] GetProcessHeap () returned 0x4e0000 [0159.189] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0159.189] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0159.189] CryptDestroyKey (hKey=0x522f98) returned 1 [0159.189] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0159.190] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0159.190] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0159.190] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0159.190] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0159.190] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0159.190] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0159.190] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0159.190] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.190] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2628, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2628, lpOverlapped=0x0) returned 1 [0159.216] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2630, dwBufLen=0x2630 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2630) returned 1 [0159.216] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.216] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2630, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2630, lpOverlapped=0x0) returned 1 [0159.216] CryptDestroyKey (hKey=0x522f98) returned 1 [0159.217] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2704, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.217] SetEndOfFile (hFile=0xdc) returned 1 [0159.219] GetProcessHeap () returned 0x4e0000 [0159.219] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0159.219] GetProcessHeap () returned 0x4e0000 [0159.219] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0159.219] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152600.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152600.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0159.220] CloseHandle (hObject=0xdc) returned 1 [0159.225] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1884, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152602.WMF", cAlternateFileName="")) returned 1 [0159.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152602.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0159.226] GetProcessHeap () returned 0x4e0000 [0159.226] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0159.226] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0159.226] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0159.226] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0159.239] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0159.239] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0159.239] GetProcessHeap () returned 0x4e0000 [0159.239] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0159.239] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0159.239] CryptDestroyKey (hKey=0x522f98) returned 1 [0159.239] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0159.239] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0159.239] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0159.239] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0159.239] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0159.239] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0159.240] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0159.240] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0159.240] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.240] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1884, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1884, lpOverlapped=0x0) returned 1 [0159.241] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1890, dwBufLen=0x1890 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1890) returned 1 [0159.241] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.241] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1890, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1890, lpOverlapped=0x0) returned 1 [0159.241] CryptDestroyKey (hKey=0x522f98) returned 1 [0159.241] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1964, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.241] SetEndOfFile (hFile=0xdc) returned 1 [0159.243] GetProcessHeap () returned 0x4e0000 [0159.243] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0159.243] GetProcessHeap () returned 0x4e0000 [0159.244] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0159.244] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152602.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152602.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0159.245] CloseHandle (hObject=0xdc) returned 1 [0159.245] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56452630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x40f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152606.WMF", cAlternateFileName="")) returned 1 [0159.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152606.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0159.246] GetProcessHeap () returned 0x4e0000 [0159.246] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0159.246] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0159.246] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0159.247] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0159.302] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0159.302] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0159.302] GetProcessHeap () returned 0x4e0000 [0159.303] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0159.303] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0159.303] CryptDestroyKey (hKey=0x522f98) returned 1 [0159.303] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0159.303] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0159.303] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0159.303] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0159.303] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0159.303] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0159.303] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0159.303] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0159.303] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.303] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40f8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x40f8, lpOverlapped=0x0) returned 1 [0159.305] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4100, dwBufLen=0x4100 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4100) returned 1 [0159.305] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.306] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4100, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4100, lpOverlapped=0x0) returned 1 [0159.306] CryptDestroyKey (hKey=0x522f98) returned 1 [0159.306] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x41d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.306] SetEndOfFile (hFile=0xdc) returned 1 [0159.308] GetProcessHeap () returned 0x4e0000 [0159.308] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0159.308] GetProcessHeap () returned 0x4e0000 [0159.308] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0159.308] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152606.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152606.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0159.309] CloseHandle (hObject=0xdc) returned 1 [0159.309] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3094, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152608.WMF", cAlternateFileName="")) returned 1 [0159.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152608.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0159.310] GetProcessHeap () returned 0x4e0000 [0159.310] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0159.310] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0159.310] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0159.310] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0159.420] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0159.420] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0159.420] GetProcessHeap () returned 0x4e0000 [0159.420] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0159.420] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0159.420] CryptDestroyKey (hKey=0x522f98) returned 1 [0159.421] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0159.421] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0159.421] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0159.421] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0159.421] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0159.421] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0159.421] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0159.421] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0159.421] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.421] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3094, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3094, lpOverlapped=0x0) returned 1 [0159.609] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x30a0, dwBufLen=0x30a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x30a0) returned 1 [0159.609] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.609] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x30a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x30a0, lpOverlapped=0x0) returned 1 [0159.609] CryptDestroyKey (hKey=0x522f98) returned 1 [0159.610] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3174, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.610] SetEndOfFile (hFile=0xdc) returned 1 [0159.612] GetProcessHeap () returned 0x4e0000 [0159.612] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0159.612] GetProcessHeap () returned 0x4e0000 [0159.612] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0159.612] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152608.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152608.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0159.613] CloseHandle (hObject=0xdc) returned 1 [0159.613] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1748, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152610.WMF", cAlternateFileName="")) returned 1 [0159.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152610.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0159.614] GetProcessHeap () returned 0x4e0000 [0159.614] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0159.614] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0159.614] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0159.614] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0159.621] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0159.621] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0159.621] GetProcessHeap () returned 0x4e0000 [0159.621] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0159.621] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0159.621] CryptDestroyKey (hKey=0x522f98) returned 1 [0159.621] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0159.622] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0159.622] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0159.622] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0159.622] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0159.622] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0159.622] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0159.622] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0159.622] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.622] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1748, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1748, lpOverlapped=0x0) returned 1 [0159.635] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1750, dwBufLen=0x1750 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1750) returned 1 [0159.635] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.635] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1750, lpOverlapped=0x0) returned 1 [0159.635] CryptDestroyKey (hKey=0x522f98) returned 1 [0159.635] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1824, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.635] SetEndOfFile (hFile=0xdc) returned 1 [0159.638] GetProcessHeap () returned 0x4e0000 [0159.638] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0159.638] GetProcessHeap () returned 0x4e0000 [0159.638] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0159.638] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152610.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152610.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0159.639] CloseHandle (hObject=0xdc) returned 1 [0159.640] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2584, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152622.WMF", cAlternateFileName="")) returned 1 [0159.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152622.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0159.641] GetProcessHeap () returned 0x4e0000 [0159.641] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0159.641] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0159.641] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0159.641] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0159.650] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0159.650] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0159.650] GetProcessHeap () returned 0x4e0000 [0159.650] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0159.650] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0159.650] CryptDestroyKey (hKey=0x522f98) returned 1 [0159.650] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0159.650] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0159.650] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0159.650] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0159.651] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0159.651] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0159.651] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0159.651] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0159.651] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.651] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2584, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2584, lpOverlapped=0x0) returned 1 [0159.679] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2590, dwBufLen=0x2590 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2590) returned 1 [0159.679] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.679] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2590, lpOverlapped=0x0) returned 1 [0159.679] CryptDestroyKey (hKey=0x522f98) returned 1 [0159.679] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2664, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.679] SetEndOfFile (hFile=0xdc) returned 1 [0159.682] GetProcessHeap () returned 0x4e0000 [0159.682] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0159.682] GetProcessHeap () returned 0x4e0000 [0159.682] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0159.683] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152622.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152622.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0159.684] CloseHandle (hObject=0xdc) returned 1 [0159.684] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56452630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6688, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152626.WMF", cAlternateFileName="")) returned 1 [0159.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152626.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0159.685] GetProcessHeap () returned 0x4e0000 [0159.685] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0159.685] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0159.685] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0159.685] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0159.709] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0159.709] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0159.709] GetProcessHeap () returned 0x4e0000 [0159.709] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0159.709] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0159.709] CryptDestroyKey (hKey=0x522f98) returned 1 [0159.709] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0159.709] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0159.709] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0159.709] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0159.709] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0159.709] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0159.710] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0159.710] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0159.710] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.710] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x6688, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x6688, lpOverlapped=0x0) returned 1 [0159.720] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6690, dwBufLen=0x6690 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6690) returned 1 [0159.720] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.720] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6690, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x6690, lpOverlapped=0x0) returned 1 [0159.720] CryptDestroyKey (hKey=0x522f98) returned 1 [0159.720] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6764, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.721] SetEndOfFile (hFile=0xdc) returned 1 [0159.723] GetProcessHeap () returned 0x4e0000 [0159.723] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0159.724] GetProcessHeap () returned 0x4e0000 [0159.724] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0159.724] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152626.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152626.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0159.725] CloseHandle (hObject=0xdc) returned 1 [0159.725] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56452630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x785c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152628.WMF", cAlternateFileName="")) returned 1 [0159.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152628.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0159.726] GetProcessHeap () returned 0x4e0000 [0159.726] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0159.726] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0159.726] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0159.726] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0159.729] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0159.729] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0159.729] GetProcessHeap () returned 0x4e0000 [0159.729] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0159.729] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0159.730] CryptDestroyKey (hKey=0x522f98) returned 1 [0159.730] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0159.730] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0159.730] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0159.730] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0159.730] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0159.730] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0159.730] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0159.730] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0159.730] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.730] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x785c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x785c, lpOverlapped=0x0) returned 1 [0159.770] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7860, dwBufLen=0x7860 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7860) returned 1 [0159.771] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.771] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7860, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7860, lpOverlapped=0x0) returned 1 [0159.771] CryptDestroyKey (hKey=0x522f98) returned 1 [0159.771] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7934, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.771] SetEndOfFile (hFile=0xdc) returned 1 [0159.774] GetProcessHeap () returned 0x4e0000 [0159.774] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0159.774] GetProcessHeap () returned 0x4e0000 [0159.774] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0159.774] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152628.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152628.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0159.776] CloseHandle (hObject=0xdc) returned 1 [0159.776] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8774, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152688.WMF", cAlternateFileName="")) returned 1 [0159.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152688.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0159.777] GetProcessHeap () returned 0x4e0000 [0159.777] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0159.777] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0159.777] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0159.777] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0159.780] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0159.780] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0159.780] GetProcessHeap () returned 0x4e0000 [0159.780] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0159.781] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0159.781] CryptDestroyKey (hKey=0x522f98) returned 1 [0159.781] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0159.781] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0159.781] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0159.781] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0159.781] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0159.782] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0159.783] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0159.783] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0159.783] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.783] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x8774, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x8774, lpOverlapped=0x0) returned 1 [0159.792] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8780, dwBufLen=0x8780 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8780) returned 1 [0159.793] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.793] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x8780, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x8780, lpOverlapped=0x0) returned 1 [0159.793] CryptDestroyKey (hKey=0x522f98) returned 1 [0159.793] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x8854, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.793] SetEndOfFile (hFile=0xdc) returned 1 [0159.796] GetProcessHeap () returned 0x4e0000 [0159.796] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0159.796] GetProcessHeap () returned 0x4e0000 [0159.796] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0159.796] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152688.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152688.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0159.798] CloseHandle (hObject=0xdc) returned 1 [0159.798] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4f4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152690.WMF", cAlternateFileName="")) returned 1 [0159.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152690.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0159.799] GetProcessHeap () returned 0x4e0000 [0159.799] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0159.799] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0159.799] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0159.799] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0159.802] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0159.802] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0159.802] GetProcessHeap () returned 0x4e0000 [0159.802] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0159.802] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0159.802] CryptDestroyKey (hKey=0x522f98) returned 1 [0159.802] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0159.802] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0159.802] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0159.802] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0159.802] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0159.802] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0159.802] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0159.803] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0159.803] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.803] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4f4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4f4, lpOverlapped=0x0) returned 1 [0159.803] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x500, dwBufLen=0x500 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x500) returned 1 [0159.803] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.803] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x500, lpOverlapped=0x0) returned 1 [0159.803] CryptDestroyKey (hKey=0x522f98) returned 1 [0159.803] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.803] SetEndOfFile (hFile=0xdc) returned 1 [0159.806] GetProcessHeap () returned 0x4e0000 [0159.807] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0159.807] GetProcessHeap () returned 0x4e0000 [0159.807] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0159.807] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152690.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152690.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0159.808] CloseHandle (hObject=0xdc) returned 1 [0159.808] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x544, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152694.WMF", cAlternateFileName="")) returned 1 [0159.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152694.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0159.809] GetProcessHeap () returned 0x4e0000 [0159.809] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0159.809] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0159.809] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0159.809] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0159.826] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0159.826] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0159.826] GetProcessHeap () returned 0x4e0000 [0159.826] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0159.826] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0159.826] CryptDestroyKey (hKey=0x522f98) returned 1 [0159.826] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0159.826] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0159.826] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0159.826] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0159.826] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0159.826] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0159.827] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0159.827] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0159.827] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.827] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x544, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x544, lpOverlapped=0x0) returned 1 [0159.827] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x550, dwBufLen=0x550 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x550) returned 1 [0159.827] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.827] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x550, lpOverlapped=0x0) returned 1 [0159.827] CryptDestroyKey (hKey=0x522f98) returned 1 [0159.827] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x624, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.827] SetEndOfFile (hFile=0xdc) returned 1 [0159.830] GetProcessHeap () returned 0x4e0000 [0159.830] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0159.830] GetProcessHeap () returned 0x4e0000 [0159.830] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0159.830] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152694.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152694.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0159.832] CloseHandle (hObject=0xdc) returned 1 [0159.832] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1c98, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152696.WMF", cAlternateFileName="")) returned 1 [0159.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0159.834] GetProcessHeap () returned 0x4e0000 [0159.834] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0159.834] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0159.834] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0159.835] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0159.929] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0159.929] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0159.929] GetProcessHeap () returned 0x4e0000 [0159.929] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0159.929] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0159.929] CryptDestroyKey (hKey=0x522f98) returned 1 [0159.929] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0159.929] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0159.929] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0159.929] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0159.929] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0159.930] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0159.930] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0159.930] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0159.930] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.930] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1c98, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1c98, lpOverlapped=0x0) returned 1 [0159.931] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1ca0, dwBufLen=0x1ca0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1ca0) returned 1 [0159.931] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.931] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1ca0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1ca0, lpOverlapped=0x0) returned 1 [0159.931] CryptDestroyKey (hKey=0x522f98) returned 1 [0159.931] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1d74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.931] SetEndOfFile (hFile=0xdc) returned 1 [0159.934] GetProcessHeap () returned 0x4e0000 [0159.934] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0159.934] GetProcessHeap () returned 0x4e0000 [0159.934] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0159.934] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0159.936] CloseHandle (hObject=0xdc) returned 1 [0159.936] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56452630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152698.WMF", cAlternateFileName="")) returned 1 [0159.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0159.937] GetProcessHeap () returned 0x4e0000 [0159.937] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0159.937] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0159.937] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0159.937] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0159.940] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0159.940] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0159.940] GetProcessHeap () returned 0x4e0000 [0159.940] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0159.940] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0159.940] CryptDestroyKey (hKey=0x522f98) returned 1 [0159.940] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0159.940] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0159.940] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0159.940] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0159.940] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0159.941] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0159.941] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0159.941] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0159.941] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.941] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4b8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4b8, lpOverlapped=0x0) returned 1 [0159.941] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4c0, dwBufLen=0x4c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4c0) returned 1 [0159.941] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.941] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4c0, lpOverlapped=0x0) returned 1 [0159.941] CryptDestroyKey (hKey=0x522f98) returned 1 [0159.941] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x594, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.941] SetEndOfFile (hFile=0xdc) returned 1 [0159.944] GetProcessHeap () returned 0x4e0000 [0159.944] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0159.944] GetProcessHeap () returned 0x4e0000 [0159.944] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0159.944] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0159.945] CloseHandle (hObject=0xdc) returned 1 [0159.945] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56452630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152702.WMF", cAlternateFileName="")) returned 1 [0159.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0159.947] GetProcessHeap () returned 0x4e0000 [0159.947] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0159.947] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0159.947] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0159.947] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0159.949] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0159.949] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0159.949] GetProcessHeap () returned 0x4e0000 [0159.949] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0159.950] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0159.950] CryptDestroyKey (hKey=0x522f98) returned 1 [0159.950] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0159.950] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0159.950] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0159.950] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0159.950] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0159.950] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0159.950] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0159.950] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0159.950] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.950] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4b8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4b8, lpOverlapped=0x0) returned 1 [0159.950] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4c0, dwBufLen=0x4c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4c0) returned 1 [0159.950] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.951] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4c0, lpOverlapped=0x0) returned 1 [0159.951] CryptDestroyKey (hKey=0x522f98) returned 1 [0159.951] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x594, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.951] SetEndOfFile (hFile=0xdc) returned 1 [0159.954] GetProcessHeap () returned 0x4e0000 [0159.954] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0159.954] GetProcessHeap () returned 0x4e0000 [0159.954] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0159.954] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0159.955] CloseHandle (hObject=0xdc) returned 1 [0159.955] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x674, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152704.WMF", cAlternateFileName="")) returned 1 [0159.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0159.956] GetProcessHeap () returned 0x4e0000 [0159.956] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0159.956] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0159.956] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0159.956] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0159.958] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0159.958] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0159.958] GetProcessHeap () returned 0x4e0000 [0159.958] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0159.958] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0159.958] CryptDestroyKey (hKey=0x522f98) returned 1 [0159.958] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0159.959] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0159.959] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0159.959] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0159.959] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0159.959] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0159.959] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0159.959] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0159.959] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.959] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x674, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x674, lpOverlapped=0x0) returned 1 [0159.959] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x680, dwBufLen=0x680 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x680) returned 1 [0159.959] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.959] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x680, lpOverlapped=0x0) returned 1 [0159.960] CryptDestroyKey (hKey=0x522f98) returned 1 [0159.960] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x754, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.960] SetEndOfFile (hFile=0xdc) returned 1 [0159.962] GetProcessHeap () returned 0x4e0000 [0159.963] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0159.963] GetProcessHeap () returned 0x4e0000 [0159.963] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0159.963] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0159.964] CloseHandle (hObject=0xdc) returned 1 [0159.964] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x132c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152708.WMF", cAlternateFileName="")) returned 1 [0159.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0159.965] GetProcessHeap () returned 0x4e0000 [0159.965] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0159.965] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0159.965] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0159.965] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0159.968] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0159.969] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0159.969] GetProcessHeap () returned 0x4e0000 [0159.969] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0159.969] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0159.969] CryptDestroyKey (hKey=0x522f98) returned 1 [0159.969] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0159.969] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0159.969] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0159.969] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0159.969] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0159.969] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0159.969] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0159.969] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0159.969] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.970] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x132c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x132c, lpOverlapped=0x0) returned 1 [0159.970] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1330, dwBufLen=0x1330 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1330) returned 1 [0159.970] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.971] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1330, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1330, lpOverlapped=0x0) returned 1 [0159.971] CryptDestroyKey (hKey=0x522f98) returned 1 [0159.971] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1404, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.971] SetEndOfFile (hFile=0xdc) returned 1 [0159.973] GetProcessHeap () returned 0x4e0000 [0159.973] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0159.973] GetProcessHeap () returned 0x4e0000 [0159.973] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0159.974] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0159.975] CloseHandle (hObject=0xdc) returned 1 [0159.975] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56452630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x11e4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152716.WMF", cAlternateFileName="")) returned 1 [0159.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0159.976] GetProcessHeap () returned 0x4e0000 [0159.976] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0159.976] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0159.976] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0159.976] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0159.978] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0159.978] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0159.978] GetProcessHeap () returned 0x4e0000 [0159.979] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0159.979] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0159.979] CryptDestroyKey (hKey=0x522f98) returned 1 [0159.979] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0159.979] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0159.979] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0159.979] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0159.979] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0159.979] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0159.979] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0159.979] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0159.979] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.979] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x11e4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x11e4, lpOverlapped=0x0) returned 1 [0159.980] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x11f0, dwBufLen=0x11f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x11f0) returned 1 [0159.981] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.981] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x11f0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x11f0, lpOverlapped=0x0) returned 1 [0159.981] CryptDestroyKey (hKey=0x522f98) returned 1 [0159.981] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x12c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.981] SetEndOfFile (hFile=0xdc) returned 1 [0159.984] GetProcessHeap () returned 0x4e0000 [0159.984] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0159.984] GetProcessHeap () returned 0x4e0000 [0159.984] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0159.984] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0159.985] CloseHandle (hObject=0xdc) returned 1 [0159.985] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b6c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152722.WMF", cAlternateFileName="")) returned 1 [0159.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0159.987] GetProcessHeap () returned 0x4e0000 [0159.987] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0159.987] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0159.987] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0159.987] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0159.989] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0159.989] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0159.989] GetProcessHeap () returned 0x4e0000 [0159.989] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0159.990] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0159.990] CryptDestroyKey (hKey=0x522f98) returned 1 [0159.990] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0159.990] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0159.990] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0159.990] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0159.990] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0159.990] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0159.990] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0159.990] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0159.990] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.990] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1b6c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1b6c, lpOverlapped=0x0) returned 1 [0159.991] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1b70, dwBufLen=0x1b70 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1b70) returned 1 [0159.991] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.991] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1b70, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1b70, lpOverlapped=0x0) returned 1 [0159.992] CryptDestroyKey (hKey=0x522f98) returned 1 [0159.992] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1c44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.992] SetEndOfFile (hFile=0xdc) returned 1 [0159.994] GetProcessHeap () returned 0x4e0000 [0159.994] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0159.994] GetProcessHeap () returned 0x4e0000 [0159.995] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0159.995] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0159.996] CloseHandle (hObject=0xdc) returned 1 [0159.996] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ec4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152876.WMF", cAlternateFileName="")) returned 1 [0159.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0159.998] GetProcessHeap () returned 0x4e0000 [0159.998] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0159.998] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0159.998] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0159.998] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0160.003] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.003] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.003] GetProcessHeap () returned 0x4e0000 [0160.003] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0160.003] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0160.003] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.003] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0160.003] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0160.003] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0160.003] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0160.003] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0160.003] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0160.003] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.003] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.004] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.004] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1ec4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1ec4, lpOverlapped=0x0) returned 1 [0160.004] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1ed0, dwBufLen=0x1ed0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1ed0) returned 1 [0160.005] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.005] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1ed0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1ed0, lpOverlapped=0x0) returned 1 [0160.005] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.005] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1fa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.005] SetEndOfFile (hFile=0xdc) returned 1 [0160.008] GetProcessHeap () returned 0x4e0000 [0160.008] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0160.008] GetProcessHeap () returned 0x4e0000 [0160.008] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0160.008] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0160.010] CloseHandle (hObject=0xdc) returned 1 [0160.010] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3a28, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152878.WMF", cAlternateFileName="")) returned 1 [0160.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0160.011] GetProcessHeap () returned 0x4e0000 [0160.011] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0160.011] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0160.011] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0160.011] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0160.013] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.013] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.013] GetProcessHeap () returned 0x4e0000 [0160.013] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0160.013] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0160.013] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.013] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0160.013] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0160.013] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0160.013] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0160.014] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0160.014] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0160.014] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.014] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.014] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.014] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3a28, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3a28, lpOverlapped=0x0) returned 1 [0160.015] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3a30, dwBufLen=0x3a30 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3a30) returned 1 [0160.015] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.015] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3a30, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3a30, lpOverlapped=0x0) returned 1 [0160.015] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.015] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3b04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.015] SetEndOfFile (hFile=0xdc) returned 1 [0160.018] GetProcessHeap () returned 0x4e0000 [0160.018] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0160.018] GetProcessHeap () returned 0x4e0000 [0160.018] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0160.018] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0160.019] CloseHandle (hObject=0xdc) returned 1 [0160.020] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2370, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152882.WMF", cAlternateFileName="")) returned 1 [0160.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0160.020] GetProcessHeap () returned 0x4e0000 [0160.020] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0160.020] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0160.020] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0160.021] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.021] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.021] GetProcessHeap () returned 0x4e0000 [0160.021] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0160.021] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0160.021] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.021] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0160.023] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0160.023] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0160.023] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0160.023] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0160.023] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0160.023] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.023] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.023] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.023] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2370, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2370, lpOverlapped=0x0) returned 1 [0160.024] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2370, dwBufLen=0x2370 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2370) returned 1 [0160.025] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.025] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2370, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2370, lpOverlapped=0x0) returned 1 [0160.025] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.025] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2444, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.025] SetEndOfFile (hFile=0xdc) returned 1 [0160.027] GetProcessHeap () returned 0x4e0000 [0160.027] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0160.028] GetProcessHeap () returned 0x4e0000 [0160.028] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0160.028] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0160.029] CloseHandle (hObject=0xdc) returned 1 [0160.029] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b2c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152884.WMF", cAlternateFileName="")) returned 1 [0160.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0160.030] GetProcessHeap () returned 0x4e0000 [0160.030] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0160.030] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0160.030] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0160.030] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0160.033] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.033] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.033] GetProcessHeap () returned 0x4e0000 [0160.033] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0160.034] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0160.034] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.034] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0160.034] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0160.034] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0160.034] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0160.034] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0160.034] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0160.034] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.034] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.034] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.034] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1b2c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1b2c, lpOverlapped=0x0) returned 1 [0160.036] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1b30, dwBufLen=0x1b30 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1b30) returned 1 [0160.036] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.036] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1b30, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1b30, lpOverlapped=0x0) returned 1 [0160.036] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.036] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1c04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.036] SetEndOfFile (hFile=0xdc) returned 1 [0160.039] GetProcessHeap () returned 0x4e0000 [0160.039] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0160.039] GetProcessHeap () returned 0x4e0000 [0160.039] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0160.039] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0160.042] CloseHandle (hObject=0xdc) returned 1 [0160.042] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x794, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152890.WMF", cAlternateFileName="")) returned 1 [0160.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0160.045] GetProcessHeap () returned 0x4e0000 [0160.045] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0160.045] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0160.045] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0160.045] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0160.048] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.048] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.048] GetProcessHeap () returned 0x4e0000 [0160.049] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0160.049] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0160.049] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.049] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0160.049] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0160.049] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0160.049] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0160.049] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0160.049] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0160.049] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.049] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.049] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.049] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x794, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x794, lpOverlapped=0x0) returned 1 [0160.050] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7a0, dwBufLen=0x7a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7a0) returned 1 [0160.050] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.050] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7a0, lpOverlapped=0x0) returned 1 [0160.050] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.050] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x874, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.050] SetEndOfFile (hFile=0xdc) returned 1 [0160.052] GetProcessHeap () returned 0x4e0000 [0160.052] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0160.053] GetProcessHeap () returned 0x4e0000 [0160.053] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0160.053] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0160.054] CloseHandle (hObject=0xdc) returned 1 [0160.054] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56452630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x29ac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152892.WMF", cAlternateFileName="")) returned 1 [0160.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0160.055] GetProcessHeap () returned 0x4e0000 [0160.055] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0160.055] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0160.055] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0160.055] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0160.165] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.165] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.165] GetProcessHeap () returned 0x4e0000 [0160.165] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0160.165] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0160.165] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.165] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0160.165] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0160.166] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0160.166] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0160.166] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0160.166] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0160.166] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.166] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.166] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.166] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x29ac, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x29ac, lpOverlapped=0x0) returned 1 [0160.167] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x29b0, dwBufLen=0x29b0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x29b0) returned 1 [0160.167] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.167] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x29b0, lpOverlapped=0x0) returned 1 [0160.168] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.168] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2a84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.168] SetEndOfFile (hFile=0xdc) returned 1 [0160.170] GetProcessHeap () returned 0x4e0000 [0160.171] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0160.171] GetProcessHeap () returned 0x4e0000 [0160.171] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0160.171] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0160.172] CloseHandle (hObject=0xdc) returned 1 [0160.172] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2c54, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152894.WMF", cAlternateFileName="")) returned 1 [0160.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0160.173] GetProcessHeap () returned 0x4e0000 [0160.173] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0160.173] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0160.173] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0160.173] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0160.176] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.176] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.176] GetProcessHeap () returned 0x4e0000 [0160.176] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0160.176] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0160.176] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.176] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0160.176] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0160.176] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0160.176] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0160.176] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0160.177] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0160.177] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.177] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.177] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.177] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2c54, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2c54, lpOverlapped=0x0) returned 1 [0160.178] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2c60, dwBufLen=0x2c60 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2c60) returned 1 [0160.178] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.178] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2c60, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2c60, lpOverlapped=0x0) returned 1 [0160.178] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.178] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2d34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.178] SetEndOfFile (hFile=0xdc) returned 1 [0160.181] GetProcessHeap () returned 0x4e0000 [0160.181] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0160.181] GetProcessHeap () returned 0x4e0000 [0160.181] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0160.182] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0160.183] CloseHandle (hObject=0xdc) returned 1 [0160.183] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1190, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152898.WMF", cAlternateFileName="")) returned 1 [0160.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0160.184] GetProcessHeap () returned 0x4e0000 [0160.184] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0160.184] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0160.184] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0160.184] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.184] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.184] GetProcessHeap () returned 0x4e0000 [0160.184] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0160.184] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0160.184] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.184] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0160.189] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0160.189] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0160.189] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0160.189] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0160.189] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0160.189] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.189] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.189] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.189] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1190, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1190, lpOverlapped=0x0) returned 1 [0160.190] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1190, dwBufLen=0x1190 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1190) returned 1 [0160.190] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.190] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1190, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1190, lpOverlapped=0x0) returned 1 [0160.191] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.191] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1264, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.191] SetEndOfFile (hFile=0xdc) returned 1 [0160.193] GetProcessHeap () returned 0x4e0000 [0160.193] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0160.193] GetProcessHeap () returned 0x4e0000 [0160.193] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0160.193] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0160.195] CloseHandle (hObject=0xdc) returned 1 [0160.195] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x812c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153047.WMF", cAlternateFileName="")) returned 1 [0160.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0160.197] GetProcessHeap () returned 0x4e0000 [0160.197] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0160.197] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0160.197] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0160.197] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0160.199] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.200] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.200] GetProcessHeap () returned 0x4e0000 [0160.200] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0160.200] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0160.200] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.200] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0160.200] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0160.200] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0160.200] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0160.200] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0160.200] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0160.200] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.200] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.200] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.201] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x812c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x812c, lpOverlapped=0x0) returned 1 [0160.203] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8130, dwBufLen=0x8130 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8130) returned 1 [0160.204] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.204] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x8130, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x8130, lpOverlapped=0x0) returned 1 [0160.204] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.204] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x8204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.204] SetEndOfFile (hFile=0xdc) returned 1 [0160.207] GetProcessHeap () returned 0x4e0000 [0160.207] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0160.207] GetProcessHeap () returned 0x4e0000 [0160.207] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0160.207] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0160.209] CloseHandle (hObject=0xdc) returned 1 [0160.209] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x778, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153087.WMF", cAlternateFileName="")) returned 1 [0160.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0160.209] GetProcessHeap () returned 0x4e0000 [0160.209] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0160.210] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0160.210] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0160.210] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0160.241] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.241] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.241] GetProcessHeap () returned 0x4e0000 [0160.241] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0160.241] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0160.241] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.241] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0160.242] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0160.242] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0160.242] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0160.242] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0160.242] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0160.242] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.242] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.242] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.242] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x778, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x778, lpOverlapped=0x0) returned 1 [0160.242] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x780, dwBufLen=0x780 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x780) returned 1 [0160.242] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.242] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x780, lpOverlapped=0x0) returned 1 [0160.243] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.243] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x854, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.243] SetEndOfFile (hFile=0xdc) returned 1 [0160.246] GetProcessHeap () returned 0x4e0000 [0160.246] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0160.246] GetProcessHeap () returned 0x4e0000 [0160.246] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0160.246] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0160.247] CloseHandle (hObject=0xdc) returned 1 [0160.248] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ea8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153089.WMF", cAlternateFileName="")) returned 1 [0160.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0160.248] GetProcessHeap () returned 0x4e0000 [0160.249] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0160.249] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0160.249] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0160.249] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0160.255] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.255] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.255] GetProcessHeap () returned 0x4e0000 [0160.255] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0160.255] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0160.255] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.255] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0160.255] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0160.255] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0160.255] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0160.255] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0160.255] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0160.255] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.255] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.255] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.255] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1ea8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1ea8, lpOverlapped=0x0) returned 1 [0160.256] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1eb0, dwBufLen=0x1eb0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1eb0) returned 1 [0160.256] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.256] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1eb0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1eb0, lpOverlapped=0x0) returned 1 [0160.257] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.257] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1f84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.257] SetEndOfFile (hFile=0xdc) returned 1 [0160.259] GetProcessHeap () returned 0x4e0000 [0160.259] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0160.259] GetProcessHeap () returned 0x4e0000 [0160.259] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0160.259] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0160.260] CloseHandle (hObject=0xdc) returned 1 [0160.260] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1fc8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153091.WMF", cAlternateFileName="")) returned 1 [0160.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153091.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0160.262] GetProcessHeap () returned 0x4e0000 [0160.262] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0160.262] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0160.262] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0160.262] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0160.264] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.264] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.264] GetProcessHeap () returned 0x4e0000 [0160.264] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0160.264] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0160.264] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.264] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0160.264] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0160.264] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0160.264] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0160.264] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0160.264] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0160.264] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.265] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.265] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.265] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1fc8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1fc8, lpOverlapped=0x0) returned 1 [0160.266] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1fd0, dwBufLen=0x1fd0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1fd0) returned 1 [0160.266] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.266] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1fd0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1fd0, lpOverlapped=0x0) returned 1 [0160.266] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.266] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x20a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.266] SetEndOfFile (hFile=0xdc) returned 1 [0160.268] GetProcessHeap () returned 0x4e0000 [0160.268] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0160.268] GetProcessHeap () returned 0x4e0000 [0160.268] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0160.268] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153091.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153091.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0160.269] CloseHandle (hObject=0xdc) returned 1 [0160.269] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x22b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153093.WMF", cAlternateFileName="")) returned 1 [0160.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153093.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0160.270] GetProcessHeap () returned 0x4e0000 [0160.270] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0160.270] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0160.270] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0160.270] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.270] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.270] GetProcessHeap () returned 0x4e0000 [0160.270] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0160.270] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0160.270] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.270] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0160.273] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0160.273] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0160.273] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0160.273] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0160.273] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0160.273] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.273] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.273] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.273] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x22b0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x22b0, lpOverlapped=0x0) returned 1 [0160.274] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x22b0, dwBufLen=0x22b0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x22b0) returned 1 [0160.274] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.274] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x22b0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x22b0, lpOverlapped=0x0) returned 1 [0160.274] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.274] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2384, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.274] SetEndOfFile (hFile=0xdc) returned 1 [0160.276] GetProcessHeap () returned 0x4e0000 [0160.277] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0160.277] GetProcessHeap () returned 0x4e0000 [0160.277] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0160.277] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153093.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153093.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0160.278] CloseHandle (hObject=0xdc) returned 1 [0160.278] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe78, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153095.WMF", cAlternateFileName="")) returned 1 [0160.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153095.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0160.278] GetProcessHeap () returned 0x4e0000 [0160.278] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0160.279] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0160.279] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0160.279] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0160.281] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.281] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.281] GetProcessHeap () returned 0x4e0000 [0160.281] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0160.281] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0160.281] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.281] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0160.281] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0160.281] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0160.281] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0160.281] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0160.281] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0160.281] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.281] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.281] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.281] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xe78, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xe78, lpOverlapped=0x0) returned 1 [0160.281] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe80, dwBufLen=0xe80 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe80) returned 1 [0160.281] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.281] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xe80, lpOverlapped=0x0) returned 1 [0160.282] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.282] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xf54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.282] SetEndOfFile (hFile=0xdc) returned 1 [0160.284] GetProcessHeap () returned 0x4e0000 [0160.284] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0160.284] GetProcessHeap () returned 0x4e0000 [0160.284] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0160.284] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153095.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153095.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0160.285] CloseHandle (hObject=0xdc) returned 1 [0160.285] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbc0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153265.WMF", cAlternateFileName="")) returned 1 [0160.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153265.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0160.285] GetProcessHeap () returned 0x4e0000 [0160.285] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0160.285] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0160.285] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0160.286] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.286] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.286] GetProcessHeap () returned 0x4e0000 [0160.286] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0160.286] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0160.286] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.286] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0160.287] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0160.287] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0160.288] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0160.288] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0160.288] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0160.288] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.288] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.288] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.288] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xbc0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xbc0, lpOverlapped=0x0) returned 1 [0160.288] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xbc0, dwBufLen=0xbc0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xbc0) returned 1 [0160.288] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.288] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xbc0, lpOverlapped=0x0) returned 1 [0160.288] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.288] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xc94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.288] SetEndOfFile (hFile=0xdc) returned 1 [0160.290] GetProcessHeap () returned 0x4e0000 [0160.290] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0160.290] GetProcessHeap () returned 0x4e0000 [0160.290] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0160.290] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153265.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153265.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0160.291] CloseHandle (hObject=0xdc) returned 1 [0160.292] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4e80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153273.WMF", cAlternateFileName="")) returned 1 [0160.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153273.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0160.292] GetProcessHeap () returned 0x4e0000 [0160.292] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0160.292] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0160.292] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0160.292] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.292] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.292] GetProcessHeap () returned 0x4e0000 [0160.292] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0160.292] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0160.292] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.292] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0160.294] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0160.294] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0160.294] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0160.294] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0160.294] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0160.295] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.295] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.295] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.295] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4e80, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4e80, lpOverlapped=0x0) returned 1 [0160.296] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4e80, dwBufLen=0x4e80 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4e80) returned 1 [0160.296] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.296] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4e80, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4e80, lpOverlapped=0x0) returned 1 [0160.296] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.296] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4f54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.296] SetEndOfFile (hFile=0xdc) returned 1 [0160.298] GetProcessHeap () returned 0x4e0000 [0160.298] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0160.298] GetProcessHeap () returned 0x4e0000 [0160.298] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0160.298] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153273.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153273.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0160.299] CloseHandle (hObject=0xdc) returned 1 [0160.299] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8f0c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153299.WMF", cAlternateFileName="")) returned 1 [0160.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153299.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0160.300] GetProcessHeap () returned 0x4e0000 [0160.300] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0160.300] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0160.300] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0160.300] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0160.307] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.307] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.307] GetProcessHeap () returned 0x4e0000 [0160.307] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0160.307] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0160.307] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.307] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0160.307] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0160.307] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0160.307] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0160.307] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0160.307] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0160.307] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.307] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.307] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.308] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x8f0c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x8f0c, lpOverlapped=0x0) returned 1 [0160.310] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8f10, dwBufLen=0x8f10 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8f10) returned 1 [0160.310] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.310] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x8f10, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x8f10, lpOverlapped=0x0) returned 1 [0160.310] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.310] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x8fe4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.310] SetEndOfFile (hFile=0xdc) returned 1 [0160.313] GetProcessHeap () returned 0x4e0000 [0160.313] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0160.313] GetProcessHeap () returned 0x4e0000 [0160.313] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0160.313] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153299.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153299.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0160.314] CloseHandle (hObject=0xdc) returned 1 [0160.314] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7850, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153302.WMF", cAlternateFileName="")) returned 1 [0160.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153302.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0160.320] GetProcessHeap () returned 0x4e0000 [0160.320] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0160.320] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0160.320] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0160.320] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.320] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.320] GetProcessHeap () returned 0x4e0000 [0160.320] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0160.320] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0160.320] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.320] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0160.325] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0160.325] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0160.325] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0160.325] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0160.325] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0160.325] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.325] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.325] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.325] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7850, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7850, lpOverlapped=0x0) returned 1 [0160.326] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7850, dwBufLen=0x7850 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7850) returned 1 [0160.327] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.327] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7850, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7850, lpOverlapped=0x0) returned 1 [0160.327] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.327] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7924, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.327] SetEndOfFile (hFile=0xdc) returned 1 [0160.330] GetProcessHeap () returned 0x4e0000 [0160.330] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0160.330] GetProcessHeap () returned 0x4e0000 [0160.330] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0160.330] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153302.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153302.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0160.331] CloseHandle (hObject=0xdc) returned 1 [0160.331] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9658, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153305.WMF", cAlternateFileName="")) returned 1 [0160.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153305.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0160.332] GetProcessHeap () returned 0x4e0000 [0160.332] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0160.332] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0160.332] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0160.332] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0160.335] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.335] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.335] GetProcessHeap () returned 0x4e0000 [0160.335] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0160.335] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0160.335] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.335] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0160.335] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0160.335] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0160.335] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0160.335] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0160.335] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0160.335] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.335] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.335] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.336] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x9658, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x9658, lpOverlapped=0x0) returned 1 [0160.337] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9660, dwBufLen=0x9660 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9660) returned 1 [0160.338] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.338] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x9660, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x9660, lpOverlapped=0x0) returned 1 [0160.338] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.338] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x9734, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.338] SetEndOfFile (hFile=0xdc) returned 1 [0160.341] GetProcessHeap () returned 0x4e0000 [0160.341] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0160.341] GetProcessHeap () returned 0x4e0000 [0160.341] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0160.341] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153305.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153305.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0160.342] CloseHandle (hObject=0xdc) returned 1 [0160.342] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3c58, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153307.WMF", cAlternateFileName="")) returned 1 [0160.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153307.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0160.343] GetProcessHeap () returned 0x4e0000 [0160.343] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0160.343] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0160.343] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0160.344] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0160.346] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.346] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.346] GetProcessHeap () returned 0x4e0000 [0160.346] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0160.346] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0160.346] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.346] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0160.346] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0160.346] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0160.347] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0160.347] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0160.347] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0160.347] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.347] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.347] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.347] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3c58, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3c58, lpOverlapped=0x0) returned 1 [0160.348] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3c60, dwBufLen=0x3c60 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3c60) returned 1 [0160.348] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.348] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3c60, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3c60, lpOverlapped=0x0) returned 1 [0160.349] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.349] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3d34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.349] SetEndOfFile (hFile=0xdc) returned 1 [0160.351] GetProcessHeap () returned 0x4e0000 [0160.351] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0160.351] GetProcessHeap () returned 0x4e0000 [0160.352] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0160.352] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153307.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153307.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0160.354] CloseHandle (hObject=0xdc) returned 1 [0160.354] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4238, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153313.WMF", cAlternateFileName="")) returned 1 [0160.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153313.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0160.355] GetProcessHeap () returned 0x4e0000 [0160.355] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0160.355] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0160.355] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0160.355] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0160.358] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.358] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.358] GetProcessHeap () returned 0x4e0000 [0160.358] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0160.358] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0160.358] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.358] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0160.359] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0160.359] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0160.359] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0160.359] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0160.359] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0160.359] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.359] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.359] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.359] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4238, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4238, lpOverlapped=0x0) returned 1 [0160.360] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4240, dwBufLen=0x4240 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4240) returned 1 [0160.361] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.361] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4240, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4240, lpOverlapped=0x0) returned 1 [0160.361] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.361] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.361] SetEndOfFile (hFile=0xdc) returned 1 [0160.364] GetProcessHeap () returned 0x4e0000 [0160.364] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0160.364] GetProcessHeap () returned 0x4e0000 [0160.364] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0160.364] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153313.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153313.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0160.365] CloseHandle (hObject=0xdc) returned 1 [0160.365] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4464, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153398.WMF", cAlternateFileName="")) returned 1 [0160.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153398.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0160.366] GetProcessHeap () returned 0x4e0000 [0160.366] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0160.366] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0160.366] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0160.366] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0160.369] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.369] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.369] GetProcessHeap () returned 0x4e0000 [0160.369] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0160.369] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0160.369] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.369] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0160.369] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0160.369] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0160.370] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0160.370] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0160.370] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0160.370] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.370] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.370] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.370] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4464, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4464, lpOverlapped=0x0) returned 1 [0160.371] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4470, dwBufLen=0x4470 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4470) returned 1 [0160.371] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.371] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4470, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4470, lpOverlapped=0x0) returned 1 [0160.372] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.372] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4544, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.372] SetEndOfFile (hFile=0xdc) returned 1 [0160.374] GetProcessHeap () returned 0x4e0000 [0160.374] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0160.374] GetProcessHeap () returned 0x4e0000 [0160.374] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0160.374] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153398.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153398.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0160.375] CloseHandle (hObject=0xdc) returned 1 [0160.375] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x85d0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153508.WMF", cAlternateFileName="")) returned 1 [0160.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153508.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0160.377] GetProcessHeap () returned 0x4e0000 [0160.377] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0160.377] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0160.377] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0160.377] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.377] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.377] GetProcessHeap () returned 0x4e0000 [0160.377] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0160.377] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0160.377] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.377] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0160.380] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0160.380] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0160.380] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0160.380] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0160.380] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0160.380] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.380] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.380] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.380] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x85d0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x85d0, lpOverlapped=0x0) returned 1 [0160.384] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x85d0, dwBufLen=0x85d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x85d0) returned 1 [0160.385] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.385] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x85d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x85d0, lpOverlapped=0x0) returned 1 [0160.385] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.385] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x86a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.385] SetEndOfFile (hFile=0xdc) returned 1 [0160.388] GetProcessHeap () returned 0x4e0000 [0160.388] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0160.388] GetProcessHeap () returned 0x4e0000 [0160.388] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0160.388] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153508.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153508.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0160.390] CloseHandle (hObject=0xdc) returned 1 [0160.390] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x31d0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153514.WMF", cAlternateFileName="")) returned 1 [0160.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153514.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0160.390] GetProcessHeap () returned 0x4e0000 [0160.390] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0160.391] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0160.391] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0160.391] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.391] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.391] GetProcessHeap () returned 0x4e0000 [0160.391] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0160.391] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0160.391] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.391] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0160.614] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0160.614] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0160.614] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0160.614] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0160.614] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0160.614] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.615] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.615] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.615] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x31d0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x31d0, lpOverlapped=0x0) returned 1 [0160.616] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x31d0, dwBufLen=0x31d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x31d0) returned 1 [0160.616] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.616] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x31d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x31d0, lpOverlapped=0x0) returned 1 [0160.616] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.616] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x32a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.616] SetEndOfFile (hFile=0xdc) returned 1 [0160.619] GetProcessHeap () returned 0x4e0000 [0160.619] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0160.619] GetProcessHeap () returned 0x4e0000 [0160.619] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0160.619] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153514.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153514.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0160.621] CloseHandle (hObject=0xdc) returned 1 [0160.621] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d08, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153516.WMF", cAlternateFileName="")) returned 1 [0160.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153516.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0160.622] GetProcessHeap () returned 0x4e0000 [0160.622] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0160.622] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0160.622] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0160.622] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0160.624] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.624] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.624] GetProcessHeap () returned 0x4e0000 [0160.624] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0160.624] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0160.624] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.624] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0160.624] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0160.625] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0160.625] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0160.625] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0160.625] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0160.625] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.625] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.625] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.625] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1d08, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1d08, lpOverlapped=0x0) returned 1 [0160.626] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1d10, dwBufLen=0x1d10 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1d10) returned 1 [0160.626] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.626] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1d10, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1d10, lpOverlapped=0x0) returned 1 [0160.626] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.626] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1de4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.626] SetEndOfFile (hFile=0xdc) returned 1 [0160.629] GetProcessHeap () returned 0x4e0000 [0160.629] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0160.629] GetProcessHeap () returned 0x4e0000 [0160.629] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0160.629] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153516.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153516.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0160.630] CloseHandle (hObject=0xdc) returned 1 [0160.630] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x30f0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153518.WMF", cAlternateFileName="")) returned 1 [0160.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153518.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0160.631] GetProcessHeap () returned 0x4e0000 [0160.631] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0160.632] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0160.632] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0160.632] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.632] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.632] GetProcessHeap () returned 0x4e0000 [0160.632] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0160.632] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0160.632] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.632] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0160.634] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0160.634] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0160.634] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0160.635] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0160.635] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0160.635] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.635] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.635] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.635] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x30f0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x30f0, lpOverlapped=0x0) returned 1 [0160.636] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x30f0, dwBufLen=0x30f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x30f0) returned 1 [0160.636] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.636] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x30f0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x30f0, lpOverlapped=0x0) returned 1 [0160.637] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.637] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x31c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.637] SetEndOfFile (hFile=0xdc) returned 1 [0160.639] GetProcessHeap () returned 0x4e0000 [0160.639] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0160.640] GetProcessHeap () returned 0x4e0000 [0160.640] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0160.640] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153518.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153518.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0160.641] CloseHandle (hObject=0xdc) returned 1 [0160.641] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x560, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0156537.WMF", cAlternateFileName="")) returned 1 [0160.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0156537.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0160.645] GetProcessHeap () returned 0x4e0000 [0160.645] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0160.645] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0160.645] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0160.646] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.646] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.646] GetProcessHeap () returned 0x4e0000 [0160.646] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0160.646] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0160.646] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.646] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0160.648] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0160.648] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0160.648] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0160.648] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0160.648] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0160.648] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.648] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.648] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.648] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x560, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x560, lpOverlapped=0x0) returned 1 [0160.648] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x560, dwBufLen=0x560 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x560) returned 1 [0160.648] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.649] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x560, lpOverlapped=0x0) returned 1 [0160.649] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.649] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x634, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.649] SetEndOfFile (hFile=0xdc) returned 1 [0160.651] GetProcessHeap () returned 0x4e0000 [0160.651] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0160.651] GetProcessHeap () returned 0x4e0000 [0160.651] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0160.651] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0156537.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0156537.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0160.652] CloseHandle (hObject=0xdc) returned 1 [0160.652] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb66e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0157167.WMF", cAlternateFileName="")) returned 1 [0160.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157167.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0160.654] GetProcessHeap () returned 0x4e0000 [0160.654] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0160.654] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0160.654] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0160.654] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0160.656] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.656] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.656] GetProcessHeap () returned 0x4e0000 [0160.656] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0160.656] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0160.656] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.656] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0160.656] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0160.656] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0160.656] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0160.656] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0160.656] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0160.656] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.656] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.656] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.656] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb66e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xb66e, lpOverlapped=0x0) returned 1 [0160.657] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xb670, dwBufLen=0xb670 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xb670) returned 1 [0160.658] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.658] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xb670, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xb670, lpOverlapped=0x0) returned 1 [0160.658] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.658] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xb744, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.658] SetEndOfFile (hFile=0xdc) returned 1 [0160.660] GetProcessHeap () returned 0x4e0000 [0160.661] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0160.661] GetProcessHeap () returned 0x4e0000 [0160.661] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0160.661] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157167.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157167.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0160.662] CloseHandle (hObject=0xdc) returned 1 [0160.662] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x54d4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0157177.WMF", cAlternateFileName="")) returned 1 [0160.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157177.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0160.663] GetProcessHeap () returned 0x4e0000 [0160.663] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0160.663] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0160.663] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0160.663] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0160.665] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.665] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.665] GetProcessHeap () returned 0x4e0000 [0160.665] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0160.665] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0160.665] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.665] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0160.665] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0160.665] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0160.666] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0160.666] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0160.666] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0160.666] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.666] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.666] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.666] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x54d4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x54d4, lpOverlapped=0x0) returned 1 [0160.679] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x54e0, dwBufLen=0x54e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x54e0) returned 1 [0160.679] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.679] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x54e0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x54e0, lpOverlapped=0x0) returned 1 [0160.679] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.679] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x55b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.679] SetEndOfFile (hFile=0xdc) returned 1 [0160.682] GetProcessHeap () returned 0x4e0000 [0160.682] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0160.682] GetProcessHeap () returned 0x4e0000 [0160.682] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0160.682] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157177.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157177.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0160.684] CloseHandle (hObject=0xdc) returned 1 [0160.684] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x45f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0157191.WMF", cAlternateFileName="")) returned 1 [0160.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157191.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0160.685] GetProcessHeap () returned 0x4e0000 [0160.685] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0160.685] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0160.685] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0160.685] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0160.687] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.687] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.687] GetProcessHeap () returned 0x4e0000 [0160.687] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0160.688] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0160.688] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.688] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0160.688] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0160.688] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0160.688] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0160.688] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0160.688] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0160.688] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.688] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.688] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.688] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x45f8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x45f8, lpOverlapped=0x0) returned 1 [0160.689] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4600, dwBufLen=0x4600 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4600) returned 1 [0160.690] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.690] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4600, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4600, lpOverlapped=0x0) returned 1 [0160.690] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.690] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x46d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.690] SetEndOfFile (hFile=0xdc) returned 1 [0160.693] GetProcessHeap () returned 0x4e0000 [0160.693] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0160.693] GetProcessHeap () returned 0x4e0000 [0160.693] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0160.693] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157191.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157191.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0160.695] CloseHandle (hObject=0xdc) returned 1 [0160.695] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2c84, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0157831.WMF", cAlternateFileName="")) returned 1 [0160.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157831.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0160.696] GetProcessHeap () returned 0x4e0000 [0160.696] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0160.696] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0160.696] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0160.696] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0160.698] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.699] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.699] GetProcessHeap () returned 0x4e0000 [0160.699] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0160.699] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0160.699] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.699] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0160.699] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0160.699] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0160.699] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0160.699] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0160.699] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0160.699] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.699] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.699] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.699] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2c84, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2c84, lpOverlapped=0x0) returned 1 [0160.701] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2c90, dwBufLen=0x2c90 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2c90) returned 1 [0160.701] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.701] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2c90, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2c90, lpOverlapped=0x0) returned 1 [0160.701] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.701] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2d64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.701] SetEndOfFile (hFile=0xdc) returned 1 [0160.704] GetProcessHeap () returned 0x4e0000 [0160.704] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0160.704] GetProcessHeap () returned 0x4e0000 [0160.704] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0160.704] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157831.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157831.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0160.706] CloseHandle (hObject=0xdc) returned 1 [0160.706] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x48dc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0158071.WMF", cAlternateFileName="")) returned 1 [0160.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158071.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0160.707] GetProcessHeap () returned 0x4e0000 [0160.707] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0160.707] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0160.707] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0160.707] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0160.710] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.710] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.710] GetProcessHeap () returned 0x4e0000 [0160.710] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0160.710] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0160.710] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.710] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0160.710] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0160.710] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0160.710] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0160.711] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0160.711] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0160.711] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.711] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.711] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.711] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x48dc, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x48dc, lpOverlapped=0x0) returned 1 [0160.712] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x48e0, dwBufLen=0x48e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x48e0) returned 1 [0160.712] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.712] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x48e0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x48e0, lpOverlapped=0x0) returned 1 [0160.712] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.712] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x49b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.713] SetEndOfFile (hFile=0xdc) returned 1 [0160.715] GetProcessHeap () returned 0x4e0000 [0160.715] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0160.715] GetProcessHeap () returned 0x4e0000 [0160.715] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0160.715] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158071.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158071.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0160.717] CloseHandle (hObject=0xdc) returned 1 [0160.717] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x462e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0158477.WMF", cAlternateFileName="")) returned 1 [0160.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158477.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0160.718] GetProcessHeap () returned 0x4e0000 [0160.718] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0160.718] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0160.718] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0160.719] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0160.721] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.721] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.721] GetProcessHeap () returned 0x4e0000 [0160.721] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0160.721] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0160.721] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.721] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0160.721] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0160.721] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0160.721] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0160.721] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0160.722] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0160.722] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.722] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.722] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.722] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x462e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x462e, lpOverlapped=0x0) returned 1 [0160.723] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4630, dwBufLen=0x4630 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4630) returned 1 [0160.723] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.723] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4630, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4630, lpOverlapped=0x0) returned 1 [0160.723] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.723] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4704, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.723] SetEndOfFile (hFile=0xdc) returned 1 [0160.726] GetProcessHeap () returned 0x4e0000 [0160.726] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0160.726] GetProcessHeap () returned 0x4e0000 [0160.726] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0160.726] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158477.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158477.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0160.727] CloseHandle (hObject=0xdc) returned 1 [0160.728] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x72de, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0160590.WMF", cAlternateFileName="")) returned 1 [0160.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0160590.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0160.730] GetProcessHeap () returned 0x4e0000 [0160.730] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0160.730] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0160.730] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0160.730] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0160.732] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.732] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.732] GetProcessHeap () returned 0x4e0000 [0160.732] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0160.733] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0160.733] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.733] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0160.733] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0160.733] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0160.733] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0160.733] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0160.733] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0160.733] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.733] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.733] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.733] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x72de, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x72de, lpOverlapped=0x0) returned 1 [0160.734] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x72e0, dwBufLen=0x72e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x72e0) returned 1 [0160.735] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.735] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x72e0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x72e0, lpOverlapped=0x0) returned 1 [0160.735] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.735] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x73b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.735] SetEndOfFile (hFile=0xdc) returned 1 [0160.738] GetProcessHeap () returned 0x4e0000 [0160.738] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0160.738] GetProcessHeap () returned 0x4e0000 [0160.738] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0160.738] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0160590.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0160590.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0160.740] CloseHandle (hObject=0xdc) returned 1 [0160.740] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb594, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0164153.JPG", cAlternateFileName="")) returned 1 [0160.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0160.741] GetProcessHeap () returned 0x4e0000 [0160.741] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0160.741] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0160.741] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0160.741] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0160.910] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.910] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.910] GetProcessHeap () returned 0x4e0000 [0160.910] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0160.910] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0160.910] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.910] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0160.910] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0160.910] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0160.911] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0160.911] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0160.911] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0160.911] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.911] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.911] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.911] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb594, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xb594, lpOverlapped=0x0) returned 1 [0160.970] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xb5a0, dwBufLen=0xb5a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xb5a0) returned 1 [0160.971] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.971] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xb5a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xb5a0, lpOverlapped=0x0) returned 1 [0160.971] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.971] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xb674, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.971] SetEndOfFile (hFile=0xdc) returned 1 [0160.973] GetProcessHeap () returned 0x4e0000 [0160.973] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0160.974] GetProcessHeap () returned 0x4e0000 [0160.974] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0160.974] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0160.975] CloseHandle (hObject=0xdc) returned 1 [0160.975] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x51aa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0168644.WMF", cAlternateFileName="")) returned 1 [0160.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0168644.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0160.976] GetProcessHeap () returned 0x4e0000 [0160.976] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0160.976] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0160.976] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0160.976] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0160.978] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.978] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.978] GetProcessHeap () returned 0x4e0000 [0160.978] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0160.978] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0160.978] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.978] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0160.978] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0160.978] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0160.978] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0160.978] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0160.978] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0160.978] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.978] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.979] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.979] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x51aa, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x51aa, lpOverlapped=0x0) returned 1 [0160.979] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x51b0, dwBufLen=0x51b0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x51b0) returned 1 [0160.980] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.980] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x51b0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x51b0, lpOverlapped=0x0) returned 1 [0160.980] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.980] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5284, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.980] SetEndOfFile (hFile=0xdc) returned 1 [0160.982] GetProcessHeap () returned 0x4e0000 [0160.982] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0160.982] GetProcessHeap () returned 0x4e0000 [0160.982] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0160.982] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0168644.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0168644.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0160.984] CloseHandle (hObject=0xdc) returned 1 [0160.984] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3888, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0171685.WMF", cAlternateFileName="")) returned 1 [0160.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171685.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0160.984] GetProcessHeap () returned 0x4e0000 [0160.984] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0160.985] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0160.985] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0160.985] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0160.986] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.986] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.987] GetProcessHeap () returned 0x4e0000 [0160.987] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0160.987] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0160.987] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.987] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0160.987] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0160.987] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0160.987] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0160.987] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0160.987] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0160.987] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.987] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.987] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.987] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3888, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3888, lpOverlapped=0x0) returned 1 [0160.988] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3890, dwBufLen=0x3890 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3890) returned 1 [0160.988] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.988] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3890, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3890, lpOverlapped=0x0) returned 1 [0160.988] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.988] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3964, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.989] SetEndOfFile (hFile=0xdc) returned 1 [0160.991] GetProcessHeap () returned 0x4e0000 [0160.991] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0160.991] GetProcessHeap () returned 0x4e0000 [0160.991] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0160.991] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171685.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171685.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0160.992] CloseHandle (hObject=0xdc) returned 1 [0160.992] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ae8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0171847.WMF", cAlternateFileName="")) returned 1 [0160.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171847.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0160.993] GetProcessHeap () returned 0x4e0000 [0160.993] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0160.993] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0160.993] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0160.993] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0160.995] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.995] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.995] GetProcessHeap () returned 0x4e0000 [0160.995] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0160.995] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0160.995] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.995] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0160.995] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0160.995] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0160.995] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0160.995] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0160.995] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0160.995] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0160.995] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0160.995] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.995] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1ae8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1ae8, lpOverlapped=0x0) returned 1 [0160.996] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1af0, dwBufLen=0x1af0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1af0) returned 1 [0160.996] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.996] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1af0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1af0, lpOverlapped=0x0) returned 1 [0160.997] CryptDestroyKey (hKey=0x522f98) returned 1 [0160.997] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1bc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.997] SetEndOfFile (hFile=0xdc) returned 1 [0160.999] GetProcessHeap () returned 0x4e0000 [0160.999] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0160.999] GetProcessHeap () returned 0x4e0000 [0160.999] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0160.999] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171847.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171847.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0161.000] CloseHandle (hObject=0xdc) returned 1 [0161.000] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d18, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0172035.WMF", cAlternateFileName="")) returned 1 [0161.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172035.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0161.001] GetProcessHeap () returned 0x4e0000 [0161.001] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0161.001] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0161.001] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0161.001] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0161.003] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.003] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.003] GetProcessHeap () returned 0x4e0000 [0161.003] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0161.003] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0161.003] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.003] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0161.003] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0161.003] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0161.003] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0161.003] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0161.003] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0161.003] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.003] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.004] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.004] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1d18, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1d18, lpOverlapped=0x0) returned 1 [0161.004] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1d20, dwBufLen=0x1d20 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1d20) returned 1 [0161.004] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.004] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1d20, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1d20, lpOverlapped=0x0) returned 1 [0161.005] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.005] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1df4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.005] SetEndOfFile (hFile=0xdc) returned 1 [0161.007] GetProcessHeap () returned 0x4e0000 [0161.007] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0161.007] GetProcessHeap () returned 0x4e0000 [0161.007] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0161.007] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172035.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172035.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0161.008] CloseHandle (hObject=0xdc) returned 1 [0161.008] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b74, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0172067.WMF", cAlternateFileName="")) returned 1 [0161.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172067.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0161.009] GetProcessHeap () returned 0x4e0000 [0161.009] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0161.010] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0161.010] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0161.010] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0161.011] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.011] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.011] GetProcessHeap () returned 0x4e0000 [0161.011] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0161.011] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0161.011] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.011] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0161.011] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0161.012] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0161.012] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0161.012] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0161.012] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0161.012] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.012] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.012] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.012] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1b74, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1b74, lpOverlapped=0x0) returned 1 [0161.013] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1b80, dwBufLen=0x1b80 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1b80) returned 1 [0161.013] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.013] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1b80, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1b80, lpOverlapped=0x0) returned 1 [0161.013] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.013] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1c54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.013] SetEndOfFile (hFile=0xdc) returned 1 [0161.015] GetProcessHeap () returned 0x4e0000 [0161.015] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0161.015] GetProcessHeap () returned 0x4e0000 [0161.015] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0161.015] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172067.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172067.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0161.016] CloseHandle (hObject=0xdc) returned 1 [0161.016] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3198, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0172193.WMF", cAlternateFileName="")) returned 1 [0161.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172193.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0161.017] GetProcessHeap () returned 0x4e0000 [0161.017] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0161.017] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0161.017] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0161.017] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0161.019] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.019] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.019] GetProcessHeap () returned 0x4e0000 [0161.019] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0161.019] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0161.019] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.019] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0161.019] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0161.019] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0161.019] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0161.019] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0161.019] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0161.020] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.020] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.020] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.020] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3198, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3198, lpOverlapped=0x0) returned 1 [0161.020] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x31a0, dwBufLen=0x31a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x31a0) returned 1 [0161.021] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.021] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x31a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x31a0, lpOverlapped=0x0) returned 1 [0161.021] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.021] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3274, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.021] SetEndOfFile (hFile=0xdc) returned 1 [0161.023] GetProcessHeap () returned 0x4e0000 [0161.023] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0161.023] GetProcessHeap () returned 0x4e0000 [0161.023] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0161.024] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172193.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172193.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0161.024] CloseHandle (hObject=0xdc) returned 1 [0161.024] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0174315.WMF", cAlternateFileName="")) returned 1 [0161.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174315.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0161.025] GetProcessHeap () returned 0x4e0000 [0161.025] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0161.025] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0161.025] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0161.025] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0161.027] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.027] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.027] GetProcessHeap () returned 0x4e0000 [0161.027] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0161.027] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0161.027] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.027] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0161.027] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0161.027] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0161.027] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0161.027] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0161.027] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0161.028] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.028] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.028] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.028] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x16e8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x16e8, lpOverlapped=0x0) returned 1 [0161.028] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x16f0, dwBufLen=0x16f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x16f0) returned 1 [0161.029] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.029] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x16f0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x16f0, lpOverlapped=0x0) returned 1 [0161.029] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.029] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x17c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.029] SetEndOfFile (hFile=0xdc) returned 1 [0161.031] GetProcessHeap () returned 0x4e0000 [0161.031] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0161.031] GetProcessHeap () returned 0x4e0000 [0161.031] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0161.031] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174315.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174315.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0161.032] CloseHandle (hObject=0xdc) returned 1 [0161.032] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2608, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0174635.WMF", cAlternateFileName="")) returned 1 [0161.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174635.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0161.033] GetProcessHeap () returned 0x4e0000 [0161.033] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0161.033] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0161.033] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0161.033] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0161.035] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.035] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.035] GetProcessHeap () returned 0x4e0000 [0161.035] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0161.036] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0161.036] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.036] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0161.036] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0161.036] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0161.036] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0161.036] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0161.036] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0161.036] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.036] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.036] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.036] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2608, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2608, lpOverlapped=0x0) returned 1 [0161.037] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2610, dwBufLen=0x2610 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2610) returned 1 [0161.037] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.037] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2610, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2610, lpOverlapped=0x0) returned 1 [0161.037] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.037] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x26e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.037] SetEndOfFile (hFile=0xdc) returned 1 [0161.040] GetProcessHeap () returned 0x4e0000 [0161.040] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0161.040] GetProcessHeap () returned 0x4e0000 [0161.040] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0161.040] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174635.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174635.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0161.041] CloseHandle (hObject=0xdc) returned 1 [0161.041] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x13ec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0174639.WMF", cAlternateFileName="")) returned 1 [0161.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174639.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0161.042] GetProcessHeap () returned 0x4e0000 [0161.042] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0161.042] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0161.042] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0161.042] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0161.044] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.044] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.044] GetProcessHeap () returned 0x4e0000 [0161.044] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0161.044] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0161.044] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.044] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0161.044] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0161.044] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0161.044] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0161.045] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0161.045] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0161.045] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.045] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.045] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.045] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x13ec, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x13ec, lpOverlapped=0x0) returned 1 [0161.046] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x13f0, dwBufLen=0x13f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x13f0) returned 1 [0161.046] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.046] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x13f0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x13f0, lpOverlapped=0x0) returned 1 [0161.046] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.046] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x14c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.046] SetEndOfFile (hFile=0xdc) returned 1 [0161.048] GetProcessHeap () returned 0x4e0000 [0161.048] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0161.048] GetProcessHeap () returned 0x4e0000 [0161.048] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0161.048] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174639.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174639.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0161.049] CloseHandle (hObject=0xdc) returned 1 [0161.049] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6196, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0174952.JPG", cAlternateFileName="")) returned 1 [0161.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0161.050] GetProcessHeap () returned 0x4e0000 [0161.050] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0161.050] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0161.050] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0161.050] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0161.052] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.052] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.052] GetProcessHeap () returned 0x4e0000 [0161.052] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0161.052] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0161.052] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.052] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0161.052] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0161.052] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0161.052] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0161.052] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0161.052] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0161.053] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.053] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.053] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.053] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x6196, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x6196, lpOverlapped=0x0) returned 1 [0161.054] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x61a0, dwBufLen=0x61a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x61a0) returned 1 [0161.054] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.054] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x61a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x61a0, lpOverlapped=0x0) returned 1 [0161.054] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.054] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6274, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.054] SetEndOfFile (hFile=0xdc) returned 1 [0161.056] GetProcessHeap () returned 0x4e0000 [0161.056] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0161.056] GetProcessHeap () returned 0x4e0000 [0161.056] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0161.056] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0161.057] CloseHandle (hObject=0xdc) returned 1 [0161.057] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb57d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0175361.JPG", cAlternateFileName="")) returned 1 [0161.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0161.058] GetProcessHeap () returned 0x4e0000 [0161.058] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0161.058] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0161.058] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0161.058] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x3, lpOverlapped=0x0) returned 1 [0161.060] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.060] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.060] GetProcessHeap () returned 0x4e0000 [0161.060] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0161.060] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0161.060] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.060] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0161.060] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0161.060] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0161.060] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0161.060] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0161.060] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0161.060] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.061] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.061] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.061] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb57d, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xb57d, lpOverlapped=0x0) returned 1 [0161.063] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xb580, dwBufLen=0xb580 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xb580) returned 1 [0161.063] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.063] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xb580, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xb580, lpOverlapped=0x0) returned 1 [0161.064] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.064] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xb654, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.064] SetEndOfFile (hFile=0xdc) returned 1 [0161.066] GetProcessHeap () returned 0x4e0000 [0161.066] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0161.066] GetProcessHeap () returned 0x4e0000 [0161.066] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0161.066] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0161.067] CloseHandle (hObject=0xdc) returned 1 [0161.067] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x38d8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0175428.JPG", cAlternateFileName="")) returned 1 [0161.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0161.068] GetProcessHeap () returned 0x4e0000 [0161.068] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0161.068] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0161.068] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0161.068] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0161.069] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.069] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.069] GetProcessHeap () returned 0x4e0000 [0161.070] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0161.070] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0161.070] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.070] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0161.070] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0161.070] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0161.070] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0161.070] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0161.070] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0161.070] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.070] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.070] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.070] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x38d8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x38d8, lpOverlapped=0x0) returned 1 [0161.071] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x38e0, dwBufLen=0x38e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x38e0) returned 1 [0161.071] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.071] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x38e0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x38e0, lpOverlapped=0x0) returned 1 [0161.071] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.071] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x39b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.071] SetEndOfFile (hFile=0xdc) returned 1 [0161.073] GetProcessHeap () returned 0x4e0000 [0161.074] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0161.074] GetProcessHeap () returned 0x4e0000 [0161.074] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0161.074] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0161.074] CloseHandle (hObject=0xdc) returned 1 [0161.074] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb12e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0177257.JPG", cAlternateFileName="")) returned 1 [0161.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0161.075] GetProcessHeap () returned 0x4e0000 [0161.075] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0161.076] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0161.076] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0161.076] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0161.077] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.077] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.077] GetProcessHeap () returned 0x4e0000 [0161.077] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0161.077] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0161.077] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.078] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0161.078] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0161.078] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0161.078] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0161.078] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0161.078] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0161.078] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.078] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.078] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.078] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb12e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xb12e, lpOverlapped=0x0) returned 1 [0161.079] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xb130, dwBufLen=0xb130 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xb130) returned 1 [0161.080] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.080] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xb130, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xb130, lpOverlapped=0x0) returned 1 [0161.080] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.080] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xb204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.080] SetEndOfFile (hFile=0xdc) returned 1 [0161.082] GetProcessHeap () returned 0x4e0000 [0161.082] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0161.082] GetProcessHeap () returned 0x4e0000 [0161.082] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0161.082] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0161.083] CloseHandle (hObject=0xdc) returned 1 [0161.083] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd902, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0177806.JPG", cAlternateFileName="")) returned 1 [0161.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0161.089] GetProcessHeap () returned 0x4e0000 [0161.089] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0161.089] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0161.089] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0161.089] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0161.091] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.091] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.091] GetProcessHeap () returned 0x4e0000 [0161.091] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0161.091] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0161.091] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.091] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0161.091] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0161.091] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0161.091] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0161.091] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0161.091] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0161.092] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.092] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.092] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.092] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xd902, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xd902, lpOverlapped=0x0) returned 1 [0161.093] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xd910, dwBufLen=0xd910 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xd910) returned 1 [0161.093] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.093] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xd910, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xd910, lpOverlapped=0x0) returned 1 [0161.094] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.094] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xd9e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.094] SetEndOfFile (hFile=0xdc) returned 1 [0161.096] GetProcessHeap () returned 0x4e0000 [0161.096] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0161.096] GetProcessHeap () returned 0x4e0000 [0161.096] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0161.096] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0161.103] CloseHandle (hObject=0xdc) returned 1 [0161.103] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x907d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0178348.JPG", cAlternateFileName="")) returned 1 [0161.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0161.104] GetProcessHeap () returned 0x4e0000 [0161.104] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0161.104] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0161.104] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0161.104] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x3, lpOverlapped=0x0) returned 1 [0161.106] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.106] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.106] GetProcessHeap () returned 0x4e0000 [0161.106] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0161.106] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0161.106] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.106] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0161.106] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0161.106] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0161.106] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0161.106] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0161.106] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0161.106] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.106] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.106] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.106] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x907d, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x907d, lpOverlapped=0x0) returned 1 [0161.107] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9080, dwBufLen=0x9080 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9080) returned 1 [0161.108] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.108] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x9080, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x9080, lpOverlapped=0x0) returned 1 [0161.108] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.108] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x9154, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.108] SetEndOfFile (hFile=0xdc) returned 1 [0161.111] GetProcessHeap () returned 0x4e0000 [0161.111] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0161.111] GetProcessHeap () returned 0x4e0000 [0161.111] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0161.111] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0161.112] CloseHandle (hObject=0xdc) returned 1 [0161.112] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7214, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0178459.JPG", cAlternateFileName="")) returned 1 [0161.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0161.113] GetProcessHeap () returned 0x4e0000 [0161.113] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0161.113] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0161.113] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0161.113] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0161.115] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.115] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.115] GetProcessHeap () returned 0x4e0000 [0161.115] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0161.115] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0161.115] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.115] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0161.115] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0161.115] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0161.115] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0161.116] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0161.116] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0161.116] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.116] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.116] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.116] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7214, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7214, lpOverlapped=0x0) returned 1 [0161.117] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7220, dwBufLen=0x7220 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7220) returned 1 [0161.117] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.117] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7220, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7220, lpOverlapped=0x0) returned 1 [0161.117] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.117] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x72f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.117] SetEndOfFile (hFile=0xdc) returned 1 [0161.120] GetProcessHeap () returned 0x4e0000 [0161.120] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0161.120] GetProcessHeap () returned 0x4e0000 [0161.120] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0161.120] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0161.121] CloseHandle (hObject=0xdc) returned 1 [0161.121] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ff99200, ftCreationTime.dwHighDateTime=0x1c97bb5, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ff99200, ftLastWriteTime.dwHighDateTime=0x1c97bb5, nFileSizeHigh=0x0, nFileSizeLow=0x67a3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0178460.JPG", cAlternateFileName="")) returned 1 [0161.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0161.122] GetProcessHeap () returned 0x4e0000 [0161.122] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0161.122] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0161.122] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0161.122] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xd, lpOverlapped=0x0) returned 1 [0161.123] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.123] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.123] GetProcessHeap () returned 0x4e0000 [0161.123] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0161.123] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0161.123] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.124] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0161.124] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0161.124] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0161.124] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0161.124] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0161.124] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0161.124] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.124] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.124] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.124] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x67a3, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x67a3, lpOverlapped=0x0) returned 1 [0161.125] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x67b0, dwBufLen=0x67b0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x67b0) returned 1 [0161.125] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.125] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x67b0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x67b0, lpOverlapped=0x0) returned 1 [0161.125] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.126] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6884, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.126] SetEndOfFile (hFile=0xdc) returned 1 [0161.128] GetProcessHeap () returned 0x4e0000 [0161.128] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0161.128] GetProcessHeap () returned 0x4e0000 [0161.128] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0161.128] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0161.129] CloseHandle (hObject=0xdc) returned 1 [0161.129] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5de2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0178523.JPG", cAlternateFileName="")) returned 1 [0161.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0161.130] GetProcessHeap () returned 0x4e0000 [0161.130] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0161.130] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0161.130] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0161.130] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0161.131] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.131] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.131] GetProcessHeap () returned 0x4e0000 [0161.131] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0161.131] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0161.132] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.132] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0161.132] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0161.132] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0161.132] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0161.132] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0161.132] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0161.132] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.132] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.132] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.132] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5de2, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x5de2, lpOverlapped=0x0) returned 1 [0161.133] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5df0, dwBufLen=0x5df0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5df0) returned 1 [0161.133] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.133] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5df0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5df0, lpOverlapped=0x0) returned 1 [0161.134] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.134] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5ec4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.134] SetEndOfFile (hFile=0xdc) returned 1 [0161.136] GetProcessHeap () returned 0x4e0000 [0161.136] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0161.136] GetProcessHeap () returned 0x4e0000 [0161.136] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0161.136] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0161.137] CloseHandle (hObject=0xdc) returned 1 [0161.137] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5b2a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0178632.JPG", cAlternateFileName="")) returned 1 [0161.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0161.138] GetProcessHeap () returned 0x4e0000 [0161.138] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0161.138] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0161.138] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0161.138] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0161.140] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.140] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.140] GetProcessHeap () returned 0x4e0000 [0161.140] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0161.140] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0161.140] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.140] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0161.140] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0161.140] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0161.140] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0161.140] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0161.140] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0161.141] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.141] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.141] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.141] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5b2a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x5b2a, lpOverlapped=0x0) returned 1 [0161.142] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5b30, dwBufLen=0x5b30 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5b30) returned 1 [0161.143] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.143] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5b30, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5b30, lpOverlapped=0x0) returned 1 [0161.143] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.143] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5c04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.143] SetEndOfFile (hFile=0xdc) returned 1 [0161.145] GetProcessHeap () returned 0x4e0000 [0161.145] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0161.145] GetProcessHeap () returned 0x4e0000 [0161.145] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0161.145] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0161.146] CloseHandle (hObject=0xdc) returned 1 [0161.146] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7d26, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0178639.JPG", cAlternateFileName="")) returned 1 [0161.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0161.147] GetProcessHeap () returned 0x4e0000 [0161.147] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0161.147] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0161.147] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0161.147] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0161.149] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.149] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.149] GetProcessHeap () returned 0x4e0000 [0161.149] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0161.150] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0161.150] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.150] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0161.150] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0161.150] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0161.150] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0161.150] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0161.150] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0161.150] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.150] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.150] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.150] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7d26, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7d26, lpOverlapped=0x0) returned 1 [0161.151] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7d30, dwBufLen=0x7d30 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7d30) returned 1 [0161.151] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.151] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7d30, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7d30, lpOverlapped=0x0) returned 1 [0161.152] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.152] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7e04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.152] SetEndOfFile (hFile=0xdc) returned 1 [0161.154] GetProcessHeap () returned 0x4e0000 [0161.154] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0161.154] GetProcessHeap () returned 0x4e0000 [0161.154] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0161.154] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0161.155] CloseHandle (hObject=0xdc) returned 1 [0161.155] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8a0c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0178932.JPG", cAlternateFileName="")) returned 1 [0161.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0161.156] GetProcessHeap () returned 0x4e0000 [0161.156] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0161.156] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0161.156] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0161.156] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0161.158] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.158] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.158] GetProcessHeap () returned 0x4e0000 [0161.158] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0161.158] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0161.158] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.158] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0161.158] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0161.159] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0161.159] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0161.159] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0161.159] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0161.159] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.159] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.159] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.159] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x8a0c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x8a0c, lpOverlapped=0x0) returned 1 [0161.160] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8a10, dwBufLen=0x8a10 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8a10) returned 1 [0161.160] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.160] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x8a10, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x8a10, lpOverlapped=0x0) returned 1 [0161.160] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.160] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x8ae4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.160] SetEndOfFile (hFile=0xdc) returned 1 [0161.163] GetProcessHeap () returned 0x4e0000 [0161.163] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0161.163] GetProcessHeap () returned 0x4e0000 [0161.163] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0161.163] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0161.166] CloseHandle (hObject=0xdc) returned 1 [0161.166] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7d6e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0179963.JPG", cAlternateFileName="")) returned 1 [0161.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0161.166] GetProcessHeap () returned 0x4e0000 [0161.166] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0161.167] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0161.167] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0161.167] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0161.209] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.209] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.209] GetProcessHeap () returned 0x4e0000 [0161.209] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0161.209] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0161.209] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.209] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0161.209] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0161.210] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0161.210] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0161.210] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0161.210] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0161.210] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.210] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.210] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.210] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7d6e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7d6e, lpOverlapped=0x0) returned 1 [0161.211] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7d70, dwBufLen=0x7d70 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7d70) returned 1 [0161.211] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.211] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7d70, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7d70, lpOverlapped=0x0) returned 1 [0161.211] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.211] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7e44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.211] SetEndOfFile (hFile=0xdc) returned 1 [0161.214] GetProcessHeap () returned 0x4e0000 [0161.214] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0161.214] GetProcessHeap () returned 0x4e0000 [0161.214] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0161.214] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0161.215] CloseHandle (hObject=0xdc) returned 1 [0161.215] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x40e7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0182689.JPG", cAlternateFileName="")) returned 1 [0161.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0161.217] GetProcessHeap () returned 0x4e0000 [0161.217] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0161.217] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0161.217] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0161.217] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x9, lpOverlapped=0x0) returned 1 [0161.219] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.219] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.219] GetProcessHeap () returned 0x4e0000 [0161.219] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0161.219] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0161.219] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.219] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0161.219] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0161.219] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0161.219] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0161.219] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0161.219] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0161.219] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.219] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.219] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.219] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40e7, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x40e7, lpOverlapped=0x0) returned 1 [0161.220] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x40f0, dwBufLen=0x40f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x40f0) returned 1 [0161.220] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.220] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40f0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x40f0, lpOverlapped=0x0) returned 1 [0161.221] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.221] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x41c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.221] SetEndOfFile (hFile=0xdc) returned 1 [0161.223] GetProcessHeap () returned 0x4e0000 [0161.223] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0161.223] GetProcessHeap () returned 0x4e0000 [0161.223] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0161.223] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0161.224] CloseHandle (hObject=0xdc) returned 1 [0161.224] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5f48, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0182888.WMF", cAlternateFileName="")) returned 1 [0161.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182888.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0161.225] GetProcessHeap () returned 0x4e0000 [0161.225] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0161.225] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0161.225] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0161.225] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0161.229] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.229] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.230] GetProcessHeap () returned 0x4e0000 [0161.230] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0161.230] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0161.230] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.230] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0161.230] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0161.230] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0161.230] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0161.230] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0161.230] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0161.230] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.230] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.230] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.230] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5f48, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x5f48, lpOverlapped=0x0) returned 1 [0161.231] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5f50, dwBufLen=0x5f50 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5f50) returned 1 [0161.232] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.232] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5f50, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5f50, lpOverlapped=0x0) returned 1 [0161.232] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.232] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6024, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.232] SetEndOfFile (hFile=0xdc) returned 1 [0161.234] GetProcessHeap () returned 0x4e0000 [0161.234] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0161.234] GetProcessHeap () returned 0x4e0000 [0161.234] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0161.234] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182888.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182888.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0161.236] CloseHandle (hObject=0xdc) returned 1 [0161.236] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3b2e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0182898.WMF", cAlternateFileName="")) returned 1 [0161.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182898.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0161.236] GetProcessHeap () returned 0x4e0000 [0161.236] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0161.236] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0161.236] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0161.237] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0161.238] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.238] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.238] GetProcessHeap () returned 0x4e0000 [0161.238] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0161.238] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0161.238] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.238] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0161.238] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0161.238] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0161.239] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0161.239] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0161.239] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0161.239] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.239] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.239] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.239] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3b2e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3b2e, lpOverlapped=0x0) returned 1 [0161.242] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3b30, dwBufLen=0x3b30 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3b30) returned 1 [0161.242] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.242] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3b30, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3b30, lpOverlapped=0x0) returned 1 [0161.242] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.242] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3c04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.243] SetEndOfFile (hFile=0xdc) returned 1 [0161.245] GetProcessHeap () returned 0x4e0000 [0161.245] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0161.245] GetProcessHeap () returned 0x4e0000 [0161.245] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0161.245] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182898.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182898.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0161.247] CloseHandle (hObject=0xdc) returned 1 [0161.247] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e8e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0182902.WMF", cAlternateFileName="")) returned 1 [0161.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182902.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0161.248] GetProcessHeap () returned 0x4e0000 [0161.248] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0161.248] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0161.248] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0161.248] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0161.269] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.269] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.269] GetProcessHeap () returned 0x4e0000 [0161.269] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0161.270] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0161.270] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.270] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0161.270] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0161.270] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0161.270] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0161.270] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0161.270] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0161.270] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.270] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.270] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.270] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1e8e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1e8e, lpOverlapped=0x0) returned 1 [0161.271] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1e90, dwBufLen=0x1e90 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1e90) returned 1 [0161.271] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.271] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1e90, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1e90, lpOverlapped=0x0) returned 1 [0161.272] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.272] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1f64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.272] SetEndOfFile (hFile=0xdc) returned 1 [0161.275] GetProcessHeap () returned 0x4e0000 [0161.275] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0161.275] GetProcessHeap () returned 0x4e0000 [0161.275] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0161.275] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182902.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182902.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0161.276] CloseHandle (hObject=0xdc) returned 1 [0161.276] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21290a00, ftCreationTime.dwHighDateTime=0x1bdf6f5, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21290a00, ftLastWriteTime.dwHighDateTime=0x1bdf6f5, nFileSizeHigh=0x0, nFileSizeLow=0x3ed2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0182946.WMF", cAlternateFileName="")) returned 1 [0161.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182946.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0161.277] GetProcessHeap () returned 0x4e0000 [0161.277] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0161.277] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0161.277] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0161.278] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0161.374] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.374] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.374] GetProcessHeap () returned 0x4e0000 [0161.374] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0161.374] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0161.374] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.374] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0161.374] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0161.374] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0161.374] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0161.374] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0161.375] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0161.375] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.375] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.375] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.375] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3ed2, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3ed2, lpOverlapped=0x0) returned 1 [0161.376] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3ee0, dwBufLen=0x3ee0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3ee0) returned 1 [0161.376] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.376] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3ee0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3ee0, lpOverlapped=0x0) returned 1 [0161.376] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.376] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3fb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.377] SetEndOfFile (hFile=0xdc) returned 1 [0161.379] GetProcessHeap () returned 0x4e0000 [0161.379] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0161.379] GetProcessHeap () returned 0x4e0000 [0161.380] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0161.380] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182946.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182946.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0161.381] CloseHandle (hObject=0xdc) returned 1 [0161.381] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x745c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0183172.WMF", cAlternateFileName="")) returned 1 [0161.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183172.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0161.383] GetProcessHeap () returned 0x4e0000 [0161.383] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0161.383] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0161.383] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0161.383] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0161.385] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.385] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.385] GetProcessHeap () returned 0x4e0000 [0161.385] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0161.385] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0161.385] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.385] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0161.385] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0161.385] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0161.385] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0161.385] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0161.385] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0161.385] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.385] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.385] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.385] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x745c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x745c, lpOverlapped=0x0) returned 1 [0161.386] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7460, dwBufLen=0x7460 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7460) returned 1 [0161.387] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.387] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7460, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7460, lpOverlapped=0x0) returned 1 [0161.387] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.387] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7534, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.387] SetEndOfFile (hFile=0xdc) returned 1 [0161.389] GetProcessHeap () returned 0x4e0000 [0161.389] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0161.389] GetProcessHeap () returned 0x4e0000 [0161.389] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0161.389] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183172.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183172.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0161.390] CloseHandle (hObject=0xdc) returned 1 [0161.390] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6fd2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0183174.WMF", cAlternateFileName="")) returned 1 [0161.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183174.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0161.391] GetProcessHeap () returned 0x4e0000 [0161.391] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0161.391] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0161.391] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0161.391] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0161.393] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.393] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.393] GetProcessHeap () returned 0x4e0000 [0161.393] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0161.393] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0161.393] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.393] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0161.394] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0161.394] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0161.394] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0161.394] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0161.394] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0161.394] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.394] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.394] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.394] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x6fd2, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x6fd2, lpOverlapped=0x0) returned 1 [0161.395] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6fe0, dwBufLen=0x6fe0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6fe0) returned 1 [0161.395] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.395] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6fe0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x6fe0, lpOverlapped=0x0) returned 1 [0161.395] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.395] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x70b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.395] SetEndOfFile (hFile=0xdc) returned 1 [0161.398] GetProcessHeap () returned 0x4e0000 [0161.398] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0161.398] GetProcessHeap () returned 0x4e0000 [0161.398] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0161.398] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183174.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183174.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0161.399] CloseHandle (hObject=0xdc) returned 1 [0161.399] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5f6e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0183198.WMF", cAlternateFileName="")) returned 1 [0161.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183198.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0161.400] GetProcessHeap () returned 0x4e0000 [0161.400] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0161.400] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0161.400] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0161.400] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0161.402] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.402] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.402] GetProcessHeap () returned 0x4e0000 [0161.402] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0161.402] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0161.402] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.402] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0161.402] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0161.402] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0161.402] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0161.402] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0161.402] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0161.402] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.402] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.402] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.402] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5f6e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x5f6e, lpOverlapped=0x0) returned 1 [0161.403] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5f70, dwBufLen=0x5f70 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5f70) returned 1 [0161.404] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.404] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5f70, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5f70, lpOverlapped=0x0) returned 1 [0161.404] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.404] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6044, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.404] SetEndOfFile (hFile=0xdc) returned 1 [0161.406] GetProcessHeap () returned 0x4e0000 [0161.406] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0161.406] GetProcessHeap () returned 0x4e0000 [0161.406] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0161.406] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183198.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183198.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0161.407] CloseHandle (hObject=0xdc) returned 1 [0161.408] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b4a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0183574.WMF", cAlternateFileName="")) returned 1 [0161.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183574.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0161.409] GetProcessHeap () returned 0x4e0000 [0161.409] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0161.409] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0161.409] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0161.409] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0161.411] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.411] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.411] GetProcessHeap () returned 0x4e0000 [0161.411] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0161.411] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0161.411] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.411] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0161.412] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0161.412] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0161.412] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0161.412] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0161.412] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0161.412] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.412] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.412] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.412] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4b4a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4b4a, lpOverlapped=0x0) returned 1 [0161.426] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4b50, dwBufLen=0x4b50 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4b50) returned 1 [0161.426] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.426] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4b50, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4b50, lpOverlapped=0x0) returned 1 [0161.427] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.427] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4c24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.427] SetEndOfFile (hFile=0xdc) returned 1 [0161.431] GetProcessHeap () returned 0x4e0000 [0161.431] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0161.431] GetProcessHeap () returned 0x4e0000 [0161.431] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0161.431] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183574.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183574.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0161.433] CloseHandle (hObject=0xdc) returned 1 [0161.433] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1c88, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0185670.WMF", cAlternateFileName="")) returned 1 [0161.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185670.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0161.435] GetProcessHeap () returned 0x4e0000 [0161.435] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0161.435] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0161.435] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0161.435] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0161.445] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.445] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.445] GetProcessHeap () returned 0x4e0000 [0161.445] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0161.445] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0161.445] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.445] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0161.445] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0161.446] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0161.446] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0161.446] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0161.446] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0161.446] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.446] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.446] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.446] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1c88, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1c88, lpOverlapped=0x0) returned 1 [0161.447] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1c90, dwBufLen=0x1c90 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1c90) returned 1 [0161.447] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.447] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1c90, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1c90, lpOverlapped=0x0) returned 1 [0161.448] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.448] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1d64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.448] SetEndOfFile (hFile=0xdc) returned 1 [0161.450] GetProcessHeap () returned 0x4e0000 [0161.451] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0161.451] GetProcessHeap () returned 0x4e0000 [0161.451] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0161.451] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185670.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185670.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0161.452] CloseHandle (hObject=0xdc) returned 1 [0161.452] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4e46, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0185774.WMF", cAlternateFileName="")) returned 1 [0161.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185774.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0161.456] GetProcessHeap () returned 0x4e0000 [0161.456] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0161.456] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0161.456] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0161.456] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0161.458] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.458] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.458] GetProcessHeap () returned 0x4e0000 [0161.458] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0161.458] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0161.458] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.459] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0161.459] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0161.459] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0161.459] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0161.459] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0161.459] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0161.459] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.459] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.459] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.459] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4e46, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4e46, lpOverlapped=0x0) returned 1 [0161.461] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4e50, dwBufLen=0x4e50 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4e50) returned 1 [0161.461] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.461] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4e50, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4e50, lpOverlapped=0x0) returned 1 [0161.461] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.461] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4f24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.461] SetEndOfFile (hFile=0xdc) returned 1 [0161.464] GetProcessHeap () returned 0x4e0000 [0161.464] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0161.464] GetProcessHeap () returned 0x4e0000 [0161.464] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0161.464] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185774.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185774.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0161.466] CloseHandle (hObject=0xdc) returned 1 [0161.466] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x69d8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0185776.WMF", cAlternateFileName="")) returned 1 [0161.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185776.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0161.467] GetProcessHeap () returned 0x4e0000 [0161.467] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0161.467] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0161.467] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0161.468] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0161.471] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.471] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.471] GetProcessHeap () returned 0x4e0000 [0161.471] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0161.471] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0161.471] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.471] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0161.471] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0161.471] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0161.471] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0161.471] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0161.471] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0161.472] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.472] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.472] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.472] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x69d8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x69d8, lpOverlapped=0x0) returned 1 [0161.473] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x69e0, dwBufLen=0x69e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x69e0) returned 1 [0161.473] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.473] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x69e0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x69e0, lpOverlapped=0x0) returned 1 [0161.474] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.474] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6ab4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.474] SetEndOfFile (hFile=0xdc) returned 1 [0161.477] GetProcessHeap () returned 0x4e0000 [0161.477] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0161.477] GetProcessHeap () returned 0x4e0000 [0161.477] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0161.477] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185776.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185776.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0161.479] CloseHandle (hObject=0xdc) returned 1 [0161.479] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x62e0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0185778.WMF", cAlternateFileName="")) returned 1 [0161.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185778.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0161.481] GetProcessHeap () returned 0x4e0000 [0161.481] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0161.481] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0161.481] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0161.481] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.481] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.481] GetProcessHeap () returned 0x4e0000 [0161.481] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0161.481] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0161.481] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.481] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0161.483] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0161.484] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0161.484] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0161.484] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0161.484] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0161.484] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.484] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.484] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.484] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x62e0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x62e0, lpOverlapped=0x0) returned 1 [0161.485] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x62e0, dwBufLen=0x62e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x62e0) returned 1 [0161.486] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.486] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x62e0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x62e0, lpOverlapped=0x0) returned 1 [0161.486] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.486] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x63b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.490] SetEndOfFile (hFile=0xdc) returned 1 [0161.493] GetProcessHeap () returned 0x4e0000 [0161.493] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0161.493] GetProcessHeap () returned 0x4e0000 [0161.493] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0161.493] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185778.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185778.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0161.495] CloseHandle (hObject=0xdc) returned 1 [0161.495] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe956, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0185780.WMF", cAlternateFileName="")) returned 1 [0161.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185780.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0161.497] GetProcessHeap () returned 0x4e0000 [0161.497] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0161.497] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0161.497] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0161.497] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0161.566] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.566] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.567] GetProcessHeap () returned 0x4e0000 [0161.567] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0161.567] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0161.567] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.567] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0161.567] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0161.567] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0161.567] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0161.567] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0161.567] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0161.567] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.567] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.567] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.567] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xe956, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xe956, lpOverlapped=0x0) returned 1 [0161.569] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe960, dwBufLen=0xe960 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe960) returned 1 [0161.570] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.570] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe960, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xe960, lpOverlapped=0x0) returned 1 [0161.570] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.570] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xea34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.570] SetEndOfFile (hFile=0xdc) returned 1 [0161.573] GetProcessHeap () returned 0x4e0000 [0161.573] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0161.573] GetProcessHeap () returned 0x4e0000 [0161.573] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0161.573] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185780.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185780.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0161.575] CloseHandle (hObject=0xdc) returned 1 [0161.575] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x99a2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0185786.WMF", cAlternateFileName="")) returned 1 [0161.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185786.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0161.576] GetProcessHeap () returned 0x4e0000 [0161.576] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0161.576] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0161.576] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0161.576] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0161.578] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.578] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.578] GetProcessHeap () returned 0x4e0000 [0161.578] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0161.578] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0161.578] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.578] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0161.578] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0161.578] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0161.579] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0161.579] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0161.579] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0161.579] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.579] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.579] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.579] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x99a2, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x99a2, lpOverlapped=0x0) returned 1 [0161.580] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x99b0, dwBufLen=0x99b0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x99b0) returned 1 [0161.581] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.581] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x99b0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x99b0, lpOverlapped=0x0) returned 1 [0161.581] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.581] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x9a84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.581] SetEndOfFile (hFile=0xdc) returned 1 [0161.584] GetProcessHeap () returned 0x4e0000 [0161.584] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0161.584] GetProcessHeap () returned 0x4e0000 [0161.584] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0161.584] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185786.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185786.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0161.586] CloseHandle (hObject=0xdc) returned 1 [0161.586] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x50b6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0185790.WMF", cAlternateFileName="")) returned 1 [0161.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185790.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0161.587] GetProcessHeap () returned 0x4e0000 [0161.587] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0161.587] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0161.587] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0161.587] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0161.589] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.589] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.589] GetProcessHeap () returned 0x4e0000 [0161.589] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0161.590] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0161.590] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.590] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0161.590] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0161.590] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0161.590] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0161.590] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0161.590] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0161.590] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.590] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.590] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.590] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x50b6, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x50b6, lpOverlapped=0x0) returned 1 [0161.591] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x50c0, dwBufLen=0x50c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x50c0) returned 1 [0161.592] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.592] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x50c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x50c0, lpOverlapped=0x0) returned 1 [0161.592] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.592] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.592] SetEndOfFile (hFile=0xdc) returned 1 [0161.595] GetProcessHeap () returned 0x4e0000 [0161.595] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0161.595] GetProcessHeap () returned 0x4e0000 [0161.595] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0161.595] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185790.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185790.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0161.596] CloseHandle (hObject=0xdc) returned 1 [0161.597] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x650c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0185796.WMF", cAlternateFileName="")) returned 1 [0161.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185796.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0161.597] GetProcessHeap () returned 0x4e0000 [0161.597] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0161.597] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0161.597] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0161.598] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0161.599] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.600] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.600] GetProcessHeap () returned 0x4e0000 [0161.600] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0161.600] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0161.600] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.600] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0161.600] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0161.600] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0161.600] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0161.600] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0161.600] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0161.601] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.601] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.601] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.601] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x650c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x650c, lpOverlapped=0x0) returned 1 [0161.608] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6510, dwBufLen=0x6510 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6510) returned 1 [0161.608] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.608] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6510, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x6510, lpOverlapped=0x0) returned 1 [0161.609] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.609] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x65e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.609] SetEndOfFile (hFile=0xdc) returned 1 [0161.612] GetProcessHeap () returned 0x4e0000 [0161.612] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0161.612] GetProcessHeap () returned 0x4e0000 [0161.612] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0161.612] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185796.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185796.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0161.613] CloseHandle (hObject=0xdc) returned 1 [0161.613] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8420, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0185798.WMF", cAlternateFileName="")) returned 1 [0161.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185798.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0161.614] GetProcessHeap () returned 0x4e0000 [0161.614] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0161.614] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0161.614] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0161.615] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.615] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.615] GetProcessHeap () returned 0x4e0000 [0161.615] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0161.615] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0161.615] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.615] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0161.624] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0161.624] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0161.624] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0161.624] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0161.624] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0161.624] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.625] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.625] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.625] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x8420, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x8420, lpOverlapped=0x0) returned 1 [0161.628] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8420, dwBufLen=0x8420 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8420) returned 1 [0161.629] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.629] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x8420, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x8420, lpOverlapped=0x0) returned 1 [0161.630] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.630] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x84f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.630] SetEndOfFile (hFile=0xdc) returned 1 [0161.635] GetProcessHeap () returned 0x4e0000 [0161.635] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0161.635] GetProcessHeap () returned 0x4e0000 [0161.635] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0161.635] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185798.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185798.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0161.637] CloseHandle (hObject=0xdc) returned 1 [0161.637] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5eae, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0185800.WMF", cAlternateFileName="")) returned 1 [0161.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185800.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0161.639] GetProcessHeap () returned 0x4e0000 [0161.639] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0161.639] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0161.639] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0161.639] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0161.641] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.641] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.641] GetProcessHeap () returned 0x4e0000 [0161.641] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0161.641] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0161.641] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.641] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0161.642] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0161.642] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0161.642] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0161.642] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0161.642] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0161.642] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.642] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.642] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.642] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5eae, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x5eae, lpOverlapped=0x0) returned 1 [0161.644] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5eb0, dwBufLen=0x5eb0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5eb0) returned 1 [0161.644] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.644] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5eb0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5eb0, lpOverlapped=0x0) returned 1 [0161.644] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.644] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5f84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.644] SetEndOfFile (hFile=0xdc) returned 1 [0161.659] GetProcessHeap () returned 0x4e0000 [0161.659] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0161.659] GetProcessHeap () returned 0x4e0000 [0161.659] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0161.660] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185800.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185800.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0161.661] CloseHandle (hObject=0xdc) returned 1 [0161.661] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x773a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0185806.WMF", cAlternateFileName="")) returned 1 [0161.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185806.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0161.662] GetProcessHeap () returned 0x4e0000 [0161.662] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0161.662] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0161.662] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0161.662] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0161.696] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.696] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.696] GetProcessHeap () returned 0x4e0000 [0161.696] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0161.696] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0161.696] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.696] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0161.696] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0161.696] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0161.696] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0161.697] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0161.697] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0161.697] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.697] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.697] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.697] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x773a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x773a, lpOverlapped=0x0) returned 1 [0161.703] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7740, dwBufLen=0x7740 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7740) returned 1 [0161.703] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.703] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7740, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7740, lpOverlapped=0x0) returned 1 [0161.704] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.704] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.704] SetEndOfFile (hFile=0xdc) returned 1 [0161.707] GetProcessHeap () returned 0x4e0000 [0161.707] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0161.707] GetProcessHeap () returned 0x4e0000 [0161.707] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0161.707] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185806.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185806.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0161.709] CloseHandle (hObject=0xdc) returned 1 [0161.709] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8b8e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0185818.WMF", cAlternateFileName="")) returned 1 [0161.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185818.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0161.710] GetProcessHeap () returned 0x4e0000 [0161.710] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0161.710] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0161.710] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0161.710] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0161.738] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.738] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.738] GetProcessHeap () returned 0x4e0000 [0161.738] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0161.738] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0161.739] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.739] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0161.739] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0161.739] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0161.739] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0161.739] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0161.739] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0161.739] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.739] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.739] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.739] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x8b8e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x8b8e, lpOverlapped=0x0) returned 1 [0161.741] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8b90, dwBufLen=0x8b90 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8b90) returned 1 [0161.741] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.741] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x8b90, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x8b90, lpOverlapped=0x0) returned 1 [0161.742] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.742] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x8c64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.742] SetEndOfFile (hFile=0xdc) returned 1 [0161.744] GetProcessHeap () returned 0x4e0000 [0161.744] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0161.744] GetProcessHeap () returned 0x4e0000 [0161.745] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0161.745] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185818.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185818.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0161.746] CloseHandle (hObject=0xdc) returned 1 [0161.746] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e74, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0185828.WMF", cAlternateFileName="")) returned 1 [0161.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185828.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0161.747] GetProcessHeap () returned 0x4e0000 [0161.747] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0161.747] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0161.747] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0161.747] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0161.749] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.749] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.749] GetProcessHeap () returned 0x4e0000 [0161.750] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0161.750] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0161.750] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.750] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0161.750] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0161.750] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0161.750] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0161.750] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0161.750] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0161.750] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.750] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.750] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.750] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1e74, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1e74, lpOverlapped=0x0) returned 1 [0161.753] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1e80, dwBufLen=0x1e80 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1e80) returned 1 [0161.754] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.754] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1e80, lpOverlapped=0x0) returned 1 [0161.754] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.754] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1f54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.754] SetEndOfFile (hFile=0xdc) returned 1 [0161.757] GetProcessHeap () returned 0x4e0000 [0161.757] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0161.757] GetProcessHeap () returned 0x4e0000 [0161.757] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0161.757] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185828.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185828.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0161.758] CloseHandle (hObject=0xdc) returned 1 [0161.758] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2182, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0185834.WMF", cAlternateFileName="")) returned 1 [0161.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185834.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0161.760] GetProcessHeap () returned 0x4e0000 [0161.760] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0161.760] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0161.760] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0161.760] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0161.762] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.762] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.762] GetProcessHeap () returned 0x4e0000 [0161.762] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0161.762] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0161.762] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.763] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0161.763] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0161.763] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0161.763] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0161.763] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0161.763] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0161.763] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.763] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.763] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.763] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2182, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2182, lpOverlapped=0x0) returned 1 [0161.764] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2190, dwBufLen=0x2190 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2190) returned 1 [0161.764] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.765] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2190, lpOverlapped=0x0) returned 1 [0161.765] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.765] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2264, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.765] SetEndOfFile (hFile=0xdc) returned 1 [0161.767] GetProcessHeap () returned 0x4e0000 [0161.767] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0161.767] GetProcessHeap () returned 0x4e0000 [0161.768] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0161.768] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185834.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185834.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0161.769] CloseHandle (hObject=0xdc) returned 1 [0161.769] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x37e4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0185842.WMF", cAlternateFileName="")) returned 1 [0161.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185842.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0161.770] GetProcessHeap () returned 0x4e0000 [0161.770] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0161.771] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0161.771] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0161.771] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0161.773] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.773] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.773] GetProcessHeap () returned 0x4e0000 [0161.773] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0161.773] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0161.773] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.773] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0161.773] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0161.773] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0161.774] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0161.774] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0161.774] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0161.774] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.774] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.774] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.774] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x37e4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x37e4, lpOverlapped=0x0) returned 1 [0161.776] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x37f0, dwBufLen=0x37f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x37f0) returned 1 [0161.776] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.776] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x37f0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x37f0, lpOverlapped=0x0) returned 1 [0161.776] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.776] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x38c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.776] SetEndOfFile (hFile=0xdc) returned 1 [0161.779] GetProcessHeap () returned 0x4e0000 [0161.779] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0161.779] GetProcessHeap () returned 0x4e0000 [0161.779] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0161.779] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185842.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185842.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0161.783] CloseHandle (hObject=0xdc) returned 1 [0161.783] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x21da, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0186346.WMF", cAlternateFileName="")) returned 1 [0161.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186346.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0161.784] GetProcessHeap () returned 0x4e0000 [0161.784] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0161.784] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0161.784] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0161.784] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0161.787] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.787] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.787] GetProcessHeap () returned 0x4e0000 [0161.787] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0161.787] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0161.787] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.787] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0161.787] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0161.787] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0161.787] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0161.787] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0161.787] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0161.787] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.788] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.788] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.788] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x21da, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x21da, lpOverlapped=0x0) returned 1 [0161.789] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x21e0, dwBufLen=0x21e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x21e0) returned 1 [0161.789] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.789] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x21e0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x21e0, lpOverlapped=0x0) returned 1 [0161.789] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.789] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x22b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.789] SetEndOfFile (hFile=0xdc) returned 1 [0161.792] GetProcessHeap () returned 0x4e0000 [0161.792] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0161.792] GetProcessHeap () returned 0x4e0000 [0161.792] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0161.792] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186346.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186346.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0161.794] CloseHandle (hObject=0xdc) returned 1 [0161.794] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x843a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0186360.WMF", cAlternateFileName="")) returned 1 [0161.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186360.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0161.795] GetProcessHeap () returned 0x4e0000 [0161.795] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0161.795] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0161.795] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0161.795] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0161.797] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.797] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.797] GetProcessHeap () returned 0x4e0000 [0161.797] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0161.797] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0161.797] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.797] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0161.797] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0161.797] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0161.797] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0161.798] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0161.798] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0161.798] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.798] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.798] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.798] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x843a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x843a, lpOverlapped=0x0) returned 1 [0161.799] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8440, dwBufLen=0x8440 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8440) returned 1 [0161.800] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.800] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x8440, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x8440, lpOverlapped=0x0) returned 1 [0161.800] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.800] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x8514, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.800] SetEndOfFile (hFile=0xdc) returned 1 [0161.803] GetProcessHeap () returned 0x4e0000 [0161.803] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0161.803] GetProcessHeap () returned 0x4e0000 [0161.803] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0161.803] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186360.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186360.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0161.804] CloseHandle (hObject=0xdc) returned 1 [0161.804] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x44fe, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0186362.WMF", cAlternateFileName="")) returned 1 [0161.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186362.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0161.805] GetProcessHeap () returned 0x4e0000 [0161.805] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0161.805] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0161.805] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0161.806] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0161.808] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.808] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.808] GetProcessHeap () returned 0x4e0000 [0161.808] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0161.808] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0161.808] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.808] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0161.808] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0161.808] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0161.808] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0161.808] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0161.808] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0161.809] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.809] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.809] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.809] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x44fe, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x44fe, lpOverlapped=0x0) returned 1 [0161.810] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4500, dwBufLen=0x4500 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4500) returned 1 [0161.810] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.810] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4500, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4500, lpOverlapped=0x0) returned 1 [0161.810] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.810] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x45d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.810] SetEndOfFile (hFile=0xdc) returned 1 [0161.813] GetProcessHeap () returned 0x4e0000 [0161.813] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0161.813] GetProcessHeap () returned 0x4e0000 [0161.813] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0161.813] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186362.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186362.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0161.814] CloseHandle (hObject=0xdc) returned 1 [0161.815] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4724, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0186364.WMF", cAlternateFileName="")) returned 1 [0161.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186364.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0161.815] GetProcessHeap () returned 0x4e0000 [0161.815] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0161.816] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0161.816] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0161.816] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0161.828] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.828] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.828] GetProcessHeap () returned 0x4e0000 [0161.828] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0161.828] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0161.828] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.828] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0161.828] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0161.828] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0161.828] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0161.828] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0161.828] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0161.828] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.829] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.829] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.829] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4724, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4724, lpOverlapped=0x0) returned 1 [0161.830] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4730, dwBufLen=0x4730 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4730) returned 1 [0161.830] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.830] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4730, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4730, lpOverlapped=0x0) returned 1 [0161.830] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.830] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4804, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.830] SetEndOfFile (hFile=0xdc) returned 1 [0161.833] GetProcessHeap () returned 0x4e0000 [0161.833] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0161.833] GetProcessHeap () returned 0x4e0000 [0161.833] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0161.833] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186364.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186364.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0161.835] CloseHandle (hObject=0xdc) returned 1 [0161.835] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x19c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187647.WMF", cAlternateFileName="")) returned 1 [0161.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187647.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0161.837] GetProcessHeap () returned 0x4e0000 [0161.837] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0161.837] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0161.837] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0161.837] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0161.839] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.839] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.839] GetProcessHeap () returned 0x4e0000 [0161.839] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0161.839] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0161.839] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.839] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0161.839] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0161.839] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0161.839] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0161.839] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0161.839] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0161.840] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.840] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.840] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.840] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x19c4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x19c4, lpOverlapped=0x0) returned 1 [0161.841] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x19d0, dwBufLen=0x19d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x19d0) returned 1 [0161.841] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.841] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x19d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x19d0, lpOverlapped=0x0) returned 1 [0161.841] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.841] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1aa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.841] SetEndOfFile (hFile=0xdc) returned 1 [0161.844] GetProcessHeap () returned 0x4e0000 [0161.844] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0161.844] GetProcessHeap () returned 0x4e0000 [0161.844] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0161.844] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187647.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187647.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0161.845] CloseHandle (hObject=0xdc) returned 1 [0161.845] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1500, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187815.WMF", cAlternateFileName="")) returned 1 [0161.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187815.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0161.846] GetProcessHeap () returned 0x4e0000 [0161.846] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0161.846] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0161.846] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0161.846] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.846] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.846] GetProcessHeap () returned 0x4e0000 [0161.846] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0161.846] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0161.846] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.846] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0161.850] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0161.851] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0161.851] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0161.851] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0161.851] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0161.851] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.851] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.851] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.851] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1500, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1500, lpOverlapped=0x0) returned 1 [0161.852] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1500, dwBufLen=0x1500 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1500) returned 1 [0161.852] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.852] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1500, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1500, lpOverlapped=0x0) returned 1 [0161.852] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.852] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x15d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.852] SetEndOfFile (hFile=0xdc) returned 1 [0161.855] GetProcessHeap () returned 0x4e0000 [0161.855] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0161.855] GetProcessHeap () returned 0x4e0000 [0161.855] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0161.855] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187815.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187815.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0161.856] CloseHandle (hObject=0xdc) returned 1 [0161.857] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2d7c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187817.WMF", cAlternateFileName="")) returned 1 [0161.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187817.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0161.857] GetProcessHeap () returned 0x4e0000 [0161.857] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0161.857] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0161.857] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0161.858] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0161.873] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.873] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.873] GetProcessHeap () returned 0x4e0000 [0161.873] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0161.873] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0161.873] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.873] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0161.873] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0161.873] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0161.874] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0161.874] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0161.874] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0161.874] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.874] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.874] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.874] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2d7c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2d7c, lpOverlapped=0x0) returned 1 [0161.875] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2d80, dwBufLen=0x2d80 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2d80) returned 1 [0161.876] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.876] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2d80, lpOverlapped=0x0) returned 1 [0161.876] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.876] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2e54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.876] SetEndOfFile (hFile=0xdc) returned 1 [0161.879] GetProcessHeap () returned 0x4e0000 [0161.879] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0161.879] GetProcessHeap () returned 0x4e0000 [0161.879] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0161.879] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187817.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187817.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0161.880] CloseHandle (hObject=0xdc) returned 1 [0161.880] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2870, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187819.WMF", cAlternateFileName="")) returned 1 [0161.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187819.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0161.885] GetProcessHeap () returned 0x4e0000 [0161.885] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0161.885] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0161.885] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0161.885] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.885] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.885] GetProcessHeap () returned 0x4e0000 [0161.885] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0161.885] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0161.885] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.885] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0161.890] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0161.890] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0161.891] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0161.891] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0161.891] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0161.891] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.891] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.891] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.891] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2870, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2870, lpOverlapped=0x0) returned 1 [0161.893] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2870, dwBufLen=0x2870 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2870) returned 1 [0161.893] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.893] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2870, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2870, lpOverlapped=0x0) returned 1 [0161.893] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.894] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2944, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.894] SetEndOfFile (hFile=0xdc) returned 1 [0161.896] GetProcessHeap () returned 0x4e0000 [0161.896] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0161.896] GetProcessHeap () returned 0x4e0000 [0161.896] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0161.896] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187819.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187819.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0161.898] CloseHandle (hObject=0xdc) returned 1 [0161.898] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d4c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187825.WMF", cAlternateFileName="")) returned 1 [0161.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187825.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0161.899] GetProcessHeap () returned 0x4e0000 [0161.899] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0161.899] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0161.899] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0161.899] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0161.903] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.903] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.903] GetProcessHeap () returned 0x4e0000 [0161.903] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0161.903] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0161.903] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.903] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0161.903] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0161.903] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0161.904] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0161.904] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0161.904] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0161.904] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.904] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.904] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.904] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1d4c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1d4c, lpOverlapped=0x0) returned 1 [0161.905] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1d50, dwBufLen=0x1d50 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1d50) returned 1 [0161.905] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.905] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1d50, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1d50, lpOverlapped=0x0) returned 1 [0161.906] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.906] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1e24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.906] SetEndOfFile (hFile=0xdc) returned 1 [0161.908] GetProcessHeap () returned 0x4e0000 [0161.908] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0161.908] GetProcessHeap () returned 0x4e0000 [0161.909] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0161.909] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187825.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187825.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0161.910] CloseHandle (hObject=0xdc) returned 1 [0161.910] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3040, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187829.WMF", cAlternateFileName="")) returned 1 [0161.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187829.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0161.911] GetProcessHeap () returned 0x4e0000 [0161.911] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0161.911] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0161.911] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0161.911] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.911] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.911] GetProcessHeap () returned 0x4e0000 [0161.911] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0161.911] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0161.912] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.912] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0161.925] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0161.925] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0161.925] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0161.925] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0161.925] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0161.925] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.925] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.925] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.925] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3040, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3040, lpOverlapped=0x0) returned 1 [0161.927] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3040, dwBufLen=0x3040 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3040) returned 1 [0161.927] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.927] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3040, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3040, lpOverlapped=0x0) returned 1 [0161.927] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.927] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3114, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.927] SetEndOfFile (hFile=0xdc) returned 1 [0161.930] GetProcessHeap () returned 0x4e0000 [0161.930] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0161.930] GetProcessHeap () returned 0x4e0000 [0161.930] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0161.930] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187829.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187829.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0161.933] CloseHandle (hObject=0xdc) returned 1 [0161.933] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2480, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187835.WMF", cAlternateFileName="")) returned 1 [0161.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187835.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0161.934] GetProcessHeap () returned 0x4e0000 [0161.934] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0161.934] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0161.934] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0161.934] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.934] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.934] GetProcessHeap () returned 0x4e0000 [0161.934] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0161.934] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0161.934] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.934] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0161.937] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0161.937] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0161.937] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0161.937] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0161.937] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0161.937] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.937] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.937] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.937] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2480, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2480, lpOverlapped=0x0) returned 1 [0161.938] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2480, dwBufLen=0x2480 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2480) returned 1 [0161.938] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.938] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2480, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2480, lpOverlapped=0x0) returned 1 [0161.939] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.939] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2554, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.939] SetEndOfFile (hFile=0xdc) returned 1 [0161.941] GetProcessHeap () returned 0x4e0000 [0161.941] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0161.941] GetProcessHeap () returned 0x4e0000 [0161.941] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0161.942] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187835.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187835.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0161.943] CloseHandle (hObject=0xdc) returned 1 [0161.943] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3fe2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187837.WMF", cAlternateFileName="")) returned 1 [0161.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187837.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0161.945] GetProcessHeap () returned 0x4e0000 [0161.945] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0161.945] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0161.945] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0161.945] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0161.948] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.948] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.948] GetProcessHeap () returned 0x4e0000 [0161.948] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0161.948] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0161.948] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.948] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0161.949] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0161.949] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0161.949] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0161.949] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0161.949] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0161.949] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.949] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.949] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.949] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3fe2, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3fe2, lpOverlapped=0x0) returned 1 [0161.950] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3ff0, dwBufLen=0x3ff0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3ff0) returned 1 [0161.950] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.950] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3ff0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3ff0, lpOverlapped=0x0) returned 1 [0161.950] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.950] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x40c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.950] SetEndOfFile (hFile=0xdc) returned 1 [0161.953] GetProcessHeap () returned 0x4e0000 [0161.953] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0161.953] GetProcessHeap () returned 0x4e0000 [0161.953] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0161.953] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187837.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187837.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0161.954] CloseHandle (hObject=0xdc) returned 1 [0161.954] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x14fc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187839.WMF", cAlternateFileName="")) returned 1 [0161.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187839.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0161.955] GetProcessHeap () returned 0x4e0000 [0161.955] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0161.955] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0161.955] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0161.955] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0161.956] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.956] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.956] GetProcessHeap () returned 0x4e0000 [0161.957] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0161.957] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0161.957] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.957] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0161.957] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0161.957] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0161.957] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0161.957] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0161.957] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0161.957] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.957] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.957] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.957] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x14fc, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x14fc, lpOverlapped=0x0) returned 1 [0161.958] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1500, dwBufLen=0x1500 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1500) returned 1 [0161.958] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.958] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1500, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1500, lpOverlapped=0x0) returned 1 [0161.958] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.958] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x15d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.958] SetEndOfFile (hFile=0xdc) returned 1 [0161.961] GetProcessHeap () returned 0x4e0000 [0161.961] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0161.961] GetProcessHeap () returned 0x4e0000 [0161.961] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0161.961] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187839.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187839.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0161.962] CloseHandle (hObject=0xdc) returned 1 [0161.962] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1bcc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187847.WMF", cAlternateFileName="")) returned 1 [0161.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187847.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0161.963] GetProcessHeap () returned 0x4e0000 [0161.963] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0161.963] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0161.963] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0161.963] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0161.965] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.965] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.965] GetProcessHeap () returned 0x4e0000 [0161.965] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0161.965] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0161.965] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.965] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0161.965] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0161.965] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0161.965] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0161.965] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0161.965] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0161.965] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.965] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.965] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.965] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1bcc, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1bcc, lpOverlapped=0x0) returned 1 [0161.966] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1bd0, dwBufLen=0x1bd0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1bd0) returned 1 [0161.966] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.966] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1bd0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1bd0, lpOverlapped=0x0) returned 1 [0161.967] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.967] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1ca4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.967] SetEndOfFile (hFile=0xdc) returned 1 [0161.969] GetProcessHeap () returned 0x4e0000 [0161.969] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0161.969] GetProcessHeap () returned 0x4e0000 [0161.969] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0161.969] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187847.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187847.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0161.970] CloseHandle (hObject=0xdc) returned 1 [0161.970] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d94, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187849.WMF", cAlternateFileName="")) returned 1 [0161.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187849.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0161.971] GetProcessHeap () returned 0x4e0000 [0161.971] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0161.971] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0161.971] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0161.971] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0161.973] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.973] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.973] GetProcessHeap () returned 0x4e0000 [0161.973] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0161.973] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0161.973] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.973] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0161.973] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0161.973] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0161.973] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0161.973] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0161.973] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0161.974] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.974] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.974] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.974] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1d94, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1d94, lpOverlapped=0x0) returned 1 [0161.974] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1da0, dwBufLen=0x1da0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1da0) returned 1 [0161.974] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.975] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1da0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1da0, lpOverlapped=0x0) returned 1 [0161.975] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.975] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1e74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.975] SetEndOfFile (hFile=0xdc) returned 1 [0161.977] GetProcessHeap () returned 0x4e0000 [0161.977] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0161.977] GetProcessHeap () returned 0x4e0000 [0161.977] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0161.977] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187849.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187849.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0161.978] CloseHandle (hObject=0xdc) returned 1 [0161.978] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x221c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187851.WMF", cAlternateFileName="")) returned 1 [0161.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187851.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0161.979] GetProcessHeap () returned 0x4e0000 [0161.979] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0161.979] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0161.979] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0161.979] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0161.981] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.981] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.981] GetProcessHeap () returned 0x4e0000 [0161.981] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0161.981] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0161.981] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.981] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0161.981] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0161.981] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0161.981] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0161.981] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0161.981] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0161.981] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.981] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.981] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.981] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x221c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x221c, lpOverlapped=0x0) returned 1 [0161.982] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2220, dwBufLen=0x2220 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2220) returned 1 [0161.982] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.982] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2220, lpOverlapped=0x0) returned 1 [0161.982] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.982] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x22f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.982] SetEndOfFile (hFile=0xdc) returned 1 [0161.985] GetProcessHeap () returned 0x4e0000 [0161.985] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0161.985] GetProcessHeap () returned 0x4e0000 [0161.985] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0161.985] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187851.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187851.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0161.986] CloseHandle (hObject=0xdc) returned 1 [0161.986] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187859.WMF", cAlternateFileName="")) returned 1 [0161.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187859.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0161.987] GetProcessHeap () returned 0x4e0000 [0161.987] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0161.987] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0161.987] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0161.987] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0161.990] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.990] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.990] GetProcessHeap () returned 0x4e0000 [0161.990] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0161.990] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0161.990] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.990] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0161.990] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0161.990] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0161.990] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0161.991] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0161.991] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0161.991] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.991] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.991] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.991] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xaac, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xaac, lpOverlapped=0x0) returned 1 [0161.991] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xab0, dwBufLen=0xab0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xab0) returned 1 [0161.991] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.991] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xab0, lpOverlapped=0x0) returned 1 [0161.991] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.991] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xb84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.991] SetEndOfFile (hFile=0xdc) returned 1 [0161.993] GetProcessHeap () returned 0x4e0000 [0161.993] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0161.993] GetProcessHeap () returned 0x4e0000 [0161.993] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0161.993] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187859.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187859.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0161.994] CloseHandle (hObject=0xdc) returned 1 [0161.995] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2394, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187861.WMF", cAlternateFileName="")) returned 1 [0161.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187861.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0161.996] GetProcessHeap () returned 0x4e0000 [0161.996] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0161.996] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0161.996] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0161.996] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0161.998] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.998] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.998] GetProcessHeap () returned 0x4e0000 [0161.998] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0161.998] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0161.998] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.998] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0161.998] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0161.998] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0161.998] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0161.998] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0161.998] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0161.998] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0161.998] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0161.998] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.998] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2394, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2394, lpOverlapped=0x0) returned 1 [0161.999] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x23a0, dwBufLen=0x23a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x23a0) returned 1 [0161.999] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.999] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x23a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x23a0, lpOverlapped=0x0) returned 1 [0161.999] CryptDestroyKey (hKey=0x522f98) returned 1 [0161.999] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.000] SetEndOfFile (hFile=0xdc) returned 1 [0162.002] GetProcessHeap () returned 0x4e0000 [0162.002] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0162.002] GetProcessHeap () returned 0x4e0000 [0162.002] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0162.002] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187861.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187861.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0162.003] CloseHandle (hObject=0xdc) returned 1 [0162.003] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2a44, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187863.WMF", cAlternateFileName="")) returned 1 [0162.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187863.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0162.004] GetProcessHeap () returned 0x4e0000 [0162.004] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0162.004] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0162.004] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0162.004] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0162.005] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.006] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.006] GetProcessHeap () returned 0x4e0000 [0162.006] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0162.006] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0162.006] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.006] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0162.006] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.006] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0162.006] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0162.006] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0162.006] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0162.006] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.006] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.006] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.006] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2a44, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2a44, lpOverlapped=0x0) returned 1 [0162.007] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2a50, dwBufLen=0x2a50 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2a50) returned 1 [0162.007] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.007] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2a50, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2a50, lpOverlapped=0x0) returned 1 [0162.008] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.008] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2b24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.008] SetEndOfFile (hFile=0xdc) returned 1 [0162.010] GetProcessHeap () returned 0x4e0000 [0162.010] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0162.010] GetProcessHeap () returned 0x4e0000 [0162.010] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0162.010] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187863.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187863.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0162.011] CloseHandle (hObject=0xdc) returned 1 [0162.011] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1258, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187881.WMF", cAlternateFileName="")) returned 1 [0162.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187881.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0162.011] GetProcessHeap () returned 0x4e0000 [0162.011] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0162.011] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0162.011] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0162.012] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0162.013] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.013] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.013] GetProcessHeap () returned 0x4e0000 [0162.013] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0162.013] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0162.013] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.013] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0162.013] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.014] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0162.014] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0162.014] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0162.014] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0162.014] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.014] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.014] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.014] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1258, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1258, lpOverlapped=0x0) returned 1 [0162.015] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1260, dwBufLen=0x1260 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1260) returned 1 [0162.015] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.015] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1260, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1260, lpOverlapped=0x0) returned 1 [0162.015] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.015] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1334, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.015] SetEndOfFile (hFile=0xdc) returned 1 [0162.017] GetProcessHeap () returned 0x4e0000 [0162.017] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0162.017] GetProcessHeap () returned 0x4e0000 [0162.017] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0162.017] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187881.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187881.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0162.018] CloseHandle (hObject=0xdc) returned 1 [0162.018] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x834, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187883.WMF", cAlternateFileName="")) returned 1 [0162.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187883.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0162.019] GetProcessHeap () returned 0x4e0000 [0162.019] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0162.019] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0162.019] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0162.019] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0162.020] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.020] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.020] GetProcessHeap () returned 0x4e0000 [0162.020] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0162.021] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0162.021] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.021] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0162.021] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.021] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0162.021] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0162.021] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0162.021] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0162.021] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.021] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.021] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.021] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x834, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x834, lpOverlapped=0x0) returned 1 [0162.021] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x840, dwBufLen=0x840 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x840) returned 1 [0162.021] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.021] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x840, lpOverlapped=0x0) returned 1 [0162.021] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.022] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x914, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.022] SetEndOfFile (hFile=0xdc) returned 1 [0162.024] GetProcessHeap () returned 0x4e0000 [0162.024] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0162.024] GetProcessHeap () returned 0x4e0000 [0162.024] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0162.024] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187883.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187883.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0162.025] CloseHandle (hObject=0xdc) returned 1 [0162.025] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x15f4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187893.WMF", cAlternateFileName="")) returned 1 [0162.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187893.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0162.025] GetProcessHeap () returned 0x4e0000 [0162.025] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0162.025] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0162.025] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0162.025] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0162.027] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.027] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.027] GetProcessHeap () returned 0x4e0000 [0162.027] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0162.027] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0162.027] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.027] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0162.027] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.027] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0162.027] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0162.028] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0162.028] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0162.028] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.028] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.028] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.028] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x15f4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x15f4, lpOverlapped=0x0) returned 1 [0162.029] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1600, dwBufLen=0x1600 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1600) returned 1 [0162.029] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.029] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1600, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1600, lpOverlapped=0x0) returned 1 [0162.029] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.029] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x16d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.029] SetEndOfFile (hFile=0xdc) returned 1 [0162.031] GetProcessHeap () returned 0x4e0000 [0162.031] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0162.031] GetProcessHeap () returned 0x4e0000 [0162.031] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0162.031] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187893.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187893.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0162.032] CloseHandle (hObject=0xdc) returned 1 [0162.032] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187895.WMF", cAlternateFileName="")) returned 1 [0162.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187895.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0162.033] GetProcessHeap () returned 0x4e0000 [0162.033] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0162.033] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0162.033] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0162.033] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.033] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.033] GetProcessHeap () returned 0x4e0000 [0162.033] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0162.033] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0162.033] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.033] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0162.035] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.035] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0162.035] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0162.035] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0162.035] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0162.035] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.035] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.035] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.035] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xd90, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xd90, lpOverlapped=0x0) returned 1 [0162.035] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xd90, dwBufLen=0xd90 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xd90) returned 1 [0162.035] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.035] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xd90, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xd90, lpOverlapped=0x0) returned 1 [0162.035] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.035] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xe64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.035] SetEndOfFile (hFile=0xdc) returned 1 [0162.038] GetProcessHeap () returned 0x4e0000 [0162.038] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0162.038] GetProcessHeap () returned 0x4e0000 [0162.038] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0162.038] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187895.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187895.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0162.039] CloseHandle (hObject=0xdc) returned 1 [0162.039] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1388, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187921.WMF", cAlternateFileName="")) returned 1 [0162.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187921.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0162.040] GetProcessHeap () returned 0x4e0000 [0162.040] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0162.040] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0162.040] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0162.040] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0162.042] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.042] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.042] GetProcessHeap () returned 0x4e0000 [0162.042] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0162.042] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0162.042] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.042] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0162.042] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.042] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0162.042] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0162.042] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0162.042] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0162.043] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.043] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.043] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.043] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1388, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1388, lpOverlapped=0x0) returned 1 [0162.043] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1390, dwBufLen=0x1390 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1390) returned 1 [0162.043] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.043] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1390, lpOverlapped=0x0) returned 1 [0162.044] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.044] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.044] SetEndOfFile (hFile=0xdc) returned 1 [0162.046] GetProcessHeap () returned 0x4e0000 [0162.046] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0162.046] GetProcessHeap () returned 0x4e0000 [0162.046] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0162.046] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187921.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187921.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0162.047] CloseHandle (hObject=0xdc) returned 1 [0162.047] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x29dc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0188511.WMF", cAlternateFileName="")) returned 1 [0162.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188511.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0162.048] GetProcessHeap () returned 0x4e0000 [0162.048] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0162.048] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0162.048] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0162.048] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.050] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.050] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.050] GetProcessHeap () returned 0x4e0000 [0162.050] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0162.050] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0162.050] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.050] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0162.050] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.050] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0162.050] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0162.050] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0162.050] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0162.050] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.050] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.050] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.050] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x29dc, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x29dc, lpOverlapped=0x0) returned 1 [0162.051] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x29e0, dwBufLen=0x29e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x29e0) returned 1 [0162.051] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.051] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x29e0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x29e0, lpOverlapped=0x0) returned 1 [0162.051] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.051] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2ab4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.051] SetEndOfFile (hFile=0xdc) returned 1 [0162.054] GetProcessHeap () returned 0x4e0000 [0162.054] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0162.054] GetProcessHeap () returned 0x4e0000 [0162.054] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0162.054] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188511.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188511.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0162.055] CloseHandle (hObject=0xdc) returned 1 [0162.055] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3004, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0188513.WMF", cAlternateFileName="")) returned 1 [0162.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188513.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0162.055] GetProcessHeap () returned 0x4e0000 [0162.055] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0162.055] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0162.055] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0162.055] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0162.057] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.057] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.057] GetProcessHeap () returned 0x4e0000 [0162.057] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0162.057] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0162.057] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.057] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0162.057] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.057] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0162.057] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0162.057] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0162.057] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0162.057] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.057] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.058] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.058] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3004, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3004, lpOverlapped=0x0) returned 1 [0162.058] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3010, dwBufLen=0x3010 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3010) returned 1 [0162.058] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.058] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3010, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3010, lpOverlapped=0x0) returned 1 [0162.059] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.059] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x30e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.059] SetEndOfFile (hFile=0xdc) returned 1 [0162.061] GetProcessHeap () returned 0x4e0000 [0162.061] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0162.061] GetProcessHeap () returned 0x4e0000 [0162.061] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0162.061] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188513.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188513.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0162.062] CloseHandle (hObject=0xdc) returned 1 [0162.062] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0188519.WMF", cAlternateFileName="")) returned 1 [0162.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188519.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0162.062] GetProcessHeap () returned 0x4e0000 [0162.062] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0162.062] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0162.062] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0162.062] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.062] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.062] GetProcessHeap () returned 0x4e0000 [0162.062] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0162.062] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0162.062] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.062] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0162.064] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.064] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0162.064] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0162.064] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0162.064] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0162.064] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.064] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.064] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.064] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x16c0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x16c0, lpOverlapped=0x0) returned 1 [0162.066] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x16c0, dwBufLen=0x16c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x16c0) returned 1 [0162.066] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.066] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x16c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x16c0, lpOverlapped=0x0) returned 1 [0162.066] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.066] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1794, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.066] SetEndOfFile (hFile=0xdc) returned 1 [0162.068] GetProcessHeap () returned 0x4e0000 [0162.068] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0162.068] GetProcessHeap () returned 0x4e0000 [0162.068] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0162.069] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188519.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188519.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0162.069] CloseHandle (hObject=0xdc) returned 1 [0162.069] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3b5c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0188587.WMF", cAlternateFileName="")) returned 1 [0162.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188587.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0162.070] GetProcessHeap () returned 0x4e0000 [0162.070] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0162.070] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0162.070] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0162.070] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.072] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.072] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.072] GetProcessHeap () returned 0x4e0000 [0162.072] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0162.072] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0162.072] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.072] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0162.072] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.072] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0162.072] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0162.072] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0162.072] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0162.072] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.072] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.072] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.072] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3b5c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3b5c, lpOverlapped=0x0) returned 1 [0162.073] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3b60, dwBufLen=0x3b60 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3b60) returned 1 [0162.073] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.073] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3b60, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3b60, lpOverlapped=0x0) returned 1 [0162.074] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.074] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3c34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.074] SetEndOfFile (hFile=0xdc) returned 1 [0162.076] GetProcessHeap () returned 0x4e0000 [0162.076] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0162.076] GetProcessHeap () returned 0x4e0000 [0162.076] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0162.076] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188587.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188587.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0162.077] CloseHandle (hObject=0xdc) returned 1 [0162.077] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3e9e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0188667.WMF", cAlternateFileName="")) returned 1 [0162.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188667.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0162.077] GetProcessHeap () returned 0x4e0000 [0162.077] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0162.077] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0162.077] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0162.077] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0162.079] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.079] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.079] GetProcessHeap () returned 0x4e0000 [0162.079] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0162.079] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0162.079] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.079] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0162.079] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.079] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0162.079] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0162.079] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0162.079] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0162.079] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.079] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.080] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.080] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3e9e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3e9e, lpOverlapped=0x0) returned 1 [0162.080] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3ea0, dwBufLen=0x3ea0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3ea0) returned 1 [0162.081] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.081] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3ea0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3ea0, lpOverlapped=0x0) returned 1 [0162.081] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.081] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3f74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.081] SetEndOfFile (hFile=0xdc) returned 1 [0162.083] GetProcessHeap () returned 0x4e0000 [0162.083] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0162.083] GetProcessHeap () returned 0x4e0000 [0162.083] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0162.083] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188667.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188667.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0162.084] CloseHandle (hObject=0xdc) returned 1 [0162.084] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x73a2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0188669.WMF", cAlternateFileName="")) returned 1 [0162.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188669.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0162.085] GetProcessHeap () returned 0x4e0000 [0162.085] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0162.085] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0162.086] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0162.086] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0162.087] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.087] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.087] GetProcessHeap () returned 0x4e0000 [0162.087] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0162.087] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0162.087] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.087] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0162.087] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.088] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0162.088] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0162.088] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0162.088] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0162.088] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.088] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.088] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.088] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x73a2, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x73a2, lpOverlapped=0x0) returned 1 [0162.089] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x73b0, dwBufLen=0x73b0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x73b0) returned 1 [0162.089] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.090] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x73b0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x73b0, lpOverlapped=0x0) returned 1 [0162.090] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.090] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7484, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.090] SetEndOfFile (hFile=0xdc) returned 1 [0162.092] GetProcessHeap () returned 0x4e0000 [0162.092] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0162.092] GetProcessHeap () returned 0x4e0000 [0162.092] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0162.092] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188669.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188669.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0162.093] CloseHandle (hObject=0xdc) returned 1 [0162.093] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x336a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0188679.WMF", cAlternateFileName="")) returned 1 [0162.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188679.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0162.094] GetProcessHeap () returned 0x4e0000 [0162.094] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0162.094] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0162.094] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0162.094] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0162.095] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.095] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.095] GetProcessHeap () returned 0x4e0000 [0162.095] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0162.095] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0162.095] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.096] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0162.096] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.096] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0162.096] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0162.096] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0162.096] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0162.096] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.096] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.096] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.096] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x336a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x336a, lpOverlapped=0x0) returned 1 [0162.097] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3370, dwBufLen=0x3370 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3370) returned 1 [0162.097] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.097] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3370, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3370, lpOverlapped=0x0) returned 1 [0162.097] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.097] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3444, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.097] SetEndOfFile (hFile=0xdc) returned 1 [0162.099] GetProcessHeap () returned 0x4e0000 [0162.099] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0162.099] GetProcessHeap () returned 0x4e0000 [0162.099] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0162.100] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188679.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188679.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0162.100] CloseHandle (hObject=0xdc) returned 1 [0162.100] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ca4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0195248.WMF", cAlternateFileName="")) returned 1 [0162.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195248.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0162.101] GetProcessHeap () returned 0x4e0000 [0162.101] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0162.101] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0162.101] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0162.101] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0162.103] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.103] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.103] GetProcessHeap () returned 0x4e0000 [0162.103] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0162.103] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0162.103] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.103] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0162.103] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.103] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0162.103] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0162.103] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0162.103] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0162.103] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.103] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.103] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.103] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1ca4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1ca4, lpOverlapped=0x0) returned 1 [0162.104] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1cb0, dwBufLen=0x1cb0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1cb0) returned 1 [0162.104] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.105] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1cb0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1cb0, lpOverlapped=0x0) returned 1 [0162.105] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.105] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1d84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.105] SetEndOfFile (hFile=0xdc) returned 1 [0162.108] GetProcessHeap () returned 0x4e0000 [0162.108] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0162.108] GetProcessHeap () returned 0x4e0000 [0162.108] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0162.108] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195248.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195248.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0162.109] CloseHandle (hObject=0xdc) returned 1 [0162.109] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81dcbf00, ftCreationTime.dwHighDateTime=0x1be2705, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81dcbf00, ftLastWriteTime.dwHighDateTime=0x1be2705, nFileSizeHigh=0x0, nFileSizeLow=0x11b6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0195254.WMF", cAlternateFileName="")) returned 1 [0162.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195254.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0162.110] GetProcessHeap () returned 0x4e0000 [0162.110] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0162.110] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0162.110] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0162.110] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0162.112] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.112] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.112] GetProcessHeap () returned 0x4e0000 [0162.112] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0162.112] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0162.112] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.112] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0162.112] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.112] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0162.113] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0162.113] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0162.113] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0162.113] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.113] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.113] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.113] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x11b6, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x11b6, lpOverlapped=0x0) returned 1 [0162.114] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x11c0, dwBufLen=0x11c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x11c0) returned 1 [0162.114] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.114] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x11c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x11c0, lpOverlapped=0x0) returned 1 [0162.114] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.114] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1294, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.114] SetEndOfFile (hFile=0xdc) returned 1 [0162.117] GetProcessHeap () returned 0x4e0000 [0162.117] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0162.117] GetProcessHeap () returned 0x4e0000 [0162.117] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0162.117] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195254.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195254.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0162.118] CloseHandle (hObject=0xdc) returned 1 [0162.118] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85704600, ftCreationTime.dwHighDateTime=0x1be2705, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x85704600, ftLastWriteTime.dwHighDateTime=0x1be2705, nFileSizeHigh=0x0, nFileSizeLow=0x207a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0195260.WMF", cAlternateFileName="")) returned 1 [0162.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195260.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0162.119] GetProcessHeap () returned 0x4e0000 [0162.119] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0162.119] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0162.119] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0162.119] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0162.121] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.121] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.121] GetProcessHeap () returned 0x4e0000 [0162.122] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0162.122] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0162.122] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.122] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0162.122] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.122] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0162.122] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0162.122] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0162.122] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0162.122] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.122] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.122] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.122] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x207a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x207a, lpOverlapped=0x0) returned 1 [0162.123] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2080, dwBufLen=0x2080 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2080) returned 1 [0162.123] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.124] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2080, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2080, lpOverlapped=0x0) returned 1 [0162.124] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.124] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2154, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.124] SetEndOfFile (hFile=0xdc) returned 1 [0162.127] GetProcessHeap () returned 0x4e0000 [0162.127] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0162.127] GetProcessHeap () returned 0x4e0000 [0162.127] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0162.127] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195260.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195260.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0162.132] CloseHandle (hObject=0xdc) returned 1 [0162.132] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98831600, ftCreationTime.dwHighDateTime=0x1be2705, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x98831600, ftLastWriteTime.dwHighDateTime=0x1be2705, nFileSizeHigh=0x0, nFileSizeLow=0x72f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0195320.WMF", cAlternateFileName="")) returned 1 [0162.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195320.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0162.134] GetProcessHeap () returned 0x4e0000 [0162.134] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0162.134] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0162.134] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0162.134] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0162.136] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.136] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.136] GetProcessHeap () returned 0x4e0000 [0162.136] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0162.136] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0162.136] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.136] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0162.136] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.136] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0162.137] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0162.137] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0162.137] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0162.137] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.137] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.137] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.137] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x72f8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x72f8, lpOverlapped=0x0) returned 1 [0162.138] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7300, dwBufLen=0x7300 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7300) returned 1 [0162.139] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.139] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7300, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7300, lpOverlapped=0x0) returned 1 [0162.139] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.139] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x73d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.139] SetEndOfFile (hFile=0xdc) returned 1 [0162.142] GetProcessHeap () returned 0x4e0000 [0162.142] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0162.142] GetProcessHeap () returned 0x4e0000 [0162.142] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0162.142] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195320.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195320.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0162.143] CloseHandle (hObject=0xdc) returned 1 [0162.143] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9338c00, ftCreationTime.dwHighDateTime=0x1be2705, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9338c00, ftLastWriteTime.dwHighDateTime=0x1be2705, nFileSizeHigh=0x0, nFileSizeLow=0x5350, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0195342.WMF", cAlternateFileName="")) returned 1 [0162.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195342.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0162.144] GetProcessHeap () returned 0x4e0000 [0162.144] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0162.144] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0162.144] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0162.144] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.144] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.145] GetProcessHeap () returned 0x4e0000 [0162.145] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0162.145] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0162.145] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.145] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0162.179] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.179] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0162.179] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0162.179] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0162.180] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0162.180] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.180] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.180] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.180] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5350, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x5350, lpOverlapped=0x0) returned 1 [0162.181] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5350, dwBufLen=0x5350 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5350) returned 1 [0162.181] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.182] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5350, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5350, lpOverlapped=0x0) returned 1 [0162.182] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.182] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5424, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.182] SetEndOfFile (hFile=0xdc) returned 1 [0162.185] GetProcessHeap () returned 0x4e0000 [0162.185] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0162.185] GetProcessHeap () returned 0x4e0000 [0162.185] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0162.185] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195342.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195342.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0162.187] CloseHandle (hObject=0xdc) returned 1 [0162.187] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x48be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0195428.WMF", cAlternateFileName="")) returned 1 [0162.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195428.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0162.188] GetProcessHeap () returned 0x4e0000 [0162.188] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0162.188] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0162.188] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0162.188] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0162.191] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.191] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.191] GetProcessHeap () returned 0x4e0000 [0162.191] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0162.191] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0162.191] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.191] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0162.191] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.191] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0162.191] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0162.192] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0162.192] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0162.192] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.192] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.192] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.192] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x48be, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x48be, lpOverlapped=0x0) returned 1 [0162.193] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x48c0, dwBufLen=0x48c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x48c0) returned 1 [0162.193] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.193] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x48c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x48c0, lpOverlapped=0x0) returned 1 [0162.194] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.194] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.194] SetEndOfFile (hFile=0xdc) returned 1 [0162.197] GetProcessHeap () returned 0x4e0000 [0162.197] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0162.197] GetProcessHeap () returned 0x4e0000 [0162.197] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0162.197] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195428.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195428.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0162.198] CloseHandle (hObject=0xdc) returned 1 [0162.198] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe60, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0195772.WMF", cAlternateFileName="")) returned 1 [0162.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195772.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0162.203] GetProcessHeap () returned 0x4e0000 [0162.203] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0162.203] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0162.203] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0162.203] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.203] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.203] GetProcessHeap () returned 0x4e0000 [0162.203] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0162.203] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0162.203] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.203] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0162.208] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.208] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0162.208] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0162.209] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0162.209] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0162.209] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.209] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.209] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.209] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xe60, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xe60, lpOverlapped=0x0) returned 1 [0162.209] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe60, dwBufLen=0xe60 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe60) returned 1 [0162.209] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.209] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe60, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xe60, lpOverlapped=0x0) returned 1 [0162.210] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.210] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xf34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.210] SetEndOfFile (hFile=0xdc) returned 1 [0162.212] GetProcessHeap () returned 0x4e0000 [0162.212] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0162.212] GetProcessHeap () returned 0x4e0000 [0162.212] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0162.213] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195772.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195772.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0162.214] CloseHandle (hObject=0xdc) returned 1 [0162.214] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbbc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0195788.WMF", cAlternateFileName="")) returned 1 [0162.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195788.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0162.215] GetProcessHeap () returned 0x4e0000 [0162.215] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0162.215] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0162.215] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0162.215] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.218] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.218] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.218] GetProcessHeap () returned 0x4e0000 [0162.218] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0162.218] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0162.218] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.218] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0162.218] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.218] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0162.218] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0162.218] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0162.218] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0162.219] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.219] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.219] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.219] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xbbc, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xbbc, lpOverlapped=0x0) returned 1 [0162.219] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xbc0, dwBufLen=0xbc0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xbc0) returned 1 [0162.219] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.219] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xbc0, lpOverlapped=0x0) returned 1 [0162.219] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.219] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xc94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.219] SetEndOfFile (hFile=0xdc) returned 1 [0162.222] GetProcessHeap () returned 0x4e0000 [0162.222] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0162.222] GetProcessHeap () returned 0x4e0000 [0162.222] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0162.222] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195788.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195788.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0162.223] CloseHandle (hObject=0xdc) returned 1 [0162.223] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x128e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0196060.WMF", cAlternateFileName="")) returned 1 [0162.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196060.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0162.225] GetProcessHeap () returned 0x4e0000 [0162.225] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0162.225] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0162.225] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0162.225] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0162.227] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.227] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.227] GetProcessHeap () returned 0x4e0000 [0162.227] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0162.227] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0162.227] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.227] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0162.227] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.227] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0162.227] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0162.227] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0162.227] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0162.227] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.227] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.228] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.228] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x128e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x128e, lpOverlapped=0x0) returned 1 [0162.228] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1290, dwBufLen=0x1290 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1290) returned 1 [0162.228] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.228] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1290, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1290, lpOverlapped=0x0) returned 1 [0162.229] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.229] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1364, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.229] SetEndOfFile (hFile=0xdc) returned 1 [0162.231] GetProcessHeap () returned 0x4e0000 [0162.231] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0162.231] GetProcessHeap () returned 0x4e0000 [0162.231] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0162.231] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196060.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196060.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0162.232] CloseHandle (hObject=0xdc) returned 1 [0162.232] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x14ce, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0196110.WMF", cAlternateFileName="")) returned 1 [0162.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196110.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0162.233] GetProcessHeap () returned 0x4e0000 [0162.233] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0162.233] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0162.233] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0162.233] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0162.235] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.235] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.235] GetProcessHeap () returned 0x4e0000 [0162.235] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0162.235] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0162.235] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.235] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0162.235] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.235] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0162.235] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0162.235] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0162.235] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0162.235] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.235] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.235] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.235] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x14ce, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x14ce, lpOverlapped=0x0) returned 1 [0162.237] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x14d0, dwBufLen=0x14d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x14d0) returned 1 [0162.237] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.237] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x14d0, lpOverlapped=0x0) returned 1 [0162.237] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.237] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x15a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.237] SetEndOfFile (hFile=0xdc) returned 1 [0162.239] GetProcessHeap () returned 0x4e0000 [0162.239] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0162.239] GetProcessHeap () returned 0x4e0000 [0162.239] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0162.239] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196110.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196110.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0162.240] CloseHandle (hObject=0xdc) returned 1 [0162.240] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xef2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0196142.WMF", cAlternateFileName="")) returned 1 [0162.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196142.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0162.241] GetProcessHeap () returned 0x4e0000 [0162.241] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0162.241] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0162.241] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0162.241] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0162.243] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.243] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.243] GetProcessHeap () returned 0x4e0000 [0162.243] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0162.243] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0162.243] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.243] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0162.243] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.243] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0162.243] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0162.244] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0162.244] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0162.244] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.244] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.244] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.244] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xef2, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xef2, lpOverlapped=0x0) returned 1 [0162.244] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xf00, dwBufLen=0xf00 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xf00) returned 1 [0162.244] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.244] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xf00, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xf00, lpOverlapped=0x0) returned 1 [0162.244] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.244] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xfd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.244] SetEndOfFile (hFile=0xdc) returned 1 [0162.246] GetProcessHeap () returned 0x4e0000 [0162.246] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0162.246] GetProcessHeap () returned 0x4e0000 [0162.246] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0162.246] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196142.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196142.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0162.247] CloseHandle (hObject=0xdc) returned 1 [0162.247] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x739e4f00, ftCreationTime.dwHighDateTime=0x1be390f, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x739e4f00, ftLastWriteTime.dwHighDateTime=0x1be390f, nFileSizeHigh=0x0, nFileSizeLow=0x3586, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0196354.WMF", cAlternateFileName="")) returned 1 [0162.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196354.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0162.248] GetProcessHeap () returned 0x4e0000 [0162.248] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0162.248] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0162.248] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0162.248] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0162.250] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.250] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.250] GetProcessHeap () returned 0x4e0000 [0162.250] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0162.250] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0162.250] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.250] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0162.250] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.250] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0162.250] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0162.250] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0162.250] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0162.251] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.251] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.251] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.251] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3586, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3586, lpOverlapped=0x0) returned 1 [0162.252] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3590, dwBufLen=0x3590 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3590) returned 1 [0162.252] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.252] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3590, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3590, lpOverlapped=0x0) returned 1 [0162.252] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.252] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3664, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.252] SetEndOfFile (hFile=0xdc) returned 1 [0162.254] GetProcessHeap () returned 0x4e0000 [0162.254] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0162.254] GetProcessHeap () returned 0x4e0000 [0162.254] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0162.254] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196354.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196354.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0162.255] CloseHandle (hObject=0xdc) returned 1 [0162.255] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74cf7c00, ftCreationTime.dwHighDateTime=0x1be390f, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74cf7c00, ftLastWriteTime.dwHighDateTime=0x1be390f, nFileSizeHigh=0x0, nFileSizeLow=0x1b00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0196358.WMF", cAlternateFileName="")) returned 1 [0162.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196358.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0162.256] GetProcessHeap () returned 0x4e0000 [0162.256] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0162.256] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0162.256] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0162.257] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.257] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.257] GetProcessHeap () returned 0x4e0000 [0162.257] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0162.257] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0162.257] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.257] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0162.258] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.258] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0162.258] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0162.259] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0162.259] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0162.259] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.259] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.259] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.259] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1b00, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1b00, lpOverlapped=0x0) returned 1 [0162.259] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1b00, dwBufLen=0x1b00 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1b00) returned 1 [0162.259] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.260] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1b00, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1b00, lpOverlapped=0x0) returned 1 [0162.260] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.260] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1bd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.260] SetEndOfFile (hFile=0xdc) returned 1 [0162.262] GetProcessHeap () returned 0x4e0000 [0162.262] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0162.262] GetProcessHeap () returned 0x4e0000 [0162.262] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0162.262] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196358.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196358.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0162.263] CloseHandle (hObject=0xdc) returned 1 [0162.263] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78630300, ftCreationTime.dwHighDateTime=0x1be390f, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78630300, ftLastWriteTime.dwHighDateTime=0x1be390f, nFileSizeHigh=0x0, nFileSizeLow=0x164c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0196364.WMF", cAlternateFileName="")) returned 1 [0162.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196364.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0162.265] GetProcessHeap () returned 0x4e0000 [0162.265] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0162.265] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0162.265] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0162.265] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.267] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.267] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.267] GetProcessHeap () returned 0x4e0000 [0162.267] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0162.267] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0162.267] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.267] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0162.267] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.267] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0162.267] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0162.268] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0162.268] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0162.268] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.268] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.268] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.268] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x164c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x164c, lpOverlapped=0x0) returned 1 [0162.269] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1650, dwBufLen=0x1650 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1650) returned 1 [0162.269] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.269] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1650, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1650, lpOverlapped=0x0) returned 1 [0162.269] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.269] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1724, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.269] SetEndOfFile (hFile=0xdc) returned 1 [0162.271] GetProcessHeap () returned 0x4e0000 [0162.271] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0162.271] GetProcessHeap () returned 0x4e0000 [0162.271] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0162.271] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196364.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196364.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0162.272] CloseHandle (hObject=0xdc) returned 1 [0162.272] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9d26, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0197979.WMF", cAlternateFileName="")) returned 1 [0162.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197979.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0162.273] GetProcessHeap () returned 0x4e0000 [0162.273] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0162.273] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0162.273] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0162.273] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0162.275] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.275] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.275] GetProcessHeap () returned 0x4e0000 [0162.275] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0162.275] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0162.275] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.275] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0162.275] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.275] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0162.275] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0162.275] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0162.275] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0162.275] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.275] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.275] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.275] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x9d26, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x9d26, lpOverlapped=0x0) returned 1 [0162.276] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9d30, dwBufLen=0x9d30 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9d30) returned 1 [0162.277] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.277] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x9d30, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x9d30, lpOverlapped=0x0) returned 1 [0162.277] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.277] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x9e04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.277] SetEndOfFile (hFile=0xdc) returned 1 [0162.279] GetProcessHeap () returned 0x4e0000 [0162.280] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0162.280] GetProcessHeap () returned 0x4e0000 [0162.280] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0162.280] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197979.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197979.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0162.281] CloseHandle (hObject=0xdc) returned 1 [0162.281] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23edc800, ftCreationTime.dwHighDateTime=0x1be3d01, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x23edc800, ftLastWriteTime.dwHighDateTime=0x1be3d01, nFileSizeHigh=0x0, nFileSizeLow=0x668c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0197983.WMF", cAlternateFileName="")) returned 1 [0162.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197983.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0162.282] GetProcessHeap () returned 0x4e0000 [0162.282] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0162.282] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0162.282] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0162.282] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.284] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.284] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.284] GetProcessHeap () returned 0x4e0000 [0162.284] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0162.284] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0162.284] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.284] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0162.284] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.284] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0162.284] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0162.284] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0162.284] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0162.284] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.284] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.284] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.284] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x668c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x668c, lpOverlapped=0x0) returned 1 [0162.285] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6690, dwBufLen=0x6690 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6690) returned 1 [0162.286] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.286] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6690, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x6690, lpOverlapped=0x0) returned 1 [0162.286] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.286] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6764, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.286] SetEndOfFile (hFile=0xdc) returned 1 [0162.288] GetProcessHeap () returned 0x4e0000 [0162.288] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0162.288] GetProcessHeap () returned 0x4e0000 [0162.288] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0162.288] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197983.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197983.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0162.289] CloseHandle (hObject=0xdc) returned 1 [0162.289] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9fe6800, ftCreationTime.dwHighDateTime=0x1c0323c, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9fe6800, ftLastWriteTime.dwHighDateTime=0x1c0323c, nFileSizeHigh=0x0, nFileSizeLow=0x849c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0198016.WMF", cAlternateFileName="")) returned 1 [0162.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198016.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0162.290] GetProcessHeap () returned 0x4e0000 [0162.290] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0162.290] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0162.290] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0162.290] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.292] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.292] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.292] GetProcessHeap () returned 0x4e0000 [0162.292] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0162.292] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0162.292] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.292] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0162.292] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.293] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0162.293] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0162.293] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0162.293] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0162.293] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.293] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.293] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.293] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x849c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x849c, lpOverlapped=0x0) returned 1 [0162.294] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x84a0, dwBufLen=0x84a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x84a0) returned 1 [0162.294] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.294] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x84a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x84a0, lpOverlapped=0x0) returned 1 [0162.295] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.295] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x8574, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.295] SetEndOfFile (hFile=0xdc) returned 1 [0162.297] GetProcessHeap () returned 0x4e0000 [0162.297] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0162.297] GetProcessHeap () returned 0x4e0000 [0162.297] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0162.297] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198016.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198016.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0162.298] CloseHandle (hObject=0xdc) returned 1 [0162.299] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71f94700, ftCreationTime.dwHighDateTime=0x1bd8464, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71f94700, ftLastWriteTime.dwHighDateTime=0x1bd8464, nFileSizeHigh=0x0, nFileSizeLow=0x5cae, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0198020.WMF", cAlternateFileName="")) returned 1 [0162.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198020.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0162.299] GetProcessHeap () returned 0x4e0000 [0162.299] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0162.299] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0162.300] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0162.300] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0162.301] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.301] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.301] GetProcessHeap () returned 0x4e0000 [0162.301] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0162.301] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0162.301] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.301] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0162.302] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.302] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0162.302] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0162.302] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0162.302] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0162.302] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.302] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.302] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.302] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5cae, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x5cae, lpOverlapped=0x0) returned 1 [0162.303] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5cb0, dwBufLen=0x5cb0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5cb0) returned 1 [0162.303] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.303] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5cb0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5cb0, lpOverlapped=0x0) returned 1 [0162.303] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.303] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5d84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.303] SetEndOfFile (hFile=0xdc) returned 1 [0162.305] GetProcessHeap () returned 0x4e0000 [0162.305] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0162.305] GetProcessHeap () returned 0x4e0000 [0162.305] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0162.306] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198020.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198020.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0162.307] CloseHandle (hObject=0xdc) returned 1 [0162.307] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745ba100, ftCreationTime.dwHighDateTime=0x1bd8464, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x745ba100, ftLastWriteTime.dwHighDateTime=0x1bd8464, nFileSizeHigh=0x0, nFileSizeLow=0x8860, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0198021.WMF", cAlternateFileName="")) returned 1 [0162.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198021.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0162.308] GetProcessHeap () returned 0x4e0000 [0162.308] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0162.308] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0162.308] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0162.308] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.308] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.308] GetProcessHeap () returned 0x4e0000 [0162.308] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0162.308] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0162.308] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.308] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0162.310] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.310] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0162.310] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0162.310] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0162.310] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0162.310] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.310] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.311] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.311] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x8860, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x8860, lpOverlapped=0x0) returned 1 [0162.312] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8860, dwBufLen=0x8860 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8860) returned 1 [0162.312] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.312] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x8860, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x8860, lpOverlapped=0x0) returned 1 [0162.312] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.312] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x8934, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.312] SetEndOfFile (hFile=0xdc) returned 1 [0162.314] GetProcessHeap () returned 0x4e0000 [0162.314] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0162.314] GetProcessHeap () returned 0x4e0000 [0162.315] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0162.315] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198021.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198021.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0162.316] CloseHandle (hObject=0xdc) returned 1 [0162.316] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18fcfa00, ftCreationTime.dwHighDateTime=0x1c0323d, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18fcfa00, ftLastWriteTime.dwHighDateTime=0x1c0323d, nFileSizeHigh=0x0, nFileSizeLow=0x6624, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0198022.WMF", cAlternateFileName="")) returned 1 [0162.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198022.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0162.317] GetProcessHeap () returned 0x4e0000 [0162.317] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0162.317] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0162.317] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0162.317] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0162.320] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.320] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.320] GetProcessHeap () returned 0x4e0000 [0162.320] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0162.320] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0162.320] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.320] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0162.320] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.320] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0162.320] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0162.320] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0162.320] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0162.320] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.320] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.320] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.320] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x6624, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x6624, lpOverlapped=0x0) returned 1 [0162.321] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6630, dwBufLen=0x6630 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6630) returned 1 [0162.321] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.322] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6630, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x6630, lpOverlapped=0x0) returned 1 [0162.322] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.322] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6704, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.322] SetEndOfFile (hFile=0xdc) returned 1 [0162.324] GetProcessHeap () returned 0x4e0000 [0162.324] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0162.324] GetProcessHeap () returned 0x4e0000 [0162.324] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0162.324] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198022.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198022.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0162.325] CloseHandle (hObject=0xdc) returned 1 [0162.325] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7de50900, ftCreationTime.dwHighDateTime=0x1bd8464, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7de50900, ftLastWriteTime.dwHighDateTime=0x1bd8464, nFileSizeHigh=0x0, nFileSizeLow=0x3cce, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0198025.WMF", cAlternateFileName="")) returned 1 [0162.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198025.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0162.326] GetProcessHeap () returned 0x4e0000 [0162.326] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0162.326] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0162.326] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0162.326] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0162.328] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.328] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.328] GetProcessHeap () returned 0x4e0000 [0162.328] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0162.328] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0162.328] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.328] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0162.328] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.328] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0162.328] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0162.328] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0162.328] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0162.328] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.328] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.328] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.328] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3cce, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3cce, lpOverlapped=0x0) returned 1 [0162.329] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3cd0, dwBufLen=0x3cd0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3cd0) returned 1 [0162.329] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.329] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3cd0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3cd0, lpOverlapped=0x0) returned 1 [0162.330] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.330] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3da4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.330] SetEndOfFile (hFile=0xdc) returned 1 [0162.332] GetProcessHeap () returned 0x4e0000 [0162.332] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0162.332] GetProcessHeap () returned 0x4e0000 [0162.332] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0162.332] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198025.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198025.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0162.333] CloseHandle (hObject=0xdc) returned 1 [0162.333] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb570900, ftCreationTime.dwHighDateTime=0x1bd9f2f, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcb570900, ftLastWriteTime.dwHighDateTime=0x1bd9f2f, nFileSizeHigh=0x0, nFileSizeLow=0xd6b4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0198102.WMF", cAlternateFileName="")) returned 1 [0162.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198102.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0162.334] GetProcessHeap () returned 0x4e0000 [0162.334] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0162.334] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0162.334] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0162.334] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0162.338] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.338] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.338] GetProcessHeap () returned 0x4e0000 [0162.339] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0162.339] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0162.339] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.339] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0162.339] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.339] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0162.339] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0162.339] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0162.339] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0162.339] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.339] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.339] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.339] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xd6b4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xd6b4, lpOverlapped=0x0) returned 1 [0162.340] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xd6c0, dwBufLen=0xd6c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xd6c0) returned 1 [0162.341] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.341] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xd6c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xd6c0, lpOverlapped=0x0) returned 1 [0162.341] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.341] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xd794, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.341] SetEndOfFile (hFile=0xdc) returned 1 [0162.343] GetProcessHeap () returned 0x4e0000 [0162.343] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0162.343] GetProcessHeap () returned 0x4e0000 [0162.343] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0162.343] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198102.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198102.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0162.344] CloseHandle (hObject=0xdc) returned 1 [0162.344] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce00a00, ftCreationTime.dwHighDateTime=0x1bd9fdf, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcce00a00, ftLastWriteTime.dwHighDateTime=0x1bd9fdf, nFileSizeHigh=0x0, nFileSizeLow=0xa520, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0198113.WMF", cAlternateFileName="")) returned 1 [0162.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198113.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0162.345] GetProcessHeap () returned 0x4e0000 [0162.345] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0162.345] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0162.345] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0162.345] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.345] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.345] GetProcessHeap () returned 0x4e0000 [0162.345] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0162.345] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0162.345] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.345] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0162.347] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.347] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0162.347] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0162.347] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0162.347] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0162.347] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.347] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.347] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.347] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xa520, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xa520, lpOverlapped=0x0) returned 1 [0162.348] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa520, dwBufLen=0xa520 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa520) returned 1 [0162.349] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.349] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xa520, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xa520, lpOverlapped=0x0) returned 1 [0162.349] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.349] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xa5f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.349] SetEndOfFile (hFile=0xdc) returned 1 [0162.351] GetProcessHeap () returned 0x4e0000 [0162.351] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0162.351] GetProcessHeap () returned 0x4e0000 [0162.351] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0162.351] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198113.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198113.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0162.352] CloseHandle (hObject=0xdc) returned 1 [0162.352] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa3b2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0198226.WMF", cAlternateFileName="")) returned 1 [0162.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198226.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0162.354] GetProcessHeap () returned 0x4e0000 [0162.354] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0162.354] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0162.354] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0162.354] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0162.356] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.356] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.356] GetProcessHeap () returned 0x4e0000 [0162.356] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0162.356] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0162.356] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.356] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0162.356] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.356] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0162.356] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0162.356] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0162.356] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0162.356] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.356] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.356] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.356] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xa3b2, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xa3b2, lpOverlapped=0x0) returned 1 [0162.357] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa3c0, dwBufLen=0xa3c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa3c0) returned 1 [0162.358] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.358] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xa3c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xa3c0, lpOverlapped=0x0) returned 1 [0162.358] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.358] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xa494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.358] SetEndOfFile (hFile=0xdc) returned 1 [0162.360] GetProcessHeap () returned 0x4e0000 [0162.360] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0162.360] GetProcessHeap () returned 0x4e0000 [0162.360] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0162.360] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198226.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198226.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0162.361] CloseHandle (hObject=0xdc) returned 1 [0162.361] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa69e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0198234.WMF", cAlternateFileName="")) returned 1 [0162.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198234.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0162.362] GetProcessHeap () returned 0x4e0000 [0162.362] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0162.362] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0162.362] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0162.362] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0162.364] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.364] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.364] GetProcessHeap () returned 0x4e0000 [0162.364] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0162.364] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0162.364] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.364] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0162.364] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.364] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0162.364] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0162.364] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0162.364] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0162.365] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.365] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.365] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.365] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xa69e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xa69e, lpOverlapped=0x0) returned 1 [0162.366] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa6a0, dwBufLen=0xa6a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa6a0) returned 1 [0162.367] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.367] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xa6a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xa6a0, lpOverlapped=0x0) returned 1 [0162.367] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.367] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xa774, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.367] SetEndOfFile (hFile=0xdc) returned 1 [0162.369] GetProcessHeap () returned 0x4e0000 [0162.369] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0162.369] GetProcessHeap () returned 0x4e0000 [0162.369] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0162.369] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198234.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198234.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0162.370] CloseHandle (hObject=0xdc) returned 1 [0162.370] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6f9c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0198372.WMF", cAlternateFileName="")) returned 1 [0162.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198372.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0162.371] GetProcessHeap () returned 0x4e0000 [0162.371] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0162.371] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0162.371] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0162.371] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.372] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.372] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.372] GetProcessHeap () returned 0x4e0000 [0162.372] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0162.373] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0162.373] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.373] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0162.373] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.373] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0162.373] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0162.373] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0162.373] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0162.373] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.373] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.373] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.373] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x6f9c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x6f9c, lpOverlapped=0x0) returned 1 [0162.374] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6fa0, dwBufLen=0x6fa0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6fa0) returned 1 [0162.374] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.374] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6fa0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x6fa0, lpOverlapped=0x0) returned 1 [0162.375] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.375] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7074, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.375] SetEndOfFile (hFile=0xdc) returned 1 [0162.377] GetProcessHeap () returned 0x4e0000 [0162.377] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0162.377] GetProcessHeap () returned 0x4e0000 [0162.377] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0162.377] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198372.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198372.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0162.378] CloseHandle (hObject=0xdc) returned 1 [0162.378] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1925100, ftCreationTime.dwHighDateTime=0x1be3a08, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf1925100, ftLastWriteTime.dwHighDateTime=0x1be3a08, nFileSizeHigh=0x0, nFileSizeLow=0x9d6c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0198377.WMF", cAlternateFileName="")) returned 1 [0162.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198377.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0162.379] GetProcessHeap () returned 0x4e0000 [0162.379] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0162.379] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0162.379] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0162.379] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.381] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.381] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.381] GetProcessHeap () returned 0x4e0000 [0162.381] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0162.381] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0162.381] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.381] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0162.381] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.381] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0162.381] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0162.381] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0162.381] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0162.381] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.382] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.382] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.382] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x9d6c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x9d6c, lpOverlapped=0x0) returned 1 [0162.383] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9d70, dwBufLen=0x9d70 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9d70) returned 1 [0162.383] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.383] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x9d70, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x9d70, lpOverlapped=0x0) returned 1 [0162.383] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.383] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x9e44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.383] SetEndOfFile (hFile=0xdc) returned 1 [0162.385] GetProcessHeap () returned 0x4e0000 [0162.385] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0162.385] GetProcessHeap () returned 0x4e0000 [0162.385] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0162.386] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198377.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198377.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0162.386] CloseHandle (hObject=0xdc) returned 1 [0162.386] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc20c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0198447.WMF", cAlternateFileName="")) returned 1 [0162.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198447.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0162.388] GetProcessHeap () returned 0x4e0000 [0162.388] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0162.388] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0162.388] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0162.388] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.389] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.389] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.389] GetProcessHeap () returned 0x4e0000 [0162.389] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0162.389] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0162.389] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.389] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0162.390] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.390] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0162.390] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0162.390] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0162.390] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0162.390] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.390] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.390] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.390] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xc20c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xc20c, lpOverlapped=0x0) returned 1 [0162.391] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xc210, dwBufLen=0xc210 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xc210) returned 1 [0162.392] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.392] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc210, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xc210, lpOverlapped=0x0) returned 1 [0162.392] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.392] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xc2e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.392] SetEndOfFile (hFile=0xdc) returned 1 [0162.395] GetProcessHeap () returned 0x4e0000 [0162.395] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0162.395] GetProcessHeap () returned 0x4e0000 [0162.395] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0162.395] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198447.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198447.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0162.396] CloseHandle (hObject=0xdc) returned 1 [0162.396] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xae08, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0198494.WMF", cAlternateFileName="")) returned 1 [0162.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198494.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0162.396] GetProcessHeap () returned 0x4e0000 [0162.396] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0162.396] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0162.397] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0162.397] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0162.399] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.399] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.399] GetProcessHeap () returned 0x4e0000 [0162.399] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0162.399] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0162.399] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.399] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0162.399] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.399] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0162.399] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0162.399] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0162.399] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0162.399] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.399] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.399] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.399] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xae08, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xae08, lpOverlapped=0x0) returned 1 [0162.403] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xae10, dwBufLen=0xae10 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xae10) returned 1 [0162.404] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.404] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xae10, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xae10, lpOverlapped=0x0) returned 1 [0162.404] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.404] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xaee4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.404] SetEndOfFile (hFile=0xdc) returned 1 [0162.406] GetProcessHeap () returned 0x4e0000 [0162.406] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0162.406] GetProcessHeap () returned 0x4e0000 [0162.406] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0162.407] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198494.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198494.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0162.407] CloseHandle (hObject=0xdc) returned 1 [0162.407] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe17a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0198712.WMF", cAlternateFileName="")) returned 1 [0162.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198712.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0162.408] GetProcessHeap () returned 0x4e0000 [0162.408] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0162.408] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0162.408] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0162.408] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0162.410] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.410] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.410] GetProcessHeap () returned 0x4e0000 [0162.410] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0162.410] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0162.410] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.410] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0162.410] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.410] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0162.410] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0162.410] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0162.410] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0162.410] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.410] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.410] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.410] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xe17a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xe17a, lpOverlapped=0x0) returned 1 [0162.420] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe180, dwBufLen=0xe180 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe180) returned 1 [0162.420] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.420] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe180, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xe180, lpOverlapped=0x0) returned 1 [0162.421] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.421] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xe254, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.421] SetEndOfFile (hFile=0xdc) returned 1 [0162.423] GetProcessHeap () returned 0x4e0000 [0162.423] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0162.423] GetProcessHeap () returned 0x4e0000 [0162.423] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0162.423] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198712.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198712.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0162.424] CloseHandle (hObject=0xdc) returned 1 [0162.424] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x714e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0199279.WMF", cAlternateFileName="")) returned 1 [0162.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199279.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0162.425] GetProcessHeap () returned 0x4e0000 [0162.425] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0162.425] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0162.425] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0162.425] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0162.555] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.555] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.555] GetProcessHeap () returned 0x4e0000 [0162.555] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0162.555] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0162.555] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.556] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0162.556] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.556] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0162.556] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0162.556] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0162.556] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0162.556] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.556] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.556] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.556] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x714e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x714e, lpOverlapped=0x0) returned 1 [0162.831] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7150, dwBufLen=0x7150 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7150) returned 1 [0162.831] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.832] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7150, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7150, lpOverlapped=0x0) returned 1 [0162.832] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.832] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.832] SetEndOfFile (hFile=0xdc) returned 1 [0162.837] GetProcessHeap () returned 0x4e0000 [0162.837] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0162.837] GetProcessHeap () returned 0x4e0000 [0162.837] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0162.837] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199279.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199279.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0162.838] CloseHandle (hObject=0xdc) returned 1 [0162.838] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5655cfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7c4e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0199303.WMF", cAlternateFileName="")) returned 1 [0162.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199303.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0162.840] GetProcessHeap () returned 0x4e0000 [0162.840] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0162.840] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0162.840] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0162.840] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0162.842] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.842] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.842] GetProcessHeap () returned 0x4e0000 [0162.842] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0162.842] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0162.842] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.842] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0162.843] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.843] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0162.843] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0162.843] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0162.843] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0162.843] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.843] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.843] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.843] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7c4e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7c4e, lpOverlapped=0x0) returned 1 [0162.844] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7c50, dwBufLen=0x7c50 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7c50) returned 1 [0162.845] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.845] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7c50, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7c50, lpOverlapped=0x0) returned 1 [0162.845] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.845] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7d24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.845] SetEndOfFile (hFile=0xdc) returned 1 [0162.848] GetProcessHeap () returned 0x4e0000 [0162.848] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0162.848] GetProcessHeap () returned 0x4e0000 [0162.848] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0162.848] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199303.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199303.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0162.850] CloseHandle (hObject=0xdc) returned 1 [0162.850] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc37e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0199307.WMF", cAlternateFileName="")) returned 1 [0162.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199307.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0162.850] GetProcessHeap () returned 0x4e0000 [0162.850] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0162.850] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0162.850] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0162.851] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0162.853] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.853] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.853] GetProcessHeap () returned 0x4e0000 [0162.853] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0162.853] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0162.853] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.853] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0162.853] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.853] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0162.853] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0162.853] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0162.853] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0162.853] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.853] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.854] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.854] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xc37e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xc37e, lpOverlapped=0x0) returned 1 [0162.855] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xc380, dwBufLen=0xc380 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xc380) returned 1 [0162.855] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.855] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc380, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xc380, lpOverlapped=0x0) returned 1 [0162.856] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.856] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xc454, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.856] SetEndOfFile (hFile=0xdc) returned 1 [0162.859] GetProcessHeap () returned 0x4e0000 [0162.859] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0162.859] GetProcessHeap () returned 0x4e0000 [0162.859] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0162.859] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199307.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199307.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0162.860] CloseHandle (hObject=0xdc) returned 1 [0162.860] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5655cfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x662a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0199423.WMF", cAlternateFileName="")) returned 1 [0162.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199423.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0162.861] GetProcessHeap () returned 0x4e0000 [0162.861] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0162.861] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0162.861] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0162.861] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0162.863] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.863] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.863] GetProcessHeap () returned 0x4e0000 [0162.863] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0162.863] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0162.863] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.863] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0162.863] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.863] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0162.863] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0162.864] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0162.864] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0162.864] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.864] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.864] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.864] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x662a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x662a, lpOverlapped=0x0) returned 1 [0162.865] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6630, dwBufLen=0x6630 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6630) returned 1 [0162.865] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.865] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6630, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x6630, lpOverlapped=0x0) returned 1 [0162.866] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.866] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6704, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.866] SetEndOfFile (hFile=0xdc) returned 1 [0162.868] GetProcessHeap () returned 0x4e0000 [0162.868] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0162.868] GetProcessHeap () returned 0x4e0000 [0162.868] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0162.868] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199423.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199423.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0162.869] CloseHandle (hObject=0xdc) returned 1 [0162.869] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4124, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0199429.WMF", cAlternateFileName="")) returned 1 [0162.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199429.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0162.870] GetProcessHeap () returned 0x4e0000 [0162.870] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0162.870] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0162.870] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0162.870] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0162.872] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.872] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.872] GetProcessHeap () returned 0x4e0000 [0162.872] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0162.872] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0162.872] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.873] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0162.873] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.873] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0162.873] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0162.873] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0162.873] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0162.873] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.873] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.873] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.873] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4124, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4124, lpOverlapped=0x0) returned 1 [0162.874] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4130, dwBufLen=0x4130 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4130) returned 1 [0162.874] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.875] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4130, lpOverlapped=0x0) returned 1 [0162.875] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.875] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.875] SetEndOfFile (hFile=0xdc) returned 1 [0162.877] GetProcessHeap () returned 0x4e0000 [0162.878] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0162.878] GetProcessHeap () returned 0x4e0000 [0162.878] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0162.878] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199429.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199429.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0162.879] CloseHandle (hObject=0xdc) returned 1 [0162.879] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5655cfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x13c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0199465.WMF", cAlternateFileName="")) returned 1 [0162.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199465.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0162.880] GetProcessHeap () returned 0x4e0000 [0162.880] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0162.880] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0162.880] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0162.880] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0162.882] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.882] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.882] GetProcessHeap () returned 0x4e0000 [0162.882] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0162.882] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0162.882] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.882] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0162.883] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.883] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0162.883] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0162.883] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0162.883] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0162.883] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.883] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.883] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.883] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x13c4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x13c4, lpOverlapped=0x0) returned 1 [0162.884] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x13d0, dwBufLen=0x13d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x13d0) returned 1 [0162.884] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.884] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x13d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x13d0, lpOverlapped=0x0) returned 1 [0162.884] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.884] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x14a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.884] SetEndOfFile (hFile=0xdc) returned 1 [0162.887] GetProcessHeap () returned 0x4e0000 [0162.887] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0162.887] GetProcessHeap () returned 0x4e0000 [0162.887] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0162.887] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199465.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199465.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0162.888] CloseHandle (hObject=0xdc) returned 1 [0162.888] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x35bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0199469.WMF", cAlternateFileName="")) returned 1 [0162.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199469.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0162.889] GetProcessHeap () returned 0x4e0000 [0162.890] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0162.890] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0162.890] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0162.890] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.892] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.892] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.892] GetProcessHeap () returned 0x4e0000 [0162.892] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0162.892] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0162.892] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.892] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0162.892] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.892] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0162.892] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0162.892] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0162.892] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0162.893] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.893] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.893] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.893] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x35bc, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x35bc, lpOverlapped=0x0) returned 1 [0162.894] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x35c0, dwBufLen=0x35c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x35c0) returned 1 [0162.894] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.894] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x35c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x35c0, lpOverlapped=0x0) returned 1 [0162.894] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.894] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.894] SetEndOfFile (hFile=0xdc) returned 1 [0162.897] GetProcessHeap () returned 0x4e0000 [0162.897] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0162.897] GetProcessHeap () returned 0x4e0000 [0162.897] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0162.897] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199469.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199469.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0162.899] CloseHandle (hObject=0xdc) returned 1 [0162.899] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2a18, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0199473.WMF", cAlternateFileName="")) returned 1 [0162.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199473.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0162.900] GetProcessHeap () returned 0x4e0000 [0162.900] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0162.900] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0162.900] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0162.900] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0162.902] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.902] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.902] GetProcessHeap () returned 0x4e0000 [0162.902] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0162.902] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0162.902] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.902] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0162.902] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.902] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0162.902] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0162.903] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0162.903] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0162.903] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.903] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.903] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.903] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2a18, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2a18, lpOverlapped=0x0) returned 1 [0162.904] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2a20, dwBufLen=0x2a20 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2a20) returned 1 [0162.904] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.904] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2a20, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2a20, lpOverlapped=0x0) returned 1 [0162.904] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.904] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2af4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.904] SetEndOfFile (hFile=0xdc) returned 1 [0162.907] GetProcessHeap () returned 0x4e0000 [0162.907] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0162.907] GetProcessHeap () returned 0x4e0000 [0162.907] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0162.907] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199473.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199473.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0162.909] CloseHandle (hObject=0xdc) returned 1 [0162.909] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5655cfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1484, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0199475.WMF", cAlternateFileName="")) returned 1 [0162.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199475.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0162.910] GetProcessHeap () returned 0x4e0000 [0162.910] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0162.910] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0162.910] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0162.910] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0162.913] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.913] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.913] GetProcessHeap () returned 0x4e0000 [0162.913] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0162.913] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0162.913] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.913] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0162.913] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.913] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0162.913] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0162.913] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0162.913] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0162.913] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.913] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.914] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.914] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1484, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1484, lpOverlapped=0x0) returned 1 [0162.914] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1490, dwBufLen=0x1490 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1490) returned 1 [0162.915] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.915] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1490, lpOverlapped=0x0) returned 1 [0162.915] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.915] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1564, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.915] SetEndOfFile (hFile=0xdc) returned 1 [0162.917] GetProcessHeap () returned 0x4e0000 [0162.917] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0162.918] GetProcessHeap () returned 0x4e0000 [0162.918] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0162.918] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199475.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199475.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0162.919] CloseHandle (hObject=0xdc) returned 1 [0162.919] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x27b4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0199483.WMF", cAlternateFileName="")) returned 1 [0162.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199483.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0162.920] GetProcessHeap () returned 0x4e0000 [0162.920] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0162.920] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0162.920] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0162.920] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0162.922] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.922] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.922] GetProcessHeap () returned 0x4e0000 [0162.922] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0162.922] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0162.922] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.922] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0162.922] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.922] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0162.922] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0162.923] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0162.923] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0162.923] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.923] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.923] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.923] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x27b4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x27b4, lpOverlapped=0x0) returned 1 [0162.925] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x27c0, dwBufLen=0x27c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x27c0) returned 1 [0162.925] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.925] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x27c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x27c0, lpOverlapped=0x0) returned 1 [0162.926] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.926] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2894, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.926] SetEndOfFile (hFile=0xdc) returned 1 [0162.928] GetProcessHeap () returned 0x4e0000 [0162.928] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0162.928] GetProcessHeap () returned 0x4e0000 [0162.928] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0162.928] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199483.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199483.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0162.930] CloseHandle (hObject=0xdc) returned 1 [0162.930] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6dbde600, ftCreationTime.dwHighDateTime=0x1be3e9a, ftLastAccessTime.dwLowDateTime=0x5655cfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6dbde600, ftLastWriteTime.dwHighDateTime=0x1be3e9a, nFileSizeHigh=0x0, nFileSizeLow=0x302c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0199609.WMF", cAlternateFileName="")) returned 1 [0162.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199609.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0162.931] GetProcessHeap () returned 0x4e0000 [0162.931] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0162.931] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0162.931] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0162.931] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.933] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.933] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.933] GetProcessHeap () returned 0x4e0000 [0162.933] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0162.933] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0162.933] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.933] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0162.933] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.933] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0162.933] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0162.934] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0162.934] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0162.934] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.934] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.934] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.934] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x302c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x302c, lpOverlapped=0x0) returned 1 [0162.935] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3030, dwBufLen=0x3030 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3030) returned 1 [0162.935] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.935] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3030, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3030, lpOverlapped=0x0) returned 1 [0162.935] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.935] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3104, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.935] SetEndOfFile (hFile=0xdc) returned 1 [0162.938] GetProcessHeap () returned 0x4e0000 [0162.938] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0162.938] GetProcessHeap () returned 0x4e0000 [0162.938] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0162.938] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199609.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199609.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0162.939] CloseHandle (hObject=0xdc) returned 1 [0162.939] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2004, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0200151.WMF", cAlternateFileName="")) returned 1 [0162.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200151.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0162.941] GetProcessHeap () returned 0x4e0000 [0162.941] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0162.941] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0162.941] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0162.941] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0162.944] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.944] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.944] GetProcessHeap () returned 0x4e0000 [0162.944] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0162.944] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0162.944] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.944] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0162.944] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.945] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0162.945] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0162.945] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0162.945] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0162.945] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.945] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.945] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.945] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2004, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2004, lpOverlapped=0x0) returned 1 [0162.947] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2010, dwBufLen=0x2010 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2010) returned 1 [0162.947] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.947] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2010, lpOverlapped=0x0) returned 1 [0162.947] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.947] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x20e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.947] SetEndOfFile (hFile=0xdc) returned 1 [0162.950] GetProcessHeap () returned 0x4e0000 [0162.950] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0162.950] GetProcessHeap () returned 0x4e0000 [0162.950] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0162.950] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200151.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200151.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0162.951] CloseHandle (hObject=0xdc) returned 1 [0162.951] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1c0c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0200163.WMF", cAlternateFileName="")) returned 1 [0162.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200163.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0162.953] GetProcessHeap () returned 0x4e0000 [0162.953] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0162.953] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0162.953] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0162.953] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.955] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.956] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.956] GetProcessHeap () returned 0x4e0000 [0162.956] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0162.956] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0162.956] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.956] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0162.956] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.956] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0162.956] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0162.956] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0162.956] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0162.956] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.956] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.956] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.956] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1c0c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1c0c, lpOverlapped=0x0) returned 1 [0162.958] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1c10, dwBufLen=0x1c10 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1c10) returned 1 [0162.958] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.958] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1c10, lpOverlapped=0x0) returned 1 [0162.958] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.958] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1ce4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.958] SetEndOfFile (hFile=0xdc) returned 1 [0162.961] GetProcessHeap () returned 0x4e0000 [0162.961] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0162.961] GetProcessHeap () returned 0x4e0000 [0162.961] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0162.961] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200163.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200163.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0162.963] CloseHandle (hObject=0xdc) returned 1 [0162.963] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x14c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0200183.WMF", cAlternateFileName="")) returned 1 [0162.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200183.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0162.964] GetProcessHeap () returned 0x4e0000 [0162.964] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0162.964] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0162.964] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0162.964] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.964] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.964] GetProcessHeap () returned 0x4e0000 [0162.964] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0162.964] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0162.964] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.964] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0162.966] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.966] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0162.966] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0162.966] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0162.966] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0162.967] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.967] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.967] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.967] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x14c0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x14c0, lpOverlapped=0x0) returned 1 [0162.968] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x14c0, dwBufLen=0x14c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x14c0) returned 1 [0162.968] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.968] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x14c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x14c0, lpOverlapped=0x0) returned 1 [0162.968] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.968] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1594, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.968] SetEndOfFile (hFile=0xdc) returned 1 [0162.971] GetProcessHeap () returned 0x4e0000 [0162.971] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0162.971] GetProcessHeap () returned 0x4e0000 [0162.971] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0162.971] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200183.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200183.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0162.972] CloseHandle (hObject=0xdc) returned 1 [0162.972] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f7c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0200189.WMF", cAlternateFileName="")) returned 1 [0162.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200189.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0162.974] GetProcessHeap () returned 0x4e0000 [0162.974] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0162.974] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0162.974] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0162.974] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.976] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.976] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.976] GetProcessHeap () returned 0x4e0000 [0162.976] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0162.976] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0162.976] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.976] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0162.976] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.976] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0162.976] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0162.977] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0162.977] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0162.977] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.977] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.977] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.977] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1f7c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1f7c, lpOverlapped=0x0) returned 1 [0162.978] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1f80, dwBufLen=0x1f80 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1f80) returned 1 [0162.978] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.978] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1f80, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1f80, lpOverlapped=0x0) returned 1 [0162.978] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.978] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2054, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.978] SetEndOfFile (hFile=0xdc) returned 1 [0162.981] GetProcessHeap () returned 0x4e0000 [0162.981] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0162.981] GetProcessHeap () returned 0x4e0000 [0162.981] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0162.981] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200189.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200189.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0162.982] CloseHandle (hObject=0xdc) returned 1 [0162.983] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa65cc000, ftCreationTime.dwHighDateTime=0x1be3e98, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa65cc000, ftLastWriteTime.dwHighDateTime=0x1be3e98, nFileSizeHigh=0x0, nFileSizeLow=0x7a46, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0200273.WMF", cAlternateFileName="")) returned 1 [0162.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200273.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0162.983] GetProcessHeap () returned 0x4e0000 [0162.983] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0162.984] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0162.984] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0162.984] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0162.986] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.986] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.986] GetProcessHeap () returned 0x4e0000 [0162.986] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0162.986] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0162.986] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.986] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0162.987] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0162.987] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0162.987] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0162.987] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0162.987] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0162.987] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0162.987] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0162.987] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.987] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7a46, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7a46, lpOverlapped=0x0) returned 1 [0162.992] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7a50, dwBufLen=0x7a50 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7a50) returned 1 [0162.992] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.992] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7a50, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7a50, lpOverlapped=0x0) returned 1 [0162.992] CryptDestroyKey (hKey=0x522f98) returned 1 [0162.992] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7b24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.993] SetEndOfFile (hFile=0xdc) returned 1 [0162.995] GetProcessHeap () returned 0x4e0000 [0162.995] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0162.995] GetProcessHeap () returned 0x4e0000 [0162.995] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0162.996] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200273.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200273.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0162.997] CloseHandle (hObject=0xdc) returned 1 [0162.997] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9f04700, ftCreationTime.dwHighDateTime=0x1be3e98, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9f04700, ftLastWriteTime.dwHighDateTime=0x1be3e98, nFileSizeHigh=0x0, nFileSizeLow=0x4c0a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0200279.WMF", cAlternateFileName="")) returned 1 [0162.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200279.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0162.998] GetProcessHeap () returned 0x4e0000 [0162.998] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0162.998] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0162.998] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0162.999] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0163.001] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.001] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.001] GetProcessHeap () returned 0x4e0000 [0163.001] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0163.001] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0163.001] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.001] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0163.001] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.001] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0163.001] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0163.001] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0163.001] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.001] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.002] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.002] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.002] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4c0a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4c0a, lpOverlapped=0x0) returned 1 [0163.003] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4c10, dwBufLen=0x4c10 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4c10) returned 1 [0163.003] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.003] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4c10, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4c10, lpOverlapped=0x0) returned 1 [0163.003] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.003] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4ce4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.003] SetEndOfFile (hFile=0xdc) returned 1 [0163.006] GetProcessHeap () returned 0x4e0000 [0163.006] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0163.006] GetProcessHeap () returned 0x4e0000 [0163.006] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0163.006] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200279.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200279.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0163.008] CloseHandle (hObject=0xdc) returned 1 [0163.008] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb379af00, ftCreationTime.dwHighDateTime=0x1be3e98, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb379af00, ftLastWriteTime.dwHighDateTime=0x1be3e98, nFileSizeHigh=0x0, nFileSizeLow=0xa0b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0200289.WMF", cAlternateFileName="")) returned 1 [0163.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200289.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.009] GetProcessHeap () returned 0x4e0000 [0163.009] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0163.009] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0163.009] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0163.009] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.009] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.009] GetProcessHeap () returned 0x4e0000 [0163.009] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0163.009] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0163.009] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.009] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0163.011] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.011] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0163.011] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0163.011] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0163.012] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.012] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.012] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.012] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.012] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xa0b0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xa0b0, lpOverlapped=0x0) returned 1 [0163.013] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa0b0, dwBufLen=0xa0b0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa0b0) returned 1 [0163.013] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.014] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xa0b0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xa0b0, lpOverlapped=0x0) returned 1 [0163.014] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.014] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xa184, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.014] SetEndOfFile (hFile=0xdc) returned 1 [0163.017] GetProcessHeap () returned 0x4e0000 [0163.017] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0163.017] GetProcessHeap () returned 0x4e0000 [0163.017] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0163.017] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200289.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200289.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0163.018] CloseHandle (hObject=0xdc) returned 1 [0163.018] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ec38100, ftCreationTime.dwHighDateTime=0x1be3e99, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ec38100, ftLastWriteTime.dwHighDateTime=0x1be3e99, nFileSizeHigh=0x0, nFileSizeLow=0x4f08, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0200377.WMF", cAlternateFileName="")) returned 1 [0163.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200377.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.019] GetProcessHeap () returned 0x4e0000 [0163.019] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0163.019] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0163.019] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0163.019] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.022] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.022] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.022] GetProcessHeap () returned 0x4e0000 [0163.022] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0163.022] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0163.022] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.022] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0163.022] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.022] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0163.023] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0163.023] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0163.023] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.023] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.023] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.023] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.023] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4f08, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4f08, lpOverlapped=0x0) returned 1 [0163.024] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4f10, dwBufLen=0x4f10 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4f10) returned 1 [0163.024] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.024] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4f10, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4f10, lpOverlapped=0x0) returned 1 [0163.025] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.025] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4fe4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.025] SetEndOfFile (hFile=0xdc) returned 1 [0163.027] GetProcessHeap () returned 0x4e0000 [0163.027] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0163.027] GetProcessHeap () returned 0x4e0000 [0163.027] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0163.027] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200377.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200377.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0163.029] CloseHandle (hObject=0xdc) returned 1 [0163.029] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5398, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0200383.WMF", cAlternateFileName="")) returned 1 [0163.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200383.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.030] GetProcessHeap () returned 0x4e0000 [0163.030] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0163.031] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0163.031] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0163.031] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.033] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.033] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.033] GetProcessHeap () returned 0x4e0000 [0163.033] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0163.033] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0163.033] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.033] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0163.033] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.033] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0163.033] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0163.033] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0163.033] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.034] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.034] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.034] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.034] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5398, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x5398, lpOverlapped=0x0) returned 1 [0163.035] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x53a0, dwBufLen=0x53a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x53a0) returned 1 [0163.035] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.035] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x53a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x53a0, lpOverlapped=0x0) returned 1 [0163.035] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.035] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.035] SetEndOfFile (hFile=0xdc) returned 1 [0163.038] GetProcessHeap () returned 0x4e0000 [0163.038] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0163.038] GetProcessHeap () returned 0x4e0000 [0163.038] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0163.038] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200383.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200383.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0163.040] CloseHandle (hObject=0xdc) returned 1 [0163.040] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x366e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0200467.WMF", cAlternateFileName="")) returned 1 [0163.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200467.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.040] GetProcessHeap () returned 0x4e0000 [0163.040] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0163.040] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0163.041] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0163.041] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0163.043] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.043] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.043] GetProcessHeap () returned 0x4e0000 [0163.043] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0163.043] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0163.043] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.043] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0163.043] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.043] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0163.043] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0163.043] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0163.043] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.044] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.044] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.044] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.044] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x366e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x366e, lpOverlapped=0x0) returned 1 [0163.045] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3670, dwBufLen=0x3670 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3670) returned 1 [0163.045] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.045] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3670, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3670, lpOverlapped=0x0) returned 1 [0163.045] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.045] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3744, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.045] SetEndOfFile (hFile=0xdc) returned 1 [0163.048] GetProcessHeap () returned 0x4e0000 [0163.048] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0163.048] GetProcessHeap () returned 0x4e0000 [0163.048] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0163.048] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200467.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200467.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0163.049] CloseHandle (hObject=0xdc) returned 1 [0163.049] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x273e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0200521.WMF", cAlternateFileName="")) returned 1 [0163.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200521.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.050] GetProcessHeap () returned 0x4e0000 [0163.050] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0163.050] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0163.050] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0163.050] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0163.052] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.052] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.052] GetProcessHeap () returned 0x4e0000 [0163.052] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0163.052] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0163.052] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.052] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0163.052] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.052] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0163.053] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0163.053] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0163.053] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.053] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.053] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.053] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.053] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x273e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x273e, lpOverlapped=0x0) returned 1 [0163.056] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2740, dwBufLen=0x2740 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2740) returned 1 [0163.056] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.056] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2740, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2740, lpOverlapped=0x0) returned 1 [0163.056] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.056] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.056] SetEndOfFile (hFile=0xdc) returned 1 [0163.059] GetProcessHeap () returned 0x4e0000 [0163.059] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0163.059] GetProcessHeap () returned 0x4e0000 [0163.059] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0163.059] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200521.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200521.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0163.060] CloseHandle (hObject=0xdc) returned 1 [0163.060] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66057f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xf36, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0200611.WMF", cAlternateFileName="")) returned 1 [0163.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200611.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.061] GetProcessHeap () returned 0x4e0000 [0163.061] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0163.061] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0163.061] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0163.061] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0163.063] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.063] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.063] GetProcessHeap () returned 0x4e0000 [0163.063] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0163.063] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0163.063] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.063] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0163.063] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.063] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0163.063] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0163.064] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0163.064] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.064] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.064] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.064] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.064] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xf36, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xf36, lpOverlapped=0x0) returned 1 [0163.064] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xf40, dwBufLen=0xf40 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xf40) returned 1 [0163.064] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.064] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xf40, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xf40, lpOverlapped=0x0) returned 1 [0163.064] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.064] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.064] SetEndOfFile (hFile=0xdc) returned 1 [0163.067] GetProcessHeap () returned 0x4e0000 [0163.067] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0163.067] GetProcessHeap () returned 0x4e0000 [0163.067] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0163.067] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200611.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200611.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0163.068] CloseHandle (hObject=0xdc) returned 1 [0163.068] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66057f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa50e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0202045.JPG", cAlternateFileName="")) returned 1 [0163.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0202045.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.069] GetProcessHeap () returned 0x4e0000 [0163.069] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0163.069] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0163.069] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0163.069] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0163.071] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.071] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.071] GetProcessHeap () returned 0x4e0000 [0163.071] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0163.071] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0163.071] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.071] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0163.071] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.072] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0163.072] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0163.072] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0163.072] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.072] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.072] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.072] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.072] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xa50e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xa50e, lpOverlapped=0x0) returned 1 [0163.073] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa510, dwBufLen=0xa510 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa510) returned 1 [0163.074] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.074] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xa510, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xa510, lpOverlapped=0x0) returned 1 [0163.074] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.074] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xa5e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.074] SetEndOfFile (hFile=0xdc) returned 1 [0163.077] GetProcessHeap () returned 0x4e0000 [0163.077] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0163.077] GetProcessHeap () returned 0x4e0000 [0163.077] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0163.077] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0202045.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0202045.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0163.079] CloseHandle (hObject=0xdc) returned 1 [0163.079] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60b62300, ftCreationTime.dwHighDateTime=0x1be560f, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60b62300, ftLastWriteTime.dwHighDateTime=0x1be560f, nFileSizeHigh=0x0, nFileSizeLow=0x6e74, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0211981.WMF", cAlternateFileName="")) returned 1 [0163.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0211981.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.079] GetProcessHeap () returned 0x4e0000 [0163.079] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0163.079] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0163.079] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0163.080] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0163.082] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.082] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.082] GetProcessHeap () returned 0x4e0000 [0163.082] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0163.082] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0163.082] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.082] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0163.082] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.082] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0163.082] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0163.082] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0163.082] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.083] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.083] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.083] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.083] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x6e74, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x6e74, lpOverlapped=0x0) returned 1 [0163.086] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6e80, dwBufLen=0x6e80 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6e80) returned 1 [0163.086] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.086] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6e80, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x6e80, lpOverlapped=0x0) returned 1 [0163.086] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.086] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6f54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.086] SetEndOfFile (hFile=0xdc) returned 1 [0163.089] GetProcessHeap () returned 0x4e0000 [0163.089] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0163.089] GetProcessHeap () returned 0x4e0000 [0163.089] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0163.089] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0211981.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0211981.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0163.090] CloseHandle (hObject=0xdc) returned 1 [0163.090] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x180e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0212299.WMF", cAlternateFileName="")) returned 1 [0163.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212299.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.092] GetProcessHeap () returned 0x4e0000 [0163.092] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0163.092] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0163.092] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0163.092] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0163.094] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.094] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.094] GetProcessHeap () returned 0x4e0000 [0163.094] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0163.094] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0163.094] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.094] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0163.094] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.094] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0163.094] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0163.094] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0163.095] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.095] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.095] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.095] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.095] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x180e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x180e, lpOverlapped=0x0) returned 1 [0163.096] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1810, dwBufLen=0x1810 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1810) returned 1 [0163.096] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.096] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1810, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1810, lpOverlapped=0x0) returned 1 [0163.096] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.096] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x18e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.096] SetEndOfFile (hFile=0xdc) returned 1 [0163.099] GetProcessHeap () returned 0x4e0000 [0163.099] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0163.099] GetProcessHeap () returned 0x4e0000 [0163.099] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0163.099] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212299.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212299.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0163.100] CloseHandle (hObject=0xdc) returned 1 [0163.100] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x25cc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0212601.WMF", cAlternateFileName="")) returned 1 [0163.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212601.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.101] GetProcessHeap () returned 0x4e0000 [0163.101] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0163.101] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0163.101] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0163.101] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.103] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.103] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.103] GetProcessHeap () returned 0x4e0000 [0163.103] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0163.103] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0163.103] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.103] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0163.103] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.103] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0163.103] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0163.104] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0163.104] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.104] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.104] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.104] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.104] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x25cc, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x25cc, lpOverlapped=0x0) returned 1 [0163.105] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x25d0, dwBufLen=0x25d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x25d0) returned 1 [0163.105] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.105] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x25d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x25d0, lpOverlapped=0x0) returned 1 [0163.105] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.105] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x26a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.105] SetEndOfFile (hFile=0xdc) returned 1 [0163.108] GetProcessHeap () returned 0x4e0000 [0163.108] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0163.108] GetProcessHeap () returned 0x4e0000 [0163.108] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0163.108] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212601.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212601.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0163.109] CloseHandle (hObject=0xdc) returned 1 [0163.109] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66057f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x199a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0212685.WMF", cAlternateFileName="")) returned 1 [0163.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212685.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.110] GetProcessHeap () returned 0x4e0000 [0163.110] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0163.111] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0163.111] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0163.111] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0163.120] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.121] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.121] GetProcessHeap () returned 0x4e0000 [0163.121] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0163.121] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0163.121] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.121] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0163.121] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.121] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0163.121] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0163.121] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0163.121] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.121] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.121] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.121] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.121] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x199a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x199a, lpOverlapped=0x0) returned 1 [0163.122] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x19a0, dwBufLen=0x19a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x19a0) returned 1 [0163.122] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.123] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x19a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x19a0, lpOverlapped=0x0) returned 1 [0163.123] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.123] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1a74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.123] SetEndOfFile (hFile=0xdc) returned 1 [0163.125] GetProcessHeap () returned 0x4e0000 [0163.125] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0163.125] GetProcessHeap () returned 0x4e0000 [0163.125] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0163.126] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212685.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212685.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0163.127] CloseHandle (hObject=0xdc) returned 1 [0163.127] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x80c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0212751.WMF", cAlternateFileName="")) returned 1 [0163.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212751.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.128] GetProcessHeap () returned 0x4e0000 [0163.128] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0163.128] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0163.128] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0163.128] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.130] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.130] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.130] GetProcessHeap () returned 0x4e0000 [0163.130] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0163.131] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0163.131] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.131] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0163.131] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.131] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0163.131] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0163.131] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0163.131] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.131] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.131] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.131] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.131] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x80c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x80c, lpOverlapped=0x0) returned 1 [0163.131] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x810, dwBufLen=0x810 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x810) returned 1 [0163.131] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.132] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x810, lpOverlapped=0x0) returned 1 [0163.132] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.132] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x8e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.132] SetEndOfFile (hFile=0xdc) returned 1 [0163.134] GetProcessHeap () returned 0x4e0000 [0163.134] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0163.134] GetProcessHeap () returned 0x4e0000 [0163.134] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0163.135] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212751.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212751.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0163.136] CloseHandle (hObject=0xdc) returned 1 [0163.136] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d4a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0212953.WMF", cAlternateFileName="")) returned 1 [0163.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212953.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.137] GetProcessHeap () returned 0x4e0000 [0163.137] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0163.137] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0163.137] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0163.137] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0163.139] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.139] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.139] GetProcessHeap () returned 0x4e0000 [0163.139] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0163.139] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0163.139] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.139] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0163.139] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.140] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0163.140] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0163.140] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0163.140] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.140] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.140] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.140] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.140] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1d4a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1d4a, lpOverlapped=0x0) returned 1 [0163.141] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1d50, dwBufLen=0x1d50 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1d50) returned 1 [0163.141] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.141] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1d50, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1d50, lpOverlapped=0x0) returned 1 [0163.141] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.142] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1e24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.142] SetEndOfFile (hFile=0xdc) returned 1 [0163.144] GetProcessHeap () returned 0x4e0000 [0163.144] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0163.144] GetProcessHeap () returned 0x4e0000 [0163.144] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0163.144] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212953.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212953.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0163.146] CloseHandle (hObject=0xdc) returned 1 [0163.146] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa5c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0213243.WMF", cAlternateFileName="")) returned 1 [0163.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213243.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.147] GetProcessHeap () returned 0x4e0000 [0163.147] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0163.147] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0163.147] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0163.147] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.149] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.149] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.149] GetProcessHeap () returned 0x4e0000 [0163.149] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0163.149] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0163.149] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.149] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0163.149] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.149] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0163.149] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0163.149] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0163.149] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.150] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.150] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.150] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.150] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xa5c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xa5c, lpOverlapped=0x0) returned 1 [0163.150] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa60, dwBufLen=0xa60 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa60) returned 1 [0163.150] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.150] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xa60, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xa60, lpOverlapped=0x0) returned 1 [0163.150] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.150] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xb34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.150] SetEndOfFile (hFile=0xdc) returned 1 [0163.153] GetProcessHeap () returned 0x4e0000 [0163.153] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0163.153] GetProcessHeap () returned 0x4e0000 [0163.153] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0163.153] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213243.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213243.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0163.154] CloseHandle (hObject=0xdc) returned 1 [0163.154] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xf00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0213449.WMF", cAlternateFileName="")) returned 1 [0163.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213449.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.155] GetProcessHeap () returned 0x4e0000 [0163.155] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0163.155] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0163.155] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0163.155] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.155] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.155] GetProcessHeap () returned 0x4e0000 [0163.155] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0163.155] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0163.155] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.155] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0163.182] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.182] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0163.182] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0163.182] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0163.182] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.183] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.183] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.183] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.183] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xf00, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xf00, lpOverlapped=0x0) returned 1 [0163.183] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xf00, dwBufLen=0xf00 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xf00) returned 1 [0163.183] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.183] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xf00, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xf00, lpOverlapped=0x0) returned 1 [0163.183] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.183] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xfd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.183] SetEndOfFile (hFile=0xdc) returned 1 [0163.186] GetProcessHeap () returned 0x4e0000 [0163.186] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0163.186] GetProcessHeap () returned 0x4e0000 [0163.186] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0163.186] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213449.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213449.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0163.188] CloseHandle (hObject=0xdc) returned 1 [0163.188] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7cb6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0214934.WMF", cAlternateFileName="")) returned 1 [0163.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214934.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.189] GetProcessHeap () returned 0x4e0000 [0163.189] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0163.189] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0163.189] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0163.189] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0163.192] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.192] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.192] GetProcessHeap () returned 0x4e0000 [0163.192] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0163.192] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0163.192] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.192] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0163.192] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.192] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0163.192] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0163.193] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0163.193] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.193] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.193] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.193] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.193] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7cb6, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7cb6, lpOverlapped=0x0) returned 1 [0163.194] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7cc0, dwBufLen=0x7cc0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7cc0) returned 1 [0163.195] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.195] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7cc0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7cc0, lpOverlapped=0x0) returned 1 [0163.195] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.195] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7d94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.195] SetEndOfFile (hFile=0xdc) returned 1 [0163.198] GetProcessHeap () returned 0x4e0000 [0163.198] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0163.198] GetProcessHeap () returned 0x4e0000 [0163.198] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0163.198] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214934.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214934.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0163.199] CloseHandle (hObject=0xdc) returned 1 [0163.199] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaefa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0214948.WMF", cAlternateFileName="")) returned 1 [0163.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214948.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.201] GetProcessHeap () returned 0x4e0000 [0163.201] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0163.201] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0163.201] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0163.201] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0163.203] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.203] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.203] GetProcessHeap () returned 0x4e0000 [0163.204] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0163.204] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0163.204] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.204] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0163.204] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.204] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0163.204] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0163.204] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0163.204] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.204] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.204] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.204] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.204] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xaefa, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xaefa, lpOverlapped=0x0) returned 1 [0163.206] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xaf00, dwBufLen=0xaf00 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xaf00) returned 1 [0163.206] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.206] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xaf00, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xaf00, lpOverlapped=0x0) returned 1 [0163.206] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.206] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xafd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.207] SetEndOfFile (hFile=0xdc) returned 1 [0163.211] GetProcessHeap () returned 0x4e0000 [0163.211] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0163.211] GetProcessHeap () returned 0x4e0000 [0163.211] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0163.211] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214948.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214948.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0163.212] CloseHandle (hObject=0xdc) returned 1 [0163.213] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26227e00, ftCreationTime.dwHighDateTime=0x1be5489, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x26227e00, ftLastWriteTime.dwHighDateTime=0x1be5489, nFileSizeHigh=0x0, nFileSizeLow=0x2d6c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0215070.WMF", cAlternateFileName="")) returned 1 [0163.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215070.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.214] GetProcessHeap () returned 0x4e0000 [0163.214] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0163.214] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0163.214] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0163.214] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.217] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.217] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.217] GetProcessHeap () returned 0x4e0000 [0163.217] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0163.217] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0163.217] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.217] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0163.217] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.217] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0163.217] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0163.217] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0163.218] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.218] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.218] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.218] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.218] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2d6c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2d6c, lpOverlapped=0x0) returned 1 [0163.219] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2d70, dwBufLen=0x2d70 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2d70) returned 1 [0163.219] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.219] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2d70, lpOverlapped=0x0) returned 1 [0163.219] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.219] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2e44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.219] SetEndOfFile (hFile=0xdc) returned 1 [0163.222] GetProcessHeap () returned 0x4e0000 [0163.222] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0163.222] GetProcessHeap () returned 0x4e0000 [0163.222] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0163.222] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215070.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215070.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0163.224] CloseHandle (hObject=0xdc) returned 1 [0163.224] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2209e400, ftCreationTime.dwHighDateTime=0x1be1b5b, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2209e400, ftLastWriteTime.dwHighDateTime=0x1be1b5b, nFileSizeHigh=0x0, nFileSizeLow=0x1f50, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0215076.WMF", cAlternateFileName="")) returned 1 [0163.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215076.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.225] GetProcessHeap () returned 0x4e0000 [0163.225] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0163.225] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0163.225] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0163.225] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.225] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.225] GetProcessHeap () returned 0x4e0000 [0163.225] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0163.225] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0163.225] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.225] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0163.256] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.256] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0163.256] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0163.257] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0163.257] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.257] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.257] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.257] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.257] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1f50, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1f50, lpOverlapped=0x0) returned 1 [0163.259] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1f50, dwBufLen=0x1f50 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1f50) returned 1 [0163.259] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.259] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1f50, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1f50, lpOverlapped=0x0) returned 1 [0163.259] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.259] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2024, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.259] SetEndOfFile (hFile=0xdc) returned 1 [0163.262] GetProcessHeap () returned 0x4e0000 [0163.262] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0163.262] GetProcessHeap () returned 0x4e0000 [0163.262] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0163.262] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215076.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215076.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0163.264] CloseHandle (hObject=0xdc) returned 1 [0163.264] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x81ce, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0215210.WMF", cAlternateFileName="")) returned 1 [0163.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215210.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.265] GetProcessHeap () returned 0x4e0000 [0163.265] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0163.265] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0163.265] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0163.265] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0163.267] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.267] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.267] GetProcessHeap () returned 0x4e0000 [0163.267] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0163.267] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0163.267] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.267] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0163.267] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.267] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0163.268] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0163.268] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0163.268] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.268] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.268] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.268] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.268] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x81ce, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x81ce, lpOverlapped=0x0) returned 1 [0163.269] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x81d0, dwBufLen=0x81d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x81d0) returned 1 [0163.270] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.270] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x81d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x81d0, lpOverlapped=0x0) returned 1 [0163.270] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.270] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x82a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.270] SetEndOfFile (hFile=0xdc) returned 1 [0163.273] GetProcessHeap () returned 0x4e0000 [0163.273] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0163.273] GetProcessHeap () returned 0x4e0000 [0163.273] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0163.273] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215210.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215210.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0163.274] CloseHandle (hObject=0xdc) returned 1 [0163.275] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x852fb100, ftCreationTime.dwHighDateTime=0x1be4927, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x852fb100, ftLastWriteTime.dwHighDateTime=0x1be4927, nFileSizeHigh=0x0, nFileSizeLow=0x244a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0215709.WMF", cAlternateFileName="")) returned 1 [0163.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215709.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.276] GetProcessHeap () returned 0x4e0000 [0163.276] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0163.276] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0163.276] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0163.276] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0163.279] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.279] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.279] GetProcessHeap () returned 0x4e0000 [0163.279] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0163.279] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0163.279] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.279] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0163.279] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.279] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0163.279] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0163.279] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0163.279] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.279] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.279] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.279] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.280] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x244a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x244a, lpOverlapped=0x0) returned 1 [0163.280] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2450, dwBufLen=0x2450 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2450) returned 1 [0163.281] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.281] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2450, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2450, lpOverlapped=0x0) returned 1 [0163.281] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.281] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2524, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.281] SetEndOfFile (hFile=0xdc) returned 1 [0163.284] GetProcessHeap () returned 0x4e0000 [0163.284] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0163.284] GetProcessHeap () returned 0x4e0000 [0163.284] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0163.284] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215709.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215709.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0163.285] CloseHandle (hObject=0xdc) returned 1 [0163.285] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87920b00, ftCreationTime.dwHighDateTime=0x1be4927, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x87920b00, ftLastWriteTime.dwHighDateTime=0x1be4927, nFileSizeHigh=0x0, nFileSizeLow=0x45a2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0215710.WMF", cAlternateFileName="")) returned 1 [0163.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215710.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.286] GetProcessHeap () returned 0x4e0000 [0163.286] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0163.286] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0163.286] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0163.286] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0163.288] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.289] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.289] GetProcessHeap () returned 0x4e0000 [0163.289] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0163.289] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0163.289] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.289] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0163.289] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.289] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0163.289] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0163.289] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0163.289] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.289] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.289] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.289] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.289] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x45a2, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x45a2, lpOverlapped=0x0) returned 1 [0163.290] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x45b0, dwBufLen=0x45b0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x45b0) returned 1 [0163.291] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.291] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x45b0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x45b0, lpOverlapped=0x0) returned 1 [0163.291] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.291] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.291] SetEndOfFile (hFile=0xdc) returned 1 [0163.294] GetProcessHeap () returned 0x4e0000 [0163.294] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0163.294] GetProcessHeap () returned 0x4e0000 [0163.294] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0163.294] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215710.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215710.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0163.295] CloseHandle (hObject=0xdc) returned 1 [0163.295] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95e02700, ftCreationTime.dwHighDateTime=0x1be4927, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95e02700, ftLastWriteTime.dwHighDateTime=0x1be4927, nFileSizeHigh=0x0, nFileSizeLow=0x15f2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0215718.WMF", cAlternateFileName="")) returned 1 [0163.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215718.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.296] GetProcessHeap () returned 0x4e0000 [0163.296] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0163.296] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0163.296] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0163.296] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0163.299] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.299] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.299] GetProcessHeap () returned 0x4e0000 [0163.299] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0163.299] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0163.299] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.299] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0163.299] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.299] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0163.299] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0163.299] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0163.299] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.299] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.299] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.299] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.300] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x15f2, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x15f2, lpOverlapped=0x0) returned 1 [0163.300] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1600, dwBufLen=0x1600 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1600) returned 1 [0163.300] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.300] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1600, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1600, lpOverlapped=0x0) returned 1 [0163.301] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.301] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x16d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.301] SetEndOfFile (hFile=0xdc) returned 1 [0163.303] GetProcessHeap () returned 0x4e0000 [0163.303] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0163.303] GetProcessHeap () returned 0x4e0000 [0163.304] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0163.304] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215718.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215718.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0163.305] CloseHandle (hObject=0xdc) returned 1 [0163.305] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa783, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0216112.JPG", cAlternateFileName="")) returned 1 [0163.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216112.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.306] GetProcessHeap () returned 0x4e0000 [0163.306] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0163.306] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0163.306] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0163.306] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xd, lpOverlapped=0x0) returned 1 [0163.308] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.308] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.308] GetProcessHeap () returned 0x4e0000 [0163.308] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0163.308] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0163.308] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.308] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0163.308] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.308] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0163.308] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0163.309] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0163.309] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.309] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.309] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.309] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.309] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xa783, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xa783, lpOverlapped=0x0) returned 1 [0163.310] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa790, dwBufLen=0xa790 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa790) returned 1 [0163.311] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.311] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xa790, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xa790, lpOverlapped=0x0) returned 1 [0163.311] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.311] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xa864, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.311] SetEndOfFile (hFile=0xdc) returned 1 [0163.314] GetProcessHeap () returned 0x4e0000 [0163.314] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0163.314] GetProcessHeap () returned 0x4e0000 [0163.314] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0163.314] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216112.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216112.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0163.316] CloseHandle (hObject=0xdc) returned 1 [0163.316] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5474, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0216153.JPG", cAlternateFileName="")) returned 1 [0163.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216153.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.318] GetProcessHeap () returned 0x4e0000 [0163.318] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0163.318] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0163.318] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0163.318] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0163.320] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.320] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.320] GetProcessHeap () returned 0x4e0000 [0163.320] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0163.321] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0163.321] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.321] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0163.321] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.321] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0163.321] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0163.321] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0163.321] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.321] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.321] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.321] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.321] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5474, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x5474, lpOverlapped=0x0) returned 1 [0163.322] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5480, dwBufLen=0x5480 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5480) returned 1 [0163.323] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.323] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5480, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5480, lpOverlapped=0x0) returned 1 [0163.323] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.323] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5554, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.323] SetEndOfFile (hFile=0xdc) returned 1 [0163.326] GetProcessHeap () returned 0x4e0000 [0163.326] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0163.326] GetProcessHeap () returned 0x4e0000 [0163.326] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0163.326] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216153.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216153.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0163.327] CloseHandle (hObject=0xdc) returned 1 [0163.327] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa488, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0216540.WMF", cAlternateFileName="")) returned 1 [0163.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216540.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.328] GetProcessHeap () returned 0x4e0000 [0163.328] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0163.328] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0163.328] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0163.329] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.331] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.331] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.331] GetProcessHeap () returned 0x4e0000 [0163.331] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0163.331] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0163.331] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.331] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0163.331] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.331] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0163.331] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0163.331] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0163.332] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.332] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.332] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.332] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.332] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xa488, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xa488, lpOverlapped=0x0) returned 1 [0163.333] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa490, dwBufLen=0xa490 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa490) returned 1 [0163.334] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.334] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xa490, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xa490, lpOverlapped=0x0) returned 1 [0163.334] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.334] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xa564, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.334] SetEndOfFile (hFile=0xdc) returned 1 [0163.337] GetProcessHeap () returned 0x4e0000 [0163.337] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0163.337] GetProcessHeap () returned 0x4e0000 [0163.337] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0163.337] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216540.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216540.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0163.338] CloseHandle (hObject=0xdc) returned 1 [0163.339] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x60dc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0216570.WMF", cAlternateFileName="")) returned 1 [0163.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216570.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.339] GetProcessHeap () returned 0x4e0000 [0163.339] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0163.339] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0163.340] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0163.340] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.342] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.342] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.342] GetProcessHeap () returned 0x4e0000 [0163.342] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0163.342] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0163.342] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.342] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0163.342] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.342] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0163.342] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0163.342] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0163.342] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.342] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.342] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.343] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.343] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x60dc, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x60dc, lpOverlapped=0x0) returned 1 [0163.344] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x60e0, dwBufLen=0x60e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x60e0) returned 1 [0163.344] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.344] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x60e0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x60e0, lpOverlapped=0x0) returned 1 [0163.344] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.344] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x61b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.344] SetEndOfFile (hFile=0xdc) returned 1 [0163.347] GetProcessHeap () returned 0x4e0000 [0163.347] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0163.347] GetProcessHeap () returned 0x4e0000 [0163.347] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0163.347] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216570.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216570.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0163.349] CloseHandle (hObject=0xdc) returned 1 [0163.349] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565cf3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f46, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0216600.WMF", cAlternateFileName="")) returned 1 [0163.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216600.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.350] GetProcessHeap () returned 0x4e0000 [0163.350] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0163.350] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0163.350] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0163.350] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0163.352] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.352] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.352] GetProcessHeap () returned 0x4e0000 [0163.352] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0163.352] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0163.352] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.352] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0163.352] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.353] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0163.353] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0163.353] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0163.353] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.353] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.353] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.353] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.353] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1f46, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1f46, lpOverlapped=0x0) returned 1 [0163.354] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1f50, dwBufLen=0x1f50 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1f50) returned 1 [0163.354] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.354] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1f50, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1f50, lpOverlapped=0x0) returned 1 [0163.354] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.354] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2024, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.355] SetEndOfFile (hFile=0xdc) returned 1 [0163.357] GetProcessHeap () returned 0x4e0000 [0163.357] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0163.357] GetProcessHeap () returned 0x4e0000 [0163.357] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0163.357] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216600.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216600.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0163.359] CloseHandle (hObject=0xdc) returned 1 [0163.359] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565cf3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x24e2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0216612.WMF", cAlternateFileName="")) returned 1 [0163.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216612.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.360] GetProcessHeap () returned 0x4e0000 [0163.360] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0163.360] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0163.360] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0163.360] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0163.362] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.362] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.362] GetProcessHeap () returned 0x4e0000 [0163.362] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0163.362] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0163.362] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.362] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0163.363] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.363] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0163.363] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0163.363] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0163.363] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.363] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.363] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.363] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.363] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x24e2, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x24e2, lpOverlapped=0x0) returned 1 [0163.364] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x24f0, dwBufLen=0x24f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x24f0) returned 1 [0163.364] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.364] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x24f0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x24f0, lpOverlapped=0x0) returned 1 [0163.365] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.365] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x25c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.365] SetEndOfFile (hFile=0xdc) returned 1 [0163.367] GetProcessHeap () returned 0x4e0000 [0163.367] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0163.367] GetProcessHeap () returned 0x4e0000 [0163.367] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0163.367] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216612.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216612.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0163.368] CloseHandle (hObject=0xdc) returned 1 [0163.368] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9b3a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0216874.WMF", cAlternateFileName="")) returned 1 [0163.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216874.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.370] GetProcessHeap () returned 0x4e0000 [0163.370] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0163.370] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0163.370] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0163.370] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0163.372] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.372] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.372] GetProcessHeap () returned 0x4e0000 [0163.372] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0163.372] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0163.372] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.372] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0163.372] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.373] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0163.373] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0163.373] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0163.373] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.373] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.373] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.373] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.373] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x9b3a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x9b3a, lpOverlapped=0x0) returned 1 [0163.374] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9b40, dwBufLen=0x9b40 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9b40) returned 1 [0163.375] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.375] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x9b40, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x9b40, lpOverlapped=0x0) returned 1 [0163.375] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.375] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x9c14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.375] SetEndOfFile (hFile=0xdc) returned 1 [0163.378] GetProcessHeap () returned 0x4e0000 [0163.378] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0163.378] GetProcessHeap () returned 0x4e0000 [0163.378] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0163.378] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216874.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216874.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0163.379] CloseHandle (hObject=0xdc) returned 1 [0163.379] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1484, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0217262.WMF", cAlternateFileName="")) returned 1 [0163.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217262.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.380] GetProcessHeap () returned 0x4e0000 [0163.380] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0163.380] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0163.380] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0163.380] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0163.382] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.382] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.382] GetProcessHeap () returned 0x4e0000 [0163.382] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0163.383] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0163.383] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.383] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0163.383] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.383] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0163.383] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0163.383] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0163.383] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.383] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.383] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.383] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.383] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1484, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1484, lpOverlapped=0x0) returned 1 [0163.385] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1490, dwBufLen=0x1490 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1490) returned 1 [0163.385] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.385] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1490, lpOverlapped=0x0) returned 1 [0163.385] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.385] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1564, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.385] SetEndOfFile (hFile=0xdc) returned 1 [0163.388] GetProcessHeap () returned 0x4e0000 [0163.388] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0163.388] GetProcessHeap () returned 0x4e0000 [0163.388] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0163.388] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217262.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217262.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0163.389] CloseHandle (hObject=0xdc) returned 1 [0163.389] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565cf3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd9a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0217302.WMF", cAlternateFileName="")) returned 1 [0163.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217302.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.390] GetProcessHeap () returned 0x4e0000 [0163.390] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0163.390] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0163.390] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0163.390] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0163.392] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.392] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.392] GetProcessHeap () returned 0x4e0000 [0163.392] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0163.392] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0163.392] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.392] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0163.392] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.392] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0163.393] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0163.393] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0163.393] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.393] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.393] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.393] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.393] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xd9a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xd9a, lpOverlapped=0x0) returned 1 [0163.393] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xda0, dwBufLen=0xda0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xda0) returned 1 [0163.393] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.393] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xda0, lpOverlapped=0x0) returned 1 [0163.393] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.393] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xe74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.393] SetEndOfFile (hFile=0xdc) returned 1 [0163.396] GetProcessHeap () returned 0x4e0000 [0163.396] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0163.396] GetProcessHeap () returned 0x4e0000 [0163.396] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0163.396] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217302.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217302.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0163.397] CloseHandle (hObject=0xdc) returned 1 [0163.397] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565cf3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ca8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0217872.WMF", cAlternateFileName="")) returned 1 [0163.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217872.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.398] GetProcessHeap () returned 0x4e0000 [0163.398] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0163.398] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0163.398] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0163.398] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.400] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.400] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.400] GetProcessHeap () returned 0x4e0000 [0163.400] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0163.401] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0163.401] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.401] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0163.401] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.401] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0163.401] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0163.401] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0163.401] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.401] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.401] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.401] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.401] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1ca8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1ca8, lpOverlapped=0x0) returned 1 [0163.402] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1cb0, dwBufLen=0x1cb0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1cb0) returned 1 [0163.402] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.402] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1cb0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1cb0, lpOverlapped=0x0) returned 1 [0163.402] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.402] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1d84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.403] SetEndOfFile (hFile=0xdc) returned 1 [0163.405] GetProcessHeap () returned 0x4e0000 [0163.405] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0163.405] GetProcessHeap () returned 0x4e0000 [0163.405] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0163.405] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217872.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217872.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0163.406] CloseHandle (hObject=0xdc) returned 1 [0163.407] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8ad6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0227419.JPG", cAlternateFileName="")) returned 1 [0163.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227419.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.408] GetProcessHeap () returned 0x4e0000 [0163.408] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0163.408] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0163.408] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0163.408] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0163.431] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.431] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.431] GetProcessHeap () returned 0x4e0000 [0163.431] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0163.431] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0163.431] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.431] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0163.431] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.431] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0163.431] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0163.431] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0163.431] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.431] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.432] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.432] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.432] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x8ad6, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x8ad6, lpOverlapped=0x0) returned 1 [0163.456] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8ae0, dwBufLen=0x8ae0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8ae0) returned 1 [0163.456] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.456] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x8ae0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x8ae0, lpOverlapped=0x0) returned 1 [0163.457] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.457] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x8bb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.457] SetEndOfFile (hFile=0xdc) returned 1 [0163.460] GetProcessHeap () returned 0x4e0000 [0163.460] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0163.460] GetProcessHeap () returned 0x4e0000 [0163.460] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0163.460] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227419.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227419.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0163.462] CloseHandle (hObject=0xdc) returned 1 [0163.462] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565cf3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe2e9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0227558.JPG", cAlternateFileName="")) returned 1 [0163.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227558.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.464] GetProcessHeap () returned 0x4e0000 [0163.464] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0163.464] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0163.464] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0163.464] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x7, lpOverlapped=0x0) returned 1 [0163.469] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.469] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.469] GetProcessHeap () returned 0x4e0000 [0163.469] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0163.469] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0163.469] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.469] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0163.470] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.470] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0163.470] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0163.470] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0163.470] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.470] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.470] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.470] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.470] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xe2e9, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xe2e9, lpOverlapped=0x0) returned 1 [0163.474] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe2f0, dwBufLen=0xe2f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe2f0) returned 1 [0163.475] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.475] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe2f0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xe2f0, lpOverlapped=0x0) returned 1 [0163.475] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.475] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xe3c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.475] SetEndOfFile (hFile=0xdc) returned 1 [0163.478] GetProcessHeap () returned 0x4e0000 [0163.478] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0163.478] GetProcessHeap () returned 0x4e0000 [0163.479] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0163.479] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227558.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227558.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0163.480] CloseHandle (hObject=0xdc) returned 1 [0163.480] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaccb1700, ftCreationTime.dwHighDateTime=0x1be8602, ftLastAccessTime.dwLowDateTime=0x565cf3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaccb1700, ftLastWriteTime.dwHighDateTime=0x1be8602, nFileSizeHigh=0x0, nFileSizeLow=0x65a6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0228823.WMF", cAlternateFileName="")) returned 1 [0163.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228823.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.481] GetProcessHeap () returned 0x4e0000 [0163.481] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0163.481] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0163.481] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0163.482] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0163.484] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.484] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.484] GetProcessHeap () returned 0x4e0000 [0163.484] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0163.484] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0163.484] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.484] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0163.484] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.484] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0163.484] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0163.484] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0163.484] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.484] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.485] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.485] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.485] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x65a6, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x65a6, lpOverlapped=0x0) returned 1 [0163.486] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x65b0, dwBufLen=0x65b0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x65b0) returned 1 [0163.486] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.486] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x65b0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x65b0, lpOverlapped=0x0) returned 1 [0163.486] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.486] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.486] SetEndOfFile (hFile=0xdc) returned 1 [0163.489] GetProcessHeap () returned 0x4e0000 [0163.489] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0163.489] GetProcessHeap () returned 0x4e0000 [0163.489] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0163.489] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228823.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228823.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0163.491] CloseHandle (hObject=0xdc) returned 1 [0163.491] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565cf3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x918c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0228959.WMF", cAlternateFileName="")) returned 1 [0163.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228959.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.493] GetProcessHeap () returned 0x4e0000 [0163.493] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0163.493] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0163.493] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0163.493] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.495] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.495] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.495] GetProcessHeap () returned 0x4e0000 [0163.495] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0163.495] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0163.495] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.495] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0163.495] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.495] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0163.495] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0163.495] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0163.496] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.496] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.496] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.496] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.496] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x918c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x918c, lpOverlapped=0x0) returned 1 [0163.497] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9190, dwBufLen=0x9190 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9190) returned 1 [0163.498] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.498] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x9190, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x9190, lpOverlapped=0x0) returned 1 [0163.498] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.498] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x9264, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.498] SetEndOfFile (hFile=0xdc) returned 1 [0163.501] GetProcessHeap () returned 0x4e0000 [0163.501] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0163.501] GetProcessHeap () returned 0x4e0000 [0163.501] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0163.501] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228959.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228959.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0163.503] CloseHandle (hObject=0xdc) returned 1 [0163.503] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1daa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0230553.WMF", cAlternateFileName="")) returned 1 [0163.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230553.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.505] GetProcessHeap () returned 0x4e0000 [0163.505] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0163.505] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0163.505] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0163.505] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0163.514] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.514] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.514] GetProcessHeap () returned 0x4e0000 [0163.514] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0163.514] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0163.514] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.514] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0163.515] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.515] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0163.515] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0163.515] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0163.515] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.515] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.515] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.515] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.515] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1daa, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1daa, lpOverlapped=0x0) returned 1 [0163.517] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1db0, dwBufLen=0x1db0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1db0) returned 1 [0163.517] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.517] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1db0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1db0, lpOverlapped=0x0) returned 1 [0163.517] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.517] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1e84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.518] SetEndOfFile (hFile=0xdc) returned 1 [0163.520] GetProcessHeap () returned 0x4e0000 [0163.520] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0163.520] GetProcessHeap () returned 0x4e0000 [0163.520] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0163.521] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230553.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230553.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0163.522] CloseHandle (hObject=0xdc) returned 1 [0163.522] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1066, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0230558.WMF", cAlternateFileName="")) returned 1 [0163.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230558.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.523] GetProcessHeap () returned 0x4e0000 [0163.523] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0163.523] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0163.523] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0163.523] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0163.526] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.526] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.526] GetProcessHeap () returned 0x4e0000 [0163.526] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0163.526] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0163.527] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.527] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0163.527] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.527] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0163.527] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0163.527] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0163.527] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.527] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.527] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.527] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.527] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1066, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1066, lpOverlapped=0x0) returned 1 [0163.528] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1070, dwBufLen=0x1070 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1070) returned 1 [0163.528] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.528] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1070, lpOverlapped=0x0) returned 1 [0163.528] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.529] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1144, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.529] SetEndOfFile (hFile=0xdc) returned 1 [0163.531] GetProcessHeap () returned 0x4e0000 [0163.531] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0163.531] GetProcessHeap () returned 0x4e0000 [0163.531] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0163.531] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230558.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230558.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0163.533] CloseHandle (hObject=0xdc) returned 1 [0163.533] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x332a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0232171.WMF", cAlternateFileName="")) returned 1 [0163.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232171.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.534] GetProcessHeap () returned 0x4e0000 [0163.534] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0163.534] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0163.534] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0163.534] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0163.536] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.536] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.536] GetProcessHeap () returned 0x4e0000 [0163.536] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0163.536] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0163.536] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.536] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0163.536] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.537] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0163.537] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0163.537] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0163.537] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.537] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.537] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.537] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.537] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x332a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x332a, lpOverlapped=0x0) returned 1 [0163.538] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3330, dwBufLen=0x3330 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3330) returned 1 [0163.538] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.538] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3330, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3330, lpOverlapped=0x0) returned 1 [0163.538] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.539] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3404, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.539] SetEndOfFile (hFile=0xdc) returned 1 [0163.541] GetProcessHeap () returned 0x4e0000 [0163.541] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0163.541] GetProcessHeap () returned 0x4e0000 [0163.541] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0163.541] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232171.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232171.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0163.543] CloseHandle (hObject=0xdc) returned 1 [0163.543] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22d8c500, ftCreationTime.dwHighDateTime=0x1be1ff6, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22d8c500, ftLastWriteTime.dwHighDateTime=0x1be1ff6, nFileSizeHigh=0x0, nFileSizeLow=0x6bc2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0232393.WMF", cAlternateFileName="")) returned 1 [0163.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232393.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.544] GetProcessHeap () returned 0x4e0000 [0163.544] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0163.544] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0163.544] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0163.544] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0163.546] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.546] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.546] GetProcessHeap () returned 0x4e0000 [0163.546] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0163.546] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0163.546] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.546] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0163.546] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.546] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0163.547] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0163.547] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0163.547] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.547] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.547] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.547] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.547] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x6bc2, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x6bc2, lpOverlapped=0x0) returned 1 [0163.548] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6bd0, dwBufLen=0x6bd0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6bd0) returned 1 [0163.548] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.548] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6bd0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x6bd0, lpOverlapped=0x0) returned 1 [0163.549] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.549] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6ca4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.549] SetEndOfFile (hFile=0xdc) returned 1 [0163.552] GetProcessHeap () returned 0x4e0000 [0163.552] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0163.552] GetProcessHeap () returned 0x4e0000 [0163.552] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0163.552] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232393.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232393.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0163.553] CloseHandle (hObject=0xdc) returned 1 [0163.553] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcaa1c300, ftCreationTime.dwHighDateTime=0x1be1ff5, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcaa1c300, ftLastWriteTime.dwHighDateTime=0x1be1ff5, nFileSizeHigh=0x0, nFileSizeLow=0xa086, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0232395.WMF", cAlternateFileName="")) returned 1 [0163.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232395.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.555] GetProcessHeap () returned 0x4e0000 [0163.555] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0163.555] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0163.555] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0163.555] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0163.558] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.558] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.558] GetProcessHeap () returned 0x4e0000 [0163.558] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0163.558] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0163.558] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.558] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0163.558] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.558] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0163.558] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0163.558] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0163.558] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.559] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.559] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.559] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.559] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xa086, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xa086, lpOverlapped=0x0) returned 1 [0163.560] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa090, dwBufLen=0xa090 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa090) returned 1 [0163.560] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.560] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xa090, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xa090, lpOverlapped=0x0) returned 1 [0163.561] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.561] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xa164, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.561] SetEndOfFile (hFile=0xdc) returned 1 [0163.564] GetProcessHeap () returned 0x4e0000 [0163.564] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0163.564] GetProcessHeap () returned 0x4e0000 [0163.564] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0163.564] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232395.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232395.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0163.565] CloseHandle (hObject=0xdc) returned 1 [0163.565] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5779c00, ftCreationTime.dwHighDateTime=0x1be05ef, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5779c00, ftLastWriteTime.dwHighDateTime=0x1be05ef, nFileSizeHigh=0x0, nFileSizeLow=0x380a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0232795.WMF", cAlternateFileName="")) returned 1 [0163.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232795.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.567] GetProcessHeap () returned 0x4e0000 [0163.567] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0163.567] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0163.567] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0163.567] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0163.572] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.572] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.572] GetProcessHeap () returned 0x4e0000 [0163.572] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0163.572] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0163.572] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.572] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0163.572] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.572] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0163.572] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0163.572] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0163.572] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.573] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.573] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.573] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.573] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x380a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x380a, lpOverlapped=0x0) returned 1 [0163.576] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3810, dwBufLen=0x3810 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3810) returned 1 [0163.576] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.577] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3810, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3810, lpOverlapped=0x0) returned 1 [0163.577] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.577] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x38e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.577] SetEndOfFile (hFile=0xdc) returned 1 [0163.579] GetProcessHeap () returned 0x4e0000 [0163.580] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0163.580] GetProcessHeap () returned 0x4e0000 [0163.580] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0163.580] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232795.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232795.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0163.581] CloseHandle (hObject=0xdc) returned 1 [0163.581] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6d7d00, ftCreationTime.dwHighDateTime=0x1be05ef, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb6d7d00, ftLastWriteTime.dwHighDateTime=0x1be05ef, nFileSizeHigh=0x0, nFileSizeLow=0x899c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0232797.WMF", cAlternateFileName="")) returned 1 [0163.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232797.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.582] GetProcessHeap () returned 0x4e0000 [0163.583] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0163.583] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0163.583] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0163.583] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.589] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.589] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.589] GetProcessHeap () returned 0x4e0000 [0163.589] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0163.589] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0163.589] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.589] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0163.589] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.590] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0163.590] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0163.590] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0163.590] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.590] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.590] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.590] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.590] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x899c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x899c, lpOverlapped=0x0) returned 1 [0163.591] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x89a0, dwBufLen=0x89a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x89a0) returned 1 [0163.592] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.592] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x89a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x89a0, lpOverlapped=0x0) returned 1 [0163.592] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.592] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x8a74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.592] SetEndOfFile (hFile=0xdc) returned 1 [0163.595] GetProcessHeap () returned 0x4e0000 [0163.595] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0163.595] GetProcessHeap () returned 0x4e0000 [0163.595] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0163.595] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232797.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232797.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0163.596] CloseHandle (hObject=0xdc) returned 1 [0163.597] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e804d00, ftCreationTime.dwHighDateTime=0x1be05ef, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e804d00, ftLastWriteTime.dwHighDateTime=0x1be05ef, nFileSizeHigh=0x0, nFileSizeLow=0x4de6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0232803.WMF", cAlternateFileName="")) returned 1 [0163.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232803.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.600] GetProcessHeap () returned 0x4e0000 [0163.600] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0163.600] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0163.600] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0163.600] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0163.622] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.622] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.622] GetProcessHeap () returned 0x4e0000 [0163.622] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0163.622] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0163.622] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.622] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0163.622] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.622] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0163.623] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0163.623] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0163.623] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.623] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.623] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.623] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.623] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4de6, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4de6, lpOverlapped=0x0) returned 1 [0163.624] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4df0, dwBufLen=0x4df0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4df0) returned 1 [0163.624] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.624] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4df0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4df0, lpOverlapped=0x0) returned 1 [0163.625] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.625] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4ec4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.625] SetEndOfFile (hFile=0xdc) returned 1 [0163.627] GetProcessHeap () returned 0x4e0000 [0163.627] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0163.627] GetProcessHeap () returned 0x4e0000 [0163.627] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0163.628] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232803.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232803.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0163.629] CloseHandle (hObject=0xdc) returned 1 [0163.629] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x26e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0233512.WMF", cAlternateFileName="")) returned 1 [0163.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233512.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.630] GetProcessHeap () returned 0x4e0000 [0163.630] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0163.630] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0163.630] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0163.631] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.658] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.658] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.658] GetProcessHeap () returned 0x4e0000 [0163.658] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0163.658] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0163.658] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.658] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0163.658] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.658] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0163.658] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0163.658] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0163.659] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.659] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.659] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.659] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.659] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x26e8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x26e8, lpOverlapped=0x0) returned 1 [0163.660] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x26f0, dwBufLen=0x26f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x26f0) returned 1 [0163.660] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.660] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x26f0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x26f0, lpOverlapped=0x0) returned 1 [0163.660] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.660] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x27c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.660] SetEndOfFile (hFile=0xdc) returned 1 [0163.663] GetProcessHeap () returned 0x4e0000 [0163.663] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0163.663] GetProcessHeap () returned 0x4e0000 [0163.663] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0163.663] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233512.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233512.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0163.665] CloseHandle (hObject=0xdc) returned 1 [0163.665] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x312c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0233665.WMF", cAlternateFileName="")) returned 1 [0163.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233665.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.666] GetProcessHeap () returned 0x4e0000 [0163.667] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0163.667] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0163.667] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0163.667] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.681] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.681] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.681] GetProcessHeap () returned 0x4e0000 [0163.681] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0163.682] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0163.682] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.682] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0163.682] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.682] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0163.682] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0163.682] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0163.682] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.682] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.682] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.682] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.682] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x312c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x312c, lpOverlapped=0x0) returned 1 [0163.683] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3130, dwBufLen=0x3130 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3130) returned 1 [0163.684] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.684] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3130, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3130, lpOverlapped=0x0) returned 1 [0163.684] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.684] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.684] SetEndOfFile (hFile=0xdc) returned 1 [0163.687] GetProcessHeap () returned 0x4e0000 [0163.687] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0163.687] GetProcessHeap () returned 0x4e0000 [0163.687] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0163.687] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233665.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233665.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0163.688] CloseHandle (hObject=0xdc) returned 1 [0163.689] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64f43f00, ftCreationTime.dwHighDateTime=0x1be809a, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64f43f00, ftLastWriteTime.dwHighDateTime=0x1be809a, nFileSizeHigh=0x0, nFileSizeLow=0x975e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0233992.WMF", cAlternateFileName="")) returned 1 [0163.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233992.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.690] GetProcessHeap () returned 0x4e0000 [0163.690] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0163.690] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0163.690] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0163.690] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0163.692] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.692] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.692] GetProcessHeap () returned 0x4e0000 [0163.692] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0163.692] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0163.692] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.692] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0163.692] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.692] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0163.693] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0163.693] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0163.693] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.693] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.693] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.693] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.693] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x975e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x975e, lpOverlapped=0x0) returned 1 [0163.694] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9760, dwBufLen=0x9760 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9760) returned 1 [0163.695] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.695] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x9760, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x9760, lpOverlapped=0x0) returned 1 [0163.695] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.695] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x9834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.695] SetEndOfFile (hFile=0xdc) returned 1 [0163.698] GetProcessHeap () returned 0x4e0000 [0163.698] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0163.698] GetProcessHeap () returned 0x4e0000 [0163.698] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0163.698] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233992.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233992.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0163.699] CloseHandle (hObject=0xdc) returned 1 [0163.699] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f727e00, ftCreationTime.dwHighDateTime=0x1be7b5a, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f727e00, ftLastWriteTime.dwHighDateTime=0x1be7b5a, nFileSizeHigh=0x0, nFileSizeLow=0xcec6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0234000.WMF", cAlternateFileName="")) returned 1 [0163.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234000.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.700] GetProcessHeap () returned 0x4e0000 [0163.700] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0163.700] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0163.700] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0163.700] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0163.702] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.702] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.703] GetProcessHeap () returned 0x4e0000 [0163.703] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0163.703] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0163.703] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.703] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0163.703] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.703] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0163.703] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0163.703] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0163.703] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.703] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.703] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.703] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.703] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xcec6, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xcec6, lpOverlapped=0x0) returned 1 [0163.708] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xced0, dwBufLen=0xced0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xced0) returned 1 [0163.708] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.708] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xced0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xced0, lpOverlapped=0x0) returned 1 [0163.709] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.709] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xcfa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.709] SetEndOfFile (hFile=0xdc) returned 1 [0163.712] GetProcessHeap () returned 0x4e0000 [0163.712] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0163.712] GetProcessHeap () returned 0x4e0000 [0163.712] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0163.712] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234000.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234000.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0163.713] CloseHandle (hObject=0xdc) returned 1 [0163.713] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97fc7700, ftCreationTime.dwHighDateTime=0x1be7b5e, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97fc7700, ftLastWriteTime.dwHighDateTime=0x1be7b5e, nFileSizeHigh=0x0, nFileSizeLow=0x4b40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0234001.WMF", cAlternateFileName="")) returned 1 [0163.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234001.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.714] GetProcessHeap () returned 0x4e0000 [0163.714] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0163.714] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0163.714] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0163.714] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.714] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.714] GetProcessHeap () returned 0x4e0000 [0163.714] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0163.715] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0163.715] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.715] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0163.717] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.717] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0163.717] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0163.717] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0163.717] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.718] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.718] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.718] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.718] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4b40, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4b40, lpOverlapped=0x0) returned 1 [0163.719] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4b40, dwBufLen=0x4b40 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4b40) returned 1 [0163.719] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.719] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4b40, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4b40, lpOverlapped=0x0) returned 1 [0163.719] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.719] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4c14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.719] SetEndOfFile (hFile=0xdc) returned 1 [0163.722] GetProcessHeap () returned 0x4e0000 [0163.722] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0163.722] GetProcessHeap () returned 0x4e0000 [0163.722] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0163.722] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234001.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234001.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0163.724] CloseHandle (hObject=0xdc) returned 1 [0163.724] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x80d4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0234376.WMF", cAlternateFileName="")) returned 1 [0163.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234376.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.725] GetProcessHeap () returned 0x4e0000 [0163.725] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0163.726] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0163.726] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0163.726] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0163.728] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.728] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.728] GetProcessHeap () returned 0x4e0000 [0163.728] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0163.728] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0163.728] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.728] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0163.728] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.728] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0163.728] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0163.728] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0163.728] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.728] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.729] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.729] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.729] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x80d4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x80d4, lpOverlapped=0x0) returned 1 [0163.730] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x80e0, dwBufLen=0x80e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x80e0) returned 1 [0163.730] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.730] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x80e0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x80e0, lpOverlapped=0x0) returned 1 [0163.730] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.730] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x81b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.730] SetEndOfFile (hFile=0xdc) returned 1 [0163.734] GetProcessHeap () returned 0x4e0000 [0163.734] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0163.734] GetProcessHeap () returned 0x4e0000 [0163.734] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0163.734] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234376.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234376.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0163.736] CloseHandle (hObject=0xdc) returned 1 [0163.736] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xcba0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0237225.WMF", cAlternateFileName="")) returned 1 [0163.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237225.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.737] GetProcessHeap () returned 0x4e0000 [0163.737] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0163.737] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0163.737] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0163.737] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.737] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.737] GetProcessHeap () returned 0x4e0000 [0163.737] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0163.737] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0163.737] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.737] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0163.740] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.740] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0163.740] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0163.740] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0163.741] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.741] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.741] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.741] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.741] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xcba0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xcba0, lpOverlapped=0x0) returned 1 [0163.743] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xcba0, dwBufLen=0xcba0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xcba0) returned 1 [0163.743] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.744] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xcba0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xcba0, lpOverlapped=0x0) returned 1 [0163.744] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.744] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xcc74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.744] SetEndOfFile (hFile=0xdc) returned 1 [0163.747] GetProcessHeap () returned 0x4e0000 [0163.747] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0163.747] GetProcessHeap () returned 0x4e0000 [0163.747] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0163.747] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237225.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237225.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0163.749] CloseHandle (hObject=0xdc) returned 1 [0163.749] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24625400, ftCreationTime.dwHighDateTime=0x1be8fbc, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x24625400, ftLastWriteTime.dwHighDateTime=0x1be8fbc, nFileSizeHigh=0x0, nFileSizeLow=0x5700, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0237228.WMF", cAlternateFileName="")) returned 1 [0163.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237228.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.750] GetProcessHeap () returned 0x4e0000 [0163.750] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0163.750] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0163.750] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0163.750] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.750] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.750] GetProcessHeap () returned 0x4e0000 [0163.750] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0163.750] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0163.750] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.750] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0163.752] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.752] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0163.752] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0163.752] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0163.752] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.753] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.753] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.753] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.753] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5700, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x5700, lpOverlapped=0x0) returned 1 [0163.754] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5700, dwBufLen=0x5700 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5700) returned 1 [0163.754] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.754] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5700, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5700, lpOverlapped=0x0) returned 1 [0163.754] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.754] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x57d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.754] SetEndOfFile (hFile=0xdc) returned 1 [0163.757] GetProcessHeap () returned 0x4e0000 [0163.757] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0163.757] GetProcessHeap () returned 0x4e0000 [0163.757] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0163.757] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237228.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237228.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0163.758] CloseHandle (hObject=0xdc) returned 1 [0163.758] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x60c2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0237336.WMF", cAlternateFileName="")) returned 1 [0163.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237336.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.759] GetProcessHeap () returned 0x4e0000 [0163.759] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0163.759] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0163.759] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0163.760] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0163.778] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.778] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.778] GetProcessHeap () returned 0x4e0000 [0163.778] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0163.778] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0163.778] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.778] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0163.779] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.779] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0163.779] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0163.779] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0163.779] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.779] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.779] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.779] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.779] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x60c2, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x60c2, lpOverlapped=0x0) returned 1 [0163.781] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x60d0, dwBufLen=0x60d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x60d0) returned 1 [0163.782] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.782] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x60d0, lpOverlapped=0x0) returned 1 [0163.782] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.782] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x61a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.782] SetEndOfFile (hFile=0xdc) returned 1 [0163.786] GetProcessHeap () returned 0x4e0000 [0163.786] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0163.786] GetProcessHeap () returned 0x4e0000 [0163.786] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0163.786] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237336.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237336.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0163.790] CloseHandle (hObject=0xdc) returned 1 [0163.790] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x51be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0237759.WMF", cAlternateFileName="")) returned 1 [0163.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237759.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.791] GetProcessHeap () returned 0x4e0000 [0163.791] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0163.792] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0163.792] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0163.792] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0163.794] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.794] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.794] GetProcessHeap () returned 0x4e0000 [0163.795] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0163.795] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0163.795] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.795] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0163.795] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.795] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0163.795] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0163.795] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0163.795] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.795] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.795] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.795] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.795] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x51be, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x51be, lpOverlapped=0x0) returned 1 [0163.796] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x51c0, dwBufLen=0x51c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x51c0) returned 1 [0163.797] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.797] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x51c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x51c0, lpOverlapped=0x0) returned 1 [0163.797] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.797] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5294, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.797] SetEndOfFile (hFile=0xdc) returned 1 [0163.800] GetProcessHeap () returned 0x4e0000 [0163.800] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0163.800] GetProcessHeap () returned 0x4e0000 [0163.800] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0163.801] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237759.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237759.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0163.802] CloseHandle (hObject=0xdc) returned 1 [0163.802] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x59a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0238333.WMF", cAlternateFileName="")) returned 1 [0163.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238333.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.803] GetProcessHeap () returned 0x4e0000 [0163.803] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0163.803] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0163.803] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0163.803] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.803] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.803] GetProcessHeap () returned 0x4e0000 [0163.803] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0163.803] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0163.804] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.804] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0163.850] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.850] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0163.850] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0163.850] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0163.851] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.851] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.851] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.851] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.851] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x59a0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x59a0, lpOverlapped=0x0) returned 1 [0163.852] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x59a0, dwBufLen=0x59a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x59a0) returned 1 [0163.852] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.852] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x59a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x59a0, lpOverlapped=0x0) returned 1 [0163.853] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.853] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5a74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.853] SetEndOfFile (hFile=0xdc) returned 1 [0163.856] GetProcessHeap () returned 0x4e0000 [0163.856] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0163.856] GetProcessHeap () returned 0x4e0000 [0163.856] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0163.856] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238333.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238333.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0163.857] CloseHandle (hObject=0xdc) returned 1 [0163.858] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1334, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0238927.WMF", cAlternateFileName="")) returned 1 [0163.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238927.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.859] GetProcessHeap () returned 0x4e0000 [0163.859] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0163.859] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0163.859] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0163.859] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0163.861] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.861] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.861] GetProcessHeap () returned 0x4e0000 [0163.861] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0163.861] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0163.861] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.861] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0163.862] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.862] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0163.862] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0163.862] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0163.862] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.862] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.862] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.862] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.862] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1334, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1334, lpOverlapped=0x0) returned 1 [0163.863] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1340, dwBufLen=0x1340 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1340) returned 1 [0163.863] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.863] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1340, lpOverlapped=0x0) returned 1 [0163.864] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.864] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1414, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.864] SetEndOfFile (hFile=0xdc) returned 1 [0163.866] GetProcessHeap () returned 0x4e0000 [0163.867] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0163.867] GetProcessHeap () returned 0x4e0000 [0163.867] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0163.867] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238927.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238927.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0163.868] CloseHandle (hObject=0xdc) returned 1 [0163.868] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d3c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0238959.WMF", cAlternateFileName="")) returned 1 [0163.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238959.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.869] GetProcessHeap () returned 0x4e0000 [0163.869] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0163.869] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0163.869] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0163.870] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.872] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.872] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.872] GetProcessHeap () returned 0x4e0000 [0163.872] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0163.872] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0163.872] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.872] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0163.872] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.872] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0163.873] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0163.873] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0163.873] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.873] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.873] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.873] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.873] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1d3c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1d3c, lpOverlapped=0x0) returned 1 [0163.874] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1d40, dwBufLen=0x1d40 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1d40) returned 1 [0163.874] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.874] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1d40, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1d40, lpOverlapped=0x0) returned 1 [0163.874] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.874] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1e14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.874] SetEndOfFile (hFile=0xdc) returned 1 [0163.877] GetProcessHeap () returned 0x4e0000 [0163.877] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0163.877] GetProcessHeap () returned 0x4e0000 [0163.877] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0163.877] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238959.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238959.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0163.879] CloseHandle (hObject=0xdc) returned 1 [0163.879] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x13b8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0238983.WMF", cAlternateFileName="")) returned 1 [0163.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238983.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.880] GetProcessHeap () returned 0x4e0000 [0163.880] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0163.880] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0163.880] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0163.880] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.882] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.882] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.882] GetProcessHeap () returned 0x4e0000 [0163.882] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0163.882] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0163.882] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.882] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0163.883] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.883] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0163.883] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0163.883] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0163.883] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.883] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.883] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.883] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.883] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x13b8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x13b8, lpOverlapped=0x0) returned 1 [0163.884] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x13c0, dwBufLen=0x13c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x13c0) returned 1 [0163.884] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.884] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x13c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x13c0, lpOverlapped=0x0) returned 1 [0163.884] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.884] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.885] SetEndOfFile (hFile=0xdc) returned 1 [0163.887] GetProcessHeap () returned 0x4e0000 [0163.887] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0163.887] GetProcessHeap () returned 0x4e0000 [0163.887] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0163.887] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238983.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238983.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0163.889] CloseHandle (hObject=0xdc) returned 1 [0163.889] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1284, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0239057.WMF", cAlternateFileName="")) returned 1 [0163.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239057.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.890] GetProcessHeap () returned 0x4e0000 [0163.890] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0163.890] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0163.890] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0163.890] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0163.892] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.892] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.892] GetProcessHeap () returned 0x4e0000 [0163.892] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0163.892] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0163.892] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.892] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0163.892] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.893] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0163.893] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0163.893] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0163.893] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.893] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.893] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.893] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.893] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1284, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1284, lpOverlapped=0x0) returned 1 [0163.894] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1290, dwBufLen=0x1290 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1290) returned 1 [0163.894] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.894] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1290, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1290, lpOverlapped=0x0) returned 1 [0163.894] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.894] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1364, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.895] SetEndOfFile (hFile=0xdc) returned 1 [0163.897] GetProcessHeap () returned 0x4e0000 [0163.897] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0163.897] GetProcessHeap () returned 0x4e0000 [0163.897] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0163.897] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239057.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239057.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0163.899] CloseHandle (hObject=0xdc) returned 1 [0163.899] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0239063.WMF", cAlternateFileName="")) returned 1 [0163.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239063.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.900] GetProcessHeap () returned 0x4e0000 [0163.900] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0163.900] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0163.900] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0163.900] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.906] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.906] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.906] GetProcessHeap () returned 0x4e0000 [0163.906] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0163.906] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0163.906] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.906] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0163.906] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.906] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0163.906] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0163.906] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0163.906] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.907] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.907] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.907] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.907] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x16fc, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x16fc, lpOverlapped=0x0) returned 1 [0163.908] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1700, dwBufLen=0x1700 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1700) returned 1 [0163.908] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.908] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1700, lpOverlapped=0x0) returned 1 [0163.908] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.908] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x17d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.908] SetEndOfFile (hFile=0xdc) returned 1 [0163.911] GetProcessHeap () returned 0x4e0000 [0163.911] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0163.911] GetProcessHeap () returned 0x4e0000 [0163.911] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0163.911] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239063.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239063.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0163.913] CloseHandle (hObject=0xdc) returned 1 [0163.913] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1294, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0239079.WMF", cAlternateFileName="")) returned 1 [0163.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239079.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.914] GetProcessHeap () returned 0x4e0000 [0163.914] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0163.914] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0163.914] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0163.914] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0163.916] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.916] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.916] GetProcessHeap () returned 0x4e0000 [0163.916] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0163.916] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0163.916] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.916] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0163.917] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.917] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0163.917] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0163.917] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0163.917] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.917] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.917] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.917] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.917] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1294, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1294, lpOverlapped=0x0) returned 1 [0163.918] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x12a0, dwBufLen=0x12a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x12a0) returned 1 [0163.918] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.918] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x12a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x12a0, lpOverlapped=0x0) returned 1 [0163.918] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.918] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1374, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.918] SetEndOfFile (hFile=0xdc) returned 1 [0163.921] GetProcessHeap () returned 0x4e0000 [0163.921] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0163.921] GetProcessHeap () returned 0x4e0000 [0163.921] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0163.921] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239079.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239079.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0163.923] CloseHandle (hObject=0xdc) returned 1 [0163.923] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1464, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0239191.WMF", cAlternateFileName="")) returned 1 [0163.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239191.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.924] GetProcessHeap () returned 0x4e0000 [0163.924] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0163.924] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0163.924] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0163.925] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0163.927] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.927] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.927] GetProcessHeap () returned 0x4e0000 [0163.927] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0163.927] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0163.927] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.927] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0163.927] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.927] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0163.927] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0163.927] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0163.927] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.928] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.928] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.928] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.928] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1464, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1464, lpOverlapped=0x0) returned 1 [0163.929] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1470, dwBufLen=0x1470 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1470) returned 1 [0163.929] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.929] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1470, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1470, lpOverlapped=0x0) returned 1 [0163.929] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.929] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1544, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.929] SetEndOfFile (hFile=0xdc) returned 1 [0163.932] GetProcessHeap () returned 0x4e0000 [0163.932] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0163.932] GetProcessHeap () returned 0x4e0000 [0163.932] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0163.932] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239191.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239191.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0163.933] CloseHandle (hObject=0xdc) returned 1 [0163.933] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8424, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0239611.WMF", cAlternateFileName="")) returned 1 [0163.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239611.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.934] GetProcessHeap () returned 0x4e0000 [0163.934] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0163.934] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0163.934] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0163.935] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0163.937] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.937] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.937] GetProcessHeap () returned 0x4e0000 [0163.937] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0163.937] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0163.937] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.937] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0163.938] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.938] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0163.938] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0163.938] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0163.938] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.938] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.938] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.938] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.938] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x8424, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x8424, lpOverlapped=0x0) returned 1 [0163.939] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8430, dwBufLen=0x8430 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8430) returned 1 [0163.940] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.940] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x8430, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x8430, lpOverlapped=0x0) returned 1 [0163.941] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.942] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x8504, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.942] SetEndOfFile (hFile=0xdc) returned 1 [0163.945] GetProcessHeap () returned 0x4e0000 [0163.945] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0163.945] GetProcessHeap () returned 0x4e0000 [0163.945] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0163.945] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239611.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239611.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0163.947] CloseHandle (hObject=0xdc) returned 1 [0163.947] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1314, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0239935.WMF", cAlternateFileName="")) returned 1 [0163.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239935.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.948] GetProcessHeap () returned 0x4e0000 [0163.948] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0163.948] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0163.948] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0163.948] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0163.950] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.950] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.950] GetProcessHeap () returned 0x4e0000 [0163.950] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0163.950] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0163.951] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.951] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0163.951] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.951] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0163.951] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0163.951] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0163.951] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.951] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.951] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.951] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.951] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1314, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1314, lpOverlapped=0x0) returned 1 [0163.952] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1320, dwBufLen=0x1320 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1320) returned 1 [0163.952] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.952] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1320, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1320, lpOverlapped=0x0) returned 1 [0163.952] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.953] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x13f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.953] SetEndOfFile (hFile=0xdc) returned 1 [0163.955] GetProcessHeap () returned 0x4e0000 [0163.955] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0163.955] GetProcessHeap () returned 0x4e0000 [0163.955] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0163.955] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239935.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239935.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0163.957] CloseHandle (hObject=0xdc) returned 1 [0163.957] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1418, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0239941.WMF", cAlternateFileName="")) returned 1 [0163.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239941.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.958] GetProcessHeap () returned 0x4e0000 [0163.958] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0163.958] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0163.958] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0163.958] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.960] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.960] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.960] GetProcessHeap () returned 0x4e0000 [0163.960] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0163.960] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0163.960] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.960] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0163.960] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.960] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0163.960] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0163.960] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0163.961] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.961] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.961] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.961] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.961] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1418, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1418, lpOverlapped=0x0) returned 1 [0163.962] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1420, dwBufLen=0x1420 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1420) returned 1 [0163.962] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.962] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1420, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1420, lpOverlapped=0x0) returned 1 [0163.962] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.962] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x14f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.962] SetEndOfFile (hFile=0xdc) returned 1 [0163.965] GetProcessHeap () returned 0x4e0000 [0163.965] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0163.965] GetProcessHeap () returned 0x4e0000 [0163.965] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0163.965] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239941.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239941.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0163.966] CloseHandle (hObject=0xdc) returned 1 [0163.966] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1998, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0239943.WMF", cAlternateFileName="")) returned 1 [0163.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239943.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.966] GetProcessHeap () returned 0x4e0000 [0163.967] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0163.967] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0163.967] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0163.967] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.969] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.969] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.969] GetProcessHeap () returned 0x4e0000 [0163.969] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0163.969] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0163.969] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.969] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0163.969] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.969] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0163.969] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0163.969] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0163.970] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.970] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.970] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.970] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.970] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1998, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1998, lpOverlapped=0x0) returned 1 [0163.971] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x19a0, dwBufLen=0x19a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x19a0) returned 1 [0163.971] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.971] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x19a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x19a0, lpOverlapped=0x0) returned 1 [0163.971] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.971] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1a74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.971] SetEndOfFile (hFile=0xdc) returned 1 [0163.974] GetProcessHeap () returned 0x4e0000 [0163.974] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0163.974] GetProcessHeap () returned 0x4e0000 [0163.974] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0163.974] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239943.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239943.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0163.975] CloseHandle (hObject=0xdc) returned 1 [0163.975] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1c40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0239951.WMF", cAlternateFileName="")) returned 1 [0163.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239951.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.976] GetProcessHeap () returned 0x4e0000 [0163.976] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0163.976] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0163.976] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0163.976] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.976] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.976] GetProcessHeap () returned 0x4e0000 [0163.976] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0163.976] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0163.976] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.976] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0163.978] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.978] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0163.978] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0163.979] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0163.979] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.979] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.979] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.979] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.979] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1c40, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1c40, lpOverlapped=0x0) returned 1 [0163.980] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1c40, dwBufLen=0x1c40 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1c40) returned 1 [0163.980] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.980] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1c40, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1c40, lpOverlapped=0x0) returned 1 [0163.980] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.980] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1d14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.980] SetEndOfFile (hFile=0xdc) returned 1 [0163.983] GetProcessHeap () returned 0x4e0000 [0163.983] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0163.983] GetProcessHeap () returned 0x4e0000 [0163.983] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0163.983] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239951.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239951.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0163.984] CloseHandle (hObject=0xdc) returned 1 [0163.984] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1bc8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0239953.WMF", cAlternateFileName="")) returned 1 [0163.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239953.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.985] GetProcessHeap () returned 0x4e0000 [0163.985] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0163.985] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0163.985] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0163.985] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.987] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.987] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.987] GetProcessHeap () returned 0x4e0000 [0163.987] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0163.987] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0163.988] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.988] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0163.988] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.988] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0163.988] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0163.988] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0163.988] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.988] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.988] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.988] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.988] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1bc8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1bc8, lpOverlapped=0x0) returned 1 [0163.989] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1bd0, dwBufLen=0x1bd0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1bd0) returned 1 [0163.989] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.989] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1bd0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1bd0, lpOverlapped=0x0) returned 1 [0163.990] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.990] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1ca4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.990] SetEndOfFile (hFile=0xdc) returned 1 [0163.992] GetProcessHeap () returned 0x4e0000 [0163.992] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0163.992] GetProcessHeap () returned 0x4e0000 [0163.992] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0163.993] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239953.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239953.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0163.994] CloseHandle (hObject=0xdc) returned 1 [0163.994] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1348, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0239955.WMF", cAlternateFileName="")) returned 1 [0163.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239955.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.995] GetProcessHeap () returned 0x4e0000 [0163.995] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0163.995] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0163.995] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0163.995] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.998] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.998] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.998] GetProcessHeap () returned 0x4e0000 [0163.998] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0163.998] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0163.998] CryptDestroyKey (hKey=0x522f98) returned 1 [0163.998] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0163.998] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0163.998] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0163.998] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0163.998] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0163.998] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0163.998] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0163.998] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0163.998] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.999] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1348, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1348, lpOverlapped=0x0) returned 1 [0163.999] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1350, dwBufLen=0x1350 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1350) returned 1 [0163.999] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.000] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1350, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1350, lpOverlapped=0x0) returned 1 [0164.000] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.000] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1424, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.000] SetEndOfFile (hFile=0xdc) returned 1 [0164.002] GetProcessHeap () returned 0x4e0000 [0164.003] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0164.003] GetProcessHeap () returned 0x4e0000 [0164.003] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0164.003] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239955.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239955.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0164.004] CloseHandle (hObject=0xdc) returned 1 [0164.004] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1720, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0239965.WMF", cAlternateFileName="")) returned 1 [0164.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239965.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0164.005] GetProcessHeap () returned 0x4e0000 [0164.005] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0164.005] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0164.005] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0164.005] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.005] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.005] GetProcessHeap () returned 0x4e0000 [0164.005] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0164.005] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0164.005] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.005] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0164.007] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0164.007] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0164.007] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0164.008] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0164.008] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0164.008] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.008] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.008] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.008] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1720, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1720, lpOverlapped=0x0) returned 1 [0164.009] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1720, dwBufLen=0x1720 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1720) returned 1 [0164.009] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.009] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1720, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1720, lpOverlapped=0x0) returned 1 [0164.009] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.009] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x17f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.009] SetEndOfFile (hFile=0xdc) returned 1 [0164.012] GetProcessHeap () returned 0x4e0000 [0164.012] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0164.012] GetProcessHeap () returned 0x4e0000 [0164.012] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0164.012] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239965.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239965.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0164.013] CloseHandle (hObject=0xdc) returned 1 [0164.013] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x154c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0239967.WMF", cAlternateFileName="")) returned 1 [0164.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239967.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0164.014] GetProcessHeap () returned 0x4e0000 [0164.014] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0164.014] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0164.014] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0164.014] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0164.016] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.016] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.016] GetProcessHeap () returned 0x4e0000 [0164.016] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0164.016] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0164.016] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.016] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0164.016] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0164.016] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0164.016] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0164.017] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0164.017] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0164.017] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.017] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.017] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.017] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x154c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x154c, lpOverlapped=0x0) returned 1 [0164.018] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1550, dwBufLen=0x1550 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1550) returned 1 [0164.018] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.018] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1550, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1550, lpOverlapped=0x0) returned 1 [0164.018] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.018] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1624, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.018] SetEndOfFile (hFile=0xdc) returned 1 [0164.021] GetProcessHeap () returned 0x4e0000 [0164.021] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0164.021] GetProcessHeap () returned 0x4e0000 [0164.021] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0164.021] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239967.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239967.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0164.022] CloseHandle (hObject=0xdc) returned 1 [0164.022] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x13e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0239973.WMF", cAlternateFileName="")) returned 1 [0164.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239973.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0164.023] GetProcessHeap () returned 0x4e0000 [0164.023] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0164.023] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0164.023] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0164.023] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0164.025] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.025] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.025] GetProcessHeap () returned 0x4e0000 [0164.025] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0164.025] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0164.025] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.025] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0164.025] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0164.025] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0164.026] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0164.026] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0164.026] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0164.026] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.026] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.026] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.026] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x13e8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x13e8, lpOverlapped=0x0) returned 1 [0164.027] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x13f0, dwBufLen=0x13f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x13f0) returned 1 [0164.027] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.027] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x13f0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x13f0, lpOverlapped=0x0) returned 1 [0164.027] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.027] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x14c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.027] SetEndOfFile (hFile=0xdc) returned 1 [0164.030] GetProcessHeap () returned 0x4e0000 [0164.030] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0164.030] GetProcessHeap () returned 0x4e0000 [0164.030] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0164.030] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239973.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239973.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0164.031] CloseHandle (hObject=0xdc) returned 1 [0164.031] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xda0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0239975.WMF", cAlternateFileName="")) returned 1 [0164.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239975.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0164.032] GetProcessHeap () returned 0x4e0000 [0164.032] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0164.032] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0164.032] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0164.032] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.032] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.032] GetProcessHeap () returned 0x4e0000 [0164.032] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0164.032] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0164.032] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.032] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0164.035] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0164.035] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0164.035] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0164.035] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0164.035] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0164.035] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.035] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.035] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.035] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xda0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xda0, lpOverlapped=0x0) returned 1 [0164.035] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xda0, dwBufLen=0xda0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xda0) returned 1 [0164.035] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.035] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xda0, lpOverlapped=0x0) returned 1 [0164.035] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.036] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xe74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.036] SetEndOfFile (hFile=0xdc) returned 1 [0164.038] GetProcessHeap () returned 0x4e0000 [0164.038] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0164.038] GetProcessHeap () returned 0x4e0000 [0164.038] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0164.038] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239975.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239975.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0164.039] CloseHandle (hObject=0xdc) returned 1 [0164.039] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xcd8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0239997.WMF", cAlternateFileName="")) returned 1 [0164.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239997.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0164.040] GetProcessHeap () returned 0x4e0000 [0164.040] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0164.040] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0164.040] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0164.040] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0164.043] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.043] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.043] GetProcessHeap () returned 0x4e0000 [0164.043] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0164.043] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0164.043] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.043] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0164.043] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0164.043] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0164.043] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0164.043] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0164.043] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0164.044] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.044] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.044] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.044] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xcd8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xcd8, lpOverlapped=0x0) returned 1 [0164.044] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xce0, dwBufLen=0xce0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xce0) returned 1 [0164.044] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.044] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xce0, lpOverlapped=0x0) returned 1 [0164.044] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.044] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xdb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.044] SetEndOfFile (hFile=0xdc) returned 1 [0164.047] GetProcessHeap () returned 0x4e0000 [0164.047] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0164.047] GetProcessHeap () returned 0x4e0000 [0164.047] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0164.047] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239997.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239997.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0164.048] CloseHandle (hObject=0xdc) returned 1 [0164.048] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1df8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0240157.WMF", cAlternateFileName="")) returned 1 [0164.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240157.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0164.049] GetProcessHeap () returned 0x4e0000 [0164.049] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0164.049] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0164.049] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0164.049] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0164.052] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.052] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.052] GetProcessHeap () returned 0x4e0000 [0164.052] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0164.052] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0164.052] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.052] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0164.052] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0164.052] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0164.052] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0164.052] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0164.052] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0164.053] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.053] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.053] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.053] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1df8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1df8, lpOverlapped=0x0) returned 1 [0164.054] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1e00, dwBufLen=0x1e00 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1e00) returned 1 [0164.054] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.054] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1e00, lpOverlapped=0x0) returned 1 [0164.054] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.054] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.054] SetEndOfFile (hFile=0xdc) returned 1 [0164.057] GetProcessHeap () returned 0x4e0000 [0164.057] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0164.057] GetProcessHeap () returned 0x4e0000 [0164.057] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0164.057] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240157.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240157.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0164.058] CloseHandle (hObject=0xdc) returned 1 [0164.058] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa410, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0240175.WMF", cAlternateFileName="")) returned 1 [0164.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240175.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0164.059] GetProcessHeap () returned 0x4e0000 [0164.059] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0164.059] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0164.059] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0164.059] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.059] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.059] GetProcessHeap () returned 0x4e0000 [0164.059] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0164.059] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0164.059] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.059] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0164.061] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0164.061] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0164.061] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0164.061] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0164.061] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0164.062] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.062] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.062] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.062] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xa410, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xa410, lpOverlapped=0x0) returned 1 [0164.063] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa410, dwBufLen=0xa410 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa410) returned 1 [0164.064] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.064] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xa410, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xa410, lpOverlapped=0x0) returned 1 [0164.064] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.064] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xa4e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.064] SetEndOfFile (hFile=0xdc) returned 1 [0164.068] GetProcessHeap () returned 0x4e0000 [0164.068] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0164.068] GetProcessHeap () returned 0x4e0000 [0164.068] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0164.068] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240175.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240175.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0164.069] CloseHandle (hObject=0xdc) returned 1 [0164.069] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xdc4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0240189.WMF", cAlternateFileName="")) returned 1 [0164.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240189.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0164.070] GetProcessHeap () returned 0x4e0000 [0164.070] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0164.070] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0164.070] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0164.070] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0164.072] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.072] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.072] GetProcessHeap () returned 0x4e0000 [0164.072] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0164.072] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0164.072] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.072] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0164.072] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0164.072] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0164.072] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0164.073] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0164.073] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0164.073] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.073] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.073] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.073] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xdc4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xdc4, lpOverlapped=0x0) returned 1 [0164.073] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xdd0, dwBufLen=0xdd0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xdd0) returned 1 [0164.073] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.073] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xdd0, lpOverlapped=0x0) returned 1 [0164.073] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.073] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xea4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.073] SetEndOfFile (hFile=0xdc) returned 1 [0164.076] GetProcessHeap () returned 0x4e0000 [0164.076] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0164.076] GetProcessHeap () returned 0x4e0000 [0164.076] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0164.076] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240189.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240189.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0164.077] CloseHandle (hObject=0xdc) returned 1 [0164.077] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1476, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0240291.WMF", cAlternateFileName="")) returned 1 [0164.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240291.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0164.078] GetProcessHeap () returned 0x4e0000 [0164.078] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0164.079] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0164.079] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0164.079] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0164.081] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.081] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.081] GetProcessHeap () returned 0x4e0000 [0164.081] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0164.081] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0164.081] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.081] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0164.081] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0164.082] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0164.082] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0164.082] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0164.082] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0164.082] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.082] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.082] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.082] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1476, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1476, lpOverlapped=0x0) returned 1 [0164.083] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1480, dwBufLen=0x1480 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1480) returned 1 [0164.083] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.083] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1480, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1480, lpOverlapped=0x0) returned 1 [0164.083] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.083] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1554, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.083] SetEndOfFile (hFile=0xdc) returned 1 [0164.086] GetProcessHeap () returned 0x4e0000 [0164.086] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0164.086] GetProcessHeap () returned 0x4e0000 [0164.086] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0164.086] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240291.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240291.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0164.087] CloseHandle (hObject=0xdc) returned 1 [0164.087] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90da9400, ftCreationTime.dwHighDateTime=0x1be9cda, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90da9400, ftLastWriteTime.dwHighDateTime=0x1be9cda, nFileSizeHigh=0x0, nFileSizeLow=0x92e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0241019.WMF", cAlternateFileName="")) returned 1 [0164.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241019.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0164.089] GetProcessHeap () returned 0x4e0000 [0164.089] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0164.089] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0164.089] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0164.089] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0164.091] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.091] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.091] GetProcessHeap () returned 0x4e0000 [0164.091] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0164.091] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0164.091] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.091] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0164.091] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0164.091] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0164.091] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0164.091] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0164.091] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0164.092] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.092] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.092] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.092] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x92e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x92e, lpOverlapped=0x0) returned 1 [0164.092] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x930, dwBufLen=0x930 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x930) returned 1 [0164.092] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.092] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x930, lpOverlapped=0x0) returned 1 [0164.092] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.092] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xa04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.092] SetEndOfFile (hFile=0xdc) returned 1 [0164.095] GetProcessHeap () returned 0x4e0000 [0164.095] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0164.095] GetProcessHeap () returned 0x4e0000 [0164.095] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0164.095] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241019.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241019.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0164.098] CloseHandle (hObject=0xdc) returned 1 [0164.098] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cc65600, ftCreationTime.dwHighDateTime=0x1be9cda, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9cc65600, ftLastWriteTime.dwHighDateTime=0x1be9cda, nFileSizeHigh=0x0, nFileSizeLow=0xa4e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0241037.WMF", cAlternateFileName="")) returned 1 [0164.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241037.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0164.098] GetProcessHeap () returned 0x4e0000 [0164.099] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0164.099] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0164.099] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0164.099] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0164.101] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.101] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.101] GetProcessHeap () returned 0x4e0000 [0164.101] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0164.101] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0164.101] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.101] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0164.101] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0164.101] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0164.101] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0164.101] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0164.101] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0164.102] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.102] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.102] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.102] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xa4e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xa4e, lpOverlapped=0x0) returned 1 [0164.102] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa50, dwBufLen=0xa50 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa50) returned 1 [0164.102] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.102] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xa50, lpOverlapped=0x0) returned 1 [0164.102] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.102] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xb24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.102] SetEndOfFile (hFile=0xdc) returned 1 [0164.105] GetProcessHeap () returned 0x4e0000 [0164.105] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0164.105] GetProcessHeap () returned 0x4e0000 [0164.105] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0164.105] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241037.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241037.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0164.106] CloseHandle (hObject=0xdc) returned 1 [0164.106] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa059dd00, ftCreationTime.dwHighDateTime=0x1be9cda, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa059dd00, ftLastWriteTime.dwHighDateTime=0x1be9cda, nFileSizeHigh=0x0, nFileSizeLow=0x926, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0241041.WMF", cAlternateFileName="")) returned 1 [0164.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241041.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0164.107] GetProcessHeap () returned 0x4e0000 [0164.107] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0164.107] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0164.107] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0164.107] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0164.109] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.109] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.109] GetProcessHeap () returned 0x4e0000 [0164.109] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0164.109] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0164.110] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.110] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0164.110] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0164.110] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0164.110] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0164.110] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0164.110] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0164.110] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.110] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.110] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.110] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x926, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x926, lpOverlapped=0x0) returned 1 [0164.110] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x930, dwBufLen=0x930 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x930) returned 1 [0164.110] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.111] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x930, lpOverlapped=0x0) returned 1 [0164.111] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.111] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xa04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.111] SetEndOfFile (hFile=0xdc) returned 1 [0164.113] GetProcessHeap () returned 0x4e0000 [0164.113] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0164.113] GetProcessHeap () returned 0x4e0000 [0164.113] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0164.113] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241041.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241041.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0164.117] CloseHandle (hObject=0xdc) returned 1 [0164.117] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa18b0a00, ftCreationTime.dwHighDateTime=0x1be9cda, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa18b0a00, ftLastWriteTime.dwHighDateTime=0x1be9cda, nFileSizeHigh=0x0, nFileSizeLow=0xab2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0241043.WMF", cAlternateFileName="")) returned 1 [0164.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241043.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0164.119] GetProcessHeap () returned 0x4e0000 [0164.119] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0164.119] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0164.119] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0164.119] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0164.121] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.121] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.121] GetProcessHeap () returned 0x4e0000 [0164.121] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0164.121] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0164.121] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.121] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0164.122] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0164.122] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0164.122] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0164.122] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0164.122] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0164.122] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.122] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.122] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.122] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xab2, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xab2, lpOverlapped=0x0) returned 1 [0164.122] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xac0, dwBufLen=0xac0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xac0) returned 1 [0164.122] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.122] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xac0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xac0, lpOverlapped=0x0) returned 1 [0164.122] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.123] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xb94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.123] SetEndOfFile (hFile=0xdc) returned 1 [0164.125] GetProcessHeap () returned 0x4e0000 [0164.125] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0164.125] GetProcessHeap () returned 0x4e0000 [0164.125] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0164.125] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241043.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241043.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0164.127] CloseHandle (hObject=0xdc) returned 1 [0164.127] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb49dda00, ftCreationTime.dwHighDateTime=0x1be9cda, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb49dda00, ftLastWriteTime.dwHighDateTime=0x1be9cda, nFileSizeHigh=0x0, nFileSizeLow=0x82a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0241077.WMF", cAlternateFileName="")) returned 1 [0164.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241077.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0164.128] GetProcessHeap () returned 0x4e0000 [0164.128] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0164.128] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0164.128] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0164.128] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0164.130] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.130] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.130] GetProcessHeap () returned 0x4e0000 [0164.130] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0164.130] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0164.131] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.131] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0164.131] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0164.131] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0164.131] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0164.131] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0164.131] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0164.131] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.131] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.131] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.131] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x82a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x82a, lpOverlapped=0x0) returned 1 [0164.131] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x830, dwBufLen=0x830 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x830) returned 1 [0164.131] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.132] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x830, lpOverlapped=0x0) returned 1 [0164.132] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.132] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x904, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.132] SetEndOfFile (hFile=0xdc) returned 1 [0164.134] GetProcessHeap () returned 0x4e0000 [0164.134] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0164.134] GetProcessHeap () returned 0x4e0000 [0164.134] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0164.134] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241077.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241077.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0164.136] CloseHandle (hObject=0xdc) returned 1 [0164.136] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7c98900, ftCreationTime.dwHighDateTime=0x1be9cdc, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd7c98900, ftLastWriteTime.dwHighDateTime=0x1be9cdc, nFileSizeHigh=0x0, nFileSizeLow=0xcbe, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0241773.WMF", cAlternateFileName="")) returned 1 [0164.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241773.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0164.138] GetProcessHeap () returned 0x4e0000 [0164.138] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0164.138] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0164.138] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0164.138] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0164.140] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.140] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.140] GetProcessHeap () returned 0x4e0000 [0164.140] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0164.140] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0164.140] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.140] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0164.140] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0164.140] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0164.140] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0164.140] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0164.141] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0164.141] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.141] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.141] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.141] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xcbe, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xcbe, lpOverlapped=0x0) returned 1 [0164.141] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xcc0, dwBufLen=0xcc0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xcc0) returned 1 [0164.141] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.141] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xcc0, lpOverlapped=0x0) returned 1 [0164.141] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.141] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xd94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.141] SetEndOfFile (hFile=0xdc) returned 1 [0164.145] GetProcessHeap () returned 0x4e0000 [0164.145] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0164.145] GetProcessHeap () returned 0x4e0000 [0164.145] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0164.145] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241773.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241773.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0164.146] CloseHandle (hObject=0xdc) returned 1 [0164.146] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb5d1000, ftCreationTime.dwHighDateTime=0x1be9cdc, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdb5d1000, ftLastWriteTime.dwHighDateTime=0x1be9cdc, nFileSizeHigh=0x0, nFileSizeLow=0x7b2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0241781.WMF", cAlternateFileName="")) returned 1 [0164.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241781.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0164.147] GetProcessHeap () returned 0x4e0000 [0164.147] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0164.147] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0164.147] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0164.147] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0164.150] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.150] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.150] GetProcessHeap () returned 0x4e0000 [0164.150] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0164.150] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0164.150] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.150] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0164.150] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0164.150] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0164.150] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0164.150] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0164.150] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0164.150] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.150] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.150] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.151] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7b2, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7b2, lpOverlapped=0x0) returned 1 [0164.151] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7c0, dwBufLen=0x7c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7c0) returned 1 [0164.151] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.151] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7c0, lpOverlapped=0x0) returned 1 [0164.151] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.151] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x894, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.151] SetEndOfFile (hFile=0xdc) returned 1 [0164.154] GetProcessHeap () returned 0x4e0000 [0164.154] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0164.154] GetProcessHeap () returned 0x4e0000 [0164.154] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0164.154] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241781.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241781.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0164.155] CloseHandle (hObject=0xdc) returned 1 [0164.155] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7938, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0250504.WMF", cAlternateFileName="")) returned 1 [0164.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250504.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0164.156] GetProcessHeap () returned 0x4e0000 [0164.156] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0164.156] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0164.156] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0164.156] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0164.158] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.158] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.158] GetProcessHeap () returned 0x4e0000 [0164.158] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0164.158] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0164.158] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.158] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0164.158] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0164.158] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0164.159] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0164.159] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0164.159] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0164.159] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.159] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.159] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.159] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7938, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7938, lpOverlapped=0x0) returned 1 [0164.163] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7940, dwBufLen=0x7940 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7940) returned 1 [0164.163] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.163] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7940, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7940, lpOverlapped=0x0) returned 1 [0164.164] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.164] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7a14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.164] SetEndOfFile (hFile=0xdc) returned 1 [0164.166] GetProcessHeap () returned 0x4e0000 [0164.166] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0164.167] GetProcessHeap () returned 0x4e0000 [0164.167] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0164.167] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250504.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250504.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0164.168] CloseHandle (hObject=0xdc) returned 1 [0164.168] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6958, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0250997.WMF", cAlternateFileName="")) returned 1 [0164.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250997.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0164.169] GetProcessHeap () returned 0x4e0000 [0164.169] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0164.169] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0164.169] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0164.169] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0164.171] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.171] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.171] GetProcessHeap () returned 0x4e0000 [0164.171] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0164.171] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0164.171] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.171] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0164.171] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0164.172] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0164.172] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0164.172] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0164.172] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0164.172] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.172] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.172] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.172] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x6958, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x6958, lpOverlapped=0x0) returned 1 [0164.173] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6960, dwBufLen=0x6960 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6960) returned 1 [0164.173] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.173] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6960, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x6960, lpOverlapped=0x0) returned 1 [0164.174] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.174] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6a34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.174] SetEndOfFile (hFile=0xdc) returned 1 [0164.176] GetProcessHeap () returned 0x4e0000 [0164.177] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0164.177] GetProcessHeap () returned 0x4e0000 [0164.177] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0164.177] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250997.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250997.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0164.178] CloseHandle (hObject=0xdc) returned 1 [0164.178] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1100c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0251007.WMF", cAlternateFileName="")) returned 1 [0164.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0251007.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0164.180] GetProcessHeap () returned 0x4e0000 [0164.180] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0164.180] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0164.180] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0164.180] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0164.182] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.182] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.182] GetProcessHeap () returned 0x4e0000 [0164.182] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0164.182] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0164.182] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.182] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0164.182] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0164.182] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0164.182] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0164.183] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0164.183] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0164.183] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.183] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.183] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.183] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1100c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1100c, lpOverlapped=0x0) returned 1 [0164.184] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x11010, dwBufLen=0x11010 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x11010) returned 1 [0164.185] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.185] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x11010, lpOverlapped=0x0) returned 1 [0164.185] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.185] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x110e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.185] SetEndOfFile (hFile=0xdc) returned 1 [0164.188] GetProcessHeap () returned 0x4e0000 [0164.188] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0164.188] GetProcessHeap () returned 0x4e0000 [0164.188] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0164.189] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0251007.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0251007.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0164.190] CloseHandle (hObject=0xdc) returned 1 [0164.190] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f1d4200, ftCreationTime.dwHighDateTime=0x1beb2f9, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f1d4200, ftLastWriteTime.dwHighDateTime=0x1beb2f9, nFileSizeHigh=0x0, nFileSizeLow=0xae2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0252629.WMF", cAlternateFileName="")) returned 1 [0164.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252629.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0164.192] GetProcessHeap () returned 0x4e0000 [0164.192] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0164.192] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0164.192] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0164.192] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0164.195] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.195] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.195] GetProcessHeap () returned 0x4e0000 [0164.195] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0164.195] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0164.195] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.195] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0164.195] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0164.195] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0164.195] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0164.195] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0164.196] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0164.196] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.196] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.196] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.196] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xae2, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xae2, lpOverlapped=0x0) returned 1 [0164.196] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xaf0, dwBufLen=0xaf0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xaf0) returned 1 [0164.196] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.196] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xaf0, lpOverlapped=0x0) returned 1 [0164.196] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.196] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xbc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.196] SetEndOfFile (hFile=0xdc) returned 1 [0164.199] GetProcessHeap () returned 0x4e0000 [0164.199] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0164.199] GetProcessHeap () returned 0x4e0000 [0164.199] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0164.199] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252629.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252629.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0164.200] CloseHandle (hObject=0xdc) returned 1 [0164.201] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46f4c600, ftCreationTime.dwHighDateTime=0x1beb2f9, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x46f4c600, ftLastWriteTime.dwHighDateTime=0x1beb2f9, nFileSizeHigh=0x0, nFileSizeLow=0xf56, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0252669.WMF", cAlternateFileName="")) returned 1 [0164.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252669.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0164.201] GetProcessHeap () returned 0x4e0000 [0164.202] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0164.202] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0164.202] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0164.202] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0164.204] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.204] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.204] GetProcessHeap () returned 0x4e0000 [0164.204] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0164.204] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0164.204] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.204] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0164.204] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0164.204] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0164.204] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0164.205] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0164.205] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0164.205] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.205] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.205] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.205] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xf56, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xf56, lpOverlapped=0x0) returned 1 [0164.205] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xf60, dwBufLen=0xf60 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xf60) returned 1 [0164.205] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.205] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xf60, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xf60, lpOverlapped=0x0) returned 1 [0164.205] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.205] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.206] SetEndOfFile (hFile=0xdc) returned 1 [0164.208] GetProcessHeap () returned 0x4e0000 [0164.208] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0164.208] GetProcessHeap () returned 0x4e0000 [0164.208] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0164.208] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252669.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252669.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0164.210] CloseHandle (hObject=0xdc) returned 1 [0164.210] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe89b5600, ftCreationTime.dwHighDateTime=0x1bec0f4, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe89b5600, ftLastWriteTime.dwHighDateTime=0x1bec0f4, nFileSizeHigh=0x0, nFileSizeLow=0xf6a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0278702.WMF", cAlternateFileName="")) returned 1 [0164.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0278702.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0164.211] GetProcessHeap () returned 0x4e0000 [0164.211] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0164.211] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0164.211] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0164.211] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0164.213] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.213] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.213] GetProcessHeap () returned 0x4e0000 [0164.213] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0164.213] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0164.213] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.214] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0164.214] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0164.214] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0164.214] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0164.214] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0164.214] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0164.214] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.214] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.214] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.214] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xf6a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xf6a, lpOverlapped=0x0) returned 1 [0164.215] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xf70, dwBufLen=0xf70 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xf70) returned 1 [0164.215] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.215] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xf70, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xf70, lpOverlapped=0x0) returned 1 [0164.215] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.215] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1044, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.215] SetEndOfFile (hFile=0xdc) returned 1 [0164.217] GetProcessHeap () returned 0x4e0000 [0164.218] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0164.218] GetProcessHeap () returned 0x4e0000 [0164.218] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0164.218] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0278702.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0278702.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0164.219] CloseHandle (hObject=0xdc) returned 1 [0164.219] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4330, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0279644.WMF", cAlternateFileName="")) returned 1 [0164.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0279644.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0164.221] GetProcessHeap () returned 0x4e0000 [0164.221] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0164.221] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0164.221] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0164.221] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.221] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.221] GetProcessHeap () returned 0x4e0000 [0164.221] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0164.221] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0164.221] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.221] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0164.223] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0164.224] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0164.224] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0164.224] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0164.224] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0164.224] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.224] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.224] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.224] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4330, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4330, lpOverlapped=0x0) returned 1 [0164.227] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4330, dwBufLen=0x4330 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4330) returned 1 [0164.227] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.227] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4330, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4330, lpOverlapped=0x0) returned 1 [0164.228] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.228] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4404, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.228] SetEndOfFile (hFile=0xdc) returned 1 [0164.230] GetProcessHeap () returned 0x4e0000 [0164.230] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0164.230] GetProcessHeap () returned 0x4e0000 [0164.231] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0164.231] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0279644.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0279644.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0164.232] CloseHandle (hObject=0xdc) returned 1 [0164.232] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x11dee, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0280468.WMF", cAlternateFileName="")) returned 1 [0164.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0280468.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0164.233] GetProcessHeap () returned 0x4e0000 [0164.233] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0164.233] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0164.233] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0164.233] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0164.235] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.235] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.235] GetProcessHeap () returned 0x4e0000 [0164.235] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0164.235] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0164.235] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.235] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0164.236] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0164.236] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0164.236] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0164.236] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0164.236] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0164.236] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.236] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.236] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.236] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x11dee, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x11dee, lpOverlapped=0x0) returned 1 [0164.237] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x11df0, dwBufLen=0x11df0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x11df0) returned 1 [0164.238] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.238] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x11df0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x11df0, lpOverlapped=0x0) returned 1 [0164.239] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.239] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x11ec4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.239] SetEndOfFile (hFile=0xdc) returned 1 [0164.242] GetProcessHeap () returned 0x4e0000 [0164.242] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0164.242] GetProcessHeap () returned 0x4e0000 [0164.242] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0164.242] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0280468.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0280468.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0164.244] CloseHandle (hObject=0xdc) returned 1 [0164.244] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30398a00, ftCreationTime.dwHighDateTime=0x1bed30f, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x30398a00, ftLastWriteTime.dwHighDateTime=0x1bed30f, nFileSizeHigh=0x0, nFileSizeLow=0x94c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0281008.WMF", cAlternateFileName="")) returned 1 [0164.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281008.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0164.245] GetProcessHeap () returned 0x4e0000 [0164.245] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0164.245] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0164.245] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0164.245] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0164.247] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.247] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.247] GetProcessHeap () returned 0x4e0000 [0164.247] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0164.247] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0164.247] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.247] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0164.248] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0164.248] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0164.248] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0164.248] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0164.248] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0164.248] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.248] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.248] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.248] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x94c4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x94c4, lpOverlapped=0x0) returned 1 [0164.249] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x94d0, dwBufLen=0x94d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x94d0) returned 1 [0164.250] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.250] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x94d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x94d0, lpOverlapped=0x0) returned 1 [0164.250] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.250] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x95a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.250] SetEndOfFile (hFile=0xdc) returned 1 [0164.253] GetProcessHeap () returned 0x4e0000 [0164.253] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0164.253] GetProcessHeap () returned 0x4e0000 [0164.253] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0164.253] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281008.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281008.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0164.255] CloseHandle (hObject=0xdc) returned 1 [0164.255] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd40ff00, ftCreationTime.dwHighDateTime=0x1bed402, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd40ff00, ftLastWriteTime.dwHighDateTime=0x1bed402, nFileSizeHigh=0x0, nFileSizeLow=0xb5b4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0281243.WMF", cAlternateFileName="")) returned 1 [0164.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281243.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0164.256] GetProcessHeap () returned 0x4e0000 [0164.256] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0164.256] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0164.256] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0164.256] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0164.258] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.258] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.258] GetProcessHeap () returned 0x4e0000 [0164.258] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0164.258] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0164.258] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.258] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0164.258] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0164.258] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0164.258] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0164.258] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0164.259] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0164.259] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.259] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.259] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.259] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb5b4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xb5b4, lpOverlapped=0x0) returned 1 [0164.261] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xb5c0, dwBufLen=0xb5c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xb5c0) returned 1 [0164.261] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.261] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xb5c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xb5c0, lpOverlapped=0x0) returned 1 [0164.262] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.262] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xb694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.262] SetEndOfFile (hFile=0xdc) returned 1 [0164.265] GetProcessHeap () returned 0x4e0000 [0164.265] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0164.265] GetProcessHeap () returned 0x4e0000 [0164.265] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0164.265] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281243.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281243.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0164.266] CloseHandle (hObject=0xdc) returned 1 [0164.266] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c757700, ftCreationTime.dwHighDateTime=0x1bee442, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c757700, ftLastWriteTime.dwHighDateTime=0x1bee442, nFileSizeHigh=0x0, nFileSizeLow=0x31dc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0281630.WMF", cAlternateFileName="")) returned 1 [0164.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281630.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0164.268] GetProcessHeap () returned 0x4e0000 [0164.268] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0164.268] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0164.268] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0164.268] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0164.270] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.270] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.270] GetProcessHeap () returned 0x4e0000 [0164.270] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0164.270] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0164.270] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.270] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0164.270] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0164.271] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0164.271] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0164.271] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0164.271] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0164.271] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.271] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.271] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.271] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x31dc, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x31dc, lpOverlapped=0x0) returned 1 [0164.272] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x31e0, dwBufLen=0x31e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x31e0) returned 1 [0164.272] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.272] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x31e0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x31e0, lpOverlapped=0x0) returned 1 [0164.273] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.273] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x32b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.273] SetEndOfFile (hFile=0xdc) returned 1 [0164.275] GetProcessHeap () returned 0x4e0000 [0164.275] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0164.275] GetProcessHeap () returned 0x4e0000 [0164.276] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0164.276] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281630.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281630.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0164.277] CloseHandle (hObject=0xdc) returned 1 [0164.277] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7da6a400, ftCreationTime.dwHighDateTime=0x1bee442, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7da6a400, ftLastWriteTime.dwHighDateTime=0x1bee442, nFileSizeHigh=0x0, nFileSizeLow=0x3854, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0281632.WMF", cAlternateFileName="")) returned 1 [0164.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281632.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0164.278] GetProcessHeap () returned 0x4e0000 [0164.278] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0164.278] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0164.278] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0164.278] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0164.280] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.280] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.280] GetProcessHeap () returned 0x4e0000 [0164.280] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0164.280] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0164.280] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.280] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0164.280] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0164.281] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0164.281] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0164.281] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0164.281] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0164.281] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.281] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.281] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.281] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3854, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3854, lpOverlapped=0x0) returned 1 [0164.282] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3860, dwBufLen=0x3860 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3860) returned 1 [0164.282] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.282] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3860, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3860, lpOverlapped=0x0) returned 1 [0164.283] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.283] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3934, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.283] SetEndOfFile (hFile=0xdc) returned 1 [0164.286] GetProcessHeap () returned 0x4e0000 [0164.286] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0164.286] GetProcessHeap () returned 0x4e0000 [0164.286] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0164.286] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281632.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281632.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0164.287] CloseHandle (hObject=0xdc) returned 1 [0164.287] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87300c00, ftCreationTime.dwHighDateTime=0x1bee442, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x87300c00, ftLastWriteTime.dwHighDateTime=0x1bee442, nFileSizeHigh=0x0, nFileSizeLow=0x2e88, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0281638.WMF", cAlternateFileName="")) returned 1 [0164.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281638.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0164.288] GetProcessHeap () returned 0x4e0000 [0164.288] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0164.288] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0164.288] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0164.288] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0164.293] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.293] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.293] GetProcessHeap () returned 0x4e0000 [0164.293] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0164.293] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0164.293] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.293] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0164.293] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0164.293] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0164.293] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0164.293] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0164.293] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0164.293] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.293] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.294] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.294] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2e88, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2e88, lpOverlapped=0x0) returned 1 [0164.295] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2e90, dwBufLen=0x2e90 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2e90) returned 1 [0164.295] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.295] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2e90, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2e90, lpOverlapped=0x0) returned 1 [0164.295] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.295] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2f64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.295] SetEndOfFile (hFile=0xdc) returned 1 [0164.298] GetProcessHeap () returned 0x4e0000 [0164.298] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0164.298] GetProcessHeap () returned 0x4e0000 [0164.298] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0164.298] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281638.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281638.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0164.299] CloseHandle (hObject=0xdc) returned 1 [0164.299] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88613900, ftCreationTime.dwHighDateTime=0x1bee442, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x88613900, ftLastWriteTime.dwHighDateTime=0x1bee442, nFileSizeHigh=0x0, nFileSizeLow=0x30f2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0281640.WMF", cAlternateFileName="")) returned 1 [0164.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281640.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0164.300] GetProcessHeap () returned 0x4e0000 [0164.300] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0164.300] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0164.300] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0164.300] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0164.302] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.302] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.302] GetProcessHeap () returned 0x4e0000 [0164.302] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0164.302] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0164.303] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.303] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0164.303] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0164.303] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0164.303] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0164.303] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0164.303] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0164.303] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.303] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.303] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.303] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x30f2, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x30f2, lpOverlapped=0x0) returned 1 [0164.304] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3100, dwBufLen=0x3100 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3100) returned 1 [0164.304] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.305] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3100, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3100, lpOverlapped=0x0) returned 1 [0164.305] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.305] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x31d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.305] SetEndOfFile (hFile=0xdc) returned 1 [0164.307] GetProcessHeap () returned 0x4e0000 [0164.308] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0164.308] GetProcessHeap () returned 0x4e0000 [0164.308] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0164.308] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281640.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281640.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0164.309] CloseHandle (hObject=0xdc) returned 1 [0164.309] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba8f5800, ftCreationTime.dwHighDateTime=0x1beecd8, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xba8f5800, ftLastWriteTime.dwHighDateTime=0x1beecd8, nFileSizeHigh=0x0, nFileSizeLow=0x3c9e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0282126.WMF", cAlternateFileName="")) returned 1 [0164.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282126.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0164.310] GetProcessHeap () returned 0x4e0000 [0164.310] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0164.310] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0164.310] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0164.310] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0164.312] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.312] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.312] GetProcessHeap () returned 0x4e0000 [0164.312] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0164.312] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0164.312] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.312] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0164.312] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0164.312] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0164.312] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0164.312] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0164.313] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0164.313] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.313] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.313] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.313] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3c9e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3c9e, lpOverlapped=0x0) returned 1 [0164.314] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3ca0, dwBufLen=0x3ca0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3ca0) returned 1 [0164.314] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.314] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3ca0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3ca0, lpOverlapped=0x0) returned 1 [0164.314] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.314] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3d74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.314] SetEndOfFile (hFile=0xdc) returned 1 [0164.317] GetProcessHeap () returned 0x4e0000 [0164.317] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0164.317] GetProcessHeap () returned 0x4e0000 [0164.317] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0164.317] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282126.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282126.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0164.318] CloseHandle (hObject=0xdc) returned 1 [0164.318] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8166, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0282928.WMF", cAlternateFileName="")) returned 1 [0164.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282928.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0164.320] GetProcessHeap () returned 0x4e0000 [0164.320] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0164.320] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0164.320] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0164.320] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0164.322] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.322] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.322] GetProcessHeap () returned 0x4e0000 [0164.322] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0164.322] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0164.322] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.322] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0164.322] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0164.322] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0164.323] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0164.323] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0164.323] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0164.323] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.323] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.323] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.323] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x8166, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x8166, lpOverlapped=0x0) returned 1 [0164.324] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8170, dwBufLen=0x8170 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8170) returned 1 [0164.324] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.324] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x8170, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x8170, lpOverlapped=0x0) returned 1 [0164.325] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.325] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x8244, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.325] SetEndOfFile (hFile=0xdc) returned 1 [0164.328] GetProcessHeap () returned 0x4e0000 [0164.328] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0164.328] GetProcessHeap () returned 0x4e0000 [0164.328] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0164.328] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282928.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282928.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0164.330] CloseHandle (hObject=0xdc) returned 1 [0164.330] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3700, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0282932.WMF", cAlternateFileName="")) returned 1 [0164.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282932.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0164.332] GetProcessHeap () returned 0x4e0000 [0164.332] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0164.332] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0164.332] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0164.332] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.332] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.332] GetProcessHeap () returned 0x4e0000 [0164.332] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0164.332] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0164.332] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.332] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0164.335] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0164.335] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0164.335] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0164.335] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0164.335] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0164.335] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.335] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.335] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.336] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3700, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3700, lpOverlapped=0x0) returned 1 [0164.336] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3700, dwBufLen=0x3700 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3700) returned 1 [0164.337] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.337] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3700, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3700, lpOverlapped=0x0) returned 1 [0164.337] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.337] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x37d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.337] SetEndOfFile (hFile=0xdc) returned 1 [0164.340] GetProcessHeap () returned 0x4e0000 [0164.340] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0164.340] GetProcessHeap () returned 0x4e0000 [0164.340] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0164.340] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282932.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282932.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0164.341] CloseHandle (hObject=0xdc) returned 1 [0164.341] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56641810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x388a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0285462.WMF", cAlternateFileName="")) returned 1 [0164.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285462.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0164.343] GetProcessHeap () returned 0x4e0000 [0164.343] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0164.343] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0164.343] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0164.343] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0164.345] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.345] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.345] GetProcessHeap () returned 0x4e0000 [0164.345] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0164.345] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0164.345] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.345] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0164.345] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0164.346] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0164.346] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0164.346] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0164.347] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0164.347] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.347] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.347] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.347] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x388a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x388a, lpOverlapped=0x0) returned 1 [0164.348] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3890, dwBufLen=0x3890 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3890) returned 1 [0164.348] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.348] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3890, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3890, lpOverlapped=0x0) returned 1 [0164.348] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.348] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3964, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.348] SetEndOfFile (hFile=0xdc) returned 1 [0164.351] GetProcessHeap () returned 0x4e0000 [0164.351] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0164.351] GetProcessHeap () returned 0x4e0000 [0164.351] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0164.351] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285462.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285462.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0164.352] CloseHandle (hObject=0xdc) returned 1 [0164.352] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56641810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2440, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0285484.WMF", cAlternateFileName="")) returned 1 [0164.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285484.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0164.353] GetProcessHeap () returned 0x4e0000 [0164.353] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0164.353] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0164.353] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0164.353] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.353] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.353] GetProcessHeap () returned 0x4e0000 [0164.353] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0164.353] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0164.353] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.353] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0164.358] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0164.358] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0164.358] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0164.358] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0164.358] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0164.358] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.358] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.358] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.358] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2440, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2440, lpOverlapped=0x0) returned 1 [0164.359] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2440, dwBufLen=0x2440 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2440) returned 1 [0164.359] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.359] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2440, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2440, lpOverlapped=0x0) returned 1 [0164.359] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.360] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2514, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.360] SetEndOfFile (hFile=0xdc) returned 1 [0164.362] GetProcessHeap () returned 0x4e0000 [0164.362] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0164.362] GetProcessHeap () returned 0x4e0000 [0164.362] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0164.363] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285484.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285484.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0164.364] CloseHandle (hObject=0xdc) returned 1 [0164.364] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x795c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0285780.WMF", cAlternateFileName="")) returned 1 [0164.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285780.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0164.365] GetProcessHeap () returned 0x4e0000 [0164.365] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0164.365] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0164.365] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0164.365] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0164.367] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.367] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.368] GetProcessHeap () returned 0x4e0000 [0164.368] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0164.368] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0164.368] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.368] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0164.368] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0164.368] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0164.368] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0164.368] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0164.368] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0164.368] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.368] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.368] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.368] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x795c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x795c, lpOverlapped=0x0) returned 1 [0164.370] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7960, dwBufLen=0x7960 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7960) returned 1 [0164.370] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.370] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7960, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7960, lpOverlapped=0x0) returned 1 [0164.370] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.370] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7a34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.370] SetEndOfFile (hFile=0xdc) returned 1 [0164.373] GetProcessHeap () returned 0x4e0000 [0164.373] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0164.373] GetProcessHeap () returned 0x4e0000 [0164.373] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0164.373] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285780.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285780.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0164.375] CloseHandle (hObject=0xdc) returned 1 [0164.375] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56667970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x523e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0285782.WMF", cAlternateFileName="")) returned 1 [0164.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285782.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0164.377] GetProcessHeap () returned 0x4e0000 [0164.377] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0164.377] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0164.377] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0164.377] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0164.379] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.379] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.379] GetProcessHeap () returned 0x4e0000 [0164.379] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0164.379] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0164.379] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.379] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0164.379] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0164.379] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0164.380] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0164.380] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0164.380] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0164.380] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.380] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.380] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.380] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x523e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x523e, lpOverlapped=0x0) returned 1 [0164.381] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5240, dwBufLen=0x5240 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5240) returned 1 [0164.382] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.382] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5240, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5240, lpOverlapped=0x0) returned 1 [0164.382] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.382] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.382] SetEndOfFile (hFile=0xdc) returned 1 [0164.385] GetProcessHeap () returned 0x4e0000 [0164.385] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0164.385] GetProcessHeap () returned 0x4e0000 [0164.385] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0164.385] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285782.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285782.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0164.386] CloseHandle (hObject=0xdc) returned 1 [0164.386] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2eb4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0285792.WMF", cAlternateFileName="")) returned 1 [0164.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285792.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0164.388] GetProcessHeap () returned 0x4e0000 [0164.388] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0164.388] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0164.388] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0164.388] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0164.390] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.390] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.390] GetProcessHeap () returned 0x4e0000 [0164.390] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0164.390] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0164.390] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.390] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0164.390] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0164.390] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0164.390] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0164.391] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0164.391] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0164.391] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.391] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.391] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.391] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2eb4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2eb4, lpOverlapped=0x0) returned 1 [0164.392] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2ec0, dwBufLen=0x2ec0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2ec0) returned 1 [0164.392] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.392] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2ec0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2ec0, lpOverlapped=0x0) returned 1 [0164.392] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.392] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2f94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.392] SetEndOfFile (hFile=0xdc) returned 1 [0164.395] GetProcessHeap () returned 0x4e0000 [0164.395] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0164.395] GetProcessHeap () returned 0x4e0000 [0164.395] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0164.395] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285792.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285792.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0164.397] CloseHandle (hObject=0xdc) returned 1 [0164.397] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56667970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3550, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0285796.WMF", cAlternateFileName="")) returned 1 [0164.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285796.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0164.398] GetProcessHeap () returned 0x4e0000 [0164.398] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0164.398] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0164.398] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0164.398] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.398] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.398] GetProcessHeap () returned 0x4e0000 [0164.398] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0164.398] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0164.398] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.398] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0164.400] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0164.401] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0164.401] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0164.401] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0164.401] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0164.401] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.401] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.401] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.401] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3550, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3550, lpOverlapped=0x0) returned 1 [0164.402] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3550, dwBufLen=0x3550 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3550) returned 1 [0164.402] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.402] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3550, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3550, lpOverlapped=0x0) returned 1 [0164.403] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.403] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3624, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.403] SetEndOfFile (hFile=0xdc) returned 1 [0164.405] GetProcessHeap () returned 0x4e0000 [0164.405] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0164.405] GetProcessHeap () returned 0x4e0000 [0164.405] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0164.406] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285796.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285796.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0164.407] CloseHandle (hObject=0xdc) returned 1 [0164.407] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x23f4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0285808.WMF", cAlternateFileName="")) returned 1 [0164.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285808.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0164.429] GetProcessHeap () returned 0x4e0000 [0164.429] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0164.429] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0164.429] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0164.429] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0164.466] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.466] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.466] GetProcessHeap () returned 0x4e0000 [0164.466] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0164.466] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0164.473] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.473] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0164.474] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0164.474] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0164.474] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0164.474] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0164.474] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0164.474] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.474] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.474] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.474] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x23f4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x23f4, lpOverlapped=0x0) returned 1 [0164.479] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2400, dwBufLen=0x2400 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2400) returned 1 [0164.479] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.479] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2400, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2400, lpOverlapped=0x0) returned 1 [0164.479] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.479] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x24d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.479] SetEndOfFile (hFile=0xdc) returned 1 [0164.482] GetProcessHeap () returned 0x4e0000 [0164.482] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0164.482] GetProcessHeap () returned 0x4e0000 [0164.482] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0164.482] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285808.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285808.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0164.484] CloseHandle (hObject=0xdc) returned 1 [0164.484] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56667970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2210, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0285820.WMF", cAlternateFileName="")) returned 1 [0164.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285820.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0164.485] GetProcessHeap () returned 0x4e0000 [0164.485] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0164.485] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0164.485] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0164.485] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.486] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.486] GetProcessHeap () returned 0x4e0000 [0164.486] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0164.486] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0164.486] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.486] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0164.553] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0164.553] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0164.553] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0164.553] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0164.553] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0164.553] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.553] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.553] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.553] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2210, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2210, lpOverlapped=0x0) returned 1 [0164.559] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2210, dwBufLen=0x2210 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2210) returned 1 [0164.559] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.559] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2210, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2210, lpOverlapped=0x0) returned 1 [0164.559] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.559] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x22e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.559] SetEndOfFile (hFile=0xdc) returned 1 [0164.562] GetProcessHeap () returned 0x4e0000 [0164.562] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0164.562] GetProcessHeap () returned 0x4e0000 [0164.562] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0164.562] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285820.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285820.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0164.564] CloseHandle (hObject=0xdc) returned 1 [0164.564] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56667970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x21a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0285822.WMF", cAlternateFileName="")) returned 1 [0164.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285822.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0164.566] GetProcessHeap () returned 0x4e0000 [0164.566] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0164.566] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0164.566] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0164.566] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.567] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.567] GetProcessHeap () returned 0x4e0000 [0164.567] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0164.567] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0164.567] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.567] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0164.578] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0164.578] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0164.578] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0164.578] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0164.578] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0164.578] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.579] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.579] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.579] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x21a0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x21a0, lpOverlapped=0x0) returned 1 [0164.581] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x21a0, dwBufLen=0x21a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x21a0) returned 1 [0164.581] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.581] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x21a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x21a0, lpOverlapped=0x0) returned 1 [0164.581] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.581] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2274, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.581] SetEndOfFile (hFile=0xdc) returned 1 [0164.584] GetProcessHeap () returned 0x4e0000 [0164.584] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0164.584] GetProcessHeap () returned 0x4e0000 [0164.584] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0164.584] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285822.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285822.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0164.586] CloseHandle (hObject=0xdc) returned 1 [0164.586] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7898, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0287018.WMF", cAlternateFileName="")) returned 1 [0164.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287018.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0164.587] GetProcessHeap () returned 0x4e0000 [0164.587] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0164.587] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0164.587] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0164.587] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0164.594] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.594] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.594] GetProcessHeap () returned 0x4e0000 [0164.594] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0164.594] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0164.594] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.594] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0164.594] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0164.595] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0164.595] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0164.595] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0164.595] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0164.595] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.595] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.595] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.595] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7898, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7898, lpOverlapped=0x0) returned 1 [0164.602] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x78a0, dwBufLen=0x78a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x78a0) returned 1 [0164.602] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.602] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x78a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x78a0, lpOverlapped=0x0) returned 1 [0164.602] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.602] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7974, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.602] SetEndOfFile (hFile=0xdc) returned 1 [0164.604] GetProcessHeap () returned 0x4e0000 [0164.604] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0164.604] GetProcessHeap () returned 0x4e0000 [0164.604] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0164.604] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287018.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287018.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0164.606] CloseHandle (hObject=0xdc) returned 1 [0164.606] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x931a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0287019.WMF", cAlternateFileName="")) returned 1 [0164.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287019.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0164.607] GetProcessHeap () returned 0x4e0000 [0164.607] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0164.607] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0164.607] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0164.607] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0164.622] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.622] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.622] GetProcessHeap () returned 0x4e0000 [0164.622] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0164.622] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0164.622] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.622] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0164.622] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0164.623] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0164.623] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0164.623] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0164.623] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0164.623] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.623] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.623] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.624] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x931a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x931a, lpOverlapped=0x0) returned 1 [0164.631] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9320, dwBufLen=0x9320 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9320) returned 1 [0164.631] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.631] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x9320, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x9320, lpOverlapped=0x0) returned 1 [0164.632] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.632] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x93f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.632] SetEndOfFile (hFile=0xdc) returned 1 [0164.634] GetProcessHeap () returned 0x4e0000 [0164.634] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0164.634] GetProcessHeap () returned 0x4e0000 [0164.634] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0164.634] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287019.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287019.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0164.637] CloseHandle (hObject=0xdc) returned 1 [0164.637] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x80d8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0287020.WMF", cAlternateFileName="")) returned 1 [0164.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287020.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0164.638] GetProcessHeap () returned 0x4e0000 [0164.638] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0164.638] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0164.638] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0164.638] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0164.644] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.644] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.644] GetProcessHeap () returned 0x4e0000 [0164.644] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0164.644] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0164.644] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.644] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0164.644] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0164.644] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0164.644] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0164.644] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0164.645] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0164.645] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.645] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.645] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.645] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x80d8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x80d8, lpOverlapped=0x0) returned 1 [0164.650] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x80e0, dwBufLen=0x80e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x80e0) returned 1 [0164.651] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.651] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x80e0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x80e0, lpOverlapped=0x0) returned 1 [0164.651] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.651] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x81b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.651] SetEndOfFile (hFile=0xdc) returned 1 [0164.655] GetProcessHeap () returned 0x4e0000 [0164.655] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0164.655] GetProcessHeap () returned 0x4e0000 [0164.655] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0164.655] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287020.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287020.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0164.657] CloseHandle (hObject=0xdc) returned 1 [0164.658] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc6d2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0287024.WMF", cAlternateFileName="")) returned 1 [0164.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287024.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0164.661] GetProcessHeap () returned 0x4e0000 [0164.661] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0164.661] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0164.662] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0164.662] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0164.686] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.686] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.686] GetProcessHeap () returned 0x4e0000 [0164.686] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0164.686] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0164.686] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.686] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0164.686] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0164.686] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0164.686] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0164.686] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0164.687] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0164.687] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.687] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.687] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.687] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xc6d2, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xc6d2, lpOverlapped=0x0) returned 1 [0164.696] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xc6e0, dwBufLen=0xc6e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xc6e0) returned 1 [0164.697] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.697] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc6e0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xc6e0, lpOverlapped=0x0) returned 1 [0164.697] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.697] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xc7b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.697] SetEndOfFile (hFile=0xdc) returned 1 [0164.700] GetProcessHeap () returned 0x4e0000 [0164.700] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0164.700] GetProcessHeap () returned 0x4e0000 [0164.700] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0164.701] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287024.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287024.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0164.702] CloseHandle (hObject=0xdc) returned 1 [0164.702] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xcd10, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0287408.WMF", cAlternateFileName="")) returned 1 [0164.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287408.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0164.703] GetProcessHeap () returned 0x4e0000 [0164.703] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0164.704] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0164.704] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0164.704] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.704] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.704] GetProcessHeap () returned 0x4e0000 [0164.704] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0164.704] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0164.704] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.704] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0164.706] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0164.706] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0164.706] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0164.706] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0164.706] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0164.708] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.708] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.708] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.708] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xcd10, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xcd10, lpOverlapped=0x0) returned 1 [0164.736] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xcd10, dwBufLen=0xcd10 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xcd10) returned 1 [0164.737] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.737] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xcd10, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xcd10, lpOverlapped=0x0) returned 1 [0164.737] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.737] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xcde4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.737] SetEndOfFile (hFile=0xdc) returned 1 [0164.742] GetProcessHeap () returned 0x4e0000 [0164.743] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0164.743] GetProcessHeap () returned 0x4e0000 [0164.743] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0164.743] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287408.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287408.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0164.744] CloseHandle (hObject=0xdc) returned 1 [0164.744] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa80c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0287415.WMF", cAlternateFileName="")) returned 1 [0164.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287415.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0164.746] GetProcessHeap () returned 0x4e0000 [0164.746] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0164.746] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0164.746] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0164.746] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0164.749] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.750] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.750] GetProcessHeap () returned 0x4e0000 [0164.750] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0164.750] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0164.750] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.750] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0164.750] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0164.750] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0164.751] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0164.751] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0164.752] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0164.752] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.752] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.752] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.752] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xa80c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xa80c, lpOverlapped=0x0) returned 1 [0164.755] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa810, dwBufLen=0xa810 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa810) returned 1 [0164.756] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.756] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xa810, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xa810, lpOverlapped=0x0) returned 1 [0164.756] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.756] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xa8e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.756] SetEndOfFile (hFile=0xdc) returned 1 [0164.759] GetProcessHeap () returned 0x4e0000 [0164.759] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0164.759] GetProcessHeap () returned 0x4e0000 [0164.759] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0164.759] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287415.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287415.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0164.761] CloseHandle (hObject=0xdc) returned 1 [0164.761] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd6bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0287417.WMF", cAlternateFileName="")) returned 1 [0164.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287417.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0164.762] GetProcessHeap () returned 0x4e0000 [0164.762] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0164.762] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0164.762] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0164.762] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0164.766] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.766] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.768] GetProcessHeap () returned 0x4e0000 [0164.768] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0164.768] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0164.768] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.768] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0164.768] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0164.768] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0164.768] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0164.768] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0164.768] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0164.768] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.768] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.769] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.769] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xd6bc, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xd6bc, lpOverlapped=0x0) returned 1 [0164.779] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xd6c0, dwBufLen=0xd6c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xd6c0) returned 1 [0164.780] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.780] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xd6c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xd6c0, lpOverlapped=0x0) returned 1 [0164.780] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.780] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xd794, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.780] SetEndOfFile (hFile=0xdc) returned 1 [0164.784] GetProcessHeap () returned 0x4e0000 [0164.784] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0164.784] GetProcessHeap () returned 0x4e0000 [0164.784] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0164.784] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287417.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287417.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0164.786] CloseHandle (hObject=0xdc) returned 1 [0164.786] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82369200, ftCreationTime.dwHighDateTime=0x1bf58e6, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82369200, ftLastWriteTime.dwHighDateTime=0x1bf58e6, nFileSizeHigh=0x0, nFileSizeLow=0x89a4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0287641.JPG", cAlternateFileName="")) returned 1 [0164.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287641.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0164.788] GetProcessHeap () returned 0x4e0000 [0164.788] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0164.788] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0164.788] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0164.788] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0164.806] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.806] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.806] GetProcessHeap () returned 0x4e0000 [0164.806] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0164.806] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0164.806] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.806] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0164.806] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0164.806] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0164.806] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0164.807] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0164.808] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0164.808] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.808] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.808] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.808] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x89a4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x89a4, lpOverlapped=0x0) returned 1 [0164.819] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x89b0, dwBufLen=0x89b0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x89b0) returned 1 [0164.819] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.820] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x89b0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x89b0, lpOverlapped=0x0) returned 1 [0164.820] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.820] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x8a84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.820] SetEndOfFile (hFile=0xdc) returned 1 [0164.824] GetProcessHeap () returned 0x4e0000 [0164.824] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0164.824] GetProcessHeap () returned 0x4e0000 [0164.824] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0164.824] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287641.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287641.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0164.829] CloseHandle (hObject=0xdc) returned 1 [0164.829] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6d41000, ftCreationTime.dwHighDateTime=0x1bf58da, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd6d41000, ftLastWriteTime.dwHighDateTime=0x1bf58da, nFileSizeHigh=0x0, nFileSizeLow=0x42d1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0287642.JPG", cAlternateFileName="")) returned 1 [0164.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287642.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0164.833] GetProcessHeap () returned 0x4e0000 [0164.833] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0164.833] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0164.834] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0164.834] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xf, lpOverlapped=0x0) returned 1 [0164.836] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.836] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.836] GetProcessHeap () returned 0x4e0000 [0164.836] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0164.836] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0164.836] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.836] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0164.836] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0164.836] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0164.836] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0164.836] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0164.836] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0164.836] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.836] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.836] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.837] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x42d1, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x42d1, lpOverlapped=0x0) returned 1 [0164.837] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x42e0, dwBufLen=0x42e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x42e0) returned 1 [0164.837] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.838] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x42e0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x42e0, lpOverlapped=0x0) returned 1 [0164.838] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.838] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x43b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.838] SetEndOfFile (hFile=0xdc) returned 1 [0164.841] GetProcessHeap () returned 0x4e0000 [0164.841] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0164.841] GetProcessHeap () returned 0x4e0000 [0164.841] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0164.841] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287642.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287642.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0164.842] CloseHandle (hObject=0xdc) returned 1 [0164.842] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5a2e300, ftCreationTime.dwHighDateTime=0x1bf58da, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5a2e300, ftLastWriteTime.dwHighDateTime=0x1bf58da, nFileSizeHigh=0x0, nFileSizeLow=0x3e91, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0287643.JPG", cAlternateFileName="")) returned 1 [0164.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287643.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0164.843] GetProcessHeap () returned 0x4e0000 [0164.843] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0164.843] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0164.843] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0164.844] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xf, lpOverlapped=0x0) returned 1 [0164.857] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.857] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.857] GetProcessHeap () returned 0x4e0000 [0164.857] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0164.857] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0164.857] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.858] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0164.858] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0164.858] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0164.858] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0164.858] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0164.858] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0164.858] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.858] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.858] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.858] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3e91, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3e91, lpOverlapped=0x0) returned 1 [0164.872] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3ea0, dwBufLen=0x3ea0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3ea0) returned 1 [0164.872] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.872] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3ea0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3ea0, lpOverlapped=0x0) returned 1 [0164.872] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.872] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3f74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.872] SetEndOfFile (hFile=0xdc) returned 1 [0164.875] GetProcessHeap () returned 0x4e0000 [0164.875] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0164.875] GetProcessHeap () returned 0x4e0000 [0164.875] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0164.875] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287643.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287643.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0164.877] CloseHandle (hObject=0xdc) returned 1 [0164.877] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5a2e300, ftCreationTime.dwHighDateTime=0x1bf58da, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5a2e300, ftLastWriteTime.dwHighDateTime=0x1bf58da, nFileSizeHigh=0x0, nFileSizeLow=0x43c5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0287644.JPG", cAlternateFileName="")) returned 1 [0164.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287644.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0164.881] GetProcessHeap () returned 0x4e0000 [0164.881] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0164.881] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0164.881] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0164.881] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xb, lpOverlapped=0x0) returned 1 [0164.883] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.883] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.883] GetProcessHeap () returned 0x4e0000 [0164.883] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0164.883] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0164.883] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.883] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0164.883] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0164.883] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0164.883] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0164.883] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0164.883] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0164.883] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.883] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.883] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.884] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x43c5, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x43c5, lpOverlapped=0x0) returned 1 [0164.884] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x43d0, dwBufLen=0x43d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x43d0) returned 1 [0164.884] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.885] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x43d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x43d0, lpOverlapped=0x0) returned 1 [0164.885] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.885] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x44a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.885] SetEndOfFile (hFile=0xdc) returned 1 [0164.888] GetProcessHeap () returned 0x4e0000 [0164.888] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0164.888] GetProcessHeap () returned 0x4e0000 [0164.888] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0164.888] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287644.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287644.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0164.890] CloseHandle (hObject=0xdc) returned 1 [0164.890] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5a2e300, ftCreationTime.dwHighDateTime=0x1bf58da, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5a2e300, ftLastWriteTime.dwHighDateTime=0x1bf58da, nFileSizeHigh=0x0, nFileSizeLow=0x8d86, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0287645.JPG", cAlternateFileName="")) returned 1 [0164.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287645.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0164.892] GetProcessHeap () returned 0x4e0000 [0164.892] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0164.892] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0164.892] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0164.893] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0164.894] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.894] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.895] GetProcessHeap () returned 0x4e0000 [0164.895] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0164.895] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0164.895] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.895] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0164.895] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0164.895] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0164.895] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0164.895] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0164.895] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0164.895] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0164.895] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0164.895] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.895] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x8d86, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x8d86, lpOverlapped=0x0) returned 1 [0164.896] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8d90, dwBufLen=0x8d90 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8d90) returned 1 [0164.897] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.897] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x8d90, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x8d90, lpOverlapped=0x0) returned 1 [0164.897] CryptDestroyKey (hKey=0x522f98) returned 1 [0164.897] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x8e64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.897] SetEndOfFile (hFile=0xdc) returned 1 [0164.903] GetProcessHeap () returned 0x4e0000 [0164.904] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0164.904] GetProcessHeap () returned 0x4e0000 [0164.904] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0164.904] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287645.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287645.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0164.905] CloseHandle (hObject=0xdc) returned 1 [0164.905] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2d21, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0289430.JPG", cAlternateFileName="")) returned 1 [0164.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0289430.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0164.906] GetProcessHeap () returned 0x4e0000 [0164.906] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0164.906] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0164.906] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0164.906] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xf, lpOverlapped=0x0) returned 1 [0165.051] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0165.051] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0165.051] GetProcessHeap () returned 0x4e0000 [0165.051] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0165.051] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0165.051] CryptDestroyKey (hKey=0x522f98) returned 1 [0165.051] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0165.051] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0165.051] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0165.051] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0165.052] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0165.052] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0165.052] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0165.052] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0165.052] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.052] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2d21, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2d21, lpOverlapped=0x0) returned 1 [0165.090] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2d30, dwBufLen=0x2d30 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2d30) returned 1 [0165.091] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.091] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2d30, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2d30, lpOverlapped=0x0) returned 1 [0165.091] CryptDestroyKey (hKey=0x522f98) returned 1 [0165.091] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2e04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.091] SetEndOfFile (hFile=0xdc) returned 1 [0165.094] GetProcessHeap () returned 0x4e0000 [0165.094] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0165.094] GetProcessHeap () returned 0x4e0000 [0165.094] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0165.094] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0289430.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0289430.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0165.096] CloseHandle (hObject=0xdc) returned 1 [0165.096] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9e8a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0290548.WMF", cAlternateFileName="")) returned 1 [0165.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0290548.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0165.097] GetProcessHeap () returned 0x4e0000 [0165.097] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0165.097] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0165.097] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0165.098] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0165.109] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0165.110] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0165.110] GetProcessHeap () returned 0x4e0000 [0165.110] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0165.110] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0165.110] CryptDestroyKey (hKey=0x522f98) returned 1 [0165.110] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0165.111] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0165.111] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0165.111] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0165.111] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0165.111] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0165.111] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0165.111] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0165.111] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.111] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x9e8a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x9e8a, lpOverlapped=0x0) returned 1 [0165.259] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9e90, dwBufLen=0x9e90 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9e90) returned 1 [0165.260] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.260] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x9e90, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x9e90, lpOverlapped=0x0) returned 1 [0165.260] CryptDestroyKey (hKey=0x522f98) returned 1 [0165.260] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x9f64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.260] SetEndOfFile (hFile=0xdc) returned 1 [0165.263] GetProcessHeap () returned 0x4e0000 [0165.263] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0165.263] GetProcessHeap () returned 0x4e0000 [0165.263] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0165.263] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0290548.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0290548.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0165.265] CloseHandle (hObject=0xdc) returned 1 [0165.265] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2590, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0291794.WMF", cAlternateFileName="")) returned 1 [0165.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0291794.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0165.266] GetProcessHeap () returned 0x4e0000 [0165.266] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0165.266] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0165.266] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0165.267] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0165.267] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0165.267] GetProcessHeap () returned 0x4e0000 [0165.267] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0165.267] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0165.267] CryptDestroyKey (hKey=0x522f98) returned 1 [0165.267] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0165.285] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0165.285] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0165.285] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0165.286] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0165.286] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0165.286] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0165.286] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0165.286] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.286] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2590, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2590, lpOverlapped=0x0) returned 1 [0165.348] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2590, dwBufLen=0x2590 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2590) returned 1 [0165.348] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.348] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2590, lpOverlapped=0x0) returned 1 [0165.349] CryptDestroyKey (hKey=0x522f98) returned 1 [0165.349] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2664, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.349] SetEndOfFile (hFile=0xdc) returned 1 [0165.351] GetProcessHeap () returned 0x4e0000 [0165.351] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0165.351] GetProcessHeap () returned 0x4e0000 [0165.351] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0165.352] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0291794.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0291794.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0165.353] CloseHandle (hObject=0xdc) returned 1 [0165.353] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x20e4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0292248.WMF", cAlternateFileName="")) returned 1 [0165.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292248.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0165.355] GetProcessHeap () returned 0x4e0000 [0165.355] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0165.355] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0165.356] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0165.356] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0165.358] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0165.358] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0165.358] GetProcessHeap () returned 0x4e0000 [0165.358] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0165.358] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0165.358] CryptDestroyKey (hKey=0x522f98) returned 1 [0165.359] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0165.359] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0165.359] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0165.359] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0165.359] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0165.359] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0165.359] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0165.359] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0165.359] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.359] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x20e4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x20e4, lpOverlapped=0x0) returned 1 [0165.361] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x20f0, dwBufLen=0x20f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x20f0) returned 1 [0165.361] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.361] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x20f0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x20f0, lpOverlapped=0x0) returned 1 [0165.361] CryptDestroyKey (hKey=0x522f98) returned 1 [0165.361] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x21c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.361] SetEndOfFile (hFile=0xdc) returned 1 [0165.364] GetProcessHeap () returned 0x4e0000 [0165.364] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0165.364] GetProcessHeap () returned 0x4e0000 [0165.364] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0165.364] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292248.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292248.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0165.365] CloseHandle (hObject=0xdc) returned 1 [0165.365] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7aa6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0292270.WMF", cAlternateFileName="")) returned 1 [0165.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292270.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0165.366] GetProcessHeap () returned 0x4e0000 [0165.367] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0165.367] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0165.367] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0165.367] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0165.370] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0165.370] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0165.370] GetProcessHeap () returned 0x4e0000 [0165.370] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0165.370] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0165.370] CryptDestroyKey (hKey=0x522f98) returned 1 [0165.370] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0165.370] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0165.370] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0165.370] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0165.370] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0165.371] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0165.371] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0165.371] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0165.371] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.371] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7aa6, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7aa6, lpOverlapped=0x0) returned 1 [0165.531] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7ab0, dwBufLen=0x7ab0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7ab0) returned 1 [0165.532] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.532] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7ab0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7ab0, lpOverlapped=0x0) returned 1 [0165.532] CryptDestroyKey (hKey=0x522f98) returned 1 [0165.532] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7b84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.532] SetEndOfFile (hFile=0xdc) returned 1 [0165.535] GetProcessHeap () returned 0x4e0000 [0165.535] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0165.535] GetProcessHeap () returned 0x4e0000 [0165.535] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0165.535] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292270.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292270.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0165.538] CloseHandle (hObject=0xdc) returned 1 [0165.538] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b64, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0292272.WMF", cAlternateFileName="")) returned 1 [0165.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292272.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0165.540] GetProcessHeap () returned 0x4e0000 [0165.540] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0165.540] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0165.540] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0165.540] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0165.544] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0165.544] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0165.544] GetProcessHeap () returned 0x4e0000 [0165.544] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0165.544] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0165.544] CryptDestroyKey (hKey=0x522f98) returned 1 [0165.544] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0165.544] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0165.544] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0165.544] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0165.544] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0165.544] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0165.544] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0165.545] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0165.545] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.545] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1b64, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1b64, lpOverlapped=0x0) returned 1 [0165.553] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1b70, dwBufLen=0x1b70 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1b70) returned 1 [0165.553] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.553] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1b70, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1b70, lpOverlapped=0x0) returned 1 [0165.554] CryptDestroyKey (hKey=0x522f98) returned 1 [0165.554] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1c44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.554] SetEndOfFile (hFile=0xdc) returned 1 [0165.556] GetProcessHeap () returned 0x4e0000 [0165.556] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0165.557] GetProcessHeap () returned 0x4e0000 [0165.557] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0165.557] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292272.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292272.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0165.558] CloseHandle (hObject=0xdc) returned 1 [0165.559] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3658, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0292278.WMF", cAlternateFileName="")) returned 1 [0165.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292278.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0165.561] GetProcessHeap () returned 0x4e0000 [0165.561] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0165.561] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0165.561] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0165.561] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0165.614] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0165.614] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0165.614] GetProcessHeap () returned 0x4e0000 [0165.614] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0165.615] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0165.615] CryptDestroyKey (hKey=0x522f98) returned 1 [0165.615] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0165.615] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0165.615] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0165.615] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0165.615] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0165.615] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0165.615] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0165.615] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0165.615] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.615] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3658, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3658, lpOverlapped=0x0) returned 1 [0165.619] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3660, dwBufLen=0x3660 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3660) returned 1 [0165.619] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.619] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3660, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3660, lpOverlapped=0x0) returned 1 [0165.619] CryptDestroyKey (hKey=0x522f98) returned 1 [0165.619] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3734, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.619] SetEndOfFile (hFile=0xdc) returned 1 [0165.648] GetProcessHeap () returned 0x4e0000 [0165.648] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0165.648] GetProcessHeap () returned 0x4e0000 [0165.648] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0165.648] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292278.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292278.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0165.650] CloseHandle (hObject=0xdc) returned 1 [0165.650] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b56, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0292286.WMF", cAlternateFileName="")) returned 1 [0165.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292286.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0165.651] GetProcessHeap () returned 0x4e0000 [0165.651] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0165.651] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0165.651] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0165.652] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0165.661] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0165.661] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0165.661] GetProcessHeap () returned 0x4e0000 [0165.661] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0165.661] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0165.662] CryptDestroyKey (hKey=0x522f98) returned 1 [0165.662] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0165.662] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0165.662] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0165.662] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0165.662] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0165.662] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0165.662] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0165.662] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0165.662] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.662] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4b56, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4b56, lpOverlapped=0x0) returned 1 [0165.666] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4b60, dwBufLen=0x4b60 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4b60) returned 1 [0165.666] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.666] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4b60, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4b60, lpOverlapped=0x0) returned 1 [0165.666] CryptDestroyKey (hKey=0x522f98) returned 1 [0165.666] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4c34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.666] SetEndOfFile (hFile=0xdc) returned 1 [0165.669] GetProcessHeap () returned 0x4e0000 [0165.669] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0165.669] GetProcessHeap () returned 0x4e0000 [0165.669] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0165.669] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292286.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292286.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0165.671] CloseHandle (hObject=0xdc) returned 1 [0165.671] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x12a6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0293800.WMF", cAlternateFileName="")) returned 1 [0165.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293800.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0165.672] GetProcessHeap () returned 0x4e0000 [0165.672] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0165.673] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0165.673] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0165.673] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0165.726] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0165.726] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0165.726] GetProcessHeap () returned 0x4e0000 [0165.726] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0165.726] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0165.726] CryptDestroyKey (hKey=0x522f98) returned 1 [0165.726] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0165.726] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0165.726] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0165.726] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0165.726] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0165.726] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0165.726] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0165.727] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0165.727] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.727] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x12a6, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x12a6, lpOverlapped=0x0) returned 1 [0165.729] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x12b0, dwBufLen=0x12b0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x12b0) returned 1 [0165.729] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.729] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x12b0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x12b0, lpOverlapped=0x0) returned 1 [0165.729] CryptDestroyKey (hKey=0x522f98) returned 1 [0165.729] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1384, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.729] SetEndOfFile (hFile=0xdc) returned 1 [0165.732] GetProcessHeap () returned 0x4e0000 [0165.732] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0165.732] GetProcessHeap () returned 0x4e0000 [0165.732] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0165.732] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293800.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293800.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0165.734] CloseHandle (hObject=0xdc) returned 1 [0165.734] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x17be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0293832.WMF", cAlternateFileName="")) returned 1 [0165.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293832.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0165.736] GetProcessHeap () returned 0x4e0000 [0165.736] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0165.736] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0165.736] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0165.736] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0165.739] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0165.739] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0165.739] GetProcessHeap () returned 0x4e0000 [0165.739] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0165.739] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0165.739] CryptDestroyKey (hKey=0x522f98) returned 1 [0165.739] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0165.739] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0165.739] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0165.739] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0165.739] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0165.739] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0165.739] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0165.739] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0165.739] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.740] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x17be, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x17be, lpOverlapped=0x0) returned 1 [0165.747] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x17c0, dwBufLen=0x17c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x17c0) returned 1 [0165.747] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.747] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x17c0, lpOverlapped=0x0) returned 1 [0165.748] CryptDestroyKey (hKey=0x522f98) returned 1 [0165.748] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1894, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.748] SetEndOfFile (hFile=0xdc) returned 1 [0165.751] GetProcessHeap () returned 0x4e0000 [0165.751] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0165.751] GetProcessHeap () returned 0x4e0000 [0165.751] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0165.751] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293832.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293832.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0165.753] CloseHandle (hObject=0xdc) returned 1 [0165.753] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x566b3c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x37de, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0294989.WMF", cAlternateFileName="")) returned 1 [0165.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294989.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0165.755] GetProcessHeap () returned 0x4e0000 [0165.755] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0165.755] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0165.755] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0165.755] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0165.757] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0165.757] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0165.757] GetProcessHeap () returned 0x4e0000 [0165.757] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0165.757] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0165.757] CryptDestroyKey (hKey=0x522f98) returned 1 [0165.757] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0165.757] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0165.757] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0165.757] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0165.757] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0165.758] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0165.758] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0165.758] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0165.758] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.758] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x37de, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x37de, lpOverlapped=0x0) returned 1 [0165.759] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x37e0, dwBufLen=0x37e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x37e0) returned 1 [0165.759] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.759] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x37e0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x37e0, lpOverlapped=0x0) returned 1 [0165.759] CryptDestroyKey (hKey=0x522f98) returned 1 [0165.759] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x38b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.759] SetEndOfFile (hFile=0xdc) returned 1 [0165.762] GetProcessHeap () returned 0x4e0000 [0165.762] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0165.762] GetProcessHeap () returned 0x4e0000 [0165.762] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0165.762] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294989.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294989.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0165.764] CloseHandle (hObject=0xdc) returned 1 [0165.764] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x566b3c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6180, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0294991.WMF", cAlternateFileName="")) returned 1 [0165.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294991.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0165.765] GetProcessHeap () returned 0x4e0000 [0165.765] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0165.765] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0165.765] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0165.765] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0165.765] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0165.765] GetProcessHeap () returned 0x4e0000 [0165.765] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0165.765] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0165.765] CryptDestroyKey (hKey=0x522f98) returned 1 [0165.765] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0165.770] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0165.770] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0165.770] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0165.770] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0165.770] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0165.770] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0165.770] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0165.770] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.770] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x6180, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x6180, lpOverlapped=0x0) returned 1 [0165.888] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6180, dwBufLen=0x6180 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6180) returned 1 [0165.889] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.889] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6180, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x6180, lpOverlapped=0x0) returned 1 [0165.889] CryptDestroyKey (hKey=0x522f98) returned 1 [0165.889] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6254, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.889] SetEndOfFile (hFile=0xdc) returned 1 [0165.892] GetProcessHeap () returned 0x4e0000 [0165.892] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0165.892] GetProcessHeap () returned 0x4e0000 [0165.892] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0165.892] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294991.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294991.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0165.894] CloseHandle (hObject=0xdc) returned 1 [0165.894] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x566b3c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x21b2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0295069.WMF", cAlternateFileName="")) returned 1 [0165.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0295069.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0165.896] GetProcessHeap () returned 0x4e0000 [0165.896] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0165.896] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0165.896] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0165.897] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0166.048] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0166.048] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0166.048] GetProcessHeap () returned 0x4e0000 [0166.048] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0166.048] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0166.048] CryptDestroyKey (hKey=0x522f98) returned 1 [0166.048] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0166.048] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0166.048] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0166.048] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0166.049] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0166.049] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0166.049] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0166.049] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0166.049] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.049] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x21b2, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x21b2, lpOverlapped=0x0) returned 1 [0166.052] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x21c0, dwBufLen=0x21c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x21c0) returned 1 [0166.052] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.052] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x21c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x21c0, lpOverlapped=0x0) returned 1 [0166.052] CryptDestroyKey (hKey=0x522f98) returned 1 [0166.052] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2294, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.052] SetEndOfFile (hFile=0xdc) returned 1 [0166.055] GetProcessHeap () returned 0x4e0000 [0166.055] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0166.055] GetProcessHeap () returned 0x4e0000 [0166.055] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0166.055] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0295069.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0295069.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0166.057] CloseHandle (hObject=0xdc) returned 1 [0166.057] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe42c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0296277.WMF", cAlternateFileName="")) returned 1 [0166.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296277.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0166.058] GetProcessHeap () returned 0x4e0000 [0166.058] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0166.059] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0166.059] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0166.059] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0166.060] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0166.061] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0166.061] GetProcessHeap () returned 0x4e0000 [0166.061] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0166.061] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0166.061] CryptDestroyKey (hKey=0x522f98) returned 1 [0166.061] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0166.061] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0166.061] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0166.061] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0166.061] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0166.061] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0166.061] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0166.061] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0166.061] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.061] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xe42c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xe42c, lpOverlapped=0x0) returned 1 [0166.107] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe430, dwBufLen=0xe430 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe430) returned 1 [0166.108] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.108] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe430, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xe430, lpOverlapped=0x0) returned 1 [0166.108] CryptDestroyKey (hKey=0x522f98) returned 1 [0166.108] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xe504, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.108] SetEndOfFile (hFile=0xdc) returned 1 [0166.112] GetProcessHeap () returned 0x4e0000 [0166.112] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0166.112] GetProcessHeap () returned 0x4e0000 [0166.112] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0166.112] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296277.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296277.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0166.113] CloseHandle (hObject=0xdc) returned 1 [0166.113] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1088e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0296279.WMF", cAlternateFileName="")) returned 1 [0166.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296279.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0166.118] GetProcessHeap () returned 0x4e0000 [0166.118] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0166.118] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0166.118] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0166.118] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0166.133] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0166.133] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0166.133] GetProcessHeap () returned 0x4e0000 [0166.133] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0166.133] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0166.133] CryptDestroyKey (hKey=0x522f98) returned 1 [0166.133] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0166.133] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0166.133] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0166.134] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0166.134] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0166.134] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0166.134] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0166.134] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0166.134] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.134] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1088e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1088e, lpOverlapped=0x0) returned 1 [0166.138] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x10890, dwBufLen=0x10890 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x10890) returned 1 [0166.139] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.139] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x10890, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x10890, lpOverlapped=0x0) returned 1 [0166.139] CryptDestroyKey (hKey=0x522f98) returned 1 [0166.140] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x10964, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.140] SetEndOfFile (hFile=0xdc) returned 1 [0166.143] GetProcessHeap () returned 0x4e0000 [0166.143] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0166.143] GetProcessHeap () returned 0x4e0000 [0166.143] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0166.143] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296279.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296279.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0166.145] CloseHandle (hObject=0xdc) returned 1 [0166.145] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x107ec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0296288.WMF", cAlternateFileName="")) returned 1 [0166.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0166.146] GetProcessHeap () returned 0x4e0000 [0166.146] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0166.146] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0166.146] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0166.146] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0166.149] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0166.149] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0166.149] GetProcessHeap () returned 0x4e0000 [0166.149] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0166.149] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0166.149] CryptDestroyKey (hKey=0x522f98) returned 1 [0166.149] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0166.149] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0166.149] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0166.149] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0166.149] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0166.149] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0166.149] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0166.149] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0166.149] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.149] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x107ec, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x107ec, lpOverlapped=0x0) returned 1 [0166.152] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x107f0, dwBufLen=0x107f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x107f0) returned 1 [0166.153] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.153] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x107f0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x107f0, lpOverlapped=0x0) returned 1 [0166.153] CryptDestroyKey (hKey=0x522f98) returned 1 [0166.153] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x108c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.153] SetEndOfFile (hFile=0xdc) returned 1 [0166.156] GetProcessHeap () returned 0x4e0000 [0166.156] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0166.156] GetProcessHeap () returned 0x4e0000 [0166.156] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0166.156] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296288.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296288.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0166.158] CloseHandle (hObject=0xdc) returned 1 [0166.158] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x59ce, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0297229.WMF", cAlternateFileName="")) returned 1 [0166.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297229.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0166.159] GetProcessHeap () returned 0x4e0000 [0166.159] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0166.159] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0166.159] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0166.159] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0166.303] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0166.303] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0166.303] GetProcessHeap () returned 0x4e0000 [0166.303] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0166.303] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0166.303] CryptDestroyKey (hKey=0x522f98) returned 1 [0166.303] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0166.303] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0166.303] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0166.304] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0166.304] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0166.304] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0166.304] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0166.304] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0166.304] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.304] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x59ce, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x59ce, lpOverlapped=0x0) returned 1 [0166.306] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x59d0, dwBufLen=0x59d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x59d0) returned 1 [0166.307] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.307] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x59d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x59d0, lpOverlapped=0x0) returned 1 [0166.307] CryptDestroyKey (hKey=0x522f98) returned 1 [0166.307] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5aa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.307] SetEndOfFile (hFile=0xdc) returned 1 [0166.309] GetProcessHeap () returned 0x4e0000 [0166.309] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0166.309] GetProcessHeap () returned 0x4e0000 [0166.309] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0166.309] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297229.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297229.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0166.310] CloseHandle (hObject=0xdc) returned 1 [0166.311] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x566b3c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3d24, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0297269.WMF", cAlternateFileName="")) returned 1 [0166.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297269.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0166.311] GetProcessHeap () returned 0x4e0000 [0166.311] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0166.312] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0166.312] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0166.312] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0166.314] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0166.314] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0166.314] GetProcessHeap () returned 0x4e0000 [0166.314] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0166.314] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0166.314] CryptDestroyKey (hKey=0x522f98) returned 1 [0166.314] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0166.314] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0166.314] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0166.314] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0166.314] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0166.314] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0166.314] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0166.315] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0166.315] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.315] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3d24, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3d24, lpOverlapped=0x0) returned 1 [0166.317] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3d30, dwBufLen=0x3d30 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3d30) returned 1 [0166.317] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.317] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3d30, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3d30, lpOverlapped=0x0) returned 1 [0166.317] CryptDestroyKey (hKey=0x522f98) returned 1 [0166.317] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3e04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.318] SetEndOfFile (hFile=0xdc) returned 1 [0166.320] GetProcessHeap () returned 0x4e0000 [0166.320] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0166.320] GetProcessHeap () returned 0x4e0000 [0166.320] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0166.320] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297269.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297269.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0166.321] CloseHandle (hObject=0xdc) returned 1 [0166.321] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x566b3c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4236, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0297725.WMF", cAlternateFileName="")) returned 1 [0166.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297725.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0166.323] GetProcessHeap () returned 0x4e0000 [0166.323] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0166.323] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0166.323] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0166.323] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0166.330] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0166.330] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0166.330] GetProcessHeap () returned 0x4e0000 [0166.330] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0166.330] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0166.330] CryptDestroyKey (hKey=0x522f98) returned 1 [0166.330] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0166.330] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0166.330] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0166.331] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0166.331] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0166.331] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0166.331] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0166.331] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0166.331] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.331] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4236, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4236, lpOverlapped=0x0) returned 1 [0166.334] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4240, dwBufLen=0x4240 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4240) returned 1 [0166.334] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.334] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4240, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4240, lpOverlapped=0x0) returned 1 [0166.335] CryptDestroyKey (hKey=0x522f98) returned 1 [0166.335] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.335] SetEndOfFile (hFile=0xdc) returned 1 [0166.337] GetProcessHeap () returned 0x4e0000 [0166.337] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0166.337] GetProcessHeap () returned 0x4e0000 [0166.337] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0166.337] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297725.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297725.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0166.338] CloseHandle (hObject=0xdc) returned 1 [0166.338] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x566b3c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3c9c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0297727.WMF", cAlternateFileName="")) returned 1 [0166.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297727.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0166.339] GetProcessHeap () returned 0x4e0000 [0166.339] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0166.340] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0166.340] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0166.340] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0166.479] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0166.479] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0166.479] GetProcessHeap () returned 0x4e0000 [0166.531] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0166.531] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0166.531] CryptDestroyKey (hKey=0x522f98) returned 1 [0166.531] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0166.531] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0166.531] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0166.531] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0166.532] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0166.532] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0166.532] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0166.532] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0166.532] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.532] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3c9c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3c9c, lpOverlapped=0x0) returned 1 [0166.540] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3ca0, dwBufLen=0x3ca0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3ca0) returned 1 [0166.540] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.540] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3ca0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3ca0, lpOverlapped=0x0) returned 1 [0166.540] CryptDestroyKey (hKey=0x522f98) returned 1 [0166.540] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3d74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.540] SetEndOfFile (hFile=0xdc) returned 1 [0166.543] GetProcessHeap () returned 0x4e0000 [0166.543] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0166.543] GetProcessHeap () returned 0x4e0000 [0166.543] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0166.543] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297727.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297727.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0166.545] CloseHandle (hObject=0xdc) returned 1 [0166.545] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x493e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0297757.WMF", cAlternateFileName="")) returned 1 [0166.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297757.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0166.547] GetProcessHeap () returned 0x4e0000 [0166.547] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0166.547] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0166.547] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0166.547] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0166.559] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0166.559] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0166.559] GetProcessHeap () returned 0x4e0000 [0166.559] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0166.559] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0166.559] CryptDestroyKey (hKey=0x522f98) returned 1 [0166.559] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0166.559] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0166.559] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0166.559] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0166.559] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0166.559] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0166.559] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0166.560] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0166.560] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.560] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x493e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x493e, lpOverlapped=0x0) returned 1 [0166.562] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4940, dwBufLen=0x4940 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4940) returned 1 [0166.562] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.573] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4940, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4940, lpOverlapped=0x0) returned 1 [0166.573] CryptDestroyKey (hKey=0x522f98) returned 1 [0166.573] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4a14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.574] SetEndOfFile (hFile=0xdc) returned 1 [0166.576] GetProcessHeap () returned 0x4e0000 [0166.576] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0166.576] GetProcessHeap () returned 0x4e0000 [0166.576] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0166.576] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297757.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297757.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0166.577] CloseHandle (hObject=0xdc) returned 1 [0166.577] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4960, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0297759.WMF", cAlternateFileName="")) returned 1 [0166.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297759.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0166.578] GetProcessHeap () returned 0x4e0000 [0166.578] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0166.578] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0166.578] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0166.578] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0166.578] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0166.578] GetProcessHeap () returned 0x4e0000 [0166.579] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0166.579] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0166.579] CryptDestroyKey (hKey=0x522f98) returned 1 [0166.579] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0166.656] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0166.656] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0166.656] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0166.656] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0166.657] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0166.657] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0166.657] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0166.657] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.657] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4960, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4960, lpOverlapped=0x0) returned 1 [0166.663] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4960, dwBufLen=0x4960 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4960) returned 1 [0166.663] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.663] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4960, lpOverlapped=0x0) returned 1 [0166.663] CryptDestroyKey (hKey=0x522f98) returned 1 [0166.663] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4a34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.663] SetEndOfFile (hFile=0xdc) returned 1 [0166.665] GetProcessHeap () returned 0x4e0000 [0166.665] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0166.665] GetProcessHeap () returned 0x4e0000 [0166.665] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0166.665] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297759.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297759.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0166.667] CloseHandle (hObject=0xdc) returned 1 [0166.667] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x566ffef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4584, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0300862.WMF", cAlternateFileName="")) returned 1 [0166.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0300862.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0166.668] GetProcessHeap () returned 0x4e0000 [0166.668] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0166.668] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0166.668] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0166.668] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0166.712] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0166.712] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0166.712] GetProcessHeap () returned 0x4e0000 [0166.712] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0166.712] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0166.712] CryptDestroyKey (hKey=0x522f98) returned 1 [0166.712] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0166.712] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0166.712] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0166.712] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0166.712] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0166.713] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0166.713] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0166.713] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0166.713] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.713] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4584, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4584, lpOverlapped=0x0) returned 1 [0166.814] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4590, dwBufLen=0x4590 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4590) returned 1 [0166.814] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.814] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4590, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4590, lpOverlapped=0x0) returned 1 [0166.815] CryptDestroyKey (hKey=0x522f98) returned 1 [0166.815] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4664, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.815] SetEndOfFile (hFile=0xdc) returned 1 [0166.817] GetProcessHeap () returned 0x4e0000 [0166.817] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0166.817] GetProcessHeap () returned 0x4e0000 [0166.817] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0166.818] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0300862.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0300862.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0166.819] CloseHandle (hObject=0xdc) returned 1 [0166.820] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf66f5700, ftCreationTime.dwHighDateTime=0x1bf452d, ftLastAccessTime.dwLowDateTime=0x566ffef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf66f5700, ftLastWriteTime.dwHighDateTime=0x1bf452d, nFileSizeHigh=0x0, nFileSizeLow=0x2b0e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0301044.WMF", cAlternateFileName="")) returned 1 [0166.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301044.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0166.821] GetProcessHeap () returned 0x4e0000 [0166.821] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0166.821] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0166.821] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0166.821] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0166.951] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0166.951] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0166.951] GetProcessHeap () returned 0x4e0000 [0166.951] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0166.951] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0166.951] CryptDestroyKey (hKey=0x522f98) returned 1 [0166.951] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0166.952] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0166.952] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0166.952] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0166.952] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0166.952] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0166.952] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0166.952] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0166.952] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.952] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2b0e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2b0e, lpOverlapped=0x0) returned 1 [0166.965] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2b10, dwBufLen=0x2b10 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2b10) returned 1 [0166.965] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.965] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2b10, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2b10, lpOverlapped=0x0) returned 1 [0166.966] CryptDestroyKey (hKey=0x522f98) returned 1 [0166.966] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2be4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.966] SetEndOfFile (hFile=0xdc) returned 1 [0166.969] GetProcessHeap () returned 0x4e0000 [0166.969] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0166.969] GetProcessHeap () returned 0x4e0000 [0166.969] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0166.969] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301044.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301044.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0166.970] CloseHandle (hObject=0xdc) returned 1 [0166.971] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ab7300, ftCreationTime.dwHighDateTime=0x1bf4a6c, ftLastAccessTime.dwLowDateTime=0x66162910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ab7300, ftLastWriteTime.dwHighDateTime=0x1bf4a6c, nFileSizeHigh=0x0, nFileSizeLow=0x2ae8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0301052.WMF", cAlternateFileName="")) returned 1 [0166.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301052.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0166.973] GetProcessHeap () returned 0x4e0000 [0166.973] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0166.973] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0166.973] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0166.973] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0166.976] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0166.976] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0166.976] GetProcessHeap () returned 0x4e0000 [0166.976] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0166.977] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0166.977] CryptDestroyKey (hKey=0x522f98) returned 1 [0166.977] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0166.977] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0166.977] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0166.977] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0166.977] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0166.977] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0166.977] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0166.977] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0166.977] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.977] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2ae8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2ae8, lpOverlapped=0x0) returned 1 [0166.980] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2af0, dwBufLen=0x2af0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2af0) returned 1 [0166.980] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.980] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2af0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2af0, lpOverlapped=0x0) returned 1 [0166.980] CryptDestroyKey (hKey=0x522f98) returned 1 [0166.980] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2bc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.980] SetEndOfFile (hFile=0xdc) returned 1 [0166.983] GetProcessHeap () returned 0x4e0000 [0166.983] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0166.983] GetProcessHeap () returned 0x4e0000 [0166.983] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0166.983] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301052.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301052.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0166.985] CloseHandle (hObject=0xdc) returned 1 [0166.985] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56726050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4a5a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0301418.WMF", cAlternateFileName="")) returned 1 [0166.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301418.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0166.987] GetProcessHeap () returned 0x4e0000 [0166.987] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0166.987] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0166.987] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0166.987] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0166.990] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0166.990] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0166.990] GetProcessHeap () returned 0x4e0000 [0166.990] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0166.990] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0166.990] CryptDestroyKey (hKey=0x522f98) returned 1 [0166.990] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0166.990] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0166.990] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0166.990] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0166.990] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0166.990] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0166.990] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0166.990] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0166.990] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.991] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4a5a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4a5a, lpOverlapped=0x0) returned 1 [0166.994] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4a60, dwBufLen=0x4a60 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4a60) returned 1 [0166.995] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.995] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4a60, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4a60, lpOverlapped=0x0) returned 1 [0166.995] CryptDestroyKey (hKey=0x522f98) returned 1 [0166.995] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4b34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.995] SetEndOfFile (hFile=0xdc) returned 1 [0166.998] GetProcessHeap () returned 0x4e0000 [0166.998] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0166.998] GetProcessHeap () returned 0x4e0000 [0166.998] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0166.998] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301418.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301418.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0167.000] CloseHandle (hObject=0xdc) returned 1 [0167.000] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66162910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4dfa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0301432.WMF", cAlternateFileName="")) returned 1 [0167.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301432.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0167.001] GetProcessHeap () returned 0x4e0000 [0167.001] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0167.001] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0167.001] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0167.001] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0167.006] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0167.006] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0167.006] GetProcessHeap () returned 0x4e0000 [0167.006] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0167.006] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0167.006] CryptDestroyKey (hKey=0x522f98) returned 1 [0167.006] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0167.006] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0167.006] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0167.006] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0167.006] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0167.007] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0167.007] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0167.007] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0167.007] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.007] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4dfa, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4dfa, lpOverlapped=0x0) returned 1 [0167.028] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4e00, dwBufLen=0x4e00 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4e00) returned 1 [0167.029] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.029] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4e00, lpOverlapped=0x0) returned 1 [0167.029] CryptDestroyKey (hKey=0x522f98) returned 1 [0167.029] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.030] SetEndOfFile (hFile=0xdc) returned 1 [0167.032] GetProcessHeap () returned 0x4e0000 [0167.032] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0167.032] GetProcessHeap () returned 0x4e0000 [0167.032] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0167.033] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301432.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301432.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0167.034] CloseHandle (hObject=0xdc) returned 1 [0167.034] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56726050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe20, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0304371.WMF", cAlternateFileName="")) returned 1 [0167.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304371.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0167.036] GetProcessHeap () returned 0x4e0000 [0167.036] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0167.036] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0167.036] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0167.036] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0167.036] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0167.036] GetProcessHeap () returned 0x4e0000 [0167.036] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0167.036] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0167.036] CryptDestroyKey (hKey=0x522f98) returned 1 [0167.036] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0167.038] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0167.038] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0167.039] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0167.039] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0167.039] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0167.039] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0167.039] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0167.039] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.039] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xe20, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xe20, lpOverlapped=0x0) returned 1 [0167.039] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe20, dwBufLen=0xe20 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe20) returned 1 [0167.039] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.039] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xe20, lpOverlapped=0x0) returned 1 [0167.039] CryptDestroyKey (hKey=0x522f98) returned 1 [0167.039] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.039] SetEndOfFile (hFile=0xdc) returned 1 [0167.042] GetProcessHeap () returned 0x4e0000 [0167.042] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0167.042] GetProcessHeap () returned 0x4e0000 [0167.042] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0167.042] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304371.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304371.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0167.044] CloseHandle (hObject=0xdc) returned 1 [0167.044] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56726050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x103e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0304405.WMF", cAlternateFileName="")) returned 1 [0167.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304405.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0167.045] GetProcessHeap () returned 0x4e0000 [0167.045] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0167.045] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0167.045] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0167.045] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0167.051] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0167.051] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0167.052] GetProcessHeap () returned 0x4e0000 [0167.052] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0167.052] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0167.052] CryptDestroyKey (hKey=0x522f98) returned 1 [0167.052] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0167.052] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0167.052] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0167.052] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0167.052] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0167.052] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0167.052] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0167.052] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0167.052] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.052] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x103e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x103e, lpOverlapped=0x0) returned 1 [0167.054] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1040, dwBufLen=0x1040 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1040) returned 1 [0167.054] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.054] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1040, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1040, lpOverlapped=0x0) returned 1 [0167.054] CryptDestroyKey (hKey=0x522f98) returned 1 [0167.054] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1114, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.054] SetEndOfFile (hFile=0xdc) returned 1 [0167.057] GetProcessHeap () returned 0x4e0000 [0167.057] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0167.057] GetProcessHeap () returned 0x4e0000 [0167.057] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0167.057] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304405.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304405.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0167.059] CloseHandle (hObject=0xdc) returned 1 [0167.059] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56726050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4a0e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0304853.WMF", cAlternateFileName="")) returned 1 [0167.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304853.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0167.060] GetProcessHeap () returned 0x4e0000 [0167.060] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0167.060] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0167.060] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0167.060] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0167.122] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0167.122] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0167.122] GetProcessHeap () returned 0x4e0000 [0167.122] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0167.122] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0167.122] CryptDestroyKey (hKey=0x522f98) returned 1 [0167.122] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0167.122] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0167.122] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0167.123] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0167.123] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0167.123] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0167.123] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0167.123] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0167.123] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.123] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4a0e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4a0e, lpOverlapped=0x0) returned 1 [0167.133] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4a10, dwBufLen=0x4a10 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4a10) returned 1 [0167.133] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.133] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4a10, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4a10, lpOverlapped=0x0) returned 1 [0167.133] CryptDestroyKey (hKey=0x522f98) returned 1 [0167.133] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4ae4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.134] SetEndOfFile (hFile=0xdc) returned 1 [0167.136] GetProcessHeap () returned 0x4e0000 [0167.136] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0167.136] GetProcessHeap () returned 0x4e0000 [0167.136] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0167.136] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304853.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304853.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0167.138] CloseHandle (hObject=0xdc) returned 1 [0167.138] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66162910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2cf8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0304861.WMF", cAlternateFileName="")) returned 1 [0167.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304861.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0167.140] GetProcessHeap () returned 0x4e0000 [0167.140] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0167.140] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0167.140] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0167.141] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0167.148] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0167.149] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0167.149] GetProcessHeap () returned 0x4e0000 [0167.149] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0167.149] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0167.149] CryptDestroyKey (hKey=0x522f98) returned 1 [0167.149] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0167.149] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0167.149] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0167.149] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0167.149] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0167.149] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0167.149] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0167.149] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0167.149] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.149] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2cf8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2cf8, lpOverlapped=0x0) returned 1 [0167.165] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2d00, dwBufLen=0x2d00 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2d00) returned 1 [0167.165] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.166] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2d00, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2d00, lpOverlapped=0x0) returned 1 [0167.166] CryptDestroyKey (hKey=0x522f98) returned 1 [0167.166] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2dd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.166] SetEndOfFile (hFile=0xdc) returned 1 [0167.169] GetProcessHeap () returned 0x4e0000 [0167.169] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0167.169] GetProcessHeap () returned 0x4e0000 [0167.169] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0167.169] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304861.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304861.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0167.171] CloseHandle (hObject=0xdc) returned 1 [0167.171] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4f8e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0304875.WMF", cAlternateFileName="")) returned 1 [0167.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304875.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0167.173] GetProcessHeap () returned 0x4e0000 [0167.173] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0167.173] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0167.173] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0167.173] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0167.193] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0167.193] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0167.193] GetProcessHeap () returned 0x4e0000 [0167.193] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0167.193] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0167.193] CryptDestroyKey (hKey=0x522f98) returned 1 [0167.193] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0167.193] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0167.193] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0167.193] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0167.194] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0167.194] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0167.194] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0167.194] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0167.194] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.194] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4f8e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4f8e, lpOverlapped=0x0) returned 1 [0167.275] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4f90, dwBufLen=0x4f90 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4f90) returned 1 [0167.275] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.275] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4f90, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4f90, lpOverlapped=0x0) returned 1 [0167.276] CryptDestroyKey (hKey=0x522f98) returned 1 [0167.276] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5064, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.276] SetEndOfFile (hFile=0xdc) returned 1 [0167.279] GetProcessHeap () returned 0x4e0000 [0167.279] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0167.279] GetProcessHeap () returned 0x4e0000 [0167.279] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0167.279] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304875.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304875.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0167.281] CloseHandle (hObject=0xdc) returned 1 [0167.281] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66162910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x29c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0309480.JPG", cAlternateFileName="")) returned 1 [0167.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309480.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0167.282] GetProcessHeap () returned 0x4e0000 [0167.282] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0167.282] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0167.282] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0167.283] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0167.294] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0167.294] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0167.294] GetProcessHeap () returned 0x4e0000 [0167.294] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0167.294] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0167.294] CryptDestroyKey (hKey=0x522f98) returned 1 [0167.294] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0167.294] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0167.294] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0167.294] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0167.294] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0167.294] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0167.294] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0167.295] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0167.295] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.295] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x29c4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x29c4, lpOverlapped=0x0) returned 1 [0167.307] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x29d0, dwBufLen=0x29d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x29d0) returned 1 [0167.307] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.308] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x29d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x29d0, lpOverlapped=0x0) returned 1 [0167.308] CryptDestroyKey (hKey=0x522f98) returned 1 [0167.308] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2aa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.308] SetEndOfFile (hFile=0xdc) returned 1 [0167.311] GetProcessHeap () returned 0x4e0000 [0167.311] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0167.311] GetProcessHeap () returned 0x4e0000 [0167.311] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0167.311] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309480.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309480.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0167.313] CloseHandle (hObject=0xdc) returned 1 [0167.313] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66162910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x544c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0309567.JPG", cAlternateFileName="")) returned 1 [0167.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309567.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0167.315] GetProcessHeap () returned 0x4e0000 [0167.315] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0167.315] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0167.315] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0167.315] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0167.317] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0167.317] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0167.317] GetProcessHeap () returned 0x4e0000 [0167.317] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0167.317] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0167.317] CryptDestroyKey (hKey=0x522f98) returned 1 [0167.317] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0167.317] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0167.317] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0167.317] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0167.317] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0167.318] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0167.318] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0167.318] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0167.318] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.318] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x544c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x544c, lpOverlapped=0x0) returned 1 [0167.319] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5450, dwBufLen=0x5450 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5450) returned 1 [0167.319] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.319] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5450, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5450, lpOverlapped=0x0) returned 1 [0167.319] CryptDestroyKey (hKey=0x522f98) returned 1 [0167.319] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5524, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.319] SetEndOfFile (hFile=0xdc) returned 1 [0167.322] GetProcessHeap () returned 0x4e0000 [0167.322] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0167.322] GetProcessHeap () returned 0x4e0000 [0167.322] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0167.322] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309567.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309567.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0167.324] CloseHandle (hObject=0xdc) returned 1 [0167.324] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9a8b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0309585.JPG", cAlternateFileName="")) returned 1 [0167.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309585.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0167.326] GetProcessHeap () returned 0x4e0000 [0167.326] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0167.326] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0167.326] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0167.326] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x5, lpOverlapped=0x0) returned 1 [0167.342] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0167.342] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0167.342] GetProcessHeap () returned 0x4e0000 [0167.342] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0167.342] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0167.342] CryptDestroyKey (hKey=0x522f98) returned 1 [0167.342] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0167.343] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0167.343] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0167.343] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0167.343] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0167.343] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0167.343] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0167.343] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0167.343] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.343] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x9a8b, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x9a8b, lpOverlapped=0x0) returned 1 [0167.346] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9a90, dwBufLen=0x9a90 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9a90) returned 1 [0167.346] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.347] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x9a90, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x9a90, lpOverlapped=0x0) returned 1 [0167.347] CryptDestroyKey (hKey=0x522f98) returned 1 [0167.347] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x9b64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.347] SetEndOfFile (hFile=0xdc) returned 1 [0167.349] GetProcessHeap () returned 0x4e0000 [0167.349] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0167.349] GetProcessHeap () returned 0x4e0000 [0167.349] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0167.349] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309585.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309585.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0167.351] CloseHandle (hObject=0xdc) returned 1 [0167.351] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x81f0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0309598.JPG", cAlternateFileName="")) returned 1 [0167.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309598.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0167.352] GetProcessHeap () returned 0x4e0000 [0167.352] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0167.352] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0167.352] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0167.352] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0167.352] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0167.352] GetProcessHeap () returned 0x4e0000 [0167.352] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0167.352] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0167.352] CryptDestroyKey (hKey=0x522f98) returned 1 [0167.352] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0167.367] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0167.367] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0167.367] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0167.367] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0167.367] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0167.367] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0167.367] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0167.367] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.367] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x81f0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x81f0, lpOverlapped=0x0) returned 1 [0167.369] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x81f0, dwBufLen=0x81f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x81f0) returned 1 [0167.369] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.369] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x81f0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x81f0, lpOverlapped=0x0) returned 1 [0167.370] CryptDestroyKey (hKey=0x522f98) returned 1 [0167.370] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x82c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.370] SetEndOfFile (hFile=0xdc) returned 1 [0167.373] GetProcessHeap () returned 0x4e0000 [0167.373] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0167.373] GetProcessHeap () returned 0x4e0000 [0167.373] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0167.373] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309598.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309598.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0167.375] CloseHandle (hObject=0xdc) returned 1 [0167.375] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaabb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0309664.JPG", cAlternateFileName="")) returned 1 [0167.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309664.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0167.376] GetProcessHeap () returned 0x4e0000 [0167.376] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0167.377] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0167.377] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0167.377] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x5, lpOverlapped=0x0) returned 1 [0167.382] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0167.382] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0167.382] GetProcessHeap () returned 0x4e0000 [0167.382] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0167.382] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0167.382] CryptDestroyKey (hKey=0x522f98) returned 1 [0167.382] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0167.382] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0167.382] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0167.382] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0167.382] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0167.382] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0167.383] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0167.383] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0167.383] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.383] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xaabb, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xaabb, lpOverlapped=0x0) returned 1 [0167.415] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xaac0, dwBufLen=0xaac0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xaac0) returned 1 [0167.416] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.416] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xaac0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xaac0, lpOverlapped=0x0) returned 1 [0167.416] CryptDestroyKey (hKey=0x522f98) returned 1 [0167.416] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xab94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.416] SetEndOfFile (hFile=0xdc) returned 1 [0167.419] GetProcessHeap () returned 0x4e0000 [0167.419] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0167.419] GetProcessHeap () returned 0x4e0000 [0167.419] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0167.419] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309664.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309664.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0167.420] CloseHandle (hObject=0xdc) returned 1 [0167.421] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66162910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4ada, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0309705.JPG", cAlternateFileName="")) returned 1 [0167.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309705.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0167.422] GetProcessHeap () returned 0x4e0000 [0167.422] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0167.422] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0167.422] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0167.422] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0167.434] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0167.434] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0167.434] GetProcessHeap () returned 0x4e0000 [0167.434] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0167.434] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0167.434] CryptDestroyKey (hKey=0x522f98) returned 1 [0167.434] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0167.435] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0167.435] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0167.435] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0167.435] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0167.435] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0167.435] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0167.435] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0167.435] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.435] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4ada, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4ada, lpOverlapped=0x0) returned 1 [0167.464] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4ae0, dwBufLen=0x4ae0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4ae0) returned 1 [0167.464] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.464] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4ae0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4ae0, lpOverlapped=0x0) returned 1 [0167.464] CryptDestroyKey (hKey=0x522f98) returned 1 [0167.464] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4bb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.464] SetEndOfFile (hFile=0xdc) returned 1 [0167.468] GetProcessHeap () returned 0x4e0000 [0167.468] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0167.468] GetProcessHeap () returned 0x4e0000 [0167.468] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0167.468] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309705.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309705.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0167.470] CloseHandle (hObject=0xdc) returned 1 [0167.470] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b95a400, ftCreationTime.dwHighDateTime=0x1bf5cb6, ftLastAccessTime.dwLowDateTime=0x66162910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b95a400, ftLastWriteTime.dwHighDateTime=0x1bf5cb6, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0309902.WMF", cAlternateFileName="")) returned 1 [0167.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309902.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0167.471] GetProcessHeap () returned 0x4e0000 [0167.471] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0167.471] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0167.471] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0167.471] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0167.471] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0167.471] GetProcessHeap () returned 0x4e0000 [0167.471] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0167.471] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0167.471] CryptDestroyKey (hKey=0x522f98) returned 1 [0167.471] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0167.500] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0167.501] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0167.501] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0167.501] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0167.501] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0167.501] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0167.501] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0167.501] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.501] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1a00, lpOverlapped=0x0) returned 1 [0167.508] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1a00, dwBufLen=0x1a00 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1a00) returned 1 [0167.508] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.508] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1a00, lpOverlapped=0x0) returned 1 [0167.509] CryptDestroyKey (hKey=0x522f98) returned 1 [0167.509] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1ad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.509] SetEndOfFile (hFile=0xdc) returned 1 [0167.512] GetProcessHeap () returned 0x4e0000 [0167.512] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0167.512] GetProcessHeap () returned 0x4e0000 [0167.512] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0167.512] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309902.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309902.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0167.516] CloseHandle (hObject=0xdc) returned 1 [0167.516] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5cc6d100, ftCreationTime.dwHighDateTime=0x1bf5cb6, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5cc6d100, ftLastWriteTime.dwHighDateTime=0x1bf5cb6, nFileSizeHigh=0x0, nFileSizeLow=0x20e4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0309904.WMF", cAlternateFileName="")) returned 1 [0167.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309904.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0167.517] GetProcessHeap () returned 0x4e0000 [0167.517] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0167.518] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0167.518] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0167.518] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0167.534] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0167.534] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0167.534] GetProcessHeap () returned 0x4e0000 [0167.534] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0167.534] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0167.535] CryptDestroyKey (hKey=0x522f98) returned 1 [0167.535] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0167.535] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0167.535] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0167.535] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0167.535] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0167.535] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0167.535] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0167.535] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0167.535] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.535] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x20e4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x20e4, lpOverlapped=0x0) returned 1 [0167.555] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x20f0, dwBufLen=0x20f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x20f0) returned 1 [0167.555] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.555] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x20f0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x20f0, lpOverlapped=0x0) returned 1 [0167.555] CryptDestroyKey (hKey=0x522f98) returned 1 [0167.555] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x21c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.555] SetEndOfFile (hFile=0xdc) returned 1 [0167.558] GetProcessHeap () returned 0x4e0000 [0167.558] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0167.558] GetProcessHeap () returned 0x4e0000 [0167.558] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0167.558] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309904.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309904.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0167.561] CloseHandle (hObject=0xdc) returned 1 [0167.561] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea87400, ftCreationTime.dwHighDateTime=0x1bf5cb6, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ea87400, ftLastWriteTime.dwHighDateTime=0x1bf5cb6, nFileSizeHigh=0x0, nFileSizeLow=0x2b38, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0309920.WMF", cAlternateFileName="")) returned 1 [0167.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309920.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0167.562] GetProcessHeap () returned 0x4e0000 [0167.562] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0167.562] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0167.562] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0167.562] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0167.679] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0167.679] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0167.679] GetProcessHeap () returned 0x4e0000 [0167.679] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0167.679] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0167.679] CryptDestroyKey (hKey=0x522f98) returned 1 [0167.679] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0167.679] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0167.679] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0167.679] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0167.679] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0167.680] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0167.680] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0167.680] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0167.680] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.680] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2b38, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2b38, lpOverlapped=0x0) returned 1 [0167.687] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2b40, dwBufLen=0x2b40 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2b40) returned 1 [0167.687] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.687] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2b40, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2b40, lpOverlapped=0x0) returned 1 [0167.688] CryptDestroyKey (hKey=0x522f98) returned 1 [0167.688] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2c14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.688] SetEndOfFile (hFile=0xdc) returned 1 [0167.690] GetProcessHeap () returned 0x4e0000 [0167.690] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0167.690] GetProcessHeap () returned 0x4e0000 [0167.690] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0167.691] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309920.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309920.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0167.692] CloseHandle (hObject=0xdc) returned 1 [0167.692] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a03b100, ftCreationTime.dwHighDateTime=0x1c97bb5, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a03b100, ftLastWriteTime.dwHighDateTime=0x1c97bb5, nFileSizeHigh=0x0, nFileSizeLow=0x911a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0313896.JPG", cAlternateFileName="")) returned 1 [0167.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313896.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0167.695] GetProcessHeap () returned 0x4e0000 [0167.695] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0167.695] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0167.695] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0167.695] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0167.698] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0167.698] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0167.698] GetProcessHeap () returned 0x4e0000 [0167.698] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0167.698] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0167.698] CryptDestroyKey (hKey=0x522f98) returned 1 [0167.698] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0167.698] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0167.698] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0167.698] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0167.698] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0167.698] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0167.698] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0167.698] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0167.698] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.698] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x911a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x911a, lpOverlapped=0x0) returned 1 [0167.738] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9120, dwBufLen=0x9120 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9120) returned 1 [0167.738] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.738] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x9120, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x9120, lpOverlapped=0x0) returned 1 [0167.738] CryptDestroyKey (hKey=0x522f98) returned 1 [0167.738] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x91f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.739] SetEndOfFile (hFile=0xdc) returned 1 [0167.741] GetProcessHeap () returned 0x4e0000 [0167.741] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0167.742] GetProcessHeap () returned 0x4e0000 [0167.742] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0167.742] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313896.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313896.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0167.743] CloseHandle (hObject=0xdc) returned 1 [0167.743] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x717bb700, ftCreationTime.dwHighDateTime=0x1c97bb5, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x717bb700, ftLastWriteTime.dwHighDateTime=0x1c97bb5, nFileSizeHigh=0x0, nFileSizeLow=0xa75a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0313965.JPG", cAlternateFileName="")) returned 1 [0167.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313965.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0167.744] GetProcessHeap () returned 0x4e0000 [0167.744] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0167.745] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0167.745] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0167.745] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0167.747] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0167.747] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0167.747] GetProcessHeap () returned 0x4e0000 [0167.747] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0167.747] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0167.747] CryptDestroyKey (hKey=0x522f98) returned 1 [0167.747] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0167.747] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0167.747] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0167.747] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0167.747] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0167.747] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0167.747] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0167.748] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0167.748] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.748] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xa75a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xa75a, lpOverlapped=0x0) returned 1 [0167.749] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa760, dwBufLen=0xa760 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa760) returned 1 [0167.749] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.749] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xa760, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xa760, lpOverlapped=0x0) returned 1 [0167.749] CryptDestroyKey (hKey=0x522f98) returned 1 [0167.749] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xa834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.749] SetEndOfFile (hFile=0xdc) returned 1 [0167.752] GetProcessHeap () returned 0x4e0000 [0167.752] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0167.752] GetProcessHeap () returned 0x4e0000 [0167.752] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0167.753] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313965.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313965.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0167.754] CloseHandle (hObject=0xdc) returned 1 [0167.754] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x527d2500, ftCreationTime.dwHighDateTime=0x1c97bb5, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x527d2500, ftLastWriteTime.dwHighDateTime=0x1c97bb5, nFileSizeHigh=0x0, nFileSizeLow=0x81ab, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0313970.JPG", cAlternateFileName="")) returned 1 [0167.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313970.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0167.755] GetProcessHeap () returned 0x4e0000 [0167.755] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0167.755] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0167.755] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0167.755] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x5, lpOverlapped=0x0) returned 1 [0167.757] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0167.757] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0167.757] GetProcessHeap () returned 0x4e0000 [0167.757] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0167.757] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0167.757] CryptDestroyKey (hKey=0x522f98) returned 1 [0167.758] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0167.758] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0167.758] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0167.758] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0167.758] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0167.758] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0167.758] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0167.758] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0167.758] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.758] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x81ab, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x81ab, lpOverlapped=0x0) returned 1 [0167.759] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x81b0, dwBufLen=0x81b0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x81b0) returned 1 [0167.760] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.760] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x81b0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x81b0, lpOverlapped=0x0) returned 1 [0167.760] CryptDestroyKey (hKey=0x522f98) returned 1 [0167.760] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x8284, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.760] SetEndOfFile (hFile=0xdc) returned 1 [0167.763] GetProcessHeap () returned 0x4e0000 [0167.763] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0167.763] GetProcessHeap () returned 0x4e0000 [0167.763] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0167.763] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313970.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313970.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0167.765] CloseHandle (hObject=0xdc) returned 1 [0167.765] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d07fb00, ftCreationTime.dwHighDateTime=0x1c97bb5, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3d07fb00, ftLastWriteTime.dwHighDateTime=0x1c97bb5, nFileSizeHigh=0x0, nFileSizeLow=0xb9d1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0313974.JPG", cAlternateFileName="")) returned 1 [0167.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313974.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0167.766] GetProcessHeap () returned 0x4e0000 [0167.766] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0167.766] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0167.766] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0167.766] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xf, lpOverlapped=0x0) returned 1 [0167.795] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0167.795] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0167.795] GetProcessHeap () returned 0x4e0000 [0167.795] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0167.795] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0167.795] CryptDestroyKey (hKey=0x522f98) returned 1 [0167.795] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0167.796] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0167.796] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0167.796] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0167.796] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0167.796] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0167.796] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0167.796] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0167.796] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.796] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb9d1, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xb9d1, lpOverlapped=0x0) returned 1 [0167.860] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xb9e0, dwBufLen=0xb9e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xb9e0) returned 1 [0167.860] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.861] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xb9e0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xb9e0, lpOverlapped=0x0) returned 1 [0167.861] CryptDestroyKey (hKey=0x522f98) returned 1 [0167.861] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xbab4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.861] SetEndOfFile (hFile=0xdc) returned 1 [0167.864] GetProcessHeap () returned 0x4e0000 [0167.864] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0167.864] GetProcessHeap () returned 0x4e0000 [0167.864] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0167.864] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313974.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313974.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0167.866] CloseHandle (hObject=0xdc) returned 1 [0167.866] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2feb0c00, ftCreationTime.dwHighDateTime=0x1c97bb5, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2feb0c00, ftLastWriteTime.dwHighDateTime=0x1c97bb5, nFileSizeHigh=0x0, nFileSizeLow=0x40f2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0314068.JPG", cAlternateFileName="")) returned 1 [0167.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0314068.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0167.868] GetProcessHeap () returned 0x4e0000 [0167.868] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0167.868] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0167.868] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0167.868] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0167.877] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0167.877] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0167.877] GetProcessHeap () returned 0x4e0000 [0167.877] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0167.877] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0167.877] CryptDestroyKey (hKey=0x522f98) returned 1 [0167.877] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0167.877] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0167.877] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0167.877] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0167.877] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0167.878] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0167.878] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0167.878] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0167.878] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.878] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40f2, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x40f2, lpOverlapped=0x0) returned 1 [0167.879] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4100, dwBufLen=0x4100 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4100) returned 1 [0167.879] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.879] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4100, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4100, lpOverlapped=0x0) returned 1 [0167.879] CryptDestroyKey (hKey=0x522f98) returned 1 [0167.879] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x41d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.880] SetEndOfFile (hFile=0xdc) returned 1 [0167.882] GetProcessHeap () returned 0x4e0000 [0167.882] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0167.882] GetProcessHeap () returned 0x4e0000 [0167.882] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0167.883] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0314068.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0314068.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0167.884] CloseHandle (hObject=0xdc) returned 1 [0167.884] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b02, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0315580.JPG", cAlternateFileName="")) returned 1 [0167.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315580.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0167.885] GetProcessHeap () returned 0x4e0000 [0167.885] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0167.885] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0167.885] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0167.886] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0167.890] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0167.890] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0167.890] GetProcessHeap () returned 0x4e0000 [0167.890] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0167.890] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0167.890] CryptDestroyKey (hKey=0x522f98) returned 1 [0167.891] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0167.891] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0167.891] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0167.891] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0167.891] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0167.891] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0167.891] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0167.891] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0167.891] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.891] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4b02, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4b02, lpOverlapped=0x0) returned 1 [0167.922] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4b10, dwBufLen=0x4b10 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4b10) returned 1 [0167.922] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.922] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4b10, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4b10, lpOverlapped=0x0) returned 1 [0167.922] CryptDestroyKey (hKey=0x522f98) returned 1 [0167.922] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4be4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.923] SetEndOfFile (hFile=0xdc) returned 1 [0167.925] GetProcessHeap () returned 0x4e0000 [0167.925] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0167.925] GetProcessHeap () returned 0x4e0000 [0167.925] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0167.926] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315580.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315580.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0167.927] CloseHandle (hObject=0xdc) returned 1 [0167.927] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x423a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0315612.JPG", cAlternateFileName="")) returned 1 [0167.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315612.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0167.928] GetProcessHeap () returned 0x4e0000 [0167.929] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0167.929] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0167.929] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0167.929] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0167.935] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0167.935] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0167.935] GetProcessHeap () returned 0x4e0000 [0167.935] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0167.935] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0167.935] CryptDestroyKey (hKey=0x522f98) returned 1 [0167.935] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0167.935] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0167.935] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0167.936] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0167.936] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0167.936] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0167.936] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0167.936] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0167.936] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.936] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x423a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x423a, lpOverlapped=0x0) returned 1 [0167.940] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4240, dwBufLen=0x4240 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4240) returned 1 [0167.940] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.940] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4240, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4240, lpOverlapped=0x0) returned 1 [0167.941] CryptDestroyKey (hKey=0x522f98) returned 1 [0167.941] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.941] SetEndOfFile (hFile=0xdc) returned 1 [0167.943] GetProcessHeap () returned 0x4e0000 [0167.943] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0167.944] GetProcessHeap () returned 0x4e0000 [0167.944] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0167.944] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315612.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315612.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0167.945] CloseHandle (hObject=0xdc) returned 1 [0167.945] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4180, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0318448.WMF", cAlternateFileName="")) returned 1 [0167.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318448.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0167.947] GetProcessHeap () returned 0x4e0000 [0167.947] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0167.947] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0167.947] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0167.947] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0167.947] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0167.947] GetProcessHeap () returned 0x4e0000 [0167.948] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0167.948] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0167.948] CryptDestroyKey (hKey=0x522f98) returned 1 [0167.948] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0167.950] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0167.950] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0167.950] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0167.950] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0167.950] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0167.950] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0167.951] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0167.951] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.951] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4180, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4180, lpOverlapped=0x0) returned 1 [0167.953] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4180, dwBufLen=0x4180 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4180) returned 1 [0167.953] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.953] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4180, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4180, lpOverlapped=0x0) returned 1 [0167.953] CryptDestroyKey (hKey=0x522f98) returned 1 [0167.953] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4254, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.953] SetEndOfFile (hFile=0xdc) returned 1 [0167.956] GetProcessHeap () returned 0x4e0000 [0167.956] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0167.956] GetProcessHeap () returned 0x4e0000 [0167.956] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0167.956] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318448.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318448.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0167.958] CloseHandle (hObject=0xdc) returned 1 [0167.958] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2dfa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0318804.WMF", cAlternateFileName="")) returned 1 [0167.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318804.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0167.959] GetProcessHeap () returned 0x4e0000 [0167.959] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0167.959] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0167.959] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0167.959] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0167.983] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0167.983] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0167.983] GetProcessHeap () returned 0x4e0000 [0167.983] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0167.984] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0167.984] CryptDestroyKey (hKey=0x522f98) returned 1 [0167.984] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0167.984] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0167.984] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0167.984] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0167.984] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0167.984] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0167.984] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0167.984] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0167.984] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.984] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2dfa, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2dfa, lpOverlapped=0x0) returned 1 [0167.986] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2e00, dwBufLen=0x2e00 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2e00) returned 1 [0167.987] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.987] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2e00, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2e00, lpOverlapped=0x0) returned 1 [0167.987] CryptDestroyKey (hKey=0x522f98) returned 1 [0167.987] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.987] SetEndOfFile (hFile=0xdc) returned 1 [0167.990] GetProcessHeap () returned 0x4e0000 [0167.990] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0167.990] GetProcessHeap () returned 0x4e0000 [0167.990] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0167.990] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318804.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318804.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0167.992] CloseHandle (hObject=0xdc) returned 1 [0167.992] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x28be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0318810.WMF", cAlternateFileName="")) returned 1 [0167.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318810.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0167.993] GetProcessHeap () returned 0x4e0000 [0167.993] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0167.993] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0167.993] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0167.993] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0167.996] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0167.996] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0167.996] GetProcessHeap () returned 0x4e0000 [0167.996] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0167.996] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0167.996] CryptDestroyKey (hKey=0x522f98) returned 1 [0167.996] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0167.996] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0167.996] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0167.996] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0167.996] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0167.997] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0167.997] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0167.997] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0167.997] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.997] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x28be, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x28be, lpOverlapped=0x0) returned 1 [0168.009] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x28c0, dwBufLen=0x28c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x28c0) returned 1 [0168.009] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.009] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x28c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x28c0, lpOverlapped=0x0) returned 1 [0168.009] CryptDestroyKey (hKey=0x522f98) returned 1 [0168.009] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.009] SetEndOfFile (hFile=0xdc) returned 1 [0168.012] GetProcessHeap () returned 0x4e0000 [0168.012] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0168.012] GetProcessHeap () returned 0x4e0000 [0168.012] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0168.012] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318810.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318810.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0168.016] CloseHandle (hObject=0xdc) returned 1 [0168.017] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x24d7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0321179.JPG", cAlternateFileName="")) returned 1 [0168.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0321179.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0168.018] GetProcessHeap () returned 0x4e0000 [0168.018] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0168.019] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0168.019] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0168.019] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x9, lpOverlapped=0x0) returned 1 [0168.076] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0168.076] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0168.076] GetProcessHeap () returned 0x4e0000 [0168.076] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0168.076] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0168.076] CryptDestroyKey (hKey=0x522f98) returned 1 [0168.076] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0168.077] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0168.077] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0168.077] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0168.077] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0168.077] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0168.077] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0168.077] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0168.077] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.077] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x24d7, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x24d7, lpOverlapped=0x0) returned 1 [0168.079] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x24e0, dwBufLen=0x24e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x24e0) returned 1 [0168.079] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.079] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x24e0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x24e0, lpOverlapped=0x0) returned 1 [0168.079] CryptDestroyKey (hKey=0x522f98) returned 1 [0168.079] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x25b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.080] SetEndOfFile (hFile=0xdc) returned 1 [0168.082] GetProcessHeap () returned 0x4e0000 [0168.082] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0168.082] GetProcessHeap () returned 0x4e0000 [0168.082] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0168.082] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0321179.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0321179.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0168.084] CloseHandle (hObject=0xdc) returned 1 [0168.084] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2ff8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0324694.WMF", cAlternateFileName="")) returned 1 [0168.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324694.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0168.085] GetProcessHeap () returned 0x4e0000 [0168.085] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0168.085] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0168.085] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0168.085] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0168.087] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0168.088] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0168.088] GetProcessHeap () returned 0x4e0000 [0168.088] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0168.088] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0168.088] CryptDestroyKey (hKey=0x522f98) returned 1 [0168.088] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0168.088] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0168.088] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0168.088] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0168.088] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0168.088] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0168.088] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0168.089] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0168.089] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.089] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2ff8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2ff8, lpOverlapped=0x0) returned 1 [0168.096] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3000, dwBufLen=0x3000 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3000) returned 1 [0168.096] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.096] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3000, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3000, lpOverlapped=0x0) returned 1 [0168.096] CryptDestroyKey (hKey=0x522f98) returned 1 [0168.096] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x30d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.096] SetEndOfFile (hFile=0xdc) returned 1 [0168.098] GetProcessHeap () returned 0x4e0000 [0168.098] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0168.098] GetProcessHeap () returned 0x4e0000 [0168.098] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0168.099] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324694.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324694.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0168.100] CloseHandle (hObject=0xdc) returned 1 [0168.100] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2e7e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0324704.WMF", cAlternateFileName="")) returned 1 [0168.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324704.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0168.101] GetProcessHeap () returned 0x4e0000 [0168.101] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0168.101] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0168.101] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0168.101] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0168.111] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0168.111] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0168.111] GetProcessHeap () returned 0x4e0000 [0168.111] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0168.111] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0168.111] CryptDestroyKey (hKey=0x522f98) returned 1 [0168.111] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0168.111] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0168.111] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0168.111] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0168.111] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0168.112] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0168.112] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0168.112] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0168.112] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.112] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2e7e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2e7e, lpOverlapped=0x0) returned 1 [0168.126] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2e80, dwBufLen=0x2e80 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2e80) returned 1 [0168.127] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.127] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2e80, lpOverlapped=0x0) returned 1 [0168.127] CryptDestroyKey (hKey=0x522f98) returned 1 [0168.127] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2f54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.127] SetEndOfFile (hFile=0xdc) returned 1 [0168.129] GetProcessHeap () returned 0x4e0000 [0168.129] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0168.129] GetProcessHeap () returned 0x4e0000 [0168.129] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0168.130] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324704.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324704.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0168.131] CloseHandle (hObject=0xdc) returned 1 [0168.132] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3260, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0337280.JPG", cAlternateFileName="")) returned 1 [0168.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0337280.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0168.133] GetProcessHeap () returned 0x4e0000 [0168.133] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0168.133] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0168.133] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0168.133] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0168.133] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0168.133] GetProcessHeap () returned 0x4e0000 [0168.133] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0168.133] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0168.133] CryptDestroyKey (hKey=0x522f98) returned 1 [0168.133] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0168.136] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0168.136] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0168.136] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0168.137] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0168.137] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0168.137] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0168.137] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0168.137] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.138] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3260, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3260, lpOverlapped=0x0) returned 1 [0168.139] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3260, dwBufLen=0x3260 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3260) returned 1 [0168.139] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.139] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3260, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3260, lpOverlapped=0x0) returned 1 [0168.140] CryptDestroyKey (hKey=0x522f98) returned 1 [0168.140] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3334, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.140] SetEndOfFile (hFile=0xdc) returned 1 [0168.142] GetProcessHeap () returned 0x4e0000 [0168.142] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0168.143] GetProcessHeap () returned 0x4e0000 [0168.143] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0168.143] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0337280.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0337280.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0168.144] CloseHandle (hObject=0xdc) returned 1 [0168.144] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x27d4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341328.JPG", cAlternateFileName="")) returned 1 [0168.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341328.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0168.146] GetProcessHeap () returned 0x4e0000 [0168.146] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0168.146] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0168.146] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0168.147] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0168.148] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0168.149] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0168.149] GetProcessHeap () returned 0x4e0000 [0168.149] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0168.149] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0168.149] CryptDestroyKey (hKey=0x522f98) returned 1 [0168.149] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0168.149] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0168.149] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0168.149] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0168.149] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0168.149] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0168.149] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0168.149] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0168.149] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.150] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x27d4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x27d4, lpOverlapped=0x0) returned 1 [0168.150] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x27e0, dwBufLen=0x27e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x27e0) returned 1 [0168.150] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.151] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x27e0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x27e0, lpOverlapped=0x0) returned 1 [0168.151] CryptDestroyKey (hKey=0x522f98) returned 1 [0168.151] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x28b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.151] SetEndOfFile (hFile=0xdc) returned 1 [0168.155] GetProcessHeap () returned 0x4e0000 [0168.155] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0168.155] GetProcessHeap () returned 0x4e0000 [0168.155] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0168.155] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341328.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341328.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0168.156] CloseHandle (hObject=0xdc) returned 1 [0168.156] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2cdd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341344.JPG", cAlternateFileName="")) returned 1 [0168.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341344.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0168.159] GetProcessHeap () returned 0x4e0000 [0168.159] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0168.159] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0168.159] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0168.159] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x3, lpOverlapped=0x0) returned 1 [0168.162] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0168.162] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0168.162] GetProcessHeap () returned 0x4e0000 [0168.162] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0168.162] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0168.162] CryptDestroyKey (hKey=0x522f98) returned 1 [0168.162] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0168.163] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0168.163] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0168.163] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0168.163] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0168.163] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0168.163] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0168.163] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0168.163] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.163] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2cdd, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2cdd, lpOverlapped=0x0) returned 1 [0168.165] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2ce0, dwBufLen=0x2ce0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2ce0) returned 1 [0168.165] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.165] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2ce0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2ce0, lpOverlapped=0x0) returned 1 [0168.165] CryptDestroyKey (hKey=0x522f98) returned 1 [0168.165] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.165] SetEndOfFile (hFile=0xdc) returned 1 [0168.168] GetProcessHeap () returned 0x4e0000 [0168.168] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0168.168] GetProcessHeap () returned 0x4e0000 [0168.168] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0168.169] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341344.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341344.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0168.170] CloseHandle (hObject=0xdc) returned 1 [0168.170] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4c6d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341439.JPG", cAlternateFileName="")) returned 1 [0168.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341439.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0168.171] GetProcessHeap () returned 0x4e0000 [0168.171] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0168.171] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0168.171] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0168.171] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x3, lpOverlapped=0x0) returned 1 [0168.200] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0168.200] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0168.200] GetProcessHeap () returned 0x4e0000 [0168.200] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0168.200] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0168.200] CryptDestroyKey (hKey=0x522f98) returned 1 [0168.200] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0168.201] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0168.201] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0168.201] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0168.201] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0168.201] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0168.201] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0168.201] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0168.201] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.201] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4c6d, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4c6d, lpOverlapped=0x0) returned 1 [0168.210] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4c70, dwBufLen=0x4c70 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4c70) returned 1 [0168.210] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.210] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4c70, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4c70, lpOverlapped=0x0) returned 1 [0168.210] CryptDestroyKey (hKey=0x522f98) returned 1 [0168.210] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4d44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.210] SetEndOfFile (hFile=0xdc) returned 1 [0168.213] GetProcessHeap () returned 0x4e0000 [0168.213] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0168.213] GetProcessHeap () returned 0x4e0000 [0168.213] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0168.214] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341439.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341439.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0168.216] CloseHandle (hObject=0xdc) returned 1 [0168.216] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4ad8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341447.JPG", cAlternateFileName="")) returned 1 [0168.216] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341447.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0168.217] GetProcessHeap () returned 0x4e0000 [0168.217] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0168.217] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0168.218] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0168.218] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0168.220] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0168.220] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0168.220] GetProcessHeap () returned 0x4e0000 [0168.220] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0168.220] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0168.220] CryptDestroyKey (hKey=0x522f98) returned 1 [0168.220] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0168.221] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0168.221] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0168.221] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0168.221] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0168.221] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0168.221] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0168.221] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0168.221] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.221] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4ad8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4ad8, lpOverlapped=0x0) returned 1 [0168.225] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4ae0, dwBufLen=0x4ae0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4ae0) returned 1 [0168.225] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.225] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4ae0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4ae0, lpOverlapped=0x0) returned 1 [0168.225] CryptDestroyKey (hKey=0x522f98) returned 1 [0168.225] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4bb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.225] SetEndOfFile (hFile=0xdc) returned 1 [0168.228] GetProcessHeap () returned 0x4e0000 [0168.228] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0168.228] GetProcessHeap () returned 0x4e0000 [0168.228] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0168.228] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341447.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341447.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0168.229] CloseHandle (hObject=0xdc) returned 1 [0168.229] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x52c3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341448.JPG", cAlternateFileName="")) returned 1 [0168.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341448.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0168.230] GetProcessHeap () returned 0x4e0000 [0168.230] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0168.230] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0168.230] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0168.230] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xd, lpOverlapped=0x0) returned 1 [0168.250] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0168.250] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0168.250] GetProcessHeap () returned 0x4e0000 [0168.250] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0168.250] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0168.250] CryptDestroyKey (hKey=0x522f98) returned 1 [0168.250] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0168.250] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0168.250] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0168.250] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0168.250] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0168.250] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0168.250] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0168.250] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0168.250] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.250] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x52c3, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x52c3, lpOverlapped=0x0) returned 1 [0168.253] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x52d0, dwBufLen=0x52d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x52d0) returned 1 [0168.253] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.253] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x52d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x52d0, lpOverlapped=0x0) returned 1 [0168.254] CryptDestroyKey (hKey=0x522f98) returned 1 [0168.254] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x53a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.254] SetEndOfFile (hFile=0xdc) returned 1 [0168.256] GetProcessHeap () returned 0x4e0000 [0168.256] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0168.256] GetProcessHeap () returned 0x4e0000 [0168.256] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0168.256] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341448.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341448.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0168.257] CloseHandle (hObject=0xdc) returned 1 [0168.258] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7457, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341455.JPG", cAlternateFileName="")) returned 1 [0168.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341455.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0168.259] GetProcessHeap () returned 0x4e0000 [0168.259] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0168.259] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0168.259] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0168.259] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x9, lpOverlapped=0x0) returned 1 [0168.261] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0168.261] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0168.262] GetProcessHeap () returned 0x4e0000 [0168.262] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0168.262] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0168.262] CryptDestroyKey (hKey=0x522f98) returned 1 [0168.262] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0168.262] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0168.262] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0168.262] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0168.262] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0168.262] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0168.262] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0168.262] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0168.262] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.262] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7457, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7457, lpOverlapped=0x0) returned 1 [0168.273] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7460, dwBufLen=0x7460 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7460) returned 1 [0168.273] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.274] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7460, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7460, lpOverlapped=0x0) returned 1 [0168.274] CryptDestroyKey (hKey=0x522f98) returned 1 [0168.274] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7534, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.274] SetEndOfFile (hFile=0xdc) returned 1 [0168.277] GetProcessHeap () returned 0x4e0000 [0168.277] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0168.277] GetProcessHeap () returned 0x4e0000 [0168.277] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0168.277] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341455.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341455.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0168.279] CloseHandle (hObject=0xdc) returned 1 [0168.279] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa9e2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341475.JPG", cAlternateFileName="")) returned 1 [0168.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341475.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0168.280] GetProcessHeap () returned 0x4e0000 [0168.280] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0168.280] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0168.280] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0168.280] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0168.283] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0168.283] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0168.283] GetProcessHeap () returned 0x4e0000 [0168.283] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0168.283] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0168.283] CryptDestroyKey (hKey=0x522f98) returned 1 [0168.283] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0168.283] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0168.283] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0168.284] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0168.284] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0168.284] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0168.284] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0168.284] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0168.284] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.284] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xa9e2, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xa9e2, lpOverlapped=0x0) returned 1 [0168.288] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa9f0, dwBufLen=0xa9f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa9f0) returned 1 [0168.288] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.288] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xa9f0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xa9f0, lpOverlapped=0x0) returned 1 [0168.289] CryptDestroyKey (hKey=0x522f98) returned 1 [0168.289] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xaac4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.289] SetEndOfFile (hFile=0xdc) returned 1 [0168.292] GetProcessHeap () returned 0x4e0000 [0168.292] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0168.292] GetProcessHeap () returned 0x4e0000 [0168.292] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0168.292] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341475.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341475.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0168.294] CloseHandle (hObject=0xdc) returned 1 [0168.294] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3ee3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341499.JPG", cAlternateFileName="")) returned 1 [0168.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341499.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0168.295] GetProcessHeap () returned 0x4e0000 [0168.295] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0168.295] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0168.296] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0168.296] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xd, lpOverlapped=0x0) returned 1 [0168.298] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0168.298] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0168.298] GetProcessHeap () returned 0x4e0000 [0168.298] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0168.298] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0168.299] CryptDestroyKey (hKey=0x522f98) returned 1 [0168.299] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0168.299] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0168.299] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0168.299] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0168.299] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0168.299] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0168.299] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0168.299] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0168.299] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.299] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3ee3, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3ee3, lpOverlapped=0x0) returned 1 [0168.306] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3ef0, dwBufLen=0x3ef0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3ef0) returned 1 [0168.306] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.306] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3ef0, lpOverlapped=0x0) returned 1 [0168.306] CryptDestroyKey (hKey=0x522f98) returned 1 [0168.306] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3fc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.306] SetEndOfFile (hFile=0xdc) returned 1 [0168.308] GetProcessHeap () returned 0x4e0000 [0168.308] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0168.308] GetProcessHeap () returned 0x4e0000 [0168.308] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0168.308] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341499.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341499.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0168.310] CloseHandle (hObject=0xdc) returned 1 [0168.310] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f8a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341534.JPG", cAlternateFileName="")) returned 1 [0168.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341534.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0168.311] GetProcessHeap () returned 0x4e0000 [0168.311] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0168.311] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0168.311] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0168.311] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0168.323] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0168.323] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0168.323] GetProcessHeap () returned 0x4e0000 [0168.323] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0168.323] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0168.323] CryptDestroyKey (hKey=0x522f98) returned 1 [0168.323] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0168.323] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0168.323] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0168.323] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0168.324] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0168.324] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0168.324] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0168.324] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0168.324] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.324] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1f8a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1f8a, lpOverlapped=0x0) returned 1 [0168.328] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1f90, dwBufLen=0x1f90 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1f90) returned 1 [0168.329] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.329] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1f90, lpOverlapped=0x0) returned 1 [0168.329] CryptDestroyKey (hKey=0x522f98) returned 1 [0168.329] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2064, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.329] SetEndOfFile (hFile=0xdc) returned 1 [0168.332] GetProcessHeap () returned 0x4e0000 [0168.332] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0168.332] GetProcessHeap () returned 0x4e0000 [0168.332] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0168.332] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341534.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341534.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0168.334] CloseHandle (hObject=0xdc) returned 1 [0168.334] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5a56, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341551.JPG", cAlternateFileName="")) returned 1 [0168.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341551.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0168.335] GetProcessHeap () returned 0x4e0000 [0168.335] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0168.335] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0168.335] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0168.335] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0168.337] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0168.337] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0168.337] GetProcessHeap () returned 0x4e0000 [0168.338] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0168.338] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0168.338] CryptDestroyKey (hKey=0x522f98) returned 1 [0168.338] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0168.338] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0168.338] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0168.338] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0168.338] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0168.338] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0168.338] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0168.338] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0168.338] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.338] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5a56, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x5a56, lpOverlapped=0x0) returned 1 [0168.340] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5a60, dwBufLen=0x5a60 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5a60) returned 1 [0168.340] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.340] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5a60, lpOverlapped=0x0) returned 1 [0168.340] CryptDestroyKey (hKey=0x522f98) returned 1 [0168.340] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5b34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.340] SetEndOfFile (hFile=0xdc) returned 1 [0168.342] GetProcessHeap () returned 0x4e0000 [0168.342] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0168.343] GetProcessHeap () returned 0x4e0000 [0168.343] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0168.343] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341551.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341551.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0168.344] CloseHandle (hObject=0xdc) returned 1 [0168.344] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6f43, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341554.JPG", cAlternateFileName="")) returned 1 [0168.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341554.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0168.346] GetProcessHeap () returned 0x4e0000 [0168.346] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0168.346] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0168.346] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0168.346] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xd, lpOverlapped=0x0) returned 1 [0168.349] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0168.349] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0168.349] GetProcessHeap () returned 0x4e0000 [0168.349] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0168.349] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0168.349] CryptDestroyKey (hKey=0x522f98) returned 1 [0168.349] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0168.349] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0168.349] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0168.349] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0168.350] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0168.350] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0168.350] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0168.350] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0168.350] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.350] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x6f43, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x6f43, lpOverlapped=0x0) returned 1 [0168.365] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6f50, dwBufLen=0x6f50 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6f50) returned 1 [0168.365] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.365] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6f50, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x6f50, lpOverlapped=0x0) returned 1 [0168.365] CryptDestroyKey (hKey=0x522f98) returned 1 [0168.365] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7024, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.365] SetEndOfFile (hFile=0xdc) returned 1 [0168.368] GetProcessHeap () returned 0x4e0000 [0168.368] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0168.368] GetProcessHeap () returned 0x4e0000 [0168.368] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0168.368] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341554.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341554.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0168.369] CloseHandle (hObject=0xdc) returned 1 [0168.369] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6aa8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341557.JPG", cAlternateFileName="")) returned 1 [0168.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341557.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0168.370] GetProcessHeap () returned 0x4e0000 [0168.370] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0168.371] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0168.371] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0168.371] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0168.373] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0168.373] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0168.373] GetProcessHeap () returned 0x4e0000 [0168.373] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0168.373] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0168.373] CryptDestroyKey (hKey=0x522f98) returned 1 [0168.373] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0168.373] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0168.373] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0168.373] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0168.374] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0168.374] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0168.374] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0168.374] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0168.374] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.374] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x6aa8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x6aa8, lpOverlapped=0x0) returned 1 [0168.377] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6ab0, dwBufLen=0x6ab0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6ab0) returned 1 [0168.377] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.377] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6ab0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x6ab0, lpOverlapped=0x0) returned 1 [0168.377] CryptDestroyKey (hKey=0x522f98) returned 1 [0168.377] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6b84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.377] SetEndOfFile (hFile=0xdc) returned 1 [0168.380] GetProcessHeap () returned 0x4e0000 [0168.380] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0168.380] GetProcessHeap () returned 0x4e0000 [0168.380] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0168.380] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341557.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341557.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0168.382] CloseHandle (hObject=0xdc) returned 1 [0168.382] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6873, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341559.JPG", cAlternateFileName="")) returned 1 [0168.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341559.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0168.383] GetProcessHeap () returned 0x4e0000 [0168.383] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0168.383] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0168.383] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0168.383] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xd, lpOverlapped=0x0) returned 1 [0168.386] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0168.386] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0168.386] GetProcessHeap () returned 0x4e0000 [0168.386] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0168.386] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0168.386] CryptDestroyKey (hKey=0x522f98) returned 1 [0168.386] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0168.386] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0168.386] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0168.386] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0168.386] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0168.386] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0168.387] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0168.387] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0168.387] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.387] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x6873, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x6873, lpOverlapped=0x0) returned 1 [0168.387] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6880, dwBufLen=0x6880 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6880) returned 1 [0168.388] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.388] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6880, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x6880, lpOverlapped=0x0) returned 1 [0168.388] CryptDestroyKey (hKey=0x522f98) returned 1 [0168.388] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6954, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.388] SetEndOfFile (hFile=0xdc) returned 1 [0168.390] GetProcessHeap () returned 0x4e0000 [0168.390] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0168.390] GetProcessHeap () returned 0x4e0000 [0168.390] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0168.390] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341559.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341559.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0168.392] CloseHandle (hObject=0xdc) returned 1 [0168.392] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa497, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341561.JPG", cAlternateFileName="")) returned 1 [0168.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341561.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0168.393] GetProcessHeap () returned 0x4e0000 [0168.393] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0168.393] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0168.393] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0168.393] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x9, lpOverlapped=0x0) returned 1 [0168.398] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0168.398] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0168.398] GetProcessHeap () returned 0x4e0000 [0168.398] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0168.398] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0168.398] CryptDestroyKey (hKey=0x522f98) returned 1 [0168.398] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0168.398] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0168.398] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0168.398] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0168.398] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0168.398] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0168.398] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0168.398] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0168.398] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.398] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xa497, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xa497, lpOverlapped=0x0) returned 1 [0168.406] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa4a0, dwBufLen=0xa4a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa4a0) returned 1 [0168.407] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.407] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xa4a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xa4a0, lpOverlapped=0x0) returned 1 [0168.407] CryptDestroyKey (hKey=0x522f98) returned 1 [0168.407] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xa574, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.407] SetEndOfFile (hFile=0xdc) returned 1 [0168.410] GetProcessHeap () returned 0x4e0000 [0168.410] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0168.410] GetProcessHeap () returned 0x4e0000 [0168.410] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0168.410] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341561.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341561.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0168.411] CloseHandle (hObject=0xdc) returned 1 [0168.411] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e7b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341634.JPG", cAlternateFileName="")) returned 1 [0168.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341634.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0168.412] GetProcessHeap () returned 0x4e0000 [0168.412] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0168.412] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0168.412] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0168.412] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x5, lpOverlapped=0x0) returned 1 [0168.415] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0168.415] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0168.415] GetProcessHeap () returned 0x4e0000 [0168.415] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0168.415] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0168.415] CryptDestroyKey (hKey=0x522f98) returned 1 [0168.415] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0168.415] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0168.415] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0168.415] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0168.415] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0168.415] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0168.415] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0168.415] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0168.415] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.415] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1e7b, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1e7b, lpOverlapped=0x0) returned 1 [0168.417] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1e80, dwBufLen=0x1e80 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1e80) returned 1 [0168.417] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.417] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1e80, lpOverlapped=0x0) returned 1 [0168.417] CryptDestroyKey (hKey=0x522f98) returned 1 [0168.417] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1f54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.417] SetEndOfFile (hFile=0xdc) returned 1 [0168.452] GetProcessHeap () returned 0x4e0000 [0168.452] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0168.452] GetProcessHeap () returned 0x4e0000 [0168.452] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0168.452] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341634.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341634.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0168.453] CloseHandle (hObject=0xdc) returned 1 [0168.453] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3615, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341636.JPG", cAlternateFileName="")) returned 1 [0168.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341636.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0168.455] GetProcessHeap () returned 0x4e0000 [0168.455] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0168.455] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0168.455] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0168.455] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xb, lpOverlapped=0x0) returned 1 [0168.580] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0168.580] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0168.580] GetProcessHeap () returned 0x4e0000 [0168.580] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0168.580] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0168.580] CryptDestroyKey (hKey=0x522f98) returned 1 [0168.580] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0168.580] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0168.580] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0168.580] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0168.581] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0168.581] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0168.581] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0168.581] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0168.581] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.581] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3615, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3615, lpOverlapped=0x0) returned 1 [0168.607] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3620, dwBufLen=0x3620 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3620) returned 1 [0168.607] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.607] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3620, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3620, lpOverlapped=0x0) returned 1 [0168.608] CryptDestroyKey (hKey=0x522f98) returned 1 [0168.608] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x36f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.608] SetEndOfFile (hFile=0xdc) returned 1 [0168.610] GetProcessHeap () returned 0x4e0000 [0168.610] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0168.610] GetProcessHeap () returned 0x4e0000 [0168.610] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0168.610] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341636.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341636.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0168.629] CloseHandle (hObject=0xdc) returned 1 [0168.629] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2026, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341645.JPG", cAlternateFileName="")) returned 1 [0168.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341645.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0168.630] GetProcessHeap () returned 0x4e0000 [0168.630] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0168.631] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0168.631] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0168.631] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0168.638] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0168.638] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0168.638] GetProcessHeap () returned 0x4e0000 [0168.638] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0168.638] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0168.638] CryptDestroyKey (hKey=0x522f98) returned 1 [0168.638] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0168.638] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0168.638] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0168.638] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0168.638] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0168.638] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0168.638] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0168.638] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0168.638] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.638] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2026, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2026, lpOverlapped=0x0) returned 1 [0168.646] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2030, dwBufLen=0x2030 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2030) returned 1 [0168.646] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.646] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2030, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2030, lpOverlapped=0x0) returned 1 [0168.646] CryptDestroyKey (hKey=0x522f98) returned 1 [0168.646] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2104, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.646] SetEndOfFile (hFile=0xdc) returned 1 [0168.648] GetProcessHeap () returned 0x4e0000 [0168.648] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0168.648] GetProcessHeap () returned 0x4e0000 [0168.648] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0168.648] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341645.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341645.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0168.650] CloseHandle (hObject=0xdc) returned 1 [0168.650] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3df7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341653.JPG", cAlternateFileName="")) returned 1 [0168.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341653.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0168.651] GetProcessHeap () returned 0x4e0000 [0168.651] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0168.651] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0168.651] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0168.651] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x9, lpOverlapped=0x0) returned 1 [0168.811] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0168.811] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0168.811] GetProcessHeap () returned 0x4e0000 [0168.811] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0168.811] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0168.811] CryptDestroyKey (hKey=0x522f98) returned 1 [0168.811] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0168.812] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0168.812] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0168.812] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0168.812] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0168.812] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0168.812] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0168.812] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0168.812] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.812] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3df7, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3df7, lpOverlapped=0x0) returned 1 [0168.909] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3e00, dwBufLen=0x3e00 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3e00) returned 1 [0168.909] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.909] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3e00, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3e00, lpOverlapped=0x0) returned 1 [0168.909] CryptDestroyKey (hKey=0x522f98) returned 1 [0168.910] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.910] SetEndOfFile (hFile=0xdc) returned 1 [0168.912] GetProcessHeap () returned 0x4e0000 [0168.912] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0168.912] GetProcessHeap () returned 0x4e0000 [0168.913] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0168.913] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341653.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341653.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0168.915] CloseHandle (hObject=0xdc) returned 1 [0168.915] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3d7f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341654.JPG", cAlternateFileName="")) returned 1 [0168.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341654.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0168.916] GetProcessHeap () returned 0x4e0000 [0168.916] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0168.916] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0168.916] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0168.916] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x1, lpOverlapped=0x0) returned 1 [0168.933] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0168.933] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0168.933] GetProcessHeap () returned 0x4e0000 [0168.933] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0168.933] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0168.933] CryptDestroyKey (hKey=0x522f98) returned 1 [0168.933] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0168.933] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0168.933] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0168.933] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0168.934] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0168.934] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0168.934] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0168.934] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0168.934] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.934] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3d7f, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3d7f, lpOverlapped=0x0) returned 1 [0168.940] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3d80, dwBufLen=0x3d80 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3d80) returned 1 [0168.940] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.940] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3d80, lpOverlapped=0x0) returned 1 [0168.940] CryptDestroyKey (hKey=0x522f98) returned 1 [0168.940] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3e54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.940] SetEndOfFile (hFile=0xdc) returned 1 [0168.943] GetProcessHeap () returned 0x4e0000 [0168.943] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0168.943] GetProcessHeap () returned 0x4e0000 [0168.943] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0168.943] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341654.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341654.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0168.945] CloseHandle (hObject=0xdc) returned 1 [0168.945] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4ec6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341738.JPG", cAlternateFileName="")) returned 1 [0168.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341738.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0168.946] GetProcessHeap () returned 0x4e0000 [0168.946] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0168.946] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0168.946] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0168.946] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0168.948] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0168.948] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0168.948] GetProcessHeap () returned 0x4e0000 [0168.948] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0168.948] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0168.948] CryptDestroyKey (hKey=0x522f98) returned 1 [0168.948] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0168.948] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0168.948] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0168.948] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0168.948] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0168.948] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0168.948] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0168.948] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0168.948] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.949] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4ec6, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4ec6, lpOverlapped=0x0) returned 1 [0168.949] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4ed0, dwBufLen=0x4ed0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4ed0) returned 1 [0168.949] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.949] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4ed0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4ed0, lpOverlapped=0x0) returned 1 [0168.949] CryptDestroyKey (hKey=0x522f98) returned 1 [0168.950] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4fa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.950] SetEndOfFile (hFile=0xdc) returned 1 [0168.953] GetProcessHeap () returned 0x4e0000 [0168.953] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0168.953] GetProcessHeap () returned 0x4e0000 [0168.953] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0168.953] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341738.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341738.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0168.955] CloseHandle (hObject=0xdc) returned 1 [0168.955] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x49ba, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341742.JPG", cAlternateFileName="")) returned 1 [0168.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341742.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0168.956] GetProcessHeap () returned 0x4e0000 [0168.956] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0168.956] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0168.956] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0168.956] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0168.981] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0168.981] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0168.981] GetProcessHeap () returned 0x4e0000 [0168.981] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0168.981] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0168.981] CryptDestroyKey (hKey=0x522f98) returned 1 [0168.981] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0168.981] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0168.981] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0168.981] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0168.981] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0168.981] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0168.982] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0168.982] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0168.982] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.982] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x49ba, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x49ba, lpOverlapped=0x0) returned 1 [0168.987] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x49c0, dwBufLen=0x49c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x49c0) returned 1 [0168.987] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.987] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x49c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x49c0, lpOverlapped=0x0) returned 1 [0168.987] CryptDestroyKey (hKey=0x522f98) returned 1 [0168.987] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4a94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.987] SetEndOfFile (hFile=0xdc) returned 1 [0168.990] GetProcessHeap () returned 0x4e0000 [0168.990] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0168.990] GetProcessHeap () returned 0x4e0000 [0168.990] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0168.990] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341742.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341742.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0168.993] CloseHandle (hObject=0xdc) returned 1 [0168.993] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x10bdc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382836.JPG", cAlternateFileName="")) returned 1 [0168.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382836.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0168.994] GetProcessHeap () returned 0x4e0000 [0168.994] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0168.994] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0168.994] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0168.994] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0168.999] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0168.999] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0168.999] GetProcessHeap () returned 0x4e0000 [0169.000] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0169.000] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0169.000] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.000] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0169.000] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0169.000] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0169.000] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0169.000] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0169.000] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0169.000] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.000] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.000] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.000] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x10bdc, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x10bdc, lpOverlapped=0x0) returned 1 [0169.011] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x10be0, dwBufLen=0x10be0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x10be0) returned 1 [0169.012] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.012] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x10be0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x10be0, lpOverlapped=0x0) returned 1 [0169.012] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.012] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x10cb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.012] SetEndOfFile (hFile=0xdc) returned 1 [0169.015] GetProcessHeap () returned 0x4e0000 [0169.015] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0169.015] GetProcessHeap () returned 0x4e0000 [0169.015] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0169.015] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382836.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382836.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0169.016] CloseHandle (hObject=0xdc) returned 1 [0169.016] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ce5a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382925.JPG", cAlternateFileName="")) returned 1 [0169.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382925.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0169.017] GetProcessHeap () returned 0x4e0000 [0169.017] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0169.017] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0169.017] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0169.017] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0169.146] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.146] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.146] GetProcessHeap () returned 0x4e0000 [0169.146] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0169.146] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0169.146] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.146] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0169.146] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0169.146] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0169.146] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0169.146] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0169.146] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0169.146] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.147] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.147] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.147] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1ce5a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1ce5a, lpOverlapped=0x0) returned 1 [0169.156] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1ce60, dwBufLen=0x1ce60 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1ce60) returned 1 [0169.157] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.157] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1ce60, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1ce60, lpOverlapped=0x0) returned 1 [0169.158] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.158] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1cf34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.158] SetEndOfFile (hFile=0xdc) returned 1 [0169.162] GetProcessHeap () returned 0x4e0000 [0169.162] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0169.162] GetProcessHeap () returned 0x4e0000 [0169.162] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0169.162] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382925.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382925.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0169.164] CloseHandle (hObject=0xdc) returned 1 [0169.164] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1672c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382926.JPG", cAlternateFileName="")) returned 1 [0169.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382926.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0169.165] GetProcessHeap () returned 0x4e0000 [0169.165] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0169.165] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0169.165] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0169.165] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0169.168] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.168] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.168] GetProcessHeap () returned 0x4e0000 [0169.168] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0169.168] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0169.168] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.168] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0169.168] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0169.169] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0169.169] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0169.169] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0169.169] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0169.169] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.169] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.169] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.169] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1672c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1672c, lpOverlapped=0x0) returned 1 [0169.172] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x16730, dwBufLen=0x16730 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x16730) returned 1 [0169.173] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.173] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x16730, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x16730, lpOverlapped=0x0) returned 1 [0169.173] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.173] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x16804, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.173] SetEndOfFile (hFile=0xdc) returned 1 [0169.177] GetProcessHeap () returned 0x4e0000 [0169.177] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0169.177] GetProcessHeap () returned 0x4e0000 [0169.177] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0169.177] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382926.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382926.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0169.179] CloseHandle (hObject=0xdc) returned 1 [0169.179] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f86c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382927.JPG", cAlternateFileName="")) returned 1 [0169.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382927.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0169.180] GetProcessHeap () returned 0x4e0000 [0169.180] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0169.180] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0169.180] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0169.181] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0169.184] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.184] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.184] GetProcessHeap () returned 0x4e0000 [0169.184] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0169.184] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0169.184] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.184] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0169.184] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0169.184] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0169.184] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0169.184] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0169.185] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0169.185] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.185] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.185] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.185] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1f86c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1f86c, lpOverlapped=0x0) returned 1 [0169.186] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1f870, dwBufLen=0x1f870 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1f870) returned 1 [0169.188] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.188] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1f870, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1f870, lpOverlapped=0x0) returned 1 [0169.188] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.188] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1f944, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.189] SetEndOfFile (hFile=0xdc) returned 1 [0169.192] GetProcessHeap () returned 0x4e0000 [0169.192] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0169.192] GetProcessHeap () returned 0x4e0000 [0169.192] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0169.192] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382927.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382927.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0169.194] CloseHandle (hObject=0xdc) returned 1 [0169.194] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b83a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382930.JPG", cAlternateFileName="")) returned 1 [0169.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382930.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0169.196] GetProcessHeap () returned 0x4e0000 [0169.196] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0169.196] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0169.196] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0169.196] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0169.198] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.198] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.198] GetProcessHeap () returned 0x4e0000 [0169.198] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0169.198] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0169.198] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.198] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0169.199] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0169.199] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0169.199] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0169.199] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0169.199] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0169.199] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.199] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.199] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.199] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1b83a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1b83a, lpOverlapped=0x0) returned 1 [0169.201] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1b840, dwBufLen=0x1b840 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1b840) returned 1 [0169.202] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.202] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1b840, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1b840, lpOverlapped=0x0) returned 1 [0169.203] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.203] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1b914, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.203] SetEndOfFile (hFile=0xdc) returned 1 [0169.206] GetProcessHeap () returned 0x4e0000 [0169.206] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0169.206] GetProcessHeap () returned 0x4e0000 [0169.206] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0169.206] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382930.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382930.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0169.208] CloseHandle (hObject=0xdc) returned 1 [0169.208] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1df43, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382931.JPG", cAlternateFileName="")) returned 1 [0169.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382931.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0169.210] GetProcessHeap () returned 0x4e0000 [0169.210] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0169.210] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0169.210] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0169.210] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xd, lpOverlapped=0x0) returned 1 [0169.212] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.212] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.212] GetProcessHeap () returned 0x4e0000 [0169.212] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0169.213] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0169.213] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.213] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0169.213] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0169.213] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0169.213] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0169.213] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0169.214] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0169.214] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.214] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.214] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.214] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1df43, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1df43, lpOverlapped=0x0) returned 1 [0169.215] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1df50, dwBufLen=0x1df50 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1df50) returned 1 [0169.217] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.217] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1df50, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1df50, lpOverlapped=0x0) returned 1 [0169.217] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.217] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1e024, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.218] SetEndOfFile (hFile=0xdc) returned 1 [0169.221] GetProcessHeap () returned 0x4e0000 [0169.221] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0169.221] GetProcessHeap () returned 0x4e0000 [0169.221] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0169.221] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382931.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382931.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0169.223] CloseHandle (hObject=0xdc) returned 1 [0169.224] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x184d3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382938.JPG", cAlternateFileName="")) returned 1 [0169.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382938.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0169.226] GetProcessHeap () returned 0x4e0000 [0169.226] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0169.226] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0169.226] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0169.226] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xd, lpOverlapped=0x0) returned 1 [0169.233] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.233] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.233] GetProcessHeap () returned 0x4e0000 [0169.233] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0169.233] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0169.233] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.233] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0169.233] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0169.233] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0169.233] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0169.233] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0169.233] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0169.234] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.234] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.234] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.234] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x184d3, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x184d3, lpOverlapped=0x0) returned 1 [0169.235] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x184e0, dwBufLen=0x184e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x184e0) returned 1 [0169.237] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.237] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x184e0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x184e0, lpOverlapped=0x0) returned 1 [0169.237] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.237] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x185b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.237] SetEndOfFile (hFile=0xdc) returned 1 [0169.241] GetProcessHeap () returned 0x4e0000 [0169.241] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0169.241] GetProcessHeap () returned 0x4e0000 [0169.241] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0169.241] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382938.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382938.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0169.243] CloseHandle (hObject=0xdc) returned 1 [0169.243] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1aba5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382939.JPG", cAlternateFileName="")) returned 1 [0169.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382939.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0169.244] GetProcessHeap () returned 0x4e0000 [0169.244] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0169.247] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0169.247] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0169.247] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xb, lpOverlapped=0x0) returned 1 [0169.259] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.260] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.260] GetProcessHeap () returned 0x4e0000 [0169.260] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0169.260] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0169.260] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.260] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0169.260] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0169.260] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0169.260] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0169.260] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0169.261] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0169.261] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.261] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.261] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.261] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1aba5, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1aba5, lpOverlapped=0x0) returned 1 [0169.262] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1abb0, dwBufLen=0x1abb0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1abb0) returned 1 [0169.264] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.264] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1abb0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1abb0, lpOverlapped=0x0) returned 1 [0169.264] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.264] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1ac84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.265] SetEndOfFile (hFile=0xdc) returned 1 [0169.268] GetProcessHeap () returned 0x4e0000 [0169.268] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0169.268] GetProcessHeap () returned 0x4e0000 [0169.268] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0169.268] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382939.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382939.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0169.270] CloseHandle (hObject=0xdc) returned 1 [0169.270] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1653a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382942.JPG", cAlternateFileName="")) returned 1 [0169.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382942.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0169.272] GetProcessHeap () returned 0x4e0000 [0169.272] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0169.273] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0169.273] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0169.273] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0169.275] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.275] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.275] GetProcessHeap () returned 0x4e0000 [0169.275] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0169.275] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0169.275] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.275] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0169.275] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0169.275] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0169.278] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0169.278] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0169.278] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0169.278] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.278] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.278] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.278] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1653a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1653a, lpOverlapped=0x0) returned 1 [0169.316] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x16540, dwBufLen=0x16540 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x16540) returned 1 [0169.317] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.317] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x16540, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x16540, lpOverlapped=0x0) returned 1 [0169.318] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.318] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x16614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.318] SetEndOfFile (hFile=0xdc) returned 1 [0169.321] GetProcessHeap () returned 0x4e0000 [0169.321] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0169.321] GetProcessHeap () returned 0x4e0000 [0169.321] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0169.321] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382942.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382942.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0169.323] CloseHandle (hObject=0xdc) returned 1 [0169.323] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x13e1d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382944.JPG", cAlternateFileName="")) returned 1 [0169.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382944.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0169.324] GetProcessHeap () returned 0x4e0000 [0169.324] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0169.324] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0169.324] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0169.324] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x3, lpOverlapped=0x0) returned 1 [0169.328] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.328] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.328] GetProcessHeap () returned 0x4e0000 [0169.328] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0169.328] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0169.328] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.328] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0169.328] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0169.328] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0169.328] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0169.328] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0169.328] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0169.329] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.329] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.329] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.329] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x13e1d, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x13e1d, lpOverlapped=0x0) returned 1 [0169.330] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x13e20, dwBufLen=0x13e20 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x13e20) returned 1 [0169.331] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.331] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x13e20, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x13e20, lpOverlapped=0x0) returned 1 [0169.331] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.331] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x13ef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.332] SetEndOfFile (hFile=0xdc) returned 1 [0169.335] GetProcessHeap () returned 0x4e0000 [0169.335] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0169.335] GetProcessHeap () returned 0x4e0000 [0169.335] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0169.335] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382944.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382944.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0169.337] CloseHandle (hObject=0xdc) returned 1 [0169.337] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1531c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382947.JPG", cAlternateFileName="")) returned 1 [0169.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382947.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0169.338] GetProcessHeap () returned 0x4e0000 [0169.338] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0169.338] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0169.338] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0169.338] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0169.347] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.347] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.347] GetProcessHeap () returned 0x4e0000 [0169.347] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0169.347] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0169.347] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.347] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0169.348] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0169.348] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0169.348] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0169.348] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0169.348] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0169.348] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.348] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.348] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.348] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1531c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1531c, lpOverlapped=0x0) returned 1 [0169.366] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x15320, dwBufLen=0x15320 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x15320) returned 1 [0169.367] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.367] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x15320, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x15320, lpOverlapped=0x0) returned 1 [0169.368] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.368] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x153f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.368] SetEndOfFile (hFile=0xdc) returned 1 [0169.371] GetProcessHeap () returned 0x4e0000 [0169.371] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0169.371] GetProcessHeap () returned 0x4e0000 [0169.371] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0169.371] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382947.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382947.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0169.373] CloseHandle (hObject=0xdc) returned 1 [0169.373] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ad37, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382948.JPG", cAlternateFileName="")) returned 1 [0169.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382948.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0169.374] GetProcessHeap () returned 0x4e0000 [0169.375] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0169.375] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0169.375] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0169.375] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x9, lpOverlapped=0x0) returned 1 [0169.378] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.378] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.378] GetProcessHeap () returned 0x4e0000 [0169.378] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0169.378] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0169.378] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.378] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0169.378] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0169.378] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0169.378] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0169.378] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0169.378] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0169.378] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.378] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.378] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.379] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1ad37, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1ad37, lpOverlapped=0x0) returned 1 [0169.389] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1ad40, dwBufLen=0x1ad40 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1ad40) returned 1 [0169.390] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.390] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1ad40, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1ad40, lpOverlapped=0x0) returned 1 [0169.390] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.391] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1ae14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.391] SetEndOfFile (hFile=0xdc) returned 1 [0169.394] GetProcessHeap () returned 0x4e0000 [0169.394] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0169.394] GetProcessHeap () returned 0x4e0000 [0169.394] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0169.394] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382948.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382948.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0169.396] CloseHandle (hObject=0xdc) returned 1 [0169.396] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x178d2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382950.JPG", cAlternateFileName="")) returned 1 [0169.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382950.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0169.398] GetProcessHeap () returned 0x4e0000 [0169.398] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0169.398] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0169.398] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0169.398] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0169.400] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.400] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.400] GetProcessHeap () returned 0x4e0000 [0169.400] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0169.400] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0169.401] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.401] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0169.401] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0169.401] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0169.401] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0169.401] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0169.401] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0169.401] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.401] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.401] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.401] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x178d2, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x178d2, lpOverlapped=0x0) returned 1 [0169.402] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x178e0, dwBufLen=0x178e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x178e0) returned 1 [0169.403] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.404] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x178e0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x178e0, lpOverlapped=0x0) returned 1 [0169.404] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.404] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x179b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.404] SetEndOfFile (hFile=0xdc) returned 1 [0169.407] GetProcessHeap () returned 0x4e0000 [0169.407] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0169.407] GetProcessHeap () returned 0x4e0000 [0169.407] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0169.407] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382950.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382950.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0169.409] CloseHandle (hObject=0xdc) returned 1 [0169.409] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661d4d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x17749, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382952.JPG", cAlternateFileName="")) returned 1 [0169.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382952.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0169.410] GetProcessHeap () returned 0x4e0000 [0169.410] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0169.410] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0169.411] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0169.411] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x7, lpOverlapped=0x0) returned 1 [0169.412] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.413] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.413] GetProcessHeap () returned 0x4e0000 [0169.413] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0169.413] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0169.413] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.413] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0169.413] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0169.413] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0169.413] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0169.413] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0169.413] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0169.413] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.413] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.413] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.413] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x17749, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x17749, lpOverlapped=0x0) returned 1 [0169.415] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x17750, dwBufLen=0x17750 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x17750) returned 1 [0169.416] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.416] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x17750, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x17750, lpOverlapped=0x0) returned 1 [0169.435] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.435] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x17824, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.435] SetEndOfFile (hFile=0xdc) returned 1 [0169.438] GetProcessHeap () returned 0x4e0000 [0169.438] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0169.438] GetProcessHeap () returned 0x4e0000 [0169.439] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0169.439] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382952.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382952.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0169.440] CloseHandle (hObject=0xdc) returned 1 [0169.441] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x15a7f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382954.JPG", cAlternateFileName="")) returned 1 [0169.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382954.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0169.442] GetProcessHeap () returned 0x4e0000 [0169.442] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0169.442] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0169.442] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0169.442] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x1, lpOverlapped=0x0) returned 1 [0169.452] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.452] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.452] GetProcessHeap () returned 0x4e0000 [0169.452] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0169.453] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0169.453] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.453] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0169.453] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0169.453] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0169.453] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0169.453] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0169.453] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0169.453] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.453] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.453] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.453] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x15a7f, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x15a7f, lpOverlapped=0x0) returned 1 [0169.455] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x15a80, dwBufLen=0x15a80 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x15a80) returned 1 [0169.456] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.456] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x15a80, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x15a80, lpOverlapped=0x0) returned 1 [0169.456] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.456] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x15b54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.456] SetEndOfFile (hFile=0xdc) returned 1 [0169.459] GetProcessHeap () returned 0x4e0000 [0169.460] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0169.460] GetProcessHeap () returned 0x4e0000 [0169.460] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0169.460] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382954.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382954.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0169.461] CloseHandle (hObject=0xdc) returned 1 [0169.461] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x15fef, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382955.JPG", cAlternateFileName="")) returned 1 [0169.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382955.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0169.463] GetProcessHeap () returned 0x4e0000 [0169.463] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0169.463] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0169.463] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0169.463] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x1, lpOverlapped=0x0) returned 1 [0169.465] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.465] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.465] GetProcessHeap () returned 0x4e0000 [0169.465] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0169.465] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0169.465] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.465] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0169.465] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0169.466] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0169.466] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0169.466] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0169.466] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0169.466] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.466] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.466] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.466] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x15fef, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x15fef, lpOverlapped=0x0) returned 1 [0169.467] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x15ff0, dwBufLen=0x15ff0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x15ff0) returned 1 [0169.468] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.468] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x15ff0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x15ff0, lpOverlapped=0x0) returned 1 [0169.469] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.469] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x160c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.469] SetEndOfFile (hFile=0xdc) returned 1 [0169.472] GetProcessHeap () returned 0x4e0000 [0169.472] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0169.472] GetProcessHeap () returned 0x4e0000 [0169.472] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0169.472] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382955.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382955.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0169.474] CloseHandle (hObject=0xdc) returned 1 [0169.474] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661d4d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1a9ed, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382957.JPG", cAlternateFileName="")) returned 1 [0169.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382957.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0169.475] GetProcessHeap () returned 0x4e0000 [0169.475] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0169.475] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0169.475] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0169.475] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x3, lpOverlapped=0x0) returned 1 [0169.477] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.477] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.477] GetProcessHeap () returned 0x4e0000 [0169.477] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0169.477] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0169.477] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.477] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0169.477] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0169.477] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0169.477] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0169.478] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0169.478] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0169.478] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.478] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.478] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.478] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1a9ed, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1a9ed, lpOverlapped=0x0) returned 1 [0169.481] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1a9f0, dwBufLen=0x1a9f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1a9f0) returned 1 [0169.482] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.482] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1a9f0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1a9f0, lpOverlapped=0x0) returned 1 [0169.483] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.483] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1aac4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.483] SetEndOfFile (hFile=0xdc) returned 1 [0169.486] GetProcessHeap () returned 0x4e0000 [0169.486] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0169.486] GetProcessHeap () returned 0x4e0000 [0169.486] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0169.486] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382957.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382957.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0169.488] CloseHandle (hObject=0xdc) returned 1 [0169.488] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661d4d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x193e7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382958.JPG", cAlternateFileName="")) returned 1 [0169.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382958.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0169.489] GetProcessHeap () returned 0x4e0000 [0169.489] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0169.489] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0169.489] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0169.489] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x9, lpOverlapped=0x0) returned 1 [0169.491] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.491] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.491] GetProcessHeap () returned 0x4e0000 [0169.491] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0169.491] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0169.491] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.491] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0169.491] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0169.492] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0169.492] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0169.492] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0169.492] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0169.492] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.492] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.492] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.492] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x193e7, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x193e7, lpOverlapped=0x0) returned 1 [0169.494] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x193f0, dwBufLen=0x193f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x193f0) returned 1 [0169.495] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.495] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x193f0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x193f0, lpOverlapped=0x0) returned 1 [0169.495] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.495] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x194c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.495] SetEndOfFile (hFile=0xdc) returned 1 [0169.499] GetProcessHeap () returned 0x4e0000 [0169.499] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0169.499] GetProcessHeap () returned 0x4e0000 [0169.499] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0169.499] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382958.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382958.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0169.500] CloseHandle (hObject=0xdc) returned 1 [0169.500] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661d4d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x14f8a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382959.JPG", cAlternateFileName="")) returned 1 [0169.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382959.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0169.502] GetProcessHeap () returned 0x4e0000 [0169.502] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0169.502] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0169.502] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0169.502] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0169.504] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.504] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.504] GetProcessHeap () returned 0x4e0000 [0169.504] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0169.504] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0169.504] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.504] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0169.505] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0169.505] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0169.505] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0169.505] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0169.505] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0169.505] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.505] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.505] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.505] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x14f8a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x14f8a, lpOverlapped=0x0) returned 1 [0169.506] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x14f90, dwBufLen=0x14f90 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x14f90) returned 1 [0169.507] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.507] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x14f90, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x14f90, lpOverlapped=0x0) returned 1 [0169.508] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.508] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x15064, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.508] SetEndOfFile (hFile=0xdc) returned 1 [0169.511] GetProcessHeap () returned 0x4e0000 [0169.511] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0169.511] GetProcessHeap () returned 0x4e0000 [0169.511] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0169.511] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382959.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382959.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0169.513] CloseHandle (hObject=0xdc) returned 1 [0169.513] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1a3f4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382960.JPG", cAlternateFileName="")) returned 1 [0169.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382960.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0169.515] GetProcessHeap () returned 0x4e0000 [0169.515] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0169.515] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0169.515] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0169.515] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0169.517] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.517] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.517] GetProcessHeap () returned 0x4e0000 [0169.517] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0169.517] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0169.517] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.517] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0169.517] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0169.517] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0169.517] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0169.518] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0169.518] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0169.518] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.518] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.518] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.518] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1a3f4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1a3f4, lpOverlapped=0x0) returned 1 [0169.519] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1a400, dwBufLen=0x1a400 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1a400) returned 1 [0169.521] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.521] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1a400, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1a400, lpOverlapped=0x0) returned 1 [0169.521] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.521] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1a4d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.521] SetEndOfFile (hFile=0xdc) returned 1 [0169.524] GetProcessHeap () returned 0x4e0000 [0169.525] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0169.525] GetProcessHeap () returned 0x4e0000 [0169.525] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0169.525] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382960.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382960.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0169.527] CloseHandle (hObject=0xdc) returned 1 [0169.527] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x18ac4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382961.JPG", cAlternateFileName="")) returned 1 [0169.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382961.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0169.528] GetProcessHeap () returned 0x4e0000 [0169.529] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0169.529] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0169.529] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0169.529] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0169.530] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.531] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.531] GetProcessHeap () returned 0x4e0000 [0169.531] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0169.531] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0169.531] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.531] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0169.531] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0169.531] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0169.531] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0169.531] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0169.531] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0169.531] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.531] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.531] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.531] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x18ac4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x18ac4, lpOverlapped=0x0) returned 1 [0169.534] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x18ad0, dwBufLen=0x18ad0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x18ad0) returned 1 [0169.536] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.536] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x18ad0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x18ad0, lpOverlapped=0x0) returned 1 [0169.536] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.536] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x18ba4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.536] SetEndOfFile (hFile=0xdc) returned 1 [0169.539] GetProcessHeap () returned 0x4e0000 [0169.540] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0169.540] GetProcessHeap () returned 0x4e0000 [0169.540] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0169.540] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382961.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382961.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0169.542] CloseHandle (hObject=0xdc) returned 1 [0169.542] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1bef7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382962.JPG", cAlternateFileName="")) returned 1 [0169.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382962.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0169.543] GetProcessHeap () returned 0x4e0000 [0169.543] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0169.543] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0169.543] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0169.543] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x9, lpOverlapped=0x0) returned 1 [0169.545] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.545] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.545] GetProcessHeap () returned 0x4e0000 [0169.545] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0169.545] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0169.545] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.545] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0169.545] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0169.545] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0169.545] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0169.545] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0169.545] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0169.546] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.546] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.546] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.546] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1bef7, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1bef7, lpOverlapped=0x0) returned 1 [0169.548] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1bf00, dwBufLen=0x1bf00 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1bf00) returned 1 [0169.549] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.549] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1bf00, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1bf00, lpOverlapped=0x0) returned 1 [0169.549] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.549] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1bfd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.550] SetEndOfFile (hFile=0xdc) returned 1 [0169.553] GetProcessHeap () returned 0x4e0000 [0169.553] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0169.553] GetProcessHeap () returned 0x4e0000 [0169.553] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0169.553] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382962.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382962.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0169.555] CloseHandle (hObject=0xdc) returned 1 [0169.555] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x17dee, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382963.JPG", cAlternateFileName="")) returned 1 [0169.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382963.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0169.556] GetProcessHeap () returned 0x4e0000 [0169.556] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0169.556] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0169.556] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0169.556] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0169.564] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.564] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.564] GetProcessHeap () returned 0x4e0000 [0169.564] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0169.564] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0169.564] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.564] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0169.564] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0169.564] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0169.564] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0169.564] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0169.564] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0169.564] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.564] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.565] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.565] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x17dee, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x17dee, lpOverlapped=0x0) returned 1 [0169.566] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x17df0, dwBufLen=0x17df0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x17df0) returned 1 [0169.567] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.567] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x17df0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x17df0, lpOverlapped=0x0) returned 1 [0169.568] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.568] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x17ec4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.568] SetEndOfFile (hFile=0xdc) returned 1 [0169.571] GetProcessHeap () returned 0x4e0000 [0169.571] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0169.571] GetProcessHeap () returned 0x4e0000 [0169.571] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0169.571] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382963.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382963.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0169.575] CloseHandle (hObject=0xdc) returned 1 [0169.575] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1bb02, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382965.JPG", cAlternateFileName="")) returned 1 [0169.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382965.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0169.576] GetProcessHeap () returned 0x4e0000 [0169.576] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0169.576] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0169.576] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0169.576] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0169.578] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.578] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.578] GetProcessHeap () returned 0x4e0000 [0169.578] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0169.578] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0169.578] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.578] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0169.579] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0169.579] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0169.579] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0169.579] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0169.579] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0169.579] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.579] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.579] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.579] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1bb02, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1bb02, lpOverlapped=0x0) returned 1 [0169.581] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1bb10, dwBufLen=0x1bb10 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1bb10) returned 1 [0169.582] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.582] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1bb10, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1bb10, lpOverlapped=0x0) returned 1 [0169.583] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.583] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1bbe4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.583] SetEndOfFile (hFile=0xdc) returned 1 [0169.586] GetProcessHeap () returned 0x4e0000 [0169.586] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0169.586] GetProcessHeap () returned 0x4e0000 [0169.586] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0169.586] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382965.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382965.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0169.588] CloseHandle (hObject=0xdc) returned 1 [0169.588] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x18888, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382966.JPG", cAlternateFileName="")) returned 1 [0169.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382966.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0169.589] GetProcessHeap () returned 0x4e0000 [0169.589] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0169.589] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0169.589] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0169.589] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0169.591] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.592] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.592] GetProcessHeap () returned 0x4e0000 [0169.592] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0169.592] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0169.592] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.592] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0169.592] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0169.592] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0169.592] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0169.592] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0169.592] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0169.592] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.592] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.592] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.592] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x18888, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x18888, lpOverlapped=0x0) returned 1 [0169.595] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x18890, dwBufLen=0x18890 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x18890) returned 1 [0169.596] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.596] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x18890, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x18890, lpOverlapped=0x0) returned 1 [0169.596] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.596] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x18964, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.596] SetEndOfFile (hFile=0xdc) returned 1 [0169.600] GetProcessHeap () returned 0x4e0000 [0169.600] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0169.600] GetProcessHeap () returned 0x4e0000 [0169.600] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0169.600] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382966.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382966.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0169.602] CloseHandle (hObject=0xdc) returned 1 [0169.602] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16d08, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382967.JPG", cAlternateFileName="")) returned 1 [0169.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382967.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0169.639] GetProcessHeap () returned 0x4e0000 [0169.639] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0169.639] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0169.639] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0169.640] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0169.644] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.644] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.644] GetProcessHeap () returned 0x4e0000 [0169.644] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0169.644] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0169.644] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.644] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0169.644] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0169.645] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0169.645] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0169.645] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0169.645] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0169.645] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.645] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.645] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.645] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x16d08, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x16d08, lpOverlapped=0x0) returned 1 [0169.649] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x16d10, dwBufLen=0x16d10 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x16d10) returned 1 [0169.650] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.650] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x16d10, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x16d10, lpOverlapped=0x0) returned 1 [0169.651] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.651] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x16de4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.651] SetEndOfFile (hFile=0xdc) returned 1 [0169.654] GetProcessHeap () returned 0x4e0000 [0169.654] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0169.654] GetProcessHeap () returned 0x4e0000 [0169.654] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0169.654] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382967.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382967.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0169.656] CloseHandle (hObject=0xdc) returned 1 [0169.656] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b75f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382968.JPG", cAlternateFileName="")) returned 1 [0169.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382968.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0169.657] GetProcessHeap () returned 0x4e0000 [0169.657] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0169.657] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0169.657] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0169.657] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x1, lpOverlapped=0x0) returned 1 [0169.660] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.660] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.660] GetProcessHeap () returned 0x4e0000 [0169.660] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0169.660] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0169.660] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.660] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0169.660] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0169.660] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0169.661] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0169.661] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0169.661] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0169.661] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.661] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.661] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.661] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1b75f, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1b75f, lpOverlapped=0x0) returned 1 [0169.662] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1b760, dwBufLen=0x1b760 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1b760) returned 1 [0169.663] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.663] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1b760, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1b760, lpOverlapped=0x0) returned 1 [0169.663] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.663] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1b834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.663] SetEndOfFile (hFile=0xdc) returned 1 [0169.666] GetProcessHeap () returned 0x4e0000 [0169.666] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0169.666] GetProcessHeap () returned 0x4e0000 [0169.666] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0169.666] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382968.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382968.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0169.668] CloseHandle (hObject=0xdc) returned 1 [0169.668] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1779f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382969.JPG", cAlternateFileName="")) returned 1 [0169.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382969.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0169.669] GetProcessHeap () returned 0x4e0000 [0169.669] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0169.669] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0169.669] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0169.669] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x1, lpOverlapped=0x0) returned 1 [0169.760] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.760] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.760] GetProcessHeap () returned 0x4e0000 [0169.760] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0169.760] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0169.760] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.760] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0169.760] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0169.761] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0169.761] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0169.761] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0169.761] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0169.761] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.761] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.761] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.761] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1779f, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1779f, lpOverlapped=0x0) returned 1 [0169.763] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x177a0, dwBufLen=0x177a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x177a0) returned 1 [0169.764] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.764] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x177a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x177a0, lpOverlapped=0x0) returned 1 [0169.764] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.764] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x17874, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.765] SetEndOfFile (hFile=0xdc) returned 1 [0169.768] GetProcessHeap () returned 0x4e0000 [0169.768] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0169.768] GetProcessHeap () returned 0x4e0000 [0169.768] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0169.768] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382969.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382969.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0169.770] CloseHandle (hObject=0xdc) returned 1 [0169.770] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x15b94, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382970.JPG", cAlternateFileName="")) returned 1 [0169.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382970.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0169.771] GetProcessHeap () returned 0x4e0000 [0169.771] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0169.771] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0169.771] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0169.771] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0169.774] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.774] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.774] GetProcessHeap () returned 0x4e0000 [0169.774] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0169.774] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0169.774] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.774] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0169.774] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0169.774] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0169.774] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0169.774] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0169.774] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0169.774] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.774] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.775] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.775] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x15b94, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x15b94, lpOverlapped=0x0) returned 1 [0169.776] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x15ba0, dwBufLen=0x15ba0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x15ba0) returned 1 [0169.777] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.777] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x15ba0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x15ba0, lpOverlapped=0x0) returned 1 [0169.778] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.778] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x15c74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.778] SetEndOfFile (hFile=0xdc) returned 1 [0169.781] GetProcessHeap () returned 0x4e0000 [0169.781] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0169.781] GetProcessHeap () returned 0x4e0000 [0169.781] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0169.781] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382970.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382970.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0169.783] CloseHandle (hObject=0xdc) returned 1 [0169.783] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x190e9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0384862.JPG", cAlternateFileName="")) returned 1 [0169.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384862.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0169.784] GetProcessHeap () returned 0x4e0000 [0169.784] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0169.784] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0169.784] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0169.784] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x7, lpOverlapped=0x0) returned 1 [0169.786] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.787] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.787] GetProcessHeap () returned 0x4e0000 [0169.787] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0169.787] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0169.787] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.787] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0169.787] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0169.787] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0169.787] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0169.787] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0169.787] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0169.787] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.787] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.787] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.787] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x190e9, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x190e9, lpOverlapped=0x0) returned 1 [0169.789] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x190f0, dwBufLen=0x190f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x190f0) returned 1 [0169.791] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.791] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x190f0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x190f0, lpOverlapped=0x0) returned 1 [0169.791] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.791] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x191c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.791] SetEndOfFile (hFile=0xdc) returned 1 [0169.795] GetProcessHeap () returned 0x4e0000 [0169.795] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0169.795] GetProcessHeap () returned 0x4e0000 [0169.795] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0169.795] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384862.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384862.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0169.796] CloseHandle (hObject=0xdc) returned 1 [0169.797] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x17b79, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0384885.JPG", cAlternateFileName="")) returned 1 [0169.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384885.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0169.799] GetProcessHeap () returned 0x4e0000 [0169.799] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0169.799] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0169.799] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0169.799] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x7, lpOverlapped=0x0) returned 1 [0169.837] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.837] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.838] GetProcessHeap () returned 0x4e0000 [0169.838] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0169.838] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0169.838] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.838] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0169.838] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0169.838] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0169.838] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0169.849] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0169.849] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0169.849] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.849] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.849] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.849] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x17b79, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x17b79, lpOverlapped=0x0) returned 1 [0169.851] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x17b80, dwBufLen=0x17b80 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x17b80) returned 1 [0169.852] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.852] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x17b80, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x17b80, lpOverlapped=0x0) returned 1 [0169.853] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.853] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x17c54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.853] SetEndOfFile (hFile=0xdc) returned 1 [0169.856] GetProcessHeap () returned 0x4e0000 [0169.856] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0169.856] GetProcessHeap () returned 0x4e0000 [0169.856] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0169.856] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384885.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384885.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0169.858] CloseHandle (hObject=0xdc) returned 1 [0169.858] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x14033, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0384888.JPG", cAlternateFileName="")) returned 1 [0169.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384888.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0169.859] GetProcessHeap () returned 0x4e0000 [0169.859] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0169.860] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0169.860] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0169.860] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xd, lpOverlapped=0x0) returned 1 [0169.862] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.862] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.862] GetProcessHeap () returned 0x4e0000 [0169.862] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0169.862] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0169.862] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.862] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0169.862] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0169.862] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0169.862] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0169.863] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0169.863] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0169.863] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.863] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.863] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.863] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x14033, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x14033, lpOverlapped=0x0) returned 1 [0169.865] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x14040, dwBufLen=0x14040 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x14040) returned 1 [0169.866] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.866] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x14040, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x14040, lpOverlapped=0x0) returned 1 [0169.866] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.866] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x14114, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.866] SetEndOfFile (hFile=0xdc) returned 1 [0169.871] GetProcessHeap () returned 0x4e0000 [0169.871] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0169.871] GetProcessHeap () returned 0x4e0000 [0169.871] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0169.872] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384888.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384888.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0169.873] CloseHandle (hObject=0xdc) returned 1 [0169.873] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd8f6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0384895.JPG", cAlternateFileName="")) returned 1 [0169.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384895.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0169.874] GetProcessHeap () returned 0x4e0000 [0169.874] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0169.874] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0169.874] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0169.874] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0169.878] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.878] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.878] GetProcessHeap () returned 0x4e0000 [0169.878] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0169.878] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0169.878] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.878] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0169.878] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0169.879] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0169.879] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0169.879] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0169.879] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0169.879] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.879] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.879] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.879] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xd8f6, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xd8f6, lpOverlapped=0x0) returned 1 [0169.881] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xd900, dwBufLen=0xd900 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xd900) returned 1 [0169.881] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.881] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xd900, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xd900, lpOverlapped=0x0) returned 1 [0169.882] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.882] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xd9d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.882] SetEndOfFile (hFile=0xdc) returned 1 [0169.887] GetProcessHeap () returned 0x4e0000 [0169.887] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0169.887] GetProcessHeap () returned 0x4e0000 [0169.887] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0169.887] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384895.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384895.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0169.889] CloseHandle (hObject=0xdc) returned 1 [0169.889] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x11780, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0384900.JPG", cAlternateFileName="")) returned 1 [0169.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384900.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0169.892] GetProcessHeap () returned 0x4e0000 [0169.892] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0169.892] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0169.892] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0169.892] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.892] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.892] GetProcessHeap () returned 0x4e0000 [0169.892] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0169.892] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0169.892] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.893] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0169.896] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0169.896] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0169.896] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0169.896] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0169.896] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0169.896] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.896] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.896] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.896] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x11780, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x11780, lpOverlapped=0x0) returned 1 [0169.898] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x11780, dwBufLen=0x11780 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x11780) returned 1 [0169.899] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.899] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x11780, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x11780, lpOverlapped=0x0) returned 1 [0169.899] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.899] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x11854, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.899] SetEndOfFile (hFile=0xdc) returned 1 [0169.903] GetProcessHeap () returned 0x4e0000 [0169.903] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0169.903] GetProcessHeap () returned 0x4e0000 [0169.903] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0169.903] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384900.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384900.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0169.905] CloseHandle (hObject=0xdc) returned 1 [0169.905] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x787a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0386120.JPG", cAlternateFileName="")) returned 1 [0169.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386120.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0169.906] GetProcessHeap () returned 0x4e0000 [0169.906] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0169.906] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0169.906] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0169.906] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0169.908] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.908] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.908] GetProcessHeap () returned 0x4e0000 [0169.908] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0169.908] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0169.908] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.909] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0169.909] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0169.909] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0169.909] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0169.909] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0169.909] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0169.909] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.909] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.909] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.909] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x787a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x787a, lpOverlapped=0x0) returned 1 [0169.910] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7880, dwBufLen=0x7880 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7880) returned 1 [0169.911] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.911] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7880, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7880, lpOverlapped=0x0) returned 1 [0169.911] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.911] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7954, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.911] SetEndOfFile (hFile=0xdc) returned 1 [0169.914] GetProcessHeap () returned 0x4e0000 [0169.914] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0169.914] GetProcessHeap () returned 0x4e0000 [0169.914] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0169.914] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386120.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386120.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0169.916] CloseHandle (hObject=0xdc) returned 1 [0169.917] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa91e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0386267.JPG", cAlternateFileName="")) returned 1 [0169.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386267.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0169.918] GetProcessHeap () returned 0x4e0000 [0169.918] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0169.918] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0169.918] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0169.918] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0169.920] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.920] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.920] GetProcessHeap () returned 0x4e0000 [0169.920] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0169.920] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0169.920] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.920] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0169.920] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0169.920] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0169.921] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0169.921] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0169.921] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0169.921] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.921] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.921] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.921] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xa91e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xa91e, lpOverlapped=0x0) returned 1 [0169.922] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa920, dwBufLen=0xa920 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa920) returned 1 [0169.923] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.923] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xa920, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xa920, lpOverlapped=0x0) returned 1 [0169.923] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.923] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xa9f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.923] SetEndOfFile (hFile=0xdc) returned 1 [0169.926] GetProcessHeap () returned 0x4e0000 [0169.926] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0169.926] GetProcessHeap () returned 0x4e0000 [0169.926] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0169.926] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386267.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386267.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0169.928] CloseHandle (hObject=0xdc) returned 1 [0169.928] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3b43, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0386270.JPG", cAlternateFileName="")) returned 1 [0169.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386270.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0169.931] GetProcessHeap () returned 0x4e0000 [0169.931] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0169.931] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0169.931] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0169.932] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xd, lpOverlapped=0x0) returned 1 [0169.934] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.934] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.935] GetProcessHeap () returned 0x4e0000 [0169.935] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0169.935] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0169.935] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.935] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0169.935] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0169.935] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0169.935] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0169.935] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0169.935] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0169.935] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.935] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.935] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.935] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3b43, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3b43, lpOverlapped=0x0) returned 1 [0169.939] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3b50, dwBufLen=0x3b50 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3b50) returned 1 [0169.940] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.940] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3b50, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3b50, lpOverlapped=0x0) returned 1 [0169.940] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.940] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3c24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.940] SetEndOfFile (hFile=0xdc) returned 1 [0169.943] GetProcessHeap () returned 0x4e0000 [0169.943] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0169.943] GetProcessHeap () returned 0x4e0000 [0169.943] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0169.943] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386270.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386270.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0169.945] CloseHandle (hObject=0xdc) returned 1 [0169.945] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x396a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0386485.JPG", cAlternateFileName="")) returned 1 [0169.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386485.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0169.946] GetProcessHeap () returned 0x4e0000 [0169.946] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0169.946] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0169.946] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0169.946] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0169.949] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.949] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.949] GetProcessHeap () returned 0x4e0000 [0169.949] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0169.949] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0169.949] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.949] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0169.949] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0169.949] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0169.949] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0169.949] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0169.949] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0169.949] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.949] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.949] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.950] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x396a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x396a, lpOverlapped=0x0) returned 1 [0169.951] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3970, dwBufLen=0x3970 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3970) returned 1 [0169.951] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.951] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3970, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3970, lpOverlapped=0x0) returned 1 [0169.951] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.951] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3a44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.951] SetEndOfFile (hFile=0xdc) returned 1 [0169.954] GetProcessHeap () returned 0x4e0000 [0169.954] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0169.954] GetProcessHeap () returned 0x4e0000 [0169.954] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0169.954] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386485.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386485.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0169.956] CloseHandle (hObject=0xdc) returned 1 [0169.956] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x693e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0386764.JPG", cAlternateFileName="")) returned 1 [0169.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386764.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0169.957] GetProcessHeap () returned 0x4e0000 [0169.957] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0169.957] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0169.957] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0169.957] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0169.960] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.960] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.960] GetProcessHeap () returned 0x4e0000 [0169.960] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0169.960] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0169.960] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.960] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0169.960] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0169.960] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0169.960] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0169.960] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0169.960] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0169.960] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.961] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.961] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.961] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x693e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x693e, lpOverlapped=0x0) returned 1 [0169.962] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6940, dwBufLen=0x6940 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6940) returned 1 [0169.962] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.963] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6940, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x6940, lpOverlapped=0x0) returned 1 [0169.963] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.963] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6a14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.963] SetEndOfFile (hFile=0xdc) returned 1 [0169.966] GetProcessHeap () returned 0x4e0000 [0169.966] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0169.966] GetProcessHeap () returned 0x4e0000 [0169.966] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0169.966] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386764.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386764.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0169.967] CloseHandle (hObject=0xdc) returned 1 [0169.968] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xcb0a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0387337.JPG", cAlternateFileName="")) returned 1 [0169.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387337.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0169.969] GetProcessHeap () returned 0x4e0000 [0169.969] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0169.969] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0169.969] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0169.969] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0169.973] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.973] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.973] GetProcessHeap () returned 0x4e0000 [0169.973] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0169.973] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0169.973] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.973] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0169.973] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0169.973] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0169.973] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0169.974] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0169.974] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0169.974] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.974] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.974] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.974] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xcb0a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xcb0a, lpOverlapped=0x0) returned 1 [0169.975] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xcb10, dwBufLen=0xcb10 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xcb10) returned 1 [0169.976] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.976] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xcb10, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xcb10, lpOverlapped=0x0) returned 1 [0169.977] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.977] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xcbe4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.977] SetEndOfFile (hFile=0xdc) returned 1 [0169.980] GetProcessHeap () returned 0x4e0000 [0169.980] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0169.980] GetProcessHeap () returned 0x4e0000 [0169.980] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0169.980] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387337.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387337.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0169.982] CloseHandle (hObject=0xdc) returned 1 [0169.982] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6cec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0387578.JPG", cAlternateFileName="")) returned 1 [0169.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387578.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0169.983] GetProcessHeap () returned 0x4e0000 [0169.983] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0169.983] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0169.983] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0169.983] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0169.985] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.985] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.986] GetProcessHeap () returned 0x4e0000 [0169.986] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0169.986] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0169.986] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.986] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0169.986] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0169.986] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0169.986] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0169.986] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0169.986] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0169.986] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.986] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.986] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.986] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x6cec, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x6cec, lpOverlapped=0x0) returned 1 [0169.987] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6cf0, dwBufLen=0x6cf0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6cf0) returned 1 [0169.988] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.988] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6cf0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x6cf0, lpOverlapped=0x0) returned 1 [0169.988] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.988] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6dc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.988] SetEndOfFile (hFile=0xdc) returned 1 [0169.991] GetProcessHeap () returned 0x4e0000 [0169.991] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0169.991] GetProcessHeap () returned 0x4e0000 [0169.991] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0169.991] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387578.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387578.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0169.993] CloseHandle (hObject=0xdc) returned 1 [0169.993] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x98c7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0387591.JPG", cAlternateFileName="")) returned 1 [0169.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387591.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0169.995] GetProcessHeap () returned 0x4e0000 [0169.995] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0169.995] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0169.995] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0169.995] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x9, lpOverlapped=0x0) returned 1 [0169.997] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.997] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.997] GetProcessHeap () returned 0x4e0000 [0169.997] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0169.997] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0169.997] CryptDestroyKey (hKey=0x522f98) returned 1 [0169.997] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0169.998] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0169.998] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0169.998] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0169.998] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0169.998] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0169.998] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0169.998] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0169.998] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.998] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x98c7, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x98c7, lpOverlapped=0x0) returned 1 [0170.001] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x98d0, dwBufLen=0x98d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x98d0) returned 1 [0170.002] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.002] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x98d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x98d0, lpOverlapped=0x0) returned 1 [0170.002] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.002] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x99a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.002] SetEndOfFile (hFile=0xdc) returned 1 [0170.004] GetProcessHeap () returned 0x4e0000 [0170.005] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0170.005] GetProcessHeap () returned 0x4e0000 [0170.005] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0170.005] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387591.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387591.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0170.006] CloseHandle (hObject=0xdc) returned 1 [0170.006] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb9bf, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0387604.JPG", cAlternateFileName="")) returned 1 [0170.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387604.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0170.007] GetProcessHeap () returned 0x4e0000 [0170.007] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0170.007] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0170.007] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0170.008] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x1, lpOverlapped=0x0) returned 1 [0170.010] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.010] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.010] GetProcessHeap () returned 0x4e0000 [0170.010] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0170.010] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0170.010] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.010] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0170.010] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0170.010] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0170.010] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0170.010] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0170.010] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0170.011] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.011] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.011] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.011] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb9bf, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xb9bf, lpOverlapped=0x0) returned 1 [0170.012] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xb9c0, dwBufLen=0xb9c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xb9c0) returned 1 [0170.012] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.012] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xb9c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xb9c0, lpOverlapped=0x0) returned 1 [0170.013] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.013] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xba94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.013] SetEndOfFile (hFile=0xdc) returned 1 [0170.016] GetProcessHeap () returned 0x4e0000 [0170.016] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0170.016] GetProcessHeap () returned 0x4e0000 [0170.016] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0170.016] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387604.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387604.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0170.018] CloseHandle (hObject=0xdc) returned 1 [0170.018] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x98ec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0387882.JPG", cAlternateFileName="")) returned 1 [0170.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387882.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0170.019] GetProcessHeap () returned 0x4e0000 [0170.019] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0170.019] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0170.019] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0170.019] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0170.022] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.022] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.022] GetProcessHeap () returned 0x4e0000 [0170.022] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0170.022] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0170.022] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.022] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0170.022] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0170.022] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0170.022] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0170.022] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0170.022] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0170.022] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.023] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.023] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.023] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x98ec, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x98ec, lpOverlapped=0x0) returned 1 [0170.024] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x98f0, dwBufLen=0x98f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x98f0) returned 1 [0170.024] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.025] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x98f0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x98f0, lpOverlapped=0x0) returned 1 [0170.025] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.025] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x99c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.025] SetEndOfFile (hFile=0xdc) returned 1 [0170.028] GetProcessHeap () returned 0x4e0000 [0170.028] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0170.028] GetProcessHeap () returned 0x4e0000 [0170.028] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0170.028] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387882.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387882.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0170.029] CloseHandle (hObject=0xdc) returned 1 [0170.029] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7df3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0387895.JPG", cAlternateFileName="")) returned 1 [0170.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387895.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0170.031] GetProcessHeap () returned 0x4e0000 [0170.031] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0170.031] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0170.031] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0170.031] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xd, lpOverlapped=0x0) returned 1 [0170.033] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.033] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.033] GetProcessHeap () returned 0x4e0000 [0170.033] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0170.033] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0170.033] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.033] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0170.033] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0170.034] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0170.034] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0170.034] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0170.034] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0170.034] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.034] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.034] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.034] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7df3, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7df3, lpOverlapped=0x0) returned 1 [0170.035] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7e00, dwBufLen=0x7e00 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7e00) returned 1 [0170.036] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.036] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7e00, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7e00, lpOverlapped=0x0) returned 1 [0170.036] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.036] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.036] SetEndOfFile (hFile=0xdc) returned 1 [0170.039] GetProcessHeap () returned 0x4e0000 [0170.039] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0170.039] GetProcessHeap () returned 0x4e0000 [0170.039] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0170.039] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387895.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387895.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0170.041] CloseHandle (hObject=0xdc) returned 1 [0170.041] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59a43300, ftCreationTime.dwHighDateTime=0x1c97bb5, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x59a43300, ftLastWriteTime.dwHighDateTime=0x1c97bb5, nFileSizeHigh=0x0, nFileSizeLow=0x351c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0390072.JPG", cAlternateFileName="")) returned 1 [0170.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0390072.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0170.042] GetProcessHeap () returned 0x4e0000 [0170.042] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0170.042] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0170.042] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0170.042] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0170.044] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.044] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.044] GetProcessHeap () returned 0x4e0000 [0170.044] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0170.044] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0170.044] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.044] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0170.044] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0170.044] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0170.044] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0170.044] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0170.044] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0170.044] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.044] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.044] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.044] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x351c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x351c, lpOverlapped=0x0) returned 1 [0170.045] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3520, dwBufLen=0x3520 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3520) returned 1 [0170.046] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.046] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3520, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3520, lpOverlapped=0x0) returned 1 [0170.046] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.046] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x35f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.046] SetEndOfFile (hFile=0xdc) returned 1 [0170.048] GetProcessHeap () returned 0x4e0000 [0170.048] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0170.048] GetProcessHeap () returned 0x4e0000 [0170.048] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0170.048] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0390072.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0390072.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0170.049] CloseHandle (hObject=0xdc) returned 1 [0170.049] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55f55f00, ftCreationTime.dwHighDateTime=0x1c98cd0, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x55f55f00, ftLastWriteTime.dwHighDateTime=0x1c98cd0, nFileSizeHigh=0x0, nFileSizeLow=0x31883, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0400001.PNG", cAlternateFileName="")) returned 1 [0170.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400001.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0170.050] GetProcessHeap () returned 0x4e0000 [0170.050] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0170.050] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0170.050] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0170.050] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xd, lpOverlapped=0x0) returned 1 [0170.052] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.053] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.053] GetProcessHeap () returned 0x4e0000 [0170.053] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0170.053] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0170.053] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.053] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0170.053] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0170.053] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0170.053] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0170.053] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0170.053] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0170.054] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.054] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.054] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.054] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x31883, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x31883, lpOverlapped=0x0) returned 1 [0170.056] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x31890, dwBufLen=0x31890 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x31890) returned 1 [0170.058] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.058] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x31890, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x31890, lpOverlapped=0x0) returned 1 [0170.058] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.058] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x31964, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.058] SetEndOfFile (hFile=0xdc) returned 1 [0170.062] GetProcessHeap () returned 0x4e0000 [0170.062] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0170.062] GetProcessHeap () returned 0x4e0000 [0170.062] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0170.062] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400001.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400001.png.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0170.065] CloseHandle (hObject=0xdc) returned 1 [0170.065] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea13f600, ftCreationTime.dwHighDateTime=0x1c98cd1, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xea13f600, ftLastWriteTime.dwHighDateTime=0x1c98cd1, nFileSizeHigh=0x0, nFileSizeLow=0x15d49, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0400002.PNG", cAlternateFileName="")) returned 1 [0170.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400002.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0170.065] GetProcessHeap () returned 0x4e0000 [0170.065] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0170.065] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0170.065] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0170.066] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x7, lpOverlapped=0x0) returned 1 [0170.131] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.131] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.131] GetProcessHeap () returned 0x4e0000 [0170.131] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0170.131] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0170.131] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.131] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0170.132] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0170.132] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0170.132] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0170.132] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0170.132] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0170.132] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.132] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.132] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.132] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x15d49, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x15d49, lpOverlapped=0x0) returned 1 [0170.134] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x15d50, dwBufLen=0x15d50 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x15d50) returned 1 [0170.135] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.135] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x15d50, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x15d50, lpOverlapped=0x0) returned 1 [0170.136] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.136] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x15e24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.136] SetEndOfFile (hFile=0xdc) returned 1 [0170.139] GetProcessHeap () returned 0x4e0000 [0170.139] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0170.139] GetProcessHeap () returned 0x4e0000 [0170.139] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0170.139] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400002.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400002.png.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0170.141] CloseHandle (hObject=0xdc) returned 1 [0170.141] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x234c6600, ftCreationTime.dwHighDateTime=0x1c98cd2, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x234c6600, ftLastWriteTime.dwHighDateTime=0x1c98cd2, nFileSizeHigh=0x0, nFileSizeLow=0x1e836, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0400003.PNG", cAlternateFileName="")) returned 1 [0170.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400003.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0170.146] GetProcessHeap () returned 0x4e0000 [0170.146] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0170.146] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0170.146] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0170.146] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0170.148] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.148] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.148] GetProcessHeap () returned 0x4e0000 [0170.148] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0170.148] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0170.148] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.148] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0170.148] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0170.148] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0170.148] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0170.149] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0170.149] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0170.149] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.149] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.149] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.149] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1e836, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1e836, lpOverlapped=0x0) returned 1 [0170.150] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1e840, dwBufLen=0x1e840 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1e840) returned 1 [0170.151] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.151] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1e840, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1e840, lpOverlapped=0x0) returned 1 [0170.152] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.152] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1e914, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.152] SetEndOfFile (hFile=0xdc) returned 1 [0170.155] GetProcessHeap () returned 0x4e0000 [0170.155] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0170.155] GetProcessHeap () returned 0x4e0000 [0170.155] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0170.155] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400003.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400003.png.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0170.156] CloseHandle (hObject=0xdc) returned 1 [0170.156] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39f2bd00, ftCreationTime.dwHighDateTime=0x1c98cd2, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x39f2bd00, ftLastWriteTime.dwHighDateTime=0x1c98cd2, nFileSizeHigh=0x0, nFileSizeLow=0x19a5d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0400004.PNG", cAlternateFileName="")) returned 1 [0170.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400004.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0170.157] GetProcessHeap () returned 0x4e0000 [0170.157] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0170.157] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0170.157] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0170.158] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x3, lpOverlapped=0x0) returned 1 [0170.159] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.159] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.160] GetProcessHeap () returned 0x4e0000 [0170.160] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0170.160] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0170.160] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.160] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0170.160] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0170.160] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0170.160] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0170.160] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0170.160] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0170.160] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.160] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.160] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.160] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x19a5d, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x19a5d, lpOverlapped=0x0) returned 1 [0170.162] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x19a60, dwBufLen=0x19a60 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x19a60) returned 1 [0170.162] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.163] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x19a60, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x19a60, lpOverlapped=0x0) returned 1 [0170.163] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.163] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x19b34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.163] SetEndOfFile (hFile=0xdc) returned 1 [0170.166] GetProcessHeap () returned 0x4e0000 [0170.166] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0170.166] GetProcessHeap () returned 0x4e0000 [0170.166] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0170.166] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400004.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400004.png.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0170.168] CloseHandle (hObject=0xdc) returned 1 [0170.168] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82aa7600, ftCreationTime.dwHighDateTime=0x1c98cd2, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82aa7600, ftLastWriteTime.dwHighDateTime=0x1c98cd2, nFileSizeHigh=0x0, nFileSizeLow=0x17742, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0400005.PNG", cAlternateFileName="")) returned 1 [0170.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400005.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0170.169] GetProcessHeap () returned 0x4e0000 [0170.169] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0170.169] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0170.169] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0170.169] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0170.178] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.178] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.178] GetProcessHeap () returned 0x4e0000 [0170.178] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0170.178] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0170.178] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.178] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0170.178] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0170.178] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0170.178] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0170.178] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0170.179] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0170.179] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.179] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.179] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.179] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x17742, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x17742, lpOverlapped=0x0) returned 1 [0170.180] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x17750, dwBufLen=0x17750 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x17750) returned 1 [0170.181] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.181] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x17750, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x17750, lpOverlapped=0x0) returned 1 [0170.181] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.181] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x17824, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.181] SetEndOfFile (hFile=0xdc) returned 1 [0170.184] GetProcessHeap () returned 0x4e0000 [0170.184] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0170.184] GetProcessHeap () returned 0x4e0000 [0170.184] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0170.184] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400005.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400005.png.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0170.186] CloseHandle (hObject=0xdc) returned 1 [0170.186] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2645, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="JAVA_01.MID", cAlternateFileName="")) returned 1 [0170.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0170.187] GetProcessHeap () returned 0x4e0000 [0170.187] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0170.187] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0170.187] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0170.187] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xb, lpOverlapped=0x0) returned 1 [0170.189] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.189] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.189] GetProcessHeap () returned 0x4e0000 [0170.189] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0170.189] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0170.189] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.189] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0170.189] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0170.189] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0170.189] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0170.189] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0170.189] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0170.189] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.189] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.189] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.189] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2645, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2645, lpOverlapped=0x0) returned 1 [0170.193] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2650, dwBufLen=0x2650 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2650) returned 1 [0170.193] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.194] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2650, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2650, lpOverlapped=0x0) returned 1 [0170.194] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.194] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2724, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.194] SetEndOfFile (hFile=0xdc) returned 1 [0170.196] GetProcessHeap () returned 0x4e0000 [0170.196] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0170.196] GetProcessHeap () returned 0x4e0000 [0170.196] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0170.196] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0170.198] CloseHandle (hObject=0xdc) returned 1 [0170.198] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x16d3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="JNGLE_01.MID", cAlternateFileName="")) returned 1 [0170.198] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0170.199] GetProcessHeap () returned 0x4e0000 [0170.199] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0170.199] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0170.199] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0170.199] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xd, lpOverlapped=0x0) returned 1 [0170.201] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.201] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.201] GetProcessHeap () returned 0x4e0000 [0170.201] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0170.201] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0170.201] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.201] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0170.201] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0170.201] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0170.201] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0170.202] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0170.202] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0170.202] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.202] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.202] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.202] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x16d3, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x16d3, lpOverlapped=0x0) returned 1 [0170.203] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x16e0, dwBufLen=0x16e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x16e0) returned 1 [0170.203] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.203] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x16e0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x16e0, lpOverlapped=0x0) returned 1 [0170.203] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.203] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x17b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.203] SetEndOfFile (hFile=0xdc) returned 1 [0170.205] GetProcessHeap () returned 0x4e0000 [0170.205] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0170.205] GetProcessHeap () returned 0x4e0000 [0170.205] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0170.205] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0170.206] CloseHandle (hObject=0xdc) returned 1 [0170.207] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x968b8700, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x58b00bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x968b8700, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x15f6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MP00021_.WMF", cAlternateFileName="")) returned 1 [0170.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00021_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0170.208] GetProcessHeap () returned 0x4e0000 [0170.208] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0170.208] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0170.208] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0170.208] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0170.210] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.210] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.210] GetProcessHeap () returned 0x4e0000 [0170.210] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0170.210] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0170.210] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.210] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0170.210] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0170.210] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0170.210] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0170.211] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0170.211] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0170.211] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.211] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.211] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.211] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x15f6, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x15f6, lpOverlapped=0x0) returned 1 [0170.212] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1600, dwBufLen=0x1600 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1600) returned 1 [0170.212] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.212] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1600, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1600, lpOverlapped=0x0) returned 1 [0170.212] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.212] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x16d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.212] SetEndOfFile (hFile=0xdc) returned 1 [0170.214] GetProcessHeap () returned 0x4e0000 [0170.214] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0170.215] GetProcessHeap () returned 0x4e0000 [0170.215] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0170.215] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00021_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00021_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0170.216] CloseHandle (hObject=0xdc) returned 1 [0170.216] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19acdd00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x58b00bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19acdd00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x1090, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MP00132_.WMF", cAlternateFileName="")) returned 1 [0170.216] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00132_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0170.217] GetProcessHeap () returned 0x4e0000 [0170.217] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0170.217] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0170.217] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0170.217] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.217] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.217] GetProcessHeap () returned 0x4e0000 [0170.217] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0170.217] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0170.217] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.217] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0170.224] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0170.224] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0170.225] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0170.225] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0170.225] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0170.226] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.226] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.226] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.226] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1090, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1090, lpOverlapped=0x0) returned 1 [0170.229] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1090, dwBufLen=0x1090 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1090) returned 1 [0170.230] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.230] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1090, lpOverlapped=0x0) returned 1 [0170.230] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.230] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1164, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.230] SetEndOfFile (hFile=0xdc) returned 1 [0170.232] GetProcessHeap () returned 0x4e0000 [0170.232] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0170.232] GetProcessHeap () returned 0x4e0000 [0170.232] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0170.232] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00132_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00132_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0170.234] CloseHandle (hObject=0xdc) returned 1 [0170.234] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b16fc00, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x69c72af0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b16fc00, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x31e2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MP00646_.WMF", cAlternateFileName="")) returned 1 [0170.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00646_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0170.235] GetProcessHeap () returned 0x4e0000 [0170.235] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0170.235] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0170.235] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0170.235] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0170.240] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.240] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.240] GetProcessHeap () returned 0x4e0000 [0170.240] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0170.240] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0170.240] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.240] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0170.240] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0170.240] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0170.240] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0170.240] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0170.240] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0170.241] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.241] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.241] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.241] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x31e2, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x31e2, lpOverlapped=0x0) returned 1 [0170.242] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x31f0, dwBufLen=0x31f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x31f0) returned 1 [0170.242] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.242] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x31f0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x31f0, lpOverlapped=0x0) returned 1 [0170.243] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.243] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x32c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.243] SetEndOfFile (hFile=0xdc) returned 1 [0170.245] GetProcessHeap () returned 0x4e0000 [0170.245] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0170.245] GetProcessHeap () returned 0x4e0000 [0170.245] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0170.245] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00646_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00646_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0170.247] CloseHandle (hObject=0xdc) returned 1 [0170.247] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1ae0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MUSIC_01.MID", cAlternateFileName="")) returned 1 [0170.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0170.249] GetProcessHeap () returned 0x4e0000 [0170.249] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0170.250] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0170.250] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0170.250] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.250] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.250] GetProcessHeap () returned 0x4e0000 [0170.250] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0170.250] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0170.250] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.250] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0170.258] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0170.258] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0170.258] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0170.258] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0170.258] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0170.258] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.258] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.259] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.259] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1ae0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1ae0, lpOverlapped=0x0) returned 1 [0170.266] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1ae0, dwBufLen=0x1ae0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1ae0) returned 1 [0170.266] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.266] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1ae0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1ae0, lpOverlapped=0x0) returned 1 [0170.267] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.267] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1bb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.267] SetEndOfFile (hFile=0xdc) returned 1 [0170.269] GetProcessHeap () returned 0x4e0000 [0170.269] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0170.269] GetProcessHeap () returned 0x4e0000 [0170.269] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0170.269] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0170.271] CloseHandle (hObject=0xdc) returned 1 [0170.271] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9070c700, ftCreationTime.dwHighDateTime=0x1bd4b32, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9070c700, ftLastWriteTime.dwHighDateTime=0x1bd4b32, nFileSizeHigh=0x0, nFileSizeLow=0x5044, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00042_.WMF", cAlternateFileName="")) returned 1 [0170.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00042_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0170.272] GetProcessHeap () returned 0x4e0000 [0170.272] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0170.272] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0170.272] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0170.272] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0170.274] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.274] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.274] GetProcessHeap () returned 0x4e0000 [0170.274] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0170.274] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0170.274] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.274] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0170.275] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0170.275] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0170.275] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0170.275] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0170.275] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0170.275] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.275] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.275] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.275] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5044, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x5044, lpOverlapped=0x0) returned 1 [0170.276] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5050, dwBufLen=0x5050 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5050) returned 1 [0170.276] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.277] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5050, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5050, lpOverlapped=0x0) returned 1 [0170.277] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.277] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5124, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.277] SetEndOfFile (hFile=0xdc) returned 1 [0170.279] GetProcessHeap () returned 0x4e0000 [0170.279] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0170.279] GetProcessHeap () returned 0x4e0000 [0170.279] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0170.279] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00042_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00042_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0170.281] CloseHandle (hObject=0xdc) returned 1 [0170.281] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b49b100, ftCreationTime.dwHighDateTime=0x1bd4af3, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2b49b100, ftLastWriteTime.dwHighDateTime=0x1bd4af3, nFileSizeHigh=0x0, nFileSizeLow=0x2a42, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00057_.WMF", cAlternateFileName="")) returned 1 [0170.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00057_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0170.282] GetProcessHeap () returned 0x4e0000 [0170.282] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0170.282] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0170.282] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0170.282] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0170.329] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.329] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.340] GetProcessHeap () returned 0x4e0000 [0170.340] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0170.340] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0170.340] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.340] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0170.340] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0170.340] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0170.340] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0170.341] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0170.341] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0170.341] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.341] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.341] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.341] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2a42, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2a42, lpOverlapped=0x0) returned 1 [0170.342] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2a50, dwBufLen=0x2a50 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2a50) returned 1 [0170.342] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.342] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2a50, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2a50, lpOverlapped=0x0) returned 1 [0170.342] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.342] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2b24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.342] SetEndOfFile (hFile=0xdc) returned 1 [0170.345] GetProcessHeap () returned 0x4e0000 [0170.345] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0170.345] GetProcessHeap () returned 0x4e0000 [0170.345] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0170.345] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00057_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00057_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0170.347] CloseHandle (hObject=0xdc) returned 1 [0170.347] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21c04900, ftCreationTime.dwHighDateTime=0x1bd4af3, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c04900, ftLastWriteTime.dwHighDateTime=0x1bd4af3, nFileSizeHigh=0x0, nFileSizeLow=0xeaa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00058_.WMF", cAlternateFileName="")) returned 1 [0170.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00058_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0170.348] GetProcessHeap () returned 0x4e0000 [0170.348] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0170.349] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0170.349] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0170.349] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0170.350] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.350] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.351] GetProcessHeap () returned 0x4e0000 [0170.351] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0170.351] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0170.351] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.351] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0170.351] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0170.351] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0170.351] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0170.351] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0170.351] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0170.351] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.352] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.352] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.352] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xeaa, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xeaa, lpOverlapped=0x0) returned 1 [0170.352] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xeb0, dwBufLen=0xeb0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xeb0) returned 1 [0170.352] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.352] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xeb0, lpOverlapped=0x0) returned 1 [0170.352] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.352] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xf84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.352] SetEndOfFile (hFile=0xdc) returned 1 [0170.355] GetProcessHeap () returned 0x4e0000 [0170.355] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0170.355] GetProcessHeap () returned 0x4e0000 [0170.355] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0170.355] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00058_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00058_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0170.357] CloseHandle (hObject=0xdc) returned 1 [0170.357] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfdad700, ftCreationTime.dwHighDateTime=0x1bd4ae1, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdfdad700, ftLastWriteTime.dwHighDateTime=0x1bd4ae1, nFileSizeHigh=0x0, nFileSizeLow=0x1324, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00068_.WMF", cAlternateFileName="")) returned 1 [0170.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00068_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0170.359] GetProcessHeap () returned 0x4e0000 [0170.359] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0170.359] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0170.359] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0170.359] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0170.361] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.361] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.361] GetProcessHeap () returned 0x4e0000 [0170.361] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0170.361] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0170.361] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.361] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0170.362] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0170.362] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0170.362] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0170.362] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0170.362] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0170.362] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.362] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.362] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.362] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1324, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1324, lpOverlapped=0x0) returned 1 [0170.363] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1330, dwBufLen=0x1330 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1330) returned 1 [0170.363] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.363] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1330, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1330, lpOverlapped=0x0) returned 1 [0170.363] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.363] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1404, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.363] SetEndOfFile (hFile=0xdc) returned 1 [0170.366] GetProcessHeap () returned 0x4e0000 [0170.366] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0170.366] GetProcessHeap () returned 0x4e0000 [0170.366] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0170.366] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00068_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00068_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0170.368] CloseHandle (hObject=0xdc) returned 1 [0170.368] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99589d00, ftCreationTime.dwHighDateTime=0x1bd4b20, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99589d00, ftLastWriteTime.dwHighDateTime=0x1bd4b20, nFileSizeHigh=0x0, nFileSizeLow=0x1384, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00238_.WMF", cAlternateFileName="")) returned 1 [0170.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00238_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0170.369] GetProcessHeap () returned 0x4e0000 [0170.369] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0170.369] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0170.369] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0170.369] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0170.371] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.371] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.371] GetProcessHeap () returned 0x4e0000 [0170.371] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0170.371] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0170.371] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.371] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0170.371] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0170.371] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0170.372] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0170.372] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0170.372] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0170.372] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.372] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.372] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.372] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1384, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1384, lpOverlapped=0x0) returned 1 [0170.373] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1390, dwBufLen=0x1390 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1390) returned 1 [0170.373] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.373] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1390, lpOverlapped=0x0) returned 1 [0170.373] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.373] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.373] SetEndOfFile (hFile=0xdc) returned 1 [0170.376] GetProcessHeap () returned 0x4e0000 [0170.376] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0170.376] GetProcessHeap () returned 0x4e0000 [0170.376] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0170.376] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00238_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00238_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0170.377] CloseHandle (hObject=0xdc) returned 1 [0170.377] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc013d500, ftCreationTime.dwHighDateTime=0x1bd4b1a, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc013d500, ftLastWriteTime.dwHighDateTime=0x1bd4b1a, nFileSizeHigh=0x0, nFileSizeLow=0x864, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00330_.WMF", cAlternateFileName="")) returned 1 [0170.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00330_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0170.378] GetProcessHeap () returned 0x4e0000 [0170.378] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0170.378] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0170.378] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0170.378] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0170.390] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.390] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.390] GetProcessHeap () returned 0x4e0000 [0170.390] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0170.391] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0170.391] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.391] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0170.394] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0170.395] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0170.397] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0170.398] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0170.398] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0170.398] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.398] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.398] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.400] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x864, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x864, lpOverlapped=0x0) returned 1 [0170.400] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x870, dwBufLen=0x870 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x870) returned 1 [0170.400] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.401] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x870, lpOverlapped=0x0) returned 1 [0170.401] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.401] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x944, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.401] SetEndOfFile (hFile=0xdc) returned 1 [0170.403] GetProcessHeap () returned 0x4e0000 [0170.403] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0170.403] GetProcessHeap () returned 0x4e0000 [0170.404] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0170.404] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00330_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00330_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0170.405] CloseHandle (hObject=0xdc) returned 1 [0170.405] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x580ec000, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x580ec000, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x1172, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00388_.WMF", cAlternateFileName="")) returned 1 [0170.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00388_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0170.407] GetProcessHeap () returned 0x4e0000 [0170.407] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0170.407] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0170.407] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0170.407] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0170.415] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.415] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.415] GetProcessHeap () returned 0x4e0000 [0170.415] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0170.416] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0170.416] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.416] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0170.416] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0170.416] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0170.416] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0170.416] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0170.416] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0170.416] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.416] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.416] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.416] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1172, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1172, lpOverlapped=0x0) returned 1 [0170.417] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1180, dwBufLen=0x1180 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1180) returned 1 [0170.417] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.418] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1180, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1180, lpOverlapped=0x0) returned 1 [0170.418] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.418] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1254, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.418] SetEndOfFile (hFile=0xdc) returned 1 [0170.421] GetProcessHeap () returned 0x4e0000 [0170.421] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0170.421] GetProcessHeap () returned 0x4e0000 [0170.421] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0170.421] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00388_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00388_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0170.422] CloseHandle (hObject=0xdc) returned 1 [0170.423] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c25e800, ftCreationTime.dwHighDateTime=0x1bd4aeb, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c25e800, ftLastWriteTime.dwHighDateTime=0x1bd4aeb, nFileSizeHigh=0x0, nFileSizeLow=0x20ca, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00389_.WMF", cAlternateFileName="")) returned 1 [0170.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00389_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0170.425] GetProcessHeap () returned 0x4e0000 [0170.425] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0170.425] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0170.425] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0170.425] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0170.427] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.427] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.427] GetProcessHeap () returned 0x4e0000 [0170.427] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0170.427] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0170.427] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.427] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0170.427] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0170.427] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0170.427] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0170.428] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0170.428] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0170.428] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.428] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.428] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.428] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x20ca, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x20ca, lpOverlapped=0x0) returned 1 [0170.429] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x20d0, dwBufLen=0x20d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x20d0) returned 1 [0170.429] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.429] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x20d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x20d0, lpOverlapped=0x0) returned 1 [0170.429] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.429] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x21a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.429] SetEndOfFile (hFile=0xdc) returned 1 [0170.444] GetProcessHeap () returned 0x4e0000 [0170.444] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0170.444] GetProcessHeap () returned 0x4e0000 [0170.444] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0170.444] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00389_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00389_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0170.446] CloseHandle (hObject=0xdc) returned 1 [0170.446] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af4bb00, ftCreationTime.dwHighDateTime=0x1bd4aeb, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5af4bb00, ftLastWriteTime.dwHighDateTime=0x1bd4aeb, nFileSizeHigh=0x0, nFileSizeLow=0x21c2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00390_.WMF", cAlternateFileName="")) returned 1 [0170.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00390_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0170.448] GetProcessHeap () returned 0x4e0000 [0170.448] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0170.448] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0170.448] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0170.448] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0170.453] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.453] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.453] GetProcessHeap () returned 0x4e0000 [0170.453] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0170.453] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0170.453] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.453] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0170.454] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0170.454] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0170.454] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0170.454] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0170.454] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0170.454] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.454] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.454] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.454] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x21c2, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x21c2, lpOverlapped=0x0) returned 1 [0170.473] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x21d0, dwBufLen=0x21d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x21d0) returned 1 [0170.473] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.473] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x21d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x21d0, lpOverlapped=0x0) returned 1 [0170.506] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.506] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x22a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.506] SetEndOfFile (hFile=0xdc) returned 1 [0170.509] GetProcessHeap () returned 0x4e0000 [0170.509] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0170.509] GetProcessHeap () returned 0x4e0000 [0170.509] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0170.509] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00390_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00390_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0170.595] CloseHandle (hObject=0xdc) returned 1 [0170.595] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde161100, ftCreationTime.dwHighDateTime=0x1bd4aeb, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xde161100, ftLastWriteTime.dwHighDateTime=0x1bd4aeb, nFileSizeHigh=0x0, nFileSizeLow=0x21ec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00391_.WMF", cAlternateFileName="")) returned 1 [0170.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00391_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0170.596] GetProcessHeap () returned 0x4e0000 [0170.596] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0170.596] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0170.596] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0170.596] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0170.640] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.640] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.640] GetProcessHeap () returned 0x4e0000 [0170.640] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0170.640] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0170.640] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.640] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0170.641] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0170.641] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0170.641] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0170.641] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0170.641] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0170.641] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.641] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.641] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.641] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x21ec, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x21ec, lpOverlapped=0x0) returned 1 [0170.642] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x21f0, dwBufLen=0x21f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x21f0) returned 1 [0170.642] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.642] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x21f0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x21f0, lpOverlapped=0x0) returned 1 [0170.643] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.643] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x22c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.643] SetEndOfFile (hFile=0xdc) returned 1 [0170.645] GetProcessHeap () returned 0x4e0000 [0170.645] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0170.645] GetProcessHeap () returned 0x4e0000 [0170.645] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0170.646] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00391_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00391_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0170.647] CloseHandle (hObject=0xdc) returned 1 [0170.647] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24e62400, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x24e62400, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x2ad4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00394_.WMF", cAlternateFileName="")) returned 1 [0170.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00394_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0170.650] GetProcessHeap () returned 0x4e0000 [0170.650] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0170.650] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0170.650] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0170.650] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0170.652] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.652] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.652] GetProcessHeap () returned 0x4e0000 [0170.652] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0170.652] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0170.652] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.652] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0170.652] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0170.653] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0170.653] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0170.653] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0170.653] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0170.653] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.653] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.653] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.653] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2ad4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2ad4, lpOverlapped=0x0) returned 1 [0170.654] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2ae0, dwBufLen=0x2ae0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2ae0) returned 1 [0170.654] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.654] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2ae0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2ae0, lpOverlapped=0x0) returned 1 [0170.655] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.655] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2bb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.655] SetEndOfFile (hFile=0xdc) returned 1 [0170.657] GetProcessHeap () returned 0x4e0000 [0170.658] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0170.658] GetProcessHeap () returned 0x4e0000 [0170.658] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0170.658] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00394_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00394_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0170.659] CloseHandle (hObject=0xdc) returned 1 [0170.659] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c22fe00, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4c22fe00, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x194a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00395_.WMF", cAlternateFileName="")) returned 1 [0170.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00395_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0170.661] GetProcessHeap () returned 0x4e0000 [0170.661] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0170.661] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0170.661] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0170.661] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0170.719] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.719] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.719] GetProcessHeap () returned 0x4e0000 [0170.719] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0170.719] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0170.719] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.719] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0170.720] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0170.720] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0170.720] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0170.721] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0170.721] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0170.721] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.721] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.721] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.721] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x194a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x194a, lpOverlapped=0x0) returned 1 [0170.748] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1950, dwBufLen=0x1950 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1950) returned 1 [0170.749] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.749] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1950, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1950, lpOverlapped=0x0) returned 1 [0170.749] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.749] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1a24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.749] SetEndOfFile (hFile=0xdc) returned 1 [0170.752] GetProcessHeap () returned 0x4e0000 [0170.752] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0170.752] GetProcessHeap () returned 0x4e0000 [0170.752] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0170.752] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00395_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00395_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0170.754] CloseHandle (hObject=0xdc) returned 1 [0170.754] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4af1d100, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4af1d100, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x38c6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00396_.WMF", cAlternateFileName="")) returned 1 [0170.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00396_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0170.755] GetProcessHeap () returned 0x4e0000 [0170.755] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0170.755] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0170.756] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0170.756] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0170.758] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.758] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.758] GetProcessHeap () returned 0x4e0000 [0170.758] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0170.758] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0170.758] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.758] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0170.758] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0170.758] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0170.758] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0170.759] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0170.759] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0170.759] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.759] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.759] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.759] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x38c6, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x38c6, lpOverlapped=0x0) returned 1 [0170.760] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x38d0, dwBufLen=0x38d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x38d0) returned 1 [0170.761] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.761] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x38d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x38d0, lpOverlapped=0x0) returned 1 [0170.761] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.761] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x39a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.761] SetEndOfFile (hFile=0xdc) returned 1 [0170.763] GetProcessHeap () returned 0x4e0000 [0170.764] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0170.764] GetProcessHeap () returned 0x4e0000 [0170.764] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0170.764] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00396_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00396_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0170.766] CloseHandle (hObject=0xdc) returned 1 [0170.766] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x239b0400, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x239b0400, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x173e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00417_.WMF", cAlternateFileName="")) returned 1 [0170.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00417_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0170.767] GetProcessHeap () returned 0x4e0000 [0170.767] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0170.767] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0170.767] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0170.768] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0170.769] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.770] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.770] GetProcessHeap () returned 0x4e0000 [0170.770] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0170.770] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0170.770] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.770] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0170.770] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0170.770] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0170.770] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0170.770] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0170.770] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0170.770] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.770] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.770] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.770] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x173e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x173e, lpOverlapped=0x0) returned 1 [0170.771] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1740, dwBufLen=0x1740 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1740) returned 1 [0170.771] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.772] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1740, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1740, lpOverlapped=0x0) returned 1 [0170.772] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.772] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.772] SetEndOfFile (hFile=0xdc) returned 1 [0170.774] GetProcessHeap () returned 0x4e0000 [0170.775] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0170.775] GetProcessHeap () returned 0x4e0000 [0170.775] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0170.775] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00417_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00417_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0170.776] CloseHandle (hObject=0xdc) returned 1 [0170.776] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x313b9400, ftCreationTime.dwHighDateTime=0x1bd4aeb, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x313b9400, ftLastWriteTime.dwHighDateTime=0x1bd4aeb, nFileSizeHigh=0x0, nFileSizeLow=0x4696, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00433_.WMF", cAlternateFileName="")) returned 1 [0170.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00433_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0170.777] GetProcessHeap () returned 0x4e0000 [0170.777] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0170.777] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0170.777] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0170.777] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0170.781] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.781] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.781] GetProcessHeap () returned 0x4e0000 [0170.781] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0170.781] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0170.781] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.781] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0170.781] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0170.781] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0170.781] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0170.781] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0170.781] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0170.781] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.781] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.781] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.782] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4696, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4696, lpOverlapped=0x0) returned 1 [0170.783] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x46a0, dwBufLen=0x46a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x46a0) returned 1 [0170.783] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.783] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x46a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x46a0, lpOverlapped=0x0) returned 1 [0170.783] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.783] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4774, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.783] SetEndOfFile (hFile=0xdc) returned 1 [0170.786] GetProcessHeap () returned 0x4e0000 [0170.786] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0170.786] GetProcessHeap () returned 0x4e0000 [0170.786] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0170.786] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00433_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00433_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0170.787] CloseHandle (hObject=0xdc) returned 1 [0170.787] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdea9aa00, ftCreationTime.dwHighDateTime=0x1bd4ae1, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdea9aa00, ftLastWriteTime.dwHighDateTime=0x1bd4ae1, nFileSizeHigh=0x0, nFileSizeLow=0x2f38, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00438_.WMF", cAlternateFileName="")) returned 1 [0170.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0170.794] GetProcessHeap () returned 0x4e0000 [0170.794] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0170.794] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0170.794] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0170.794] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0170.807] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.807] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.807] GetProcessHeap () returned 0x4e0000 [0170.807] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0170.807] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0170.807] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.807] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0170.807] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0170.808] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0170.808] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0170.808] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0170.808] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0170.808] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.808] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.808] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.808] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2f38, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2f38, lpOverlapped=0x0) returned 1 [0170.809] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2f40, dwBufLen=0x2f40 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2f40) returned 1 [0170.809] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.809] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2f40, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2f40, lpOverlapped=0x0) returned 1 [0170.810] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.810] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.810] SetEndOfFile (hFile=0xdc) returned 1 [0170.812] GetProcessHeap () returned 0x4e0000 [0170.812] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0170.812] GetProcessHeap () returned 0x4e0000 [0170.813] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0170.813] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00438_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00438_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0170.814] CloseHandle (hObject=0xdc) returned 1 [0170.815] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f311400, ftCreationTime.dwHighDateTime=0x1bd4b32, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1f311400, ftLastWriteTime.dwHighDateTime=0x1bd4b32, nFileSizeHigh=0x0, nFileSizeLow=0x14bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00452_.WMF", cAlternateFileName="")) returned 1 [0170.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00452_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0170.816] GetProcessHeap () returned 0x4e0000 [0170.816] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0170.816] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0170.816] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0170.816] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0170.818] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.818] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.818] GetProcessHeap () returned 0x4e0000 [0170.818] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0170.818] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0170.818] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.819] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0170.819] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0170.819] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0170.819] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0170.819] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0170.819] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0170.819] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.819] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.819] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.819] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x14bc, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x14bc, lpOverlapped=0x0) returned 1 [0170.820] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x14c0, dwBufLen=0x14c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x14c0) returned 1 [0170.820] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.821] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x14c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x14c0, lpOverlapped=0x0) returned 1 [0170.821] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.821] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1594, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.821] SetEndOfFile (hFile=0xdc) returned 1 [0170.823] GetProcessHeap () returned 0x4e0000 [0170.823] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0170.823] GetProcessHeap () returned 0x4e0000 [0170.824] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0170.824] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00452_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00452_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0170.825] CloseHandle (hObject=0xdc) returned 1 [0170.825] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cceba00, ftCreationTime.dwHighDateTime=0x1bd4b32, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1cceba00, ftLastWriteTime.dwHighDateTime=0x1bd4b32, nFileSizeHigh=0x0, nFileSizeLow=0x1580, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00454_.WMF", cAlternateFileName="")) returned 1 [0170.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00454_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0170.827] GetProcessHeap () returned 0x4e0000 [0170.827] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0170.827] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0170.827] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0170.827] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.827] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.827] GetProcessHeap () returned 0x4e0000 [0170.827] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0170.827] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0170.827] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.827] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0170.829] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0170.829] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0170.829] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0170.830] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0170.830] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0170.830] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.830] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.830] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.830] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1580, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1580, lpOverlapped=0x0) returned 1 [0170.831] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1580, dwBufLen=0x1580 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1580) returned 1 [0170.831] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.831] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1580, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1580, lpOverlapped=0x0) returned 1 [0170.831] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.831] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1654, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.832] SetEndOfFile (hFile=0xdc) returned 1 [0170.834] GetProcessHeap () returned 0x4e0000 [0170.834] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0170.834] GetProcessHeap () returned 0x4e0000 [0170.834] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0170.834] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00454_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00454_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0170.837] CloseHandle (hObject=0xdc) returned 1 [0170.837] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf78d7c00, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf78d7c00, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x27a4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00458_.WMF", cAlternateFileName="")) returned 1 [0170.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00458_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0170.838] GetProcessHeap () returned 0x4e0000 [0170.838] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0170.838] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0170.838] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0170.838] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0170.842] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.842] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.842] GetProcessHeap () returned 0x4e0000 [0170.842] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0170.842] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0170.842] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.842] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0170.842] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0170.842] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0170.843] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0170.843] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0170.843] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0170.843] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.843] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.843] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.843] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x27a4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x27a4, lpOverlapped=0x0) returned 1 [0170.846] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x27b0, dwBufLen=0x27b0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x27b0) returned 1 [0170.846] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.846] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x27b0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x27b0, lpOverlapped=0x0) returned 1 [0170.846] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.846] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2884, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.846] SetEndOfFile (hFile=0xdc) returned 1 [0170.849] GetProcessHeap () returned 0x4e0000 [0170.849] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0170.849] GetProcessHeap () returned 0x4e0000 [0170.849] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0170.849] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00458_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00458_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0170.851] CloseHandle (hObject=0xdc) returned 1 [0170.851] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe80e3300, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe80e3300, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x4f6c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00462_.WMF", cAlternateFileName="")) returned 1 [0170.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00462_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0170.852] GetProcessHeap () returned 0x4e0000 [0170.852] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0170.853] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0170.853] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0170.853] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0170.855] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.855] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.855] GetProcessHeap () returned 0x4e0000 [0170.855] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0170.855] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0170.855] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.855] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0170.855] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0170.856] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0170.856] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0170.856] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0170.856] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0170.856] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.856] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.856] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.856] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4f6c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4f6c, lpOverlapped=0x0) returned 1 [0170.857] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4f70, dwBufLen=0x4f70 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4f70) returned 1 [0170.857] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.858] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4f70, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4f70, lpOverlapped=0x0) returned 1 [0170.858] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.858] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5044, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.858] SetEndOfFile (hFile=0xdc) returned 1 [0170.861] GetProcessHeap () returned 0x4e0000 [0170.861] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0170.861] GetProcessHeap () returned 0x4e0000 [0170.861] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0170.861] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00462_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00462_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0170.862] CloseHandle (hObject=0xdc) returned 1 [0170.863] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x735300, ftCreationTime.dwHighDateTime=0x1bd4b1b, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x735300, ftLastWriteTime.dwHighDateTime=0x1bd4b1b, nFileSizeHigh=0x0, nFileSizeLow=0xc10, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00487_.WMF", cAlternateFileName="")) returned 1 [0170.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00487_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0170.864] GetProcessHeap () returned 0x4e0000 [0170.864] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0170.865] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0170.865] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0170.865] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.865] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.865] GetProcessHeap () returned 0x4e0000 [0170.865] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0170.865] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0170.865] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.865] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0170.867] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0170.867] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0170.867] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0170.867] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0170.867] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0170.867] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.867] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.867] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.868] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xc10, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xc10, lpOverlapped=0x0) returned 1 [0170.868] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xc10, dwBufLen=0xc10 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xc10) returned 1 [0170.868] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.868] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc10, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xc10, lpOverlapped=0x0) returned 1 [0170.868] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.868] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xce4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.868] SetEndOfFile (hFile=0xdc) returned 1 [0170.871] GetProcessHeap () returned 0x4e0000 [0170.871] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0170.871] GetProcessHeap () returned 0x4e0000 [0170.871] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0170.871] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00487_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00487_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0170.872] CloseHandle (hObject=0xdc) returned 1 [0170.872] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x955a5a00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x955a5a00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x938, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00494_.WMF", cAlternateFileName="")) returned 1 [0170.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00494_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0170.873] GetProcessHeap () returned 0x4e0000 [0170.873] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0170.874] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0170.874] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0170.874] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0170.876] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.876] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.876] GetProcessHeap () returned 0x4e0000 [0170.876] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0170.876] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0170.876] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.876] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0170.876] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0170.876] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0170.876] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0170.876] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0170.876] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0170.876] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.876] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.876] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.877] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x938, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x938, lpOverlapped=0x0) returned 1 [0170.877] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x940, dwBufLen=0x940 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x940) returned 1 [0170.877] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.877] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x940, lpOverlapped=0x0) returned 1 [0170.877] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.877] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xa14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.877] SetEndOfFile (hFile=0xdc) returned 1 [0170.879] GetProcessHeap () returned 0x4e0000 [0170.880] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0170.880] GetProcessHeap () returned 0x4e0000 [0170.880] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0170.880] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00494_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00494_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0170.881] CloseHandle (hObject=0xdc) returned 1 [0170.881] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bf33f00, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2bf33f00, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0xb60, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00512_.WMF", cAlternateFileName="")) returned 1 [0170.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00512_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0170.882] GetProcessHeap () returned 0x4e0000 [0170.882] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0170.882] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0170.906] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0170.906] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.906] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.906] GetProcessHeap () returned 0x4e0000 [0170.907] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0170.907] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0170.907] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.907] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0170.924] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0170.924] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0170.924] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0170.924] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0170.924] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0170.924] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.924] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.924] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.924] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb60, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xb60, lpOverlapped=0x0) returned 1 [0170.925] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xb60, dwBufLen=0xb60 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xb60) returned 1 [0170.925] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.925] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xb60, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xb60, lpOverlapped=0x0) returned 1 [0170.925] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.925] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xc34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.925] SetEndOfFile (hFile=0xdc) returned 1 [0170.927] GetProcessHeap () returned 0x4e0000 [0170.928] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0170.928] GetProcessHeap () returned 0x4e0000 [0170.928] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0170.928] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00512_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00512_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0170.930] CloseHandle (hObject=0xdc) returned 1 [0170.930] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc9b2c00, ftCreationTime.dwHighDateTime=0x1bd4b20, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc9b2c00, ftLastWriteTime.dwHighDateTime=0x1bd4b20, nFileSizeHigh=0x0, nFileSizeLow=0x6efa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00523_.WMF", cAlternateFileName="")) returned 1 [0170.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00523_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0170.931] GetProcessHeap () returned 0x4e0000 [0170.931] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0170.931] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0170.931] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0170.931] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0170.937] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.937] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.937] GetProcessHeap () returned 0x4e0000 [0170.937] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0170.937] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0170.937] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.937] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0170.937] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0170.937] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0170.937] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0170.938] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0170.938] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0170.938] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.938] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.938] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.938] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x6efa, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x6efa, lpOverlapped=0x0) returned 1 [0170.939] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6f00, dwBufLen=0x6f00 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6f00) returned 1 [0170.939] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.939] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6f00, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x6f00, lpOverlapped=0x0) returned 1 [0170.940] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.940] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6fd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.940] SetEndOfFile (hFile=0xdc) returned 1 [0170.942] GetProcessHeap () returned 0x4e0000 [0170.942] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0170.942] GetProcessHeap () returned 0x4e0000 [0170.943] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0170.943] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00523_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00523_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0170.945] CloseHandle (hObject=0xdc) returned 1 [0170.945] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6a54b00, ftCreationTime.dwHighDateTime=0x1bd4b20, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6a54b00, ftLastWriteTime.dwHighDateTime=0x1bd4b20, nFileSizeHigh=0x0, nFileSizeLow=0x5880, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00525_.WMF", cAlternateFileName="")) returned 1 [0170.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00525_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0170.947] GetProcessHeap () returned 0x4e0000 [0170.947] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0170.947] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0170.947] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0170.947] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.947] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.947] GetProcessHeap () returned 0x4e0000 [0170.947] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0170.947] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0170.947] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.947] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0170.949] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0170.949] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0170.950] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0170.950] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0170.950] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0170.950] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.950] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.950] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.950] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5880, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x5880, lpOverlapped=0x0) returned 1 [0170.951] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5880, dwBufLen=0x5880 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5880) returned 1 [0170.951] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.951] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5880, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5880, lpOverlapped=0x0) returned 1 [0170.952] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.952] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5954, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.952] SetEndOfFile (hFile=0xdc) returned 1 [0170.954] GetProcessHeap () returned 0x4e0000 [0170.954] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0170.954] GetProcessHeap () returned 0x4e0000 [0170.954] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0170.955] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00525_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00525_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0170.956] CloseHandle (hObject=0xdc) returned 1 [0170.956] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35fc4a00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35fc4a00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x477c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00530_.WMF", cAlternateFileName="")) returned 1 [0170.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00530_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0170.959] GetProcessHeap () returned 0x4e0000 [0170.959] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0170.960] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0170.960] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0170.960] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0170.977] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.977] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.977] GetProcessHeap () returned 0x4e0000 [0170.977] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0170.977] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0170.977] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.977] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0170.977] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0170.978] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0170.978] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0170.978] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0170.978] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0170.978] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.978] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.978] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.978] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x477c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x477c, lpOverlapped=0x0) returned 1 [0170.979] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4780, dwBufLen=0x4780 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4780) returned 1 [0170.979] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.979] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4780, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4780, lpOverlapped=0x0) returned 1 [0170.980] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.980] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4854, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.980] SetEndOfFile (hFile=0xdc) returned 1 [0170.982] GetProcessHeap () returned 0x4e0000 [0170.982] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0170.983] GetProcessHeap () returned 0x4e0000 [0170.983] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0170.983] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00530_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00530_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0170.984] CloseHandle (hObject=0xdc) returned 1 [0170.985] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x530, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00532_.WMF", cAlternateFileName="")) returned 1 [0170.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00532_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0170.986] GetProcessHeap () returned 0x4e0000 [0170.986] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0170.986] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0170.986] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0170.986] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.986] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.986] GetProcessHeap () returned 0x4e0000 [0170.986] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0170.986] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0170.986] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.986] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0170.989] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0170.989] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0170.989] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0170.989] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0170.989] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0170.989] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.989] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.989] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.989] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x530, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x530, lpOverlapped=0x0) returned 1 [0170.990] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x530, dwBufLen=0x530 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x530) returned 1 [0170.990] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.990] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x530, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x530, lpOverlapped=0x0) returned 1 [0170.990] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.990] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x604, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.990] SetEndOfFile (hFile=0xdc) returned 1 [0170.992] GetProcessHeap () returned 0x4e0000 [0170.992] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0170.993] GetProcessHeap () returned 0x4e0000 [0170.993] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0170.993] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00532_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00532_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0170.994] CloseHandle (hObject=0xdc) returned 1 [0170.994] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34cb1d00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34cb1d00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x7d14, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00538_.WMF", cAlternateFileName="")) returned 1 [0170.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00538_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0170.996] GetProcessHeap () returned 0x4e0000 [0170.996] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0170.996] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0170.996] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0170.996] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0170.998] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.998] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.998] GetProcessHeap () returned 0x4e0000 [0170.998] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0170.998] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0170.998] CryptDestroyKey (hKey=0x522f98) returned 1 [0170.998] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0170.998] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0170.998] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0170.998] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0170.998] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0170.998] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0170.999] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0170.999] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0170.999] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.999] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7d14, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7d14, lpOverlapped=0x0) returned 1 [0171.000] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7d20, dwBufLen=0x7d20 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7d20) returned 1 [0171.000] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.000] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7d20, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7d20, lpOverlapped=0x0) returned 1 [0171.001] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.001] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7df4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.001] SetEndOfFile (hFile=0xdc) returned 1 [0171.004] GetProcessHeap () returned 0x4e0000 [0171.004] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.004] GetProcessHeap () returned 0x4e0000 [0171.004] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.004] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00538_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00538_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.006] CloseHandle (hObject=0xdc) returned 1 [0171.006] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23970600, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x23970600, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0x64c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00641_.WMF", cAlternateFileName="")) returned 1 [0171.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00641_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.008] GetProcessHeap () returned 0x4e0000 [0171.008] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.008] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.008] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.008] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.010] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.010] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.010] GetProcessHeap () returned 0x4e0000 [0171.010] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.010] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.010] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.010] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.010] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.011] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.011] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.011] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.011] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.011] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.011] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.011] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.011] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x64c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x64c, lpOverlapped=0x0) returned 1 [0171.011] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x650, dwBufLen=0x650 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x650) returned 1 [0171.011] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.011] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x650, lpOverlapped=0x0) returned 1 [0171.011] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.011] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x724, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.012] SetEndOfFile (hFile=0xdc) returned 1 [0171.014] GetProcessHeap () returned 0x4e0000 [0171.014] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.014] GetProcessHeap () returned 0x4e0000 [0171.014] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.014] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00641_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00641_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.016] CloseHandle (hObject=0xdc) returned 1 [0171.017] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7658, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00784_.WMF", cAlternateFileName="")) returned 1 [0171.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00784_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.031] GetProcessHeap () returned 0x4e0000 [0171.031] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.031] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.031] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.031] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.050] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.050] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.050] GetProcessHeap () returned 0x4e0000 [0171.050] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.050] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.050] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.050] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.051] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.051] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.051] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.051] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.051] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.051] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.051] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.051] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.051] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7658, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7658, lpOverlapped=0x0) returned 1 [0171.052] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7660, dwBufLen=0x7660 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7660) returned 1 [0171.053] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.053] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7660, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7660, lpOverlapped=0x0) returned 1 [0171.053] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.053] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7734, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.053] SetEndOfFile (hFile=0xdc) returned 1 [0171.056] GetProcessHeap () returned 0x4e0000 [0171.056] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.057] GetProcessHeap () returned 0x4e0000 [0171.057] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.057] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00784_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00784_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.059] CloseHandle (hObject=0xdc) returned 1 [0171.059] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43213500, ftCreationTime.dwHighDateTime=0x1bd4af3, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x43213500, ftLastWriteTime.dwHighDateTime=0x1bd4af3, nFileSizeHigh=0x0, nFileSizeLow=0x23f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00798_.WMF", cAlternateFileName="")) returned 1 [0171.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00798_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.060] GetProcessHeap () returned 0x4e0000 [0171.060] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.060] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.060] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.060] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.062] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.062] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.063] GetProcessHeap () returned 0x4e0000 [0171.063] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.063] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.063] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.063] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.063] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.063] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.063] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.063] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.063] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.063] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.063] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.063] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.064] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x23f8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x23f8, lpOverlapped=0x0) returned 1 [0171.065] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2400, dwBufLen=0x2400 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2400) returned 1 [0171.065] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.065] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2400, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2400, lpOverlapped=0x0) returned 1 [0171.065] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.065] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x24d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.065] SetEndOfFile (hFile=0xdc) returned 1 [0171.068] GetProcessHeap () returned 0x4e0000 [0171.068] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.068] GetProcessHeap () returned 0x4e0000 [0171.068] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.068] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00798_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00798_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.070] CloseHandle (hObject=0xdc) returned 1 [0171.070] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecc0f000, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xecc0f000, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0x788, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00806_.WMF", cAlternateFileName="")) returned 1 [0171.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00806_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.072] GetProcessHeap () returned 0x4e0000 [0171.072] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.072] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.072] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.072] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.074] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.074] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.074] GetProcessHeap () returned 0x4e0000 [0171.074] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.074] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.074] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.074] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.074] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.074] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.074] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.074] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.074] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.075] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.075] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.075] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.075] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x788, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x788, lpOverlapped=0x0) returned 1 [0171.075] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x790, dwBufLen=0x790 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x790) returned 1 [0171.075] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.075] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x790, lpOverlapped=0x0) returned 1 [0171.075] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.075] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x864, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.075] SetEndOfFile (hFile=0xdc) returned 1 [0171.077] GetProcessHeap () returned 0x4e0000 [0171.077] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.077] GetProcessHeap () returned 0x4e0000 [0171.077] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.077] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00806_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00806_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.078] CloseHandle (hObject=0xdc) returned 1 [0171.078] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb8fc300, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb8fc300, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0xba4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00807_.WMF", cAlternateFileName="")) returned 1 [0171.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00807_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.079] GetProcessHeap () returned 0x4e0000 [0171.079] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.079] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.079] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.079] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0171.081] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.081] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.081] GetProcessHeap () returned 0x4e0000 [0171.081] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.081] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.081] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.081] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.081] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.081] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.081] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.081] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.082] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.082] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.082] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.082] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.082] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xba4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xba4, lpOverlapped=0x0) returned 1 [0171.082] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xbb0, dwBufLen=0xbb0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xbb0) returned 1 [0171.082] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.082] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xbb0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xbb0, lpOverlapped=0x0) returned 1 [0171.082] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.082] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xc84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.082] SetEndOfFile (hFile=0xdc) returned 1 [0171.084] GetProcessHeap () returned 0x4e0000 [0171.084] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.084] GetProcessHeap () returned 0x4e0000 [0171.084] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.084] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00807_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00807_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.098] CloseHandle (hObject=0xdc) returned 1 [0171.098] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bce0800, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7bce0800, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0x514, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00808_.WMF", cAlternateFileName="")) returned 1 [0171.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00808_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.117] GetProcessHeap () returned 0x4e0000 [0171.117] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.117] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.117] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.117] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0171.123] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.123] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.123] GetProcessHeap () returned 0x4e0000 [0171.123] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.123] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.123] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.123] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.123] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.123] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.123] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.123] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.123] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.123] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.124] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.124] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.124] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x514, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x514, lpOverlapped=0x0) returned 1 [0171.124] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x520, dwBufLen=0x520 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x520) returned 1 [0171.124] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.124] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x520, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x520, lpOverlapped=0x0) returned 1 [0171.124] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.124] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.124] SetEndOfFile (hFile=0xdc) returned 1 [0171.126] GetProcessHeap () returned 0x4e0000 [0171.126] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.126] GetProcessHeap () returned 0x4e0000 [0171.126] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.126] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00808_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00808_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.128] CloseHandle (hObject=0xdc) returned 1 [0171.128] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92d6900, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe92d6900, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0x608, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00809_.WMF", cAlternateFileName="")) returned 1 [0171.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00809_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.129] GetProcessHeap () returned 0x4e0000 [0171.129] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.129] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.129] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.129] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.155] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.155] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.156] GetProcessHeap () returned 0x4e0000 [0171.156] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.156] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.156] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.156] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.156] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.156] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.156] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.156] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.156] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.156] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.156] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.156] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.156] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x608, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x608, lpOverlapped=0x0) returned 1 [0171.156] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x610, dwBufLen=0x610 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x610) returned 1 [0171.156] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.156] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x610, lpOverlapped=0x0) returned 1 [0171.157] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.157] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.157] SetEndOfFile (hFile=0xdc) returned 1 [0171.159] GetProcessHeap () returned 0x4e0000 [0171.159] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.159] GetProcessHeap () returned 0x4e0000 [0171.159] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.159] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00809_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00809_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.161] CloseHandle (hObject=0xdc) returned 1 [0171.161] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd58, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00810_.WMF", cAlternateFileName="")) returned 1 [0171.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00810_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.162] GetProcessHeap () returned 0x4e0000 [0171.162] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.162] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.162] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.162] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.165] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.165] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.165] GetProcessHeap () returned 0x4e0000 [0171.165] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.165] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.165] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.165] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.165] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.165] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.165] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.165] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.165] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.165] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.165] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.165] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.165] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xd58, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xd58, lpOverlapped=0x0) returned 1 [0171.165] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xd60, dwBufLen=0xd60 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xd60) returned 1 [0171.166] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.166] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xd60, lpOverlapped=0x0) returned 1 [0171.166] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.166] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xe34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.166] SetEndOfFile (hFile=0xdc) returned 1 [0171.168] GetProcessHeap () returned 0x4e0000 [0171.168] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.168] GetProcessHeap () returned 0x4e0000 [0171.168] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.168] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00810_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00810_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.170] CloseHandle (hObject=0xdc) returned 1 [0171.170] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3210, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00932_.WMF", cAlternateFileName="")) returned 1 [0171.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.171] GetProcessHeap () returned 0x4e0000 [0171.171] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.171] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.171] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.171] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.171] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.171] GetProcessHeap () returned 0x4e0000 [0171.171] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.171] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.171] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.171] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.174] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.174] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.175] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.175] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.175] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.175] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.175] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.175] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.175] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3210, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3210, lpOverlapped=0x0) returned 1 [0171.176] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3210, dwBufLen=0x3210 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3210) returned 1 [0171.177] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.177] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3210, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3210, lpOverlapped=0x0) returned 1 [0171.177] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.177] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x32e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.177] SetEndOfFile (hFile=0xdc) returned 1 [0171.179] GetProcessHeap () returned 0x4e0000 [0171.179] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.179] GetProcessHeap () returned 0x4e0000 [0171.179] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.179] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00932_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00932_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.181] CloseHandle (hObject=0xdc) returned 1 [0171.181] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8abf600, ftCreationTime.dwHighDateTime=0x1bd4b31, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb8abf600, ftLastWriteTime.dwHighDateTime=0x1bd4b31, nFileSizeHigh=0x0, nFileSizeLow=0x7c46, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01064_.WMF", cAlternateFileName="")) returned 1 [0171.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01064_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.181] GetProcessHeap () returned 0x4e0000 [0171.181] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.182] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.182] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.182] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0171.183] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.184] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.184] GetProcessHeap () returned 0x4e0000 [0171.184] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.184] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.184] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.184] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.184] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.184] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.184] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.184] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.184] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.184] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.184] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.184] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.184] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7c46, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7c46, lpOverlapped=0x0) returned 1 [0171.185] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7c50, dwBufLen=0x7c50 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7c50) returned 1 [0171.186] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.186] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7c50, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7c50, lpOverlapped=0x0) returned 1 [0171.186] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.186] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7d24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.186] SetEndOfFile (hFile=0xdc) returned 1 [0171.188] GetProcessHeap () returned 0x4e0000 [0171.188] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.188] GetProcessHeap () returned 0x4e0000 [0171.188] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.188] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01064_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01064_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.189] CloseHandle (hObject=0xdc) returned 1 [0171.189] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x117a8f00, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x117a8f00, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x54a8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01066_.WMF", cAlternateFileName="")) returned 1 [0171.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01066_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.191] GetProcessHeap () returned 0x4e0000 [0171.191] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.191] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.191] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.191] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.193] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.193] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.193] GetProcessHeap () returned 0x4e0000 [0171.193] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.193] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.193] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.193] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.193] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.193] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.193] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.193] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.193] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.194] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.194] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.194] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.194] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x54a8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x54a8, lpOverlapped=0x0) returned 1 [0171.195] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x54b0, dwBufLen=0x54b0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x54b0) returned 1 [0171.196] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.196] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x54b0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x54b0, lpOverlapped=0x0) returned 1 [0171.196] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.196] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5584, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.196] SetEndOfFile (hFile=0xdc) returned 1 [0171.198] GetProcessHeap () returned 0x4e0000 [0171.198] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.198] GetProcessHeap () returned 0x4e0000 [0171.198] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.198] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01066_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01066_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.207] CloseHandle (hObject=0xdc) returned 1 [0171.207] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0d55d00, ftCreationTime.dwHighDateTime=0x1bd4b03, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0d55d00, ftLastWriteTime.dwHighDateTime=0x1bd4b03, nFileSizeHigh=0x0, nFileSizeLow=0x1a7e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01069_.WMF", cAlternateFileName="")) returned 1 [0171.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01069_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.209] GetProcessHeap () returned 0x4e0000 [0171.209] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.209] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.209] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.209] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0171.211] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.211] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.211] GetProcessHeap () returned 0x4e0000 [0171.211] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.211] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.211] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.212] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.212] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.212] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.212] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.212] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.212] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.212] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.212] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.212] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.212] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1a7e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1a7e, lpOverlapped=0x0) returned 1 [0171.213] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1a80, dwBufLen=0x1a80 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1a80) returned 1 [0171.213] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.213] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1a80, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1a80, lpOverlapped=0x0) returned 1 [0171.213] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.213] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1b54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.213] SetEndOfFile (hFile=0xdc) returned 1 [0171.215] GetProcessHeap () returned 0x4e0000 [0171.215] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.215] GetProcessHeap () returned 0x4e0000 [0171.215] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.215] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01069_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01069_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.216] CloseHandle (hObject=0xdc) returned 1 [0171.217] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe19e000, ftCreationTime.dwHighDateTime=0x1bd4afd, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe19e000, ftLastWriteTime.dwHighDateTime=0x1bd4afd, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01123_.WMF", cAlternateFileName="")) returned 1 [0171.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01123_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.217] GetProcessHeap () returned 0x4e0000 [0171.217] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.217] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.217] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.217] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.218] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.218] GetProcessHeap () returned 0x4e0000 [0171.218] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.218] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.218] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.218] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.219] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.219] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.219] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.220] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.220] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.220] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.220] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.220] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.220] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1e00, lpOverlapped=0x0) returned 1 [0171.221] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1e00, dwBufLen=0x1e00 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1e00) returned 1 [0171.221] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.221] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1e00, lpOverlapped=0x0) returned 1 [0171.221] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.221] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.221] SetEndOfFile (hFile=0xdc) returned 1 [0171.223] GetProcessHeap () returned 0x4e0000 [0171.223] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.223] GetProcessHeap () returned 0x4e0000 [0171.223] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.223] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01123_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01123_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.224] CloseHandle (hObject=0xdc) returned 1 [0171.224] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe23d3100, ftCreationTime.dwHighDateTime=0x1bd4ae1, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe23d3100, ftLastWriteTime.dwHighDateTime=0x1bd4ae1, nFileSizeHigh=0x0, nFileSizeLow=0xb70, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01126_.WMF", cAlternateFileName="")) returned 1 [0171.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01126_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.225] GetProcessHeap () returned 0x4e0000 [0171.225] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.225] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.225] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.225] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.225] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.225] GetProcessHeap () returned 0x4e0000 [0171.225] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.225] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.225] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.225] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.227] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.227] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.227] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.227] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.227] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.227] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.227] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.227] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.227] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb70, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xb70, lpOverlapped=0x0) returned 1 [0171.228] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xb70, dwBufLen=0xb70 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xb70) returned 1 [0171.228] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.228] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xb70, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xb70, lpOverlapped=0x0) returned 1 [0171.228] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.228] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xc44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.228] SetEndOfFile (hFile=0xdc) returned 1 [0171.230] GetProcessHeap () returned 0x4e0000 [0171.230] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.230] GetProcessHeap () returned 0x4e0000 [0171.230] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.230] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01126_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01126_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.231] CloseHandle (hObject=0xdc) returned 1 [0171.231] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94292d00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94292d00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x16a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01130_.WMF", cAlternateFileName="")) returned 1 [0171.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01130_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.231] GetProcessHeap () returned 0x4e0000 [0171.231] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.231] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.231] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.231] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.232] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.232] GetProcessHeap () returned 0x4e0000 [0171.232] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.232] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.232] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.232] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.236] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.236] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.236] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.236] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.236] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.236] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.236] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.236] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.237] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x16a0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x16a0, lpOverlapped=0x0) returned 1 [0171.237] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x16a0, dwBufLen=0x16a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x16a0) returned 1 [0171.237] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.237] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x16a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x16a0, lpOverlapped=0x0) returned 1 [0171.237] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.238] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1774, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.238] SetEndOfFile (hFile=0xdc) returned 1 [0171.241] GetProcessHeap () returned 0x4e0000 [0171.241] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.241] GetProcessHeap () returned 0x4e0000 [0171.241] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.241] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01130_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01130_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.243] CloseHandle (hObject=0xdc) returned 1 [0171.243] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22e1e00, ftCreationTime.dwHighDateTime=0x1bd4afd, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22e1e00, ftLastWriteTime.dwHighDateTime=0x1bd4afd, nFileSizeHigh=0x0, nFileSizeLow=0x16d8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01141_.WMF", cAlternateFileName="")) returned 1 [0171.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.244] GetProcessHeap () returned 0x4e0000 [0171.244] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.244] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.244] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.244] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.246] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.246] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.246] GetProcessHeap () returned 0x4e0000 [0171.246] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.246] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.246] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.246] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.246] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.246] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.246] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.246] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.246] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.246] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.246] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.246] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.246] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x16d8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x16d8, lpOverlapped=0x0) returned 1 [0171.247] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x16e0, dwBufLen=0x16e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x16e0) returned 1 [0171.247] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.247] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x16e0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x16e0, lpOverlapped=0x0) returned 1 [0171.247] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.247] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x17b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.247] SetEndOfFile (hFile=0xdc) returned 1 [0171.249] GetProcessHeap () returned 0x4e0000 [0171.249] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.249] GetProcessHeap () returned 0x4e0000 [0171.249] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.250] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01141_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01141_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.251] CloseHandle (hObject=0xdc) returned 1 [0171.251] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc383d00, ftCreationTime.dwHighDateTime=0x1bd4afc, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc383d00, ftLastWriteTime.dwHighDateTime=0x1bd4afc, nFileSizeHigh=0x0, nFileSizeLow=0x1f38, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01148_.WMF", cAlternateFileName="")) returned 1 [0171.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01148_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.252] GetProcessHeap () returned 0x4e0000 [0171.252] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.252] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.252] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.252] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.254] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.254] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.254] GetProcessHeap () returned 0x4e0000 [0171.254] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.254] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.254] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.254] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.254] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.254] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.254] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.254] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.254] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.254] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.254] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.255] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.255] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1f38, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1f38, lpOverlapped=0x0) returned 1 [0171.255] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1f40, dwBufLen=0x1f40 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1f40) returned 1 [0171.255] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.255] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1f40, lpOverlapped=0x0) returned 1 [0171.256] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.256] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.256] SetEndOfFile (hFile=0xdc) returned 1 [0171.258] GetProcessHeap () returned 0x4e0000 [0171.258] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.258] GetProcessHeap () returned 0x4e0000 [0171.258] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.258] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01148_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01148_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.260] CloseHandle (hObject=0xdc) returned 1 [0171.260] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1248, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01149_.WMF", cAlternateFileName="")) returned 1 [0171.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01149_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.261] GetProcessHeap () returned 0x4e0000 [0171.261] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.261] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.261] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.262] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.263] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.263] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.263] GetProcessHeap () returned 0x4e0000 [0171.263] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.263] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.263] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.263] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.263] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.264] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.264] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.264] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.264] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.264] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.264] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.264] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.264] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1248, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1248, lpOverlapped=0x0) returned 1 [0171.265] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1250, dwBufLen=0x1250 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1250) returned 1 [0171.265] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.265] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1250, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1250, lpOverlapped=0x0) returned 1 [0171.265] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.265] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1324, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.265] SetEndOfFile (hFile=0xdc) returned 1 [0171.267] GetProcessHeap () returned 0x4e0000 [0171.267] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.267] GetProcessHeap () returned 0x4e0000 [0171.267] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.267] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01149_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01149_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.269] CloseHandle (hObject=0xdc) returned 1 [0171.269] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7738900, ftCreationTime.dwHighDateTime=0x1bd4afc, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7738900, ftLastWriteTime.dwHighDateTime=0x1bd4afc, nFileSizeHigh=0x0, nFileSizeLow=0x2230, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01152_.WMF", cAlternateFileName="")) returned 1 [0171.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.270] GetProcessHeap () returned 0x4e0000 [0171.270] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.270] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.270] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.270] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.270] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.270] GetProcessHeap () returned 0x4e0000 [0171.270] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.270] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.270] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.270] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.272] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.272] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.272] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.272] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.272] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.272] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.272] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.272] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.272] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2230, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2230, lpOverlapped=0x0) returned 1 [0171.273] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2230, dwBufLen=0x2230 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2230) returned 1 [0171.273] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.273] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2230, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2230, lpOverlapped=0x0) returned 1 [0171.274] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.274] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2304, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.274] SetEndOfFile (hFile=0xdc) returned 1 [0171.276] GetProcessHeap () returned 0x4e0000 [0171.276] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.276] GetProcessHeap () returned 0x4e0000 [0171.276] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.276] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01152_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01152_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.277] CloseHandle (hObject=0xdc) returned 1 [0171.277] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6425c00, ftCreationTime.dwHighDateTime=0x1bd4afc, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6425c00, ftLastWriteTime.dwHighDateTime=0x1bd4afc, nFileSizeHigh=0x0, nFileSizeLow=0x15b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01154_.WMF", cAlternateFileName="")) returned 1 [0171.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01154_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.278] GetProcessHeap () returned 0x4e0000 [0171.278] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.278] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.278] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.278] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.278] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.278] GetProcessHeap () returned 0x4e0000 [0171.278] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.278] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.278] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.278] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.280] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.280] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.280] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.280] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.280] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.280] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.280] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.280] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.280] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x15b0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x15b0, lpOverlapped=0x0) returned 1 [0171.281] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x15b0, dwBufLen=0x15b0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x15b0) returned 1 [0171.281] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.281] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x15b0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x15b0, lpOverlapped=0x0) returned 1 [0171.282] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.282] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.282] SetEndOfFile (hFile=0xdc) returned 1 [0171.284] GetProcessHeap () returned 0x4e0000 [0171.284] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.284] GetProcessHeap () returned 0x4e0000 [0171.284] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.284] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01154_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01154_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.285] CloseHandle (hObject=0xdc) returned 1 [0171.285] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1858, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01157_.WMF", cAlternateFileName="")) returned 1 [0171.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01157_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.286] GetProcessHeap () returned 0x4e0000 [0171.286] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.286] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.286] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.286] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.288] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.288] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.288] GetProcessHeap () returned 0x4e0000 [0171.288] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.288] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.288] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.288] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.288] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.288] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.288] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.288] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.288] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.288] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.289] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.289] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.289] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1858, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1858, lpOverlapped=0x0) returned 1 [0171.289] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1860, dwBufLen=0x1860 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1860) returned 1 [0171.289] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.289] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1860, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1860, lpOverlapped=0x0) returned 1 [0171.290] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.290] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1934, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.290] SetEndOfFile (hFile=0xdc) returned 1 [0171.292] GetProcessHeap () returned 0x4e0000 [0171.292] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.292] GetProcessHeap () returned 0x4e0000 [0171.292] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.292] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01157_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01157_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.293] CloseHandle (hObject=0xdc) returned 1 [0171.293] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf04c7b00, ftCreationTime.dwHighDateTime=0x1bd4afc, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf04c7b00, ftLastWriteTime.dwHighDateTime=0x1bd4afc, nFileSizeHigh=0x0, nFileSizeLow=0x1c74, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01158_.WMF", cAlternateFileName="")) returned 1 [0171.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01158_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.295] GetProcessHeap () returned 0x4e0000 [0171.295] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.295] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.295] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.295] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0171.297] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.297] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.297] GetProcessHeap () returned 0x4e0000 [0171.297] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.297] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.297] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.297] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.297] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.297] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.297] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.297] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.298] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.298] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.298] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.298] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.298] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1c74, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1c74, lpOverlapped=0x0) returned 1 [0171.301] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1c80, dwBufLen=0x1c80 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1c80) returned 1 [0171.301] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.301] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1c80, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1c80, lpOverlapped=0x0) returned 1 [0171.301] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.301] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1d54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.301] SetEndOfFile (hFile=0xdc) returned 1 [0171.304] GetProcessHeap () returned 0x4e0000 [0171.304] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.304] GetProcessHeap () returned 0x4e0000 [0171.304] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.304] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01158_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01158_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.306] CloseHandle (hObject=0xdc) returned 1 [0171.306] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1694, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01161_.WMF", cAlternateFileName="")) returned 1 [0171.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01161_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.308] GetProcessHeap () returned 0x4e0000 [0171.308] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.308] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.308] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.308] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0171.311] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.311] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.311] GetProcessHeap () returned 0x4e0000 [0171.311] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.311] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.311] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.311] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.311] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.311] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.311] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.311] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.311] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.311] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.311] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.311] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.312] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1694, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1694, lpOverlapped=0x0) returned 1 [0171.312] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x16a0, dwBufLen=0x16a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x16a0) returned 1 [0171.313] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.313] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x16a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x16a0, lpOverlapped=0x0) returned 1 [0171.313] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.313] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1774, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.313] SetEndOfFile (hFile=0xdc) returned 1 [0171.316] GetProcessHeap () returned 0x4e0000 [0171.316] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.316] GetProcessHeap () returned 0x4e0000 [0171.316] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.316] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01161_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01161_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.318] CloseHandle (hObject=0xdc) returned 1 [0171.318] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f80000, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x92f80000, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xa04, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01164_.WMF", cAlternateFileName="")) returned 1 [0171.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01164_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.319] GetProcessHeap () returned 0x4e0000 [0171.319] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.319] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.319] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.319] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0171.322] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.322] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.322] GetProcessHeap () returned 0x4e0000 [0171.322] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.322] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.322] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.322] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.322] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.322] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.322] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.322] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.322] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.322] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.322] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.323] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.323] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xa04, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xa04, lpOverlapped=0x0) returned 1 [0171.323] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa10, dwBufLen=0xa10 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa10) returned 1 [0171.323] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.323] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xa10, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xa10, lpOverlapped=0x0) returned 1 [0171.323] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.323] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xae4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.323] SetEndOfFile (hFile=0xdc) returned 1 [0171.326] GetProcessHeap () returned 0x4e0000 [0171.326] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.326] GetProcessHeap () returned 0x4e0000 [0171.326] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.326] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01164_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01164_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.328] CloseHandle (hObject=0xdc) returned 1 [0171.328] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91c6d300, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91c6d300, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x70f0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01293_.WMF", cAlternateFileName="")) returned 1 [0171.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01293_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.329] GetProcessHeap () returned 0x4e0000 [0171.329] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.329] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.329] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.329] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.329] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.330] GetProcessHeap () returned 0x4e0000 [0171.330] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.330] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.330] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.330] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.332] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.332] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.332] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.332] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.332] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.332] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.332] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.332] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.332] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x70f0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x70f0, lpOverlapped=0x0) returned 1 [0171.333] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x70f0, dwBufLen=0x70f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x70f0) returned 1 [0171.334] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.334] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x70f0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x70f0, lpOverlapped=0x0) returned 1 [0171.334] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.334] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x71c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.334] SetEndOfFile (hFile=0xdc) returned 1 [0171.337] GetProcessHeap () returned 0x4e0000 [0171.337] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.337] GetProcessHeap () returned 0x4e0000 [0171.338] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.338] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01293_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01293_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.339] CloseHandle (hObject=0xdc) returned 1 [0171.339] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd29f0600, ftCreationTime.dwHighDateTime=0x1bd4b3c, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd29f0600, ftLastWriteTime.dwHighDateTime=0x1bd4b3c, nFileSizeHigh=0x0, nFileSizeLow=0x16ae, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01354_.WMF", cAlternateFileName="")) returned 1 [0171.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01354_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.341] GetProcessHeap () returned 0x4e0000 [0171.341] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.341] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.341] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.341] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0171.343] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.343] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.343] GetProcessHeap () returned 0x4e0000 [0171.343] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.343] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.343] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.343] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.343] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.344] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.344] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.344] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.344] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.344] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.344] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.344] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.344] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x16ae, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x16ae, lpOverlapped=0x0) returned 1 [0171.348] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x16b0, dwBufLen=0x16b0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x16b0) returned 1 [0171.348] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.348] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x16b0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x16b0, lpOverlapped=0x0) returned 1 [0171.348] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.348] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1784, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.348] SetEndOfFile (hFile=0xdc) returned 1 [0171.351] GetProcessHeap () returned 0x4e0000 [0171.351] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.351] GetProcessHeap () returned 0x4e0000 [0171.351] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.351] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01354_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01354_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.353] CloseHandle (hObject=0xdc) returned 1 [0171.353] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf0b7f00, ftCreationTime.dwHighDateTime=0x1bd4b3c, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf0b7f00, ftLastWriteTime.dwHighDateTime=0x1bd4b3c, nFileSizeHigh=0x0, nFileSizeLow=0x4732, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01356_.WMF", cAlternateFileName="")) returned 1 [0171.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01356_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.354] GetProcessHeap () returned 0x4e0000 [0171.354] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.355] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.355] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.355] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0171.357] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.357] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.357] GetProcessHeap () returned 0x4e0000 [0171.357] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.357] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.357] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.358] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.358] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.358] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.358] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.358] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.358] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.358] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.358] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.358] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.358] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4732, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4732, lpOverlapped=0x0) returned 1 [0171.359] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4740, dwBufLen=0x4740 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4740) returned 1 [0171.359] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.360] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4740, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4740, lpOverlapped=0x0) returned 1 [0171.360] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.360] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.360] SetEndOfFile (hFile=0xdc) returned 1 [0171.363] GetProcessHeap () returned 0x4e0000 [0171.363] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.363] GetProcessHeap () returned 0x4e0000 [0171.363] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.363] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01356_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01356_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.365] CloseHandle (hObject=0xdc) returned 1 [0171.365] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdda5200, ftCreationTime.dwHighDateTime=0x1bd4b3c, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcdda5200, ftLastWriteTime.dwHighDateTime=0x1bd4b3c, nFileSizeHigh=0x0, nFileSizeLow=0x6bf6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01357_.WMF", cAlternateFileName="")) returned 1 [0171.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01357_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.366] GetProcessHeap () returned 0x4e0000 [0171.366] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.367] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.367] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.367] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0171.369] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.369] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.369] GetProcessHeap () returned 0x4e0000 [0171.369] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.369] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.369] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.369] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.369] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.369] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.369] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.369] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.370] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.370] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.370] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.370] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.370] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x6bf6, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x6bf6, lpOverlapped=0x0) returned 1 [0171.371] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6c00, dwBufLen=0x6c00 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6c00) returned 1 [0171.371] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.371] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6c00, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x6c00, lpOverlapped=0x0) returned 1 [0171.371] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.371] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6cd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.371] SetEndOfFile (hFile=0xdc) returned 1 [0171.374] GetProcessHeap () returned 0x4e0000 [0171.374] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.374] GetProcessHeap () returned 0x4e0000 [0171.374] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.375] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01357_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01357_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.377] CloseHandle (hObject=0xdc) returned 1 [0171.377] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcca92500, ftCreationTime.dwHighDateTime=0x1bd4b3c, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcca92500, ftLastWriteTime.dwHighDateTime=0x1bd4b3c, nFileSizeHigh=0x0, nFileSizeLow=0xd6e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01358_.WMF", cAlternateFileName="")) returned 1 [0171.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01358_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.379] GetProcessHeap () returned 0x4e0000 [0171.379] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.379] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.379] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.379] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0171.381] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.381] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.381] GetProcessHeap () returned 0x4e0000 [0171.381] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.381] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.381] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.381] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.381] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.381] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.382] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.382] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.382] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.382] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.382] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.382] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.382] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xd6e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xd6e, lpOverlapped=0x0) returned 1 [0171.382] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xd70, dwBufLen=0xd70 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xd70) returned 1 [0171.382] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.382] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xd70, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xd70, lpOverlapped=0x0) returned 1 [0171.382] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.382] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xe44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.383] SetEndOfFile (hFile=0xdc) returned 1 [0171.385] GetProcessHeap () returned 0x4e0000 [0171.385] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.385] GetProcessHeap () returned 0x4e0000 [0171.385] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.385] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01358_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01358_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.387] CloseHandle (hObject=0xdc) returned 1 [0171.387] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6b34400, ftCreationTime.dwHighDateTime=0x1bd4b3c, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6b34400, ftLastWriteTime.dwHighDateTime=0x1bd4b3c, nFileSizeHigh=0x0, nFileSizeLow=0x1b74, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01361_.WMF", cAlternateFileName="")) returned 1 [0171.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01361_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.388] GetProcessHeap () returned 0x4e0000 [0171.388] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.389] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.389] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.389] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0171.392] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.392] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.392] GetProcessHeap () returned 0x4e0000 [0171.392] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.392] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.393] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.393] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.393] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.393] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.393] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.393] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.393] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.393] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.393] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.393] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.393] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1b74, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1b74, lpOverlapped=0x0) returned 1 [0171.395] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1b80, dwBufLen=0x1b80 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1b80) returned 1 [0171.395] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.395] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1b80, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1b80, lpOverlapped=0x0) returned 1 [0171.395] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.395] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1c54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.395] SetEndOfFile (hFile=0xdc) returned 1 [0171.398] GetProcessHeap () returned 0x4e0000 [0171.398] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.398] GetProcessHeap () returned 0x4e0000 [0171.398] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.398] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01361_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01361_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.400] CloseHandle (hObject=0xdc) returned 1 [0171.400] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe5b0900, ftCreationTime.dwHighDateTime=0x1bd4b3c, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbe5b0900, ftLastWriteTime.dwHighDateTime=0x1bd4b3c, nFileSizeHigh=0x0, nFileSizeLow=0x40412, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01368_.WMF", cAlternateFileName="")) returned 1 [0171.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01368_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.401] GetProcessHeap () returned 0x4e0000 [0171.401] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.401] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.402] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.402] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0171.404] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.404] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.404] GetProcessHeap () returned 0x4e0000 [0171.404] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.404] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.404] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.404] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.404] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.404] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.405] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.405] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.405] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.405] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.405] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.405] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.405] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40412, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x40412, lpOverlapped=0x0) returned 1 [0171.409] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x40420, dwBufLen=0x40420 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x40420) returned 1 [0171.412] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.412] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40420, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x40420, lpOverlapped=0x0) returned 1 [0171.413] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.413] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x404f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.413] SetEndOfFile (hFile=0xdc) returned 1 [0171.416] GetProcessHeap () returned 0x4e0000 [0171.416] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.416] GetProcessHeap () returned 0x4e0000 [0171.416] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.416] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01368_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01368_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.418] CloseHandle (hObject=0xdc) returned 1 [0171.418] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8653c600, ftCreationTime.dwHighDateTime=0x1bd4b3c, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8653c600, ftLastWriteTime.dwHighDateTime=0x1bd4b3c, nFileSizeHigh=0x0, nFileSizeLow=0x2b16e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01421_.WMF", cAlternateFileName="")) returned 1 [0171.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01421_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.420] GetProcessHeap () returned 0x4e0000 [0171.420] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.420] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.420] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.420] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0171.422] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.422] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.422] GetProcessHeap () returned 0x4e0000 [0171.422] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.422] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.422] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.422] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.422] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.422] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.422] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.422] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.422] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.422] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.422] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.423] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.423] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2b16e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2b16e, lpOverlapped=0x0) returned 1 [0171.424] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2b170, dwBufLen=0x2b170 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2b170) returned 1 [0171.425] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.425] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2b170, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2b170, lpOverlapped=0x0) returned 1 [0171.426] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.426] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2b244, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.426] SetEndOfFile (hFile=0xdc) returned 1 [0171.429] GetProcessHeap () returned 0x4e0000 [0171.429] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.429] GetProcessHeap () returned 0x4e0000 [0171.429] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.429] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01421_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01421_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.444] CloseHandle (hObject=0xdc) returned 1 [0171.444] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b435600, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8b435600, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x4e82, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01468_.WMF", cAlternateFileName="")) returned 1 [0171.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01468_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.448] GetProcessHeap () returned 0x4e0000 [0171.448] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.448] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.448] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.448] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0171.451] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.451] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.451] GetProcessHeap () returned 0x4e0000 [0171.451] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.451] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.451] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.451] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.451] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.451] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.451] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.451] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.451] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.451] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.451] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.451] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.451] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4e82, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4e82, lpOverlapped=0x0) returned 1 [0171.460] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4e90, dwBufLen=0x4e90 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4e90) returned 1 [0171.461] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.461] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4e90, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4e90, lpOverlapped=0x0) returned 1 [0171.461] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.461] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4f64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.461] SetEndOfFile (hFile=0xdc) returned 1 [0171.463] GetProcessHeap () returned 0x4e0000 [0171.463] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.463] GetProcessHeap () returned 0x4e0000 [0171.463] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.463] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01468_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01468_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.465] CloseHandle (hObject=0xdc) returned 1 [0171.465] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87afcf00, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x87afcf00, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x4ada, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01470_.WMF", cAlternateFileName="")) returned 1 [0171.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01470_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.466] GetProcessHeap () returned 0x4e0000 [0171.466] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.466] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.466] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.466] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0171.467] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.467] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.467] GetProcessHeap () returned 0x4e0000 [0171.468] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.468] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.468] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.468] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.468] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.468] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.468] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.468] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.468] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.468] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.468] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.468] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.468] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4ada, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4ada, lpOverlapped=0x0) returned 1 [0171.469] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4ae0, dwBufLen=0x4ae0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4ae0) returned 1 [0171.469] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.469] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4ae0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4ae0, lpOverlapped=0x0) returned 1 [0171.470] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.470] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4bb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.470] SetEndOfFile (hFile=0xdc) returned 1 [0171.472] GetProcessHeap () returned 0x4e0000 [0171.472] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.472] GetProcessHeap () returned 0x4e0000 [0171.472] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.472] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01470_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01470_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.473] CloseHandle (hObject=0xdc) returned 1 [0171.473] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x841c4800, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x841c4800, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x2028, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01472_.WMF", cAlternateFileName="")) returned 1 [0171.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01472_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.474] GetProcessHeap () returned 0x4e0000 [0171.474] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.474] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.474] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.474] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.475] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.476] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.476] GetProcessHeap () returned 0x4e0000 [0171.476] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.476] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.476] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.476] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.476] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.476] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.476] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.476] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.476] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.476] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.476] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.476] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.476] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2028, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2028, lpOverlapped=0x0) returned 1 [0171.477] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2030, dwBufLen=0x2030 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2030) returned 1 [0171.477] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.477] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2030, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2030, lpOverlapped=0x0) returned 1 [0171.477] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.477] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2104, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.477] SetEndOfFile (hFile=0xdc) returned 1 [0171.479] GetProcessHeap () returned 0x4e0000 [0171.479] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.479] GetProcessHeap () returned 0x4e0000 [0171.480] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.480] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01472_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01472_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.481] CloseHandle (hObject=0xdc) returned 1 [0171.481] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82eb1b00, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82eb1b00, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x28ae, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01473_.WMF", cAlternateFileName="")) returned 1 [0171.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01473_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.482] GetProcessHeap () returned 0x4e0000 [0171.482] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.482] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.482] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.482] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0171.484] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.484] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.484] GetProcessHeap () returned 0x4e0000 [0171.484] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.484] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.484] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.484] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.484] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.484] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.484] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.484] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.484] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.484] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.484] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.484] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.484] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x28ae, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x28ae, lpOverlapped=0x0) returned 1 [0171.485] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x28b0, dwBufLen=0x28b0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x28b0) returned 1 [0171.485] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.485] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x28b0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x28b0, lpOverlapped=0x0) returned 1 [0171.485] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.485] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2984, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.486] SetEndOfFile (hFile=0xdc) returned 1 [0171.488] GetProcessHeap () returned 0x4e0000 [0171.488] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.488] GetProcessHeap () returned 0x4e0000 [0171.488] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.488] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01473_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01473_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.489] CloseHandle (hObject=0xdc) returned 1 [0171.489] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f5def00, ftCreationTime.dwHighDateTime=0x1bd4af3, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1f5def00, ftLastWriteTime.dwHighDateTime=0x1bd4af3, nFileSizeHigh=0x0, nFileSizeLow=0x349c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01474_.WMF", cAlternateFileName="")) returned 1 [0171.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01474_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.490] GetProcessHeap () returned 0x4e0000 [0171.490] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.490] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.490] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.490] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.500] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.501] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.501] GetProcessHeap () returned 0x4e0000 [0171.501] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.501] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.501] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.501] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.501] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.501] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.501] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.501] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.501] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.501] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.501] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.501] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.501] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x349c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x349c, lpOverlapped=0x0) returned 1 [0171.561] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x34a0, dwBufLen=0x34a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x34a0) returned 1 [0171.561] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.561] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x34a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x34a0, lpOverlapped=0x0) returned 1 [0171.562] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.562] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3574, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.562] SetEndOfFile (hFile=0xdc) returned 1 [0171.564] GetProcessHeap () returned 0x4e0000 [0171.564] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.564] GetProcessHeap () returned 0x4e0000 [0171.564] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.564] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01474_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01474_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.565] CloseHandle (hObject=0xdc) returned 1 [0171.566] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bb77a00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2bb77a00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0xce0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01627_.WMF", cAlternateFileName="")) returned 1 [0171.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01627_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.567] GetProcessHeap () returned 0x4e0000 [0171.567] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.567] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.567] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.567] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.567] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.567] GetProcessHeap () returned 0x4e0000 [0171.567] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.567] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.567] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.567] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.569] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.569] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.569] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.569] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.569] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.569] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.569] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.569] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.569] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xce0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xce0, lpOverlapped=0x0) returned 1 [0171.569] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xce0, dwBufLen=0xce0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xce0) returned 1 [0171.569] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.569] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xce0, lpOverlapped=0x0) returned 1 [0171.569] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.569] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xdb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.570] SetEndOfFile (hFile=0xdc) returned 1 [0171.572] GetProcessHeap () returned 0x4e0000 [0171.572] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.572] GetProcessHeap () returned 0x4e0000 [0171.572] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.572] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01627_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01627_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.573] CloseHandle (hObject=0xdc) returned 1 [0171.573] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f01d600, ftCreationTime.dwHighDateTime=0x1bd4be8, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f01d600, ftLastWriteTime.dwHighDateTime=0x1bd4be8, nFileSizeHigh=0x0, nFileSizeLow=0xb9e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01680_.WMF", cAlternateFileName="")) returned 1 [0171.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01680_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.573] GetProcessHeap () returned 0x4e0000 [0171.573] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.574] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.574] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.574] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0171.575] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.575] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.575] GetProcessHeap () returned 0x4e0000 [0171.575] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.575] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.576] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.576] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.576] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.576] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.576] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.576] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.576] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.576] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.576] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.576] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.576] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb9e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xb9e, lpOverlapped=0x0) returned 1 [0171.576] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xba0, dwBufLen=0xba0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xba0) returned 1 [0171.576] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.576] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xba0, lpOverlapped=0x0) returned 1 [0171.576] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.576] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xc74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.576] SetEndOfFile (hFile=0xdc) returned 1 [0171.578] GetProcessHeap () returned 0x4e0000 [0171.578] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.578] GetProcessHeap () returned 0x4e0000 [0171.578] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.579] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01680_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01680_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.580] CloseHandle (hObject=0xdc) returned 1 [0171.580] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b6e4f00, ftCreationTime.dwHighDateTime=0x1bd4be8, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8b6e4f00, ftLastWriteTime.dwHighDateTime=0x1bd4be8, nFileSizeHigh=0x0, nFileSizeLow=0xc88, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01682_.WMF", cAlternateFileName="")) returned 1 [0171.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01682_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.580] GetProcessHeap () returned 0x4e0000 [0171.580] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.580] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.580] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.580] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.582] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.582] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.582] GetProcessHeap () returned 0x4e0000 [0171.582] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.582] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.582] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.582] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.582] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.582] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.582] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.583] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.583] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.583] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.583] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.583] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.583] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xc88, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xc88, lpOverlapped=0x0) returned 1 [0171.583] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xc90, dwBufLen=0xc90 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xc90) returned 1 [0171.583] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.583] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc90, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xc90, lpOverlapped=0x0) returned 1 [0171.583] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.583] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xd64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.583] SetEndOfFile (hFile=0xdc) returned 1 [0171.585] GetProcessHeap () returned 0x4e0000 [0171.585] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.585] GetProcessHeap () returned 0x4e0000 [0171.585] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.585] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01682_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01682_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.586] CloseHandle (hObject=0xdc) returned 1 [0171.586] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65da4900, ftCreationTime.dwHighDateTime=0x1bd4bda, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65da4900, ftLastWriteTime.dwHighDateTime=0x1bd4bda, nFileSizeHigh=0x0, nFileSizeLow=0x14c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01701_.WMF", cAlternateFileName="")) returned 1 [0171.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01701_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.587] GetProcessHeap () returned 0x4e0000 [0171.587] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.587] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.587] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.587] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0171.589] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.589] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.589] GetProcessHeap () returned 0x4e0000 [0171.589] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.589] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.589] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.589] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.589] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.589] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.589] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.590] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.590] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.590] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.590] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.590] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.590] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x14c4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x14c4, lpOverlapped=0x0) returned 1 [0171.591] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x14d0, dwBufLen=0x14d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x14d0) returned 1 [0171.591] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.591] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x14d0, lpOverlapped=0x0) returned 1 [0171.591] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.591] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x15a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.591] SetEndOfFile (hFile=0xdc) returned 1 [0171.593] GetProcessHeap () returned 0x4e0000 [0171.593] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.593] GetProcessHeap () returned 0x4e0000 [0171.593] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.593] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01701_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01701_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.594] CloseHandle (hObject=0xdc) returned 1 [0171.594] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01848_.WMF", cAlternateFileName="")) returned 1 [0171.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01848_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.594] GetProcessHeap () returned 0x4e0000 [0171.594] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.594] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.594] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.594] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.594] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.595] GetProcessHeap () returned 0x4e0000 [0171.595] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.595] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.595] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.595] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.596] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.597] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.597] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.597] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.597] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.597] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.597] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.597] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.597] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x460, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x460, lpOverlapped=0x0) returned 1 [0171.597] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x460, dwBufLen=0x460 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x460) returned 1 [0171.597] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.597] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x460, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x460, lpOverlapped=0x0) returned 1 [0171.597] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.597] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x534, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.597] SetEndOfFile (hFile=0xdc) returned 1 [0171.600] GetProcessHeap () returned 0x4e0000 [0171.600] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.600] GetProcessHeap () returned 0x4e0000 [0171.600] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.600] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01848_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01848_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.601] CloseHandle (hObject=0xdc) returned 1 [0171.601] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x270, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01849_.WMF", cAlternateFileName="")) returned 1 [0171.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01849_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.603] GetProcessHeap () returned 0x4e0000 [0171.603] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.603] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.603] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.603] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.603] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.603] GetProcessHeap () returned 0x4e0000 [0171.603] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.603] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.603] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.603] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.604] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.605] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.605] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.605] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.605] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.605] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.605] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.605] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.605] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x270, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x270, lpOverlapped=0x0) returned 1 [0171.605] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x270, dwBufLen=0x270 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x270) returned 1 [0171.605] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.605] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x270, lpOverlapped=0x0) returned 1 [0171.606] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.606] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x344, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.606] SetEndOfFile (hFile=0xdc) returned 1 [0171.609] GetProcessHeap () returned 0x4e0000 [0171.610] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.610] GetProcessHeap () returned 0x4e0000 [0171.610] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.610] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01849_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01849_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.611] CloseHandle (hObject=0xdc) returned 1 [0171.611] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a04ab00, ftCreationTime.dwHighDateTime=0x1bd4bfd, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2a04ab00, ftLastWriteTime.dwHighDateTime=0x1bd4bfd, nFileSizeHigh=0x0, nFileSizeLow=0x1138, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01852_.WMF", cAlternateFileName="")) returned 1 [0171.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01852_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.612] GetProcessHeap () returned 0x4e0000 [0171.612] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.612] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.612] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.612] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.614] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.614] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.614] GetProcessHeap () returned 0x4e0000 [0171.614] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.614] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.614] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.614] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.614] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.614] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.614] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.614] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.614] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.614] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.615] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.615] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.615] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1138, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1138, lpOverlapped=0x0) returned 1 [0171.615] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1140, dwBufLen=0x1140 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1140) returned 1 [0171.615] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.615] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1140, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1140, lpOverlapped=0x0) returned 1 [0171.616] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.616] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.616] SetEndOfFile (hFile=0xdc) returned 1 [0171.618] GetProcessHeap () returned 0x4e0000 [0171.618] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.618] GetProcessHeap () returned 0x4e0000 [0171.618] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.618] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01852_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01852_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.619] CloseHandle (hObject=0xdc) returned 1 [0171.619] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x10c8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01858_.WMF", cAlternateFileName="")) returned 1 [0171.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01858_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.620] GetProcessHeap () returned 0x4e0000 [0171.620] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.620] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.620] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.620] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.622] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.622] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.622] GetProcessHeap () returned 0x4e0000 [0171.622] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.622] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.622] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.622] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.622] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.622] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.622] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.622] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.622] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.622] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.622] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.622] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.622] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x10c8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x10c8, lpOverlapped=0x0) returned 1 [0171.625] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x10d0, dwBufLen=0x10d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x10d0) returned 1 [0171.625] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.626] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x10d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x10d0, lpOverlapped=0x0) returned 1 [0171.626] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.626] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x11a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.626] SetEndOfFile (hFile=0xdc) returned 1 [0171.628] GetProcessHeap () returned 0x4e0000 [0171.628] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.628] GetProcessHeap () returned 0x4e0000 [0171.628] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.628] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01858_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01858_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.629] CloseHandle (hObject=0xdc) returned 1 [0171.629] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa55a300, ftCreationTime.dwHighDateTime=0x1bd4bfc, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa55a300, ftLastWriteTime.dwHighDateTime=0x1bd4bfc, nFileSizeHigh=0x0, nFileSizeLow=0xdb8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01866_.WMF", cAlternateFileName="")) returned 1 [0171.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01866_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.630] GetProcessHeap () returned 0x4e0000 [0171.630] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.630] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.630] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.630] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.632] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.632] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.632] GetProcessHeap () returned 0x4e0000 [0171.632] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.633] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.633] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.633] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.633] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.633] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.633] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.633] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.633] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.633] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.633] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.633] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.633] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xdb8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xdb8, lpOverlapped=0x0) returned 1 [0171.633] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xdc0, dwBufLen=0xdc0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xdc0) returned 1 [0171.633] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.633] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xdc0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xdc0, lpOverlapped=0x0) returned 1 [0171.633] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.633] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xe94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.633] SetEndOfFile (hFile=0xdc) returned 1 [0171.635] GetProcessHeap () returned 0x4e0000 [0171.635] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.635] GetProcessHeap () returned 0x4e0000 [0171.635] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.636] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01866_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01866_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.637] CloseHandle (hObject=0xdc) returned 1 [0171.637] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x27e0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02009_.WMF", cAlternateFileName="")) returned 1 [0171.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02009_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.643] GetProcessHeap () returned 0x4e0000 [0171.643] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.643] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.643] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.643] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.643] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.643] GetProcessHeap () returned 0x4e0000 [0171.643] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.643] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.643] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.643] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.645] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.645] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.645] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.645] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.645] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.645] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.645] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.645] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.645] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x27e0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x27e0, lpOverlapped=0x0) returned 1 [0171.646] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x27e0, dwBufLen=0x27e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x27e0) returned 1 [0171.646] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.646] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x27e0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x27e0, lpOverlapped=0x0) returned 1 [0171.646] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.646] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x28b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.646] SetEndOfFile (hFile=0xdc) returned 1 [0171.649] GetProcessHeap () returned 0x4e0000 [0171.649] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.649] GetProcessHeap () returned 0x4e0000 [0171.649] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.649] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02009_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02009_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.650] CloseHandle (hObject=0xdc) returned 1 [0171.650] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x620ded00, ftCreationTime.dwHighDateTime=0x1bd4c01, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x620ded00, ftLastWriteTime.dwHighDateTime=0x1bd4c01, nFileSizeHigh=0x0, nFileSizeLow=0x918, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02041_.WMF", cAlternateFileName="")) returned 1 [0171.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02041_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.651] GetProcessHeap () returned 0x4e0000 [0171.651] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.651] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.651] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.651] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.653] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.653] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.653] GetProcessHeap () returned 0x4e0000 [0171.653] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.653] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.653] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.653] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.653] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.653] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.653] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.653] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.653] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.653] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.653] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.653] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.653] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x918, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x918, lpOverlapped=0x0) returned 1 [0171.653] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x920, dwBufLen=0x920 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x920) returned 1 [0171.654] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.654] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x920, lpOverlapped=0x0) returned 1 [0171.654] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.654] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x9f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.654] SetEndOfFile (hFile=0xdc) returned 1 [0171.656] GetProcessHeap () returned 0x4e0000 [0171.656] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.656] GetProcessHeap () returned 0x4e0000 [0171.656] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.656] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02041_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02041_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.657] CloseHandle (hObject=0xdc) returned 1 [0171.657] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb82d6100, ftCreationTime.dwHighDateTime=0x1bd4bfe, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb82d6100, ftLastWriteTime.dwHighDateTime=0x1bd4bfe, nFileSizeHigh=0x0, nFileSizeLow=0x43c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02066_.WMF", cAlternateFileName="")) returned 1 [0171.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02066_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.659] GetProcessHeap () returned 0x4e0000 [0171.659] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.659] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.659] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.659] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.661] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.661] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.661] GetProcessHeap () returned 0x4e0000 [0171.661] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.661] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.661] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.661] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.661] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.661] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.661] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.661] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.661] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.661] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.661] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.661] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.661] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x43c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x43c, lpOverlapped=0x0) returned 1 [0171.661] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x440, dwBufLen=0x440 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x440) returned 1 [0171.661] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.661] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x440, lpOverlapped=0x0) returned 1 [0171.661] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.662] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x514, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.662] SetEndOfFile (hFile=0xdc) returned 1 [0171.665] GetProcessHeap () returned 0x4e0000 [0171.665] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.665] GetProcessHeap () returned 0x4e0000 [0171.665] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.665] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02066_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02066_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.666] CloseHandle (hObject=0xdc) returned 1 [0171.666] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3552d900, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3552d900, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x474, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02091_.WMF", cAlternateFileName="")) returned 1 [0171.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02091_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.667] GetProcessHeap () returned 0x4e0000 [0171.667] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.667] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.667] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.667] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0171.669] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.669] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.669] GetProcessHeap () returned 0x4e0000 [0171.669] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.669] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.669] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.669] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.669] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.669] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.669] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.669] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.669] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.669] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.669] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.669] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.669] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x474, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x474, lpOverlapped=0x0) returned 1 [0171.669] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x480, dwBufLen=0x480 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x480) returned 1 [0171.669] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.670] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x480, lpOverlapped=0x0) returned 1 [0171.670] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.670] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x554, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.670] SetEndOfFile (hFile=0xdc) returned 1 [0171.672] GetProcessHeap () returned 0x4e0000 [0171.672] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.672] GetProcessHeap () returned 0x4e0000 [0171.672] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.672] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02091_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02091_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.673] CloseHandle (hObject=0xdc) returned 1 [0171.673] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38e66000, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x38e66000, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x66c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02092_.WMF", cAlternateFileName="")) returned 1 [0171.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02092_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.674] GetProcessHeap () returned 0x4e0000 [0171.674] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.674] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.674] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.674] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.676] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.676] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.676] GetProcessHeap () returned 0x4e0000 [0171.676] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.676] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.676] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.676] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.676] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.676] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.676] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.676] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.676] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.676] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.676] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.676] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.676] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x66c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x66c, lpOverlapped=0x0) returned 1 [0171.676] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x670, dwBufLen=0x670 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x670) returned 1 [0171.676] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.676] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x670, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x670, lpOverlapped=0x0) returned 1 [0171.677] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.677] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x744, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.677] SetEndOfFile (hFile=0xdc) returned 1 [0171.679] GetProcessHeap () returned 0x4e0000 [0171.679] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.679] GetProcessHeap () returned 0x4e0000 [0171.679] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.679] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02092_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02092_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.680] CloseHandle (hObject=0xdc) returned 1 [0171.680] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x308e2500, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x308e2500, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x2a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02093_.WMF", cAlternateFileName="")) returned 1 [0171.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02093_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.681] GetProcessHeap () returned 0x4e0000 [0171.681] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.681] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.681] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.681] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.681] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.681] GetProcessHeap () returned 0x4e0000 [0171.681] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.681] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.681] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.681] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.682] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.682] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.682] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.682] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.683] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.683] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.683] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.683] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.683] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2a0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2a0, lpOverlapped=0x0) returned 1 [0171.683] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2a0, dwBufLen=0x2a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2a0) returned 1 [0171.683] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.683] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2a0, lpOverlapped=0x0) returned 1 [0171.683] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.683] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x374, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.683] SetEndOfFile (hFile=0xdc) returned 1 [0171.685] GetProcessHeap () returned 0x4e0000 [0171.685] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.685] GetProcessHeap () returned 0x4e0000 [0171.685] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.685] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02093_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02093_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.686] CloseHandle (hObject=0xdc) returned 1 [0171.686] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29651800, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x29651800, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x1fe8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02124_.WMF", cAlternateFileName="")) returned 1 [0171.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02124_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.687] GetProcessHeap () returned 0x4e0000 [0171.687] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.687] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.687] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.687] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.691] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.691] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.691] GetProcessHeap () returned 0x4e0000 [0171.691] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.691] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.691] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.691] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.691] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.691] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.691] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.691] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.692] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.692] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.692] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.692] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.692] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1fe8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1fe8, lpOverlapped=0x0) returned 1 [0171.693] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1ff0, dwBufLen=0x1ff0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1ff0) returned 1 [0171.693] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.693] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1ff0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1ff0, lpOverlapped=0x0) returned 1 [0171.693] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.693] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x20c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.693] SetEndOfFile (hFile=0xdc) returned 1 [0171.695] GetProcessHeap () returned 0x4e0000 [0171.695] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.695] GetProcessHeap () returned 0x4e0000 [0171.695] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.695] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02124_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02124_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.696] CloseHandle (hObject=0xdc) returned 1 [0171.696] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50f8b800, ftCreationTime.dwHighDateTime=0x1bd4bd0, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50f8b800, ftLastWriteTime.dwHighDateTime=0x1bd4bd0, nFileSizeHigh=0x0, nFileSizeLow=0x4816, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02125_.WMF", cAlternateFileName="")) returned 1 [0171.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02125_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.698] GetProcessHeap () returned 0x4e0000 [0171.698] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.698] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.698] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.698] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0171.700] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.700] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.700] GetProcessHeap () returned 0x4e0000 [0171.700] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.700] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.700] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.700] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.700] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.700] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.700] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.700] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.700] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.700] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.700] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.700] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.700] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4816, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4816, lpOverlapped=0x0) returned 1 [0171.701] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4820, dwBufLen=0x4820 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4820) returned 1 [0171.701] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.701] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4820, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4820, lpOverlapped=0x0) returned 1 [0171.701] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.701] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x48f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.702] SetEndOfFile (hFile=0xdc) returned 1 [0171.704] GetProcessHeap () returned 0x4e0000 [0171.704] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.704] GetProcessHeap () returned 0x4e0000 [0171.704] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.704] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02125_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02125_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.705] CloseHandle (hObject=0xdc) returned 1 [0171.705] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x819c1a00, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x819c1a00, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x7c50, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02126_.WMF", cAlternateFileName="")) returned 1 [0171.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02126_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.706] GetProcessHeap () returned 0x4e0000 [0171.706] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.706] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.706] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.706] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.706] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.706] GetProcessHeap () returned 0x4e0000 [0171.706] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.706] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.706] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.706] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.708] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.708] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.708] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.708] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.708] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.708] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.708] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.708] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.708] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7c50, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7c50, lpOverlapped=0x0) returned 1 [0171.709] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7c50, dwBufLen=0x7c50 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7c50) returned 1 [0171.709] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.709] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7c50, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7c50, lpOverlapped=0x0) returned 1 [0171.710] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.710] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7d24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.710] SetEndOfFile (hFile=0xdc) returned 1 [0171.712] GetProcessHeap () returned 0x4e0000 [0171.712] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.712] GetProcessHeap () returned 0x4e0000 [0171.712] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.712] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02126_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02126_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.713] CloseHandle (hObject=0xdc) returned 1 [0171.713] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9355900, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9355900, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0xfe4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02127_.WMF", cAlternateFileName="")) returned 1 [0171.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02127_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.715] GetProcessHeap () returned 0x4e0000 [0171.715] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.715] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.715] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.715] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0171.716] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.717] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.717] GetProcessHeap () returned 0x4e0000 [0171.717] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.717] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.717] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.717] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.717] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.717] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.717] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.717] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.717] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.717] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.717] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.717] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.717] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xfe4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xfe4, lpOverlapped=0x0) returned 1 [0171.717] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xff0, dwBufLen=0xff0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xff0) returned 1 [0171.718] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.718] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xff0, lpOverlapped=0x0) returned 1 [0171.718] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.718] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x10c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.718] SetEndOfFile (hFile=0xdc) returned 1 [0171.720] GetProcessHeap () returned 0x4e0000 [0171.720] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.720] GetProcessHeap () returned 0x4e0000 [0171.720] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.720] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02127_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02127_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.722] CloseHandle (hObject=0xdc) returned 1 [0171.722] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02262_.WMF", cAlternateFileName="")) returned 1 [0171.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02262_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.723] GetProcessHeap () returned 0x4e0000 [0171.723] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.723] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.723] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.723] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.723] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.723] GetProcessHeap () returned 0x4e0000 [0171.723] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.723] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.723] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.723] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.725] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.726] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.726] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.726] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.726] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.726] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.726] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.726] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.726] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xd00, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xd00, lpOverlapped=0x0) returned 1 [0171.726] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xd00, dwBufLen=0xd00 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xd00) returned 1 [0171.726] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.726] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xd00, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xd00, lpOverlapped=0x0) returned 1 [0171.726] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.726] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xdd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.726] SetEndOfFile (hFile=0xdc) returned 1 [0171.728] GetProcessHeap () returned 0x4e0000 [0171.728] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.728] GetProcessHeap () returned 0x4e0000 [0171.728] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.729] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02262_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02262_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.730] CloseHandle (hObject=0xdc) returned 1 [0171.730] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8e0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02264_.WMF", cAlternateFileName="")) returned 1 [0171.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02264_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.731] GetProcessHeap () returned 0x4e0000 [0171.731] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.731] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.731] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.731] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.731] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.731] GetProcessHeap () returned 0x4e0000 [0171.731] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.731] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.731] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.731] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.733] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.733] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.733] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.733] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.733] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.733] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.733] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.733] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.734] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x8e0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x8e0, lpOverlapped=0x0) returned 1 [0171.734] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8e0, dwBufLen=0x8e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8e0) returned 1 [0171.734] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.734] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x8e0, lpOverlapped=0x0) returned 1 [0171.734] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.734] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x9b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.734] SetEndOfFile (hFile=0xdc) returned 1 [0171.736] GetProcessHeap () returned 0x4e0000 [0171.736] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.736] GetProcessHeap () returned 0x4e0000 [0171.736] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.736] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02264_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02264_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.737] CloseHandle (hObject=0xdc) returned 1 [0171.737] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe14, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02356_.WMF", cAlternateFileName="")) returned 1 [0171.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02356_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.738] GetProcessHeap () returned 0x4e0000 [0171.738] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.738] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.738] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.738] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0171.750] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.750] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.750] GetProcessHeap () returned 0x4e0000 [0171.750] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.750] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.750] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.750] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.750] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.750] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.751] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.751] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.751] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.751] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.751] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.751] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.751] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xe14, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xe14, lpOverlapped=0x0) returned 1 [0171.751] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe20, dwBufLen=0xe20 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe20) returned 1 [0171.751] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.751] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xe20, lpOverlapped=0x0) returned 1 [0171.751] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.751] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.751] SetEndOfFile (hFile=0xdc) returned 1 [0171.755] GetProcessHeap () returned 0x4e0000 [0171.755] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.755] GetProcessHeap () returned 0x4e0000 [0171.755] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.756] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02356_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02356_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.757] CloseHandle (hObject=0xdc) returned 1 [0171.757] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x17c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02361_.WMF", cAlternateFileName="")) returned 1 [0171.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02361_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.758] GetProcessHeap () returned 0x4e0000 [0171.758] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.758] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.759] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.759] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0171.760] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.760] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.760] GetProcessHeap () returned 0x4e0000 [0171.760] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.760] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.760] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.760] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.761] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.761] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.761] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.761] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.761] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.761] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.761] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.761] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.761] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x17c4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x17c4, lpOverlapped=0x0) returned 1 [0171.762] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x17d0, dwBufLen=0x17d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x17d0) returned 1 [0171.762] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.762] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x17d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x17d0, lpOverlapped=0x0) returned 1 [0171.763] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.763] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x18a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.763] SetEndOfFile (hFile=0xdc) returned 1 [0171.765] GetProcessHeap () returned 0x4e0000 [0171.765] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.765] GetProcessHeap () returned 0x4e0000 [0171.765] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.765] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02361_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02361_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.767] CloseHandle (hObject=0xdc) returned 1 [0171.767] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd28, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02368_.WMF", cAlternateFileName="")) returned 1 [0171.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02368_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.768] GetProcessHeap () returned 0x4e0000 [0171.768] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.768] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.768] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.768] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.770] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.770] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.770] GetProcessHeap () returned 0x4e0000 [0171.770] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.770] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.770] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.770] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.770] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.770] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.771] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.771] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.771] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.771] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.771] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.771] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.771] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xd28, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xd28, lpOverlapped=0x0) returned 1 [0171.771] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xd30, dwBufLen=0xd30 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xd30) returned 1 [0171.771] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.771] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xd30, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xd30, lpOverlapped=0x0) returned 1 [0171.771] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.771] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xe04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.771] SetEndOfFile (hFile=0xdc) returned 1 [0171.773] GetProcessHeap () returned 0x4e0000 [0171.773] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.773] GetProcessHeap () returned 0x4e0000 [0171.773] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.774] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02368_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02368_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.775] CloseHandle (hObject=0xdc) returned 1 [0171.775] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc74, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02371_.WMF", cAlternateFileName="")) returned 1 [0171.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02371_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.775] GetProcessHeap () returned 0x4e0000 [0171.775] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.775] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.775] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.775] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0171.777] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.777] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.777] GetProcessHeap () returned 0x4e0000 [0171.777] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.778] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.778] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.778] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.778] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.778] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.778] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.778] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.778] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.778] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.778] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.778] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.778] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xc74, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xc74, lpOverlapped=0x0) returned 1 [0171.778] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xc80, dwBufLen=0xc80 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xc80) returned 1 [0171.778] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.778] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xc80, lpOverlapped=0x0) returned 1 [0171.778] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.778] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xd54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.778] SetEndOfFile (hFile=0xdc) returned 1 [0171.780] GetProcessHeap () returned 0x4e0000 [0171.781] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.781] GetProcessHeap () returned 0x4e0000 [0171.781] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.781] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02371_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02371_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.782] CloseHandle (hObject=0xdc) returned 1 [0171.782] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xcec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02373_.WMF", cAlternateFileName="")) returned 1 [0171.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02373_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.782] GetProcessHeap () returned 0x4e0000 [0171.782] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.782] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.782] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.782] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.784] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.784] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.784] GetProcessHeap () returned 0x4e0000 [0171.784] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.784] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.784] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.784] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.784] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.784] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.784] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.784] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.785] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.785] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.785] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.785] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.785] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xcec, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xcec, lpOverlapped=0x0) returned 1 [0171.785] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xcf0, dwBufLen=0xcf0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xcf0) returned 1 [0171.785] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.785] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xcf0, lpOverlapped=0x0) returned 1 [0171.785] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.785] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xdc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.785] SetEndOfFile (hFile=0xdc) returned 1 [0171.787] GetProcessHeap () returned 0x4e0000 [0171.787] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.787] GetProcessHeap () returned 0x4e0000 [0171.787] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.787] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02373_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02373_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.788] CloseHandle (hObject=0xdc) returned 1 [0171.788] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbd8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02384_.WMF", cAlternateFileName="")) returned 1 [0171.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02384_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.809] GetProcessHeap () returned 0x4e0000 [0171.809] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.810] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.810] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.810] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.812] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.812] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.812] GetProcessHeap () returned 0x4e0000 [0171.812] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.812] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.813] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.813] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.813] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.813] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.813] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.813] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.813] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.813] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.813] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.813] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.813] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xbd8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xbd8, lpOverlapped=0x0) returned 1 [0171.813] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xbe0, dwBufLen=0xbe0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xbe0) returned 1 [0171.813] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.813] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xbe0, lpOverlapped=0x0) returned 1 [0171.813] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.813] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xcb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.813] SetEndOfFile (hFile=0xdc) returned 1 [0171.816] GetProcessHeap () returned 0x4e0000 [0171.816] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.816] GetProcessHeap () returned 0x4e0000 [0171.816] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.816] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02384_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02384_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.819] CloseHandle (hObject=0xdc) returned 1 [0171.819] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x948, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02386_.WMF", cAlternateFileName="")) returned 1 [0171.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02386_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.820] GetProcessHeap () returned 0x4e0000 [0171.820] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.820] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.820] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.820] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.851] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.851] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.851] GetProcessHeap () returned 0x4e0000 [0171.851] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.851] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.851] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.851] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.851] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.851] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.851] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.851] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.851] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.851] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.852] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.852] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.852] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x948, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x948, lpOverlapped=0x0) returned 1 [0171.852] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x950, dwBufLen=0x950 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x950) returned 1 [0171.852] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.852] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x950, lpOverlapped=0x0) returned 1 [0171.852] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.852] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xa24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.852] SetEndOfFile (hFile=0xdc) returned 1 [0171.854] GetProcessHeap () returned 0x4e0000 [0171.854] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.854] GetProcessHeap () returned 0x4e0000 [0171.854] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.854] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02386_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02386_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.856] CloseHandle (hObject=0xdc) returned 1 [0171.856] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc84, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02388_.WMF", cAlternateFileName="")) returned 1 [0171.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02388_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.857] GetProcessHeap () returned 0x4e0000 [0171.857] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.857] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.857] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.857] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0171.859] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.859] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.859] GetProcessHeap () returned 0x4e0000 [0171.859] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.859] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.859] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.859] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.859] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.859] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.859] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.859] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.859] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.859] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.859] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.859] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.859] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xc84, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xc84, lpOverlapped=0x0) returned 1 [0171.859] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xc90, dwBufLen=0xc90 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xc90) returned 1 [0171.859] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.859] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc90, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xc90, lpOverlapped=0x0) returned 1 [0171.860] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.860] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xd64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.860] SetEndOfFile (hFile=0xdc) returned 1 [0171.862] GetProcessHeap () returned 0x4e0000 [0171.862] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.862] GetProcessHeap () returned 0x4e0000 [0171.862] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.862] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02388_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02388_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.863] CloseHandle (hObject=0xdc) returned 1 [0171.863] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb2c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02389_.WMF", cAlternateFileName="")) returned 1 [0171.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02389_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.864] GetProcessHeap () returned 0x4e0000 [0171.864] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.864] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.864] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.864] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.866] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.866] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.866] GetProcessHeap () returned 0x4e0000 [0171.866] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.866] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.866] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.866] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.866] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.866] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.867] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.867] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.867] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.867] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.867] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.867] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.867] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb2c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xb2c, lpOverlapped=0x0) returned 1 [0171.867] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xb30, dwBufLen=0xb30 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xb30) returned 1 [0171.867] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.867] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xb30, lpOverlapped=0x0) returned 1 [0171.867] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.867] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xc04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.867] SetEndOfFile (hFile=0xdc) returned 1 [0171.869] GetProcessHeap () returned 0x4e0000 [0171.869] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.869] GetProcessHeap () returned 0x4e0000 [0171.869] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.869] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02389_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02389_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.870] CloseHandle (hObject=0xdc) returned 1 [0171.870] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe64, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02390_.WMF", cAlternateFileName="")) returned 1 [0171.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02390_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.871] GetProcessHeap () returned 0x4e0000 [0171.871] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.871] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.871] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.871] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0171.875] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.875] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.875] GetProcessHeap () returned 0x4e0000 [0171.875] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.875] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.875] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.875] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.875] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.875] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.875] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.876] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.876] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.876] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.876] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.876] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.876] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xe64, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xe64, lpOverlapped=0x0) returned 1 [0171.876] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe70, dwBufLen=0xe70 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe70) returned 1 [0171.876] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.876] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xe70, lpOverlapped=0x0) returned 1 [0171.876] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.876] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xf44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.876] SetEndOfFile (hFile=0xdc) returned 1 [0171.878] GetProcessHeap () returned 0x4e0000 [0171.878] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.878] GetProcessHeap () returned 0x4e0000 [0171.878] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.878] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02390_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02390_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.879] CloseHandle (hObject=0xdc) returned 1 [0171.879] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e98, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02398_.WMF", cAlternateFileName="")) returned 1 [0171.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02398_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.880] GetProcessHeap () returned 0x4e0000 [0171.880] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.880] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.880] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.880] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.882] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.882] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.882] GetProcessHeap () returned 0x4e0000 [0171.882] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.882] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.882] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.882] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.882] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.882] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.882] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.882] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.882] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.882] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.882] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.882] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.882] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1e98, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1e98, lpOverlapped=0x0) returned 1 [0171.883] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1ea0, dwBufLen=0x1ea0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1ea0) returned 1 [0171.883] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.883] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1ea0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1ea0, lpOverlapped=0x0) returned 1 [0171.883] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.883] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1f74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.883] SetEndOfFile (hFile=0xdc) returned 1 [0171.885] GetProcessHeap () returned 0x4e0000 [0171.885] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.885] GetProcessHeap () returned 0x4e0000 [0171.885] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.886] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02398_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02398_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.886] CloseHandle (hObject=0xdc) returned 1 [0171.886] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd24, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02400_.WMF", cAlternateFileName="")) returned 1 [0171.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02400_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.888] GetProcessHeap () returned 0x4e0000 [0171.888] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.888] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.888] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.888] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0171.890] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.890] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.890] GetProcessHeap () returned 0x4e0000 [0171.890] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.890] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.890] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.890] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.890] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.890] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.890] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.890] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.890] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.890] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.890] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.890] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.891] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xd24, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xd24, lpOverlapped=0x0) returned 1 [0171.891] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xd30, dwBufLen=0xd30 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xd30) returned 1 [0171.891] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.891] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xd30, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xd30, lpOverlapped=0x0) returned 1 [0171.891] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.891] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xe04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.891] SetEndOfFile (hFile=0xdc) returned 1 [0171.893] GetProcessHeap () returned 0x4e0000 [0171.893] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.893] GetProcessHeap () returned 0x4e0000 [0171.893] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.893] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02400_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02400_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.894] CloseHandle (hObject=0xdc) returned 1 [0171.894] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2120, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02404_.WMF", cAlternateFileName="")) returned 1 [0171.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02404_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.896] GetProcessHeap () returned 0x4e0000 [0171.896] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.896] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.896] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.896] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.896] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.896] GetProcessHeap () returned 0x4e0000 [0171.896] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.896] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.896] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.896] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.898] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.898] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.898] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.898] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.898] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.898] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.898] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.898] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.898] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2120, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2120, lpOverlapped=0x0) returned 1 [0171.899] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2120, dwBufLen=0x2120 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2120) returned 1 [0171.899] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.899] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2120, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2120, lpOverlapped=0x0) returned 1 [0171.899] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.899] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x21f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.899] SetEndOfFile (hFile=0xdc) returned 1 [0171.902] GetProcessHeap () returned 0x4e0000 [0171.902] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.902] GetProcessHeap () returned 0x4e0000 [0171.902] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.902] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02404_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02404_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.903] CloseHandle (hObject=0xdc) returned 1 [0171.903] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5080, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02405_.WMF", cAlternateFileName="")) returned 1 [0171.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02405_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.904] GetProcessHeap () returned 0x4e0000 [0171.904] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.904] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.904] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.905] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.905] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.905] GetProcessHeap () returned 0x4e0000 [0171.905] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.905] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.905] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.905] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.907] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.907] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.907] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.907] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.907] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.908] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.908] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.908] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.908] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5080, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x5080, lpOverlapped=0x0) returned 1 [0171.909] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5080, dwBufLen=0x5080 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5080) returned 1 [0171.909] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.909] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5080, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5080, lpOverlapped=0x0) returned 1 [0171.909] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.909] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5154, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.909] SetEndOfFile (hFile=0xdc) returned 1 [0171.912] GetProcessHeap () returned 0x4e0000 [0171.912] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.912] GetProcessHeap () returned 0x4e0000 [0171.912] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.912] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02405_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02405_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.914] CloseHandle (hObject=0xdc) returned 1 [0171.914] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1fc8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02407_.WMF", cAlternateFileName="")) returned 1 [0171.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02407_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.915] GetProcessHeap () returned 0x4e0000 [0171.915] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.915] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.915] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.915] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.918] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.918] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.918] GetProcessHeap () returned 0x4e0000 [0171.918] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.918] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.918] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.918] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.918] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.918] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.918] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.918] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.918] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.919] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.919] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.919] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.919] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1fc8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1fc8, lpOverlapped=0x0) returned 1 [0171.920] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1fd0, dwBufLen=0x1fd0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1fd0) returned 1 [0171.920] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.920] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1fd0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1fd0, lpOverlapped=0x0) returned 1 [0171.920] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.920] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x20a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.920] SetEndOfFile (hFile=0xdc) returned 1 [0171.923] GetProcessHeap () returned 0x4e0000 [0171.923] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.923] GetProcessHeap () returned 0x4e0000 [0171.923] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.923] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02407_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02407_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.925] CloseHandle (hObject=0xdc) returned 1 [0171.925] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x28ec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02413_.WMF", cAlternateFileName="")) returned 1 [0171.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02413_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.926] GetProcessHeap () returned 0x4e0000 [0171.926] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.926] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.926] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.927] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.929] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.929] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.929] GetProcessHeap () returned 0x4e0000 [0171.929] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.929] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.929] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.929] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.929] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.929] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.929] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.930] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.930] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.930] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.930] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.930] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.930] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x28ec, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x28ec, lpOverlapped=0x0) returned 1 [0171.931] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x28f0, dwBufLen=0x28f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x28f0) returned 1 [0171.931] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.931] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x28f0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x28f0, lpOverlapped=0x0) returned 1 [0171.932] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.932] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x29c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.932] SetEndOfFile (hFile=0xdc) returned 1 [0171.934] GetProcessHeap () returned 0x4e0000 [0171.934] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.934] GetProcessHeap () returned 0x4e0000 [0171.934] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.934] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02413_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02413_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.935] CloseHandle (hObject=0xdc) returned 1 [0171.935] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb24, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02417_.WMF", cAlternateFileName="")) returned 1 [0171.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02417_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.936] GetProcessHeap () returned 0x4e0000 [0171.936] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.936] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.937] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.937] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0171.971] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.971] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.971] GetProcessHeap () returned 0x4e0000 [0171.971] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.971] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.971] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.971] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.971] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.971] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.971] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.972] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.972] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.972] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.972] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.972] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.972] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb24, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xb24, lpOverlapped=0x0) returned 1 [0171.972] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xb30, dwBufLen=0xb30 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xb30) returned 1 [0171.972] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.972] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xb30, lpOverlapped=0x0) returned 1 [0171.972] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.972] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xc04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.972] SetEndOfFile (hFile=0xdc) returned 1 [0171.974] GetProcessHeap () returned 0x4e0000 [0171.974] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.975] GetProcessHeap () returned 0x4e0000 [0171.975] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.975] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02417_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02417_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.976] CloseHandle (hObject=0xdc) returned 1 [0171.976] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2fb8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02423_.WMF", cAlternateFileName="")) returned 1 [0171.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02423_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.977] GetProcessHeap () returned 0x4e0000 [0171.977] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.977] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.977] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.977] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.979] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.979] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.979] GetProcessHeap () returned 0x4e0000 [0171.979] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.979] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.979] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.979] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.979] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.980] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.980] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.980] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.980] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.980] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.980] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.980] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.980] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2fb8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2fb8, lpOverlapped=0x0) returned 1 [0171.981] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2fc0, dwBufLen=0x2fc0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2fc0) returned 1 [0171.981] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.981] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2fc0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2fc0, lpOverlapped=0x0) returned 1 [0171.981] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.981] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3094, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.981] SetEndOfFile (hFile=0xdc) returned 1 [0171.984] GetProcessHeap () returned 0x4e0000 [0171.984] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.984] GetProcessHeap () returned 0x4e0000 [0171.984] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.984] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02423_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02423_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.987] CloseHandle (hObject=0xdc) returned 1 [0171.987] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x53c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02424_.WMF", cAlternateFileName="")) returned 1 [0171.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02424_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.988] GetProcessHeap () returned 0x4e0000 [0171.988] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.988] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.988] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.988] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.990] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.990] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.990] GetProcessHeap () returned 0x4e0000 [0171.990] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.990] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.990] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.990] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.990] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.991] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.991] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.991] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.991] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.991] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.991] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.991] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.991] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x53c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x53c, lpOverlapped=0x0) returned 1 [0171.991] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x540, dwBufLen=0x540 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x540) returned 1 [0171.991] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.991] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x540, lpOverlapped=0x0) returned 1 [0171.991] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.991] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.991] SetEndOfFile (hFile=0xdc) returned 1 [0171.993] GetProcessHeap () returned 0x4e0000 [0171.993] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0171.993] GetProcessHeap () returned 0x4e0000 [0171.993] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0171.993] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02424_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02424_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0171.995] CloseHandle (hObject=0xdc) returned 1 [0171.995] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1948, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02426_.WMF", cAlternateFileName="")) returned 1 [0171.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02426_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.996] GetProcessHeap () returned 0x4e0000 [0171.996] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0171.996] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0171.996] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0171.996] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.998] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.998] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.998] GetProcessHeap () returned 0x4e0000 [0171.998] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0171.998] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0171.998] CryptDestroyKey (hKey=0x522f98) returned 1 [0171.998] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0171.998] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0171.998] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0171.998] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0171.999] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0171.999] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0171.999] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0171.999] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0171.999] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.999] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1948, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1948, lpOverlapped=0x0) returned 1 [0172.000] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1950, dwBufLen=0x1950 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1950) returned 1 [0172.000] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.000] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1950, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1950, lpOverlapped=0x0) returned 1 [0172.000] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.000] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1a24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.000] SetEndOfFile (hFile=0xdc) returned 1 [0172.002] GetProcessHeap () returned 0x4e0000 [0172.002] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.002] GetProcessHeap () returned 0x4e0000 [0172.002] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.002] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02426_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02426_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.004] CloseHandle (hObject=0xdc) returned 1 [0172.004] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1c2c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02431_.WMF", cAlternateFileName="")) returned 1 [0172.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02431_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.005] GetProcessHeap () returned 0x4e0000 [0172.005] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.005] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.007] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.007] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.009] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.009] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.009] GetProcessHeap () returned 0x4e0000 [0172.009] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.009] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.009] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.009] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.009] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.009] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.009] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.009] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.009] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.009] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.009] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.009] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.010] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1c2c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1c2c, lpOverlapped=0x0) returned 1 [0172.010] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1c30, dwBufLen=0x1c30 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1c30) returned 1 [0172.010] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.010] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1c30, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1c30, lpOverlapped=0x0) returned 1 [0172.011] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.011] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1d04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.011] SetEndOfFile (hFile=0xdc) returned 1 [0172.013] GetProcessHeap () returned 0x4e0000 [0172.013] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.013] GetProcessHeap () returned 0x4e0000 [0172.013] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.013] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02431_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02431_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.015] CloseHandle (hObject=0xdc) returned 1 [0172.015] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xff8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02435_.WMF", cAlternateFileName="")) returned 1 [0172.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02435_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.019] GetProcessHeap () returned 0x4e0000 [0172.019] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.019] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.019] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.019] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.021] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.021] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.021] GetProcessHeap () returned 0x4e0000 [0172.021] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.021] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.021] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.021] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.022] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.022] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.022] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.022] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.022] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.022] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.022] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.022] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.022] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xff8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xff8, lpOverlapped=0x0) returned 1 [0172.022] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1000, dwBufLen=0x1000 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1000) returned 1 [0172.022] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.022] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1000, lpOverlapped=0x0) returned 1 [0172.022] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.022] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x10d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.023] SetEndOfFile (hFile=0xdc) returned 1 [0172.025] GetProcessHeap () returned 0x4e0000 [0172.025] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.025] GetProcessHeap () returned 0x4e0000 [0172.025] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.025] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02435_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02435_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.026] CloseHandle (hObject=0xdc) returned 1 [0172.026] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1434, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02439_.WMF", cAlternateFileName="")) returned 1 [0172.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02439_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.028] GetProcessHeap () returned 0x4e0000 [0172.028] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.028] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.028] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.028] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0172.030] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.030] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.030] GetProcessHeap () returned 0x4e0000 [0172.030] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.030] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.030] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.030] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.030] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.030] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.030] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.030] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.030] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.030] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.030] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.030] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.030] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1434, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1434, lpOverlapped=0x0) returned 1 [0172.031] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1440, dwBufLen=0x1440 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1440) returned 1 [0172.031] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.031] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1440, lpOverlapped=0x0) returned 1 [0172.031] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.031] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1514, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.031] SetEndOfFile (hFile=0xdc) returned 1 [0172.034] GetProcessHeap () returned 0x4e0000 [0172.034] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.034] GetProcessHeap () returned 0x4e0000 [0172.034] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.034] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02439_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02439_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.035] CloseHandle (hObject=0xdc) returned 1 [0172.035] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3218, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02441_.WMF", cAlternateFileName="")) returned 1 [0172.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02441_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.036] GetProcessHeap () returned 0x4e0000 [0172.036] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.036] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.037] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.037] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.038] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.038] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.038] GetProcessHeap () returned 0x4e0000 [0172.039] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.039] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.039] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.039] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.039] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.039] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.039] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.039] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.039] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.039] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.039] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.039] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.039] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3218, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3218, lpOverlapped=0x0) returned 1 [0172.040] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3220, dwBufLen=0x3220 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3220) returned 1 [0172.040] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.040] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3220, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3220, lpOverlapped=0x0) returned 1 [0172.040] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.040] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x32f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.041] SetEndOfFile (hFile=0xdc) returned 1 [0172.043] GetProcessHeap () returned 0x4e0000 [0172.043] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.043] GetProcessHeap () returned 0x4e0000 [0172.043] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.043] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02441_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02441_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.044] CloseHandle (hObject=0xdc) returned 1 [0172.044] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x55c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02443_.WMF", cAlternateFileName="")) returned 1 [0172.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.045] GetProcessHeap () returned 0x4e0000 [0172.045] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.046] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.046] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.046] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.047] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.047] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.047] GetProcessHeap () returned 0x4e0000 [0172.047] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.047] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.047] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.047] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.048] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.048] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.048] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.048] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.048] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.048] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.048] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.048] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.048] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x55c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x55c, lpOverlapped=0x0) returned 1 [0172.048] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x560, dwBufLen=0x560 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x560) returned 1 [0172.048] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.048] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x560, lpOverlapped=0x0) returned 1 [0172.048] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.049] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x634, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.049] SetEndOfFile (hFile=0xdc) returned 1 [0172.051] GetProcessHeap () returned 0x4e0000 [0172.051] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.051] GetProcessHeap () returned 0x4e0000 [0172.051] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.051] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02443_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02443_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.052] CloseHandle (hObject=0xdc) returned 1 [0172.052] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x88c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02444_.WMF", cAlternateFileName="")) returned 1 [0172.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02444_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.053] GetProcessHeap () returned 0x4e0000 [0172.053] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.053] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.053] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.054] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.056] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.056] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.056] GetProcessHeap () returned 0x4e0000 [0172.056] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.056] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.056] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.056] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.056] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.057] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.057] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.057] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.057] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.057] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.057] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.057] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.057] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x88c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x88c, lpOverlapped=0x0) returned 1 [0172.057] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x890, dwBufLen=0x890 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x890) returned 1 [0172.057] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.057] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x890, lpOverlapped=0x0) returned 1 [0172.057] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.057] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x964, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.057] SetEndOfFile (hFile=0xdc) returned 1 [0172.059] GetProcessHeap () returned 0x4e0000 [0172.059] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.059] GetProcessHeap () returned 0x4e0000 [0172.059] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.059] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02444_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02444_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.061] CloseHandle (hObject=0xdc) returned 1 [0172.061] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa34, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02446_.WMF", cAlternateFileName="")) returned 1 [0172.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02446_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.062] GetProcessHeap () returned 0x4e0000 [0172.062] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.062] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.062] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.062] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0172.064] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.064] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.064] GetProcessHeap () returned 0x4e0000 [0172.064] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.064] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.064] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.064] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.064] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.064] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.064] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.064] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.064] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.064] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.065] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.065] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.065] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xa34, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xa34, lpOverlapped=0x0) returned 1 [0172.065] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa40, dwBufLen=0xa40 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa40) returned 1 [0172.065] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.065] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xa40, lpOverlapped=0x0) returned 1 [0172.065] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.065] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xb14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.065] SetEndOfFile (hFile=0xdc) returned 1 [0172.067] GetProcessHeap () returned 0x4e0000 [0172.067] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.067] GetProcessHeap () returned 0x4e0000 [0172.067] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.067] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02446_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02446_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.068] CloseHandle (hObject=0xdc) returned 1 [0172.068] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02448_.WMF", cAlternateFileName="")) returned 1 [0172.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02448_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.070] GetProcessHeap () returned 0x4e0000 [0172.070] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.070] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.070] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.070] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.070] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.070] GetProcessHeap () returned 0x4e0000 [0172.070] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.070] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.070] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.070] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.072] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.072] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.072] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.072] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.072] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.072] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.072] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.072] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.072] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x8a0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x8a0, lpOverlapped=0x0) returned 1 [0172.072] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8a0, dwBufLen=0x8a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8a0) returned 1 [0172.072] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.072] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x8a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x8a0, lpOverlapped=0x0) returned 1 [0172.072] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.073] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x974, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.073] SetEndOfFile (hFile=0xdc) returned 1 [0172.075] GetProcessHeap () returned 0x4e0000 [0172.075] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.075] GetProcessHeap () returned 0x4e0000 [0172.075] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.075] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02448_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02448_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.076] CloseHandle (hObject=0xdc) returned 1 [0172.076] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc28, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02450_.WMF", cAlternateFileName="")) returned 1 [0172.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02450_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.077] GetProcessHeap () returned 0x4e0000 [0172.077] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.077] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.077] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.077] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.079] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.079] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.079] GetProcessHeap () returned 0x4e0000 [0172.079] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.079] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.079] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.079] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.079] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.079] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.079] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.079] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.079] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.079] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.079] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.079] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.079] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xc28, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xc28, lpOverlapped=0x0) returned 1 [0172.079] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xc30, dwBufLen=0xc30 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xc30) returned 1 [0172.079] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.080] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc30, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xc30, lpOverlapped=0x0) returned 1 [0172.080] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.080] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xd04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.080] SetEndOfFile (hFile=0xdc) returned 1 [0172.082] GetProcessHeap () returned 0x4e0000 [0172.082] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.082] GetProcessHeap () returned 0x4e0000 [0172.082] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.082] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02450_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02450_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.083] CloseHandle (hObject=0xdc) returned 1 [0172.083] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd70, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02451_.WMF", cAlternateFileName="")) returned 1 [0172.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02451_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.085] GetProcessHeap () returned 0x4e0000 [0172.085] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.085] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.085] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.085] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.085] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.085] GetProcessHeap () returned 0x4e0000 [0172.085] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.085] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.085] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.085] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.086] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.087] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.087] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.087] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.087] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.087] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.087] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.087] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.087] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xd70, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xd70, lpOverlapped=0x0) returned 1 [0172.087] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xd70, dwBufLen=0xd70 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xd70) returned 1 [0172.087] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.087] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xd70, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xd70, lpOverlapped=0x0) returned 1 [0172.087] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.087] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xe44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.087] SetEndOfFile (hFile=0xdc) returned 1 [0172.089] GetProcessHeap () returned 0x4e0000 [0172.089] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.090] GetProcessHeap () returned 0x4e0000 [0172.090] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.090] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02451_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02451_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.091] CloseHandle (hObject=0xdc) returned 1 [0172.091] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd3c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02453_.WMF", cAlternateFileName="")) returned 1 [0172.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02453_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.092] GetProcessHeap () returned 0x4e0000 [0172.092] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.092] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.092] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.092] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.094] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.094] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.094] GetProcessHeap () returned 0x4e0000 [0172.094] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.094] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.094] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.094] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.094] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.094] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.094] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.094] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.094] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.094] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.095] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.095] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.095] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xd3c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xd3c, lpOverlapped=0x0) returned 1 [0172.095] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xd40, dwBufLen=0xd40 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xd40) returned 1 [0172.095] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.095] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xd40, lpOverlapped=0x0) returned 1 [0172.095] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.095] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xe14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.095] SetEndOfFile (hFile=0xdc) returned 1 [0172.097] GetProcessHeap () returned 0x4e0000 [0172.097] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.097] GetProcessHeap () returned 0x4e0000 [0172.097] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.097] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02453_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02453_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.098] CloseHandle (hObject=0xdc) returned 1 [0172.098] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1750, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NBOOK_01.MID", cAlternateFileName="")) returned 1 [0172.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.100] GetProcessHeap () returned 0x4e0000 [0172.100] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.100] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.100] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.100] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.100] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.100] GetProcessHeap () returned 0x4e0000 [0172.100] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.100] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.100] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.100] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.102] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.102] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.102] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.102] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.102] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.102] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.102] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.102] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.102] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1750, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1750, lpOverlapped=0x0) returned 1 [0172.103] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1750, dwBufLen=0x1750 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1750) returned 1 [0172.103] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.103] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1750, lpOverlapped=0x0) returned 1 [0172.103] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.103] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1824, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.104] SetEndOfFile (hFile=0xdc) returned 1 [0172.106] GetProcessHeap () returned 0x4e0000 [0172.106] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.106] GetProcessHeap () returned 0x4e0000 [0172.106] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.106] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.107] CloseHandle (hObject=0xdc) returned 1 [0172.107] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5969b6f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1540, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OCEAN_01.MID", cAlternateFileName="")) returned 1 [0172.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.109] GetProcessHeap () returned 0x4e0000 [0172.109] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.109] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.109] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.109] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.109] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.109] GetProcessHeap () returned 0x4e0000 [0172.109] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.109] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.109] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.109] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.111] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.111] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.111] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.111] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.111] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.111] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.111] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.111] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.111] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1540, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1540, lpOverlapped=0x0) returned 1 [0172.112] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1540, dwBufLen=0x1540 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1540) returned 1 [0172.112] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.112] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1540, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1540, lpOverlapped=0x0) returned 1 [0172.112] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.112] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.112] SetEndOfFile (hFile=0xdc) returned 1 [0172.114] GetProcessHeap () returned 0x4e0000 [0172.114] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.114] GetProcessHeap () returned 0x4e0000 [0172.114] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.114] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.116] CloseHandle (hObject=0xdc) returned 1 [0172.116] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x19f4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OUTDR_01.MID", cAlternateFileName="")) returned 1 [0172.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.117] GetProcessHeap () returned 0x4e0000 [0172.117] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.117] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.117] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.117] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0172.119] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.119] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.119] GetProcessHeap () returned 0x4e0000 [0172.119] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.119] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.119] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.119] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.119] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.119] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.119] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.119] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.119] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.120] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.120] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.120] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.120] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x19f4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x19f4, lpOverlapped=0x0) returned 1 [0172.120] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1a00, dwBufLen=0x1a00 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1a00) returned 1 [0172.120] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.121] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1a00, lpOverlapped=0x0) returned 1 [0172.121] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.121] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1ad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.121] SetEndOfFile (hFile=0xdc) returned 1 [0172.123] GetProcessHeap () returned 0x4e0000 [0172.123] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.123] GetProcessHeap () returned 0x4e0000 [0172.123] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.123] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.124] CloseHandle (hObject=0xdc) returned 1 [0172.124] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1a6b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PAPER_01.MID", cAlternateFileName="")) returned 1 [0172.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.125] GetProcessHeap () returned 0x4e0000 [0172.125] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.125] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.125] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.125] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x5, lpOverlapped=0x0) returned 1 [0172.127] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.127] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.127] GetProcessHeap () returned 0x4e0000 [0172.127] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.127] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.127] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.127] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.127] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.127] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.127] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.127] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.127] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.127] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.127] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.127] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.127] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1a6b, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1a6b, lpOverlapped=0x0) returned 1 [0172.129] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1a70, dwBufLen=0x1a70 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1a70) returned 1 [0172.129] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.129] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1a70, lpOverlapped=0x0) returned 1 [0172.129] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.129] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1b44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.129] SetEndOfFile (hFile=0xdc) returned 1 [0172.131] GetProcessHeap () returned 0x4e0000 [0172.131] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.131] GetProcessHeap () returned 0x4e0000 [0172.131] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.131] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.132] CloseHandle (hObject=0xdc) returned 1 [0172.133] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x195b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PARNT_01.MID", cAlternateFileName="")) returned 1 [0172.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.133] GetProcessHeap () returned 0x4e0000 [0172.133] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.133] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.133] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.133] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x5, lpOverlapped=0x0) returned 1 [0172.135] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.135] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.135] GetProcessHeap () returned 0x4e0000 [0172.135] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.135] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.135] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.135] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.135] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.135] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.135] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.136] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.136] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.136] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.136] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.136] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.136] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x195b, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x195b, lpOverlapped=0x0) returned 1 [0172.137] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1960, dwBufLen=0x1960 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1960) returned 1 [0172.137] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.137] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1960, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1960, lpOverlapped=0x0) returned 1 [0172.137] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.137] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1a34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.137] SetEndOfFile (hFile=0xdc) returned 1 [0172.139] GetProcessHeap () returned 0x4e0000 [0172.139] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.139] GetProcessHeap () returned 0x4e0000 [0172.139] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.139] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.140] CloseHandle (hObject=0xdc) returned 1 [0172.140] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1652, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PARNT_02.MID", cAlternateFileName="")) returned 1 [0172.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.141] GetProcessHeap () returned 0x4e0000 [0172.141] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.141] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.141] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.141] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0172.143] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.143] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.143] GetProcessHeap () returned 0x4e0000 [0172.143] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.143] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.143] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.143] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.143] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.143] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.143] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.143] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.143] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.143] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.143] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.143] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.143] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1652, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1652, lpOverlapped=0x0) returned 1 [0172.144] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1660, dwBufLen=0x1660 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1660) returned 1 [0172.144] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.144] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1660, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1660, lpOverlapped=0x0) returned 1 [0172.144] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.144] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1734, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.144] SetEndOfFile (hFile=0xdc) returned 1 [0172.146] GetProcessHeap () returned 0x4e0000 [0172.146] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.147] GetProcessHeap () returned 0x4e0000 [0172.147] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.147] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.149] CloseHandle (hObject=0xdc) returned 1 [0172.149] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x215a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PARNT_03.MID", cAlternateFileName="")) returned 1 [0172.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.150] GetProcessHeap () returned 0x4e0000 [0172.150] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.150] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.150] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.150] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0172.152] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.152] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.152] GetProcessHeap () returned 0x4e0000 [0172.152] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.152] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.152] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.152] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.152] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.152] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.152] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.152] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.152] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.152] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.152] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.152] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.152] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x215a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x215a, lpOverlapped=0x0) returned 1 [0172.153] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2160, dwBufLen=0x2160 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2160) returned 1 [0172.153] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.153] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2160, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2160, lpOverlapped=0x0) returned 1 [0172.153] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.153] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2234, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.153] SetEndOfFile (hFile=0xdc) returned 1 [0172.156] GetProcessHeap () returned 0x4e0000 [0172.156] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.156] GetProcessHeap () returned 0x4e0000 [0172.156] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.156] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.157] CloseHandle (hObject=0xdc) returned 1 [0172.157] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x17b6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PARNT_04.MID", cAlternateFileName="")) returned 1 [0172.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.159] GetProcessHeap () returned 0x4e0000 [0172.159] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.159] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.159] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.159] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0172.161] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.161] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.161] GetProcessHeap () returned 0x4e0000 [0172.161] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.161] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.161] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.161] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.161] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.161] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.161] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.161] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.161] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.161] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.162] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.162] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.162] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x17b6, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x17b6, lpOverlapped=0x0) returned 1 [0172.162] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x17c0, dwBufLen=0x17c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x17c0) returned 1 [0172.163] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.163] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x17c0, lpOverlapped=0x0) returned 1 [0172.163] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.163] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1894, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.163] SetEndOfFile (hFile=0xdc) returned 1 [0172.165] GetProcessHeap () returned 0x4e0000 [0172.165] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.165] GetProcessHeap () returned 0x4e0000 [0172.165] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.165] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.167] CloseHandle (hObject=0xdc) returned 1 [0172.167] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1784, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PARNT_05.MID", cAlternateFileName="")) returned 1 [0172.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.169] GetProcessHeap () returned 0x4e0000 [0172.169] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.169] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.169] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.169] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0172.171] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.171] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.171] GetProcessHeap () returned 0x4e0000 [0172.171] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.171] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.171] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.171] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.171] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.171] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.171] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.171] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.171] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.172] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.172] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.172] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.172] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1784, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1784, lpOverlapped=0x0) returned 1 [0172.172] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1790, dwBufLen=0x1790 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1790) returned 1 [0172.173] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.173] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1790, lpOverlapped=0x0) returned 1 [0172.173] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.173] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1864, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.173] SetEndOfFile (hFile=0xdc) returned 1 [0172.175] GetProcessHeap () returned 0x4e0000 [0172.175] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.175] GetProcessHeap () returned 0x4e0000 [0172.175] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.175] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.177] CloseHandle (hObject=0xdc) returned 1 [0172.177] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1e58, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PARNT_06.MID", cAlternateFileName="")) returned 1 [0172.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.178] GetProcessHeap () returned 0x4e0000 [0172.178] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.178] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.178] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.178] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.180] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.180] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.180] GetProcessHeap () returned 0x4e0000 [0172.180] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.180] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.180] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.180] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.180] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.180] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.180] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.180] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.180] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.180] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.180] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.180] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.180] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1e58, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1e58, lpOverlapped=0x0) returned 1 [0172.181] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1e60, dwBufLen=0x1e60 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1e60) returned 1 [0172.181] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.181] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1e60, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1e60, lpOverlapped=0x0) returned 1 [0172.181] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.181] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1f34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.182] SetEndOfFile (hFile=0xdc) returned 1 [0172.184] GetProcessHeap () returned 0x4e0000 [0172.184] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.184] GetProcessHeap () returned 0x4e0000 [0172.184] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.184] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.185] CloseHandle (hObject=0xdc) returned 1 [0172.185] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x19a4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PARNT_07.MID", cAlternateFileName="")) returned 1 [0172.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.186] GetProcessHeap () returned 0x4e0000 [0172.187] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.187] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.187] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.187] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0172.189] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.189] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.189] GetProcessHeap () returned 0x4e0000 [0172.189] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.189] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.189] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.189] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.189] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.189] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.189] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.189] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.189] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.189] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.190] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.190] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.190] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x19a4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x19a4, lpOverlapped=0x0) returned 1 [0172.190] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x19b0, dwBufLen=0x19b0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x19b0) returned 1 [0172.190] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.190] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x19b0, lpOverlapped=0x0) returned 1 [0172.191] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.191] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1a84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.191] SetEndOfFile (hFile=0xdc) returned 1 [0172.193] GetProcessHeap () returned 0x4e0000 [0172.193] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.194] GetProcessHeap () returned 0x4e0000 [0172.194] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.194] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.195] CloseHandle (hObject=0xdc) returned 1 [0172.195] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1cb3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PARNT_08.MID", cAlternateFileName="")) returned 1 [0172.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.196] GetProcessHeap () returned 0x4e0000 [0172.196] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.196] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.196] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.196] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xd, lpOverlapped=0x0) returned 1 [0172.199] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.199] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.199] GetProcessHeap () returned 0x4e0000 [0172.199] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.199] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.199] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.199] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.199] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.199] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.199] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.199] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.199] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.199] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.199] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.199] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.200] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1cb3, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1cb3, lpOverlapped=0x0) returned 1 [0172.200] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1cc0, dwBufLen=0x1cc0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1cc0) returned 1 [0172.200] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.200] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1cc0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1cc0, lpOverlapped=0x0) returned 1 [0172.201] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.201] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1d94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.201] SetEndOfFile (hFile=0xdc) returned 1 [0172.203] GetProcessHeap () returned 0x4e0000 [0172.203] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.203] GetProcessHeap () returned 0x4e0000 [0172.203] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.203] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.204] CloseHandle (hObject=0xdc) returned 1 [0172.204] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1a6c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PARNT_09.MID", cAlternateFileName="")) returned 1 [0172.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.205] GetProcessHeap () returned 0x4e0000 [0172.205] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.205] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.205] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.205] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.207] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.208] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.208] GetProcessHeap () returned 0x4e0000 [0172.208] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.208] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.208] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.208] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.208] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.208] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.208] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.208] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.208] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.208] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.208] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.208] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.208] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1a6c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1a6c, lpOverlapped=0x0) returned 1 [0172.209] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1a70, dwBufLen=0x1a70 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1a70) returned 1 [0172.209] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.209] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1a70, lpOverlapped=0x0) returned 1 [0172.209] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.210] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1b44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.210] SetEndOfFile (hFile=0xdc) returned 1 [0172.212] GetProcessHeap () returned 0x4e0000 [0172.212] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.212] GetProcessHeap () returned 0x4e0000 [0172.212] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.212] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.213] CloseHandle (hObject=0xdc) returned 1 [0172.213] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1511, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PARNT_10.MID", cAlternateFileName="")) returned 1 [0172.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.214] GetProcessHeap () returned 0x4e0000 [0172.214] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.214] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.214] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.214] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xf, lpOverlapped=0x0) returned 1 [0172.216] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.216] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.216] GetProcessHeap () returned 0x4e0000 [0172.216] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.216] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.216] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.216] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.216] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.216] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.217] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.217] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.217] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.217] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.217] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.217] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.217] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1511, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1511, lpOverlapped=0x0) returned 1 [0172.218] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1520, dwBufLen=0x1520 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1520) returned 1 [0172.218] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.218] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1520, lpOverlapped=0x0) returned 1 [0172.218] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.218] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x15f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.218] SetEndOfFile (hFile=0xdc) returned 1 [0172.220] GetProcessHeap () returned 0x4e0000 [0172.220] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.220] GetProcessHeap () returned 0x4e0000 [0172.220] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.220] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.221] CloseHandle (hObject=0xdc) returned 1 [0172.221] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb480d800, ftCreationTime.dwHighDateTime=0x1bd4b33, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb480d800, ftLastWriteTime.dwHighDateTime=0x1bd4b33, nFileSizeHigh=0x0, nFileSizeLow=0x6140, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00013_.WMF", cAlternateFileName="")) returned 1 [0172.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.222] GetProcessHeap () returned 0x4e0000 [0172.222] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.222] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.222] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.222] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.222] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.222] GetProcessHeap () returned 0x4e0000 [0172.222] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.222] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.222] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.222] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.224] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.224] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.224] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.224] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.224] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.224] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.224] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.224] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.224] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x6140, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x6140, lpOverlapped=0x0) returned 1 [0172.225] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6140, dwBufLen=0x6140 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6140) returned 1 [0172.226] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.226] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6140, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x6140, lpOverlapped=0x0) returned 1 [0172.226] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.226] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.226] SetEndOfFile (hFile=0xdc) returned 1 [0172.228] GetProcessHeap () returned 0x4e0000 [0172.228] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.228] GetProcessHeap () returned 0x4e0000 [0172.228] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.228] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00013_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00013_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.229] CloseHandle (hObject=0xdc) returned 1 [0172.229] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0ed5100, ftCreationTime.dwHighDateTime=0x1bd4b33, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0ed5100, ftLastWriteTime.dwHighDateTime=0x1bd4b33, nFileSizeHigh=0x0, nFileSizeLow=0x411a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00014_.WMF", cAlternateFileName="")) returned 1 [0172.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00014_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.230] GetProcessHeap () returned 0x4e0000 [0172.230] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.230] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.230] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.230] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0172.232] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.232] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.232] GetProcessHeap () returned 0x4e0000 [0172.232] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.232] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.232] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.232] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.232] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.232] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.232] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.232] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.232] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.232] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.232] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.232] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.232] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x411a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x411a, lpOverlapped=0x0) returned 1 [0172.233] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4120, dwBufLen=0x4120 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4120) returned 1 [0172.234] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.234] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4120, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4120, lpOverlapped=0x0) returned 1 [0172.234] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.234] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x41f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.234] SetEndOfFile (hFile=0xdc) returned 1 [0172.236] GetProcessHeap () returned 0x4e0000 [0172.236] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.236] GetProcessHeap () returned 0x4e0000 [0172.236] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.236] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00014_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00014_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.237] CloseHandle (hObject=0xdc) returned 1 [0172.237] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3d5c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00034_.WMF", cAlternateFileName="")) returned 1 [0172.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00034_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.238] GetProcessHeap () returned 0x4e0000 [0172.238] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.238] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.239] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.239] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.240] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.240] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.240] GetProcessHeap () returned 0x4e0000 [0172.240] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.240] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.240] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.240] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.241] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.241] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.241] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.241] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.241] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.241] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.241] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.241] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.241] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3d5c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3d5c, lpOverlapped=0x0) returned 1 [0172.242] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3d60, dwBufLen=0x3d60 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3d60) returned 1 [0172.242] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.242] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3d60, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3d60, lpOverlapped=0x0) returned 1 [0172.242] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.242] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3e34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.242] SetEndOfFile (hFile=0xdc) returned 1 [0172.244] GetProcessHeap () returned 0x4e0000 [0172.244] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.244] GetProcessHeap () returned 0x4e0000 [0172.245] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.245] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00034_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00034_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.246] CloseHandle (hObject=0xdc) returned 1 [0172.246] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f647900, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f647900, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00049_.WMF", cAlternateFileName="")) returned 1 [0172.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00049_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.247] GetProcessHeap () returned 0x4e0000 [0172.247] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.247] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.247] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.247] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.247] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.247] GetProcessHeap () returned 0x4e0000 [0172.247] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.247] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.247] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.247] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.249] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.249] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.249] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.249] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.249] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.249] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.249] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.249] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.249] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4040, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4040, lpOverlapped=0x0) returned 1 [0172.250] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4040, dwBufLen=0x4040 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4040) returned 1 [0172.250] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.250] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4040, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4040, lpOverlapped=0x0) returned 1 [0172.250] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.250] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4114, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.250] SetEndOfFile (hFile=0xdc) returned 1 [0172.252] GetProcessHeap () returned 0x4e0000 [0172.252] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.252] GetProcessHeap () returned 0x4e0000 [0172.252] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.253] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00049_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00049_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.254] CloseHandle (hObject=0xdc) returned 1 [0172.254] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e334c00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e334c00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x4d18, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00050_.WMF", cAlternateFileName="")) returned 1 [0172.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00050_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.254] GetProcessHeap () returned 0x4e0000 [0172.254] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.255] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.255] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.255] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.256] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.256] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.256] GetProcessHeap () returned 0x4e0000 [0172.256] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.257] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.257] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.257] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.257] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.257] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.257] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.257] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.257] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.257] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.257] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.257] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.257] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4d18, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4d18, lpOverlapped=0x0) returned 1 [0172.258] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4d20, dwBufLen=0x4d20 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4d20) returned 1 [0172.258] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.258] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4d20, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4d20, lpOverlapped=0x0) returned 1 [0172.258] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.258] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4df4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.258] SetEndOfFile (hFile=0xdc) returned 1 [0172.261] GetProcessHeap () returned 0x4e0000 [0172.261] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.261] GetProcessHeap () returned 0x4e0000 [0172.261] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.261] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00050_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00050_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.262] CloseHandle (hObject=0xdc) returned 1 [0172.262] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d021f00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d021f00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x47ec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00052_.WMF", cAlternateFileName="")) returned 1 [0172.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00052_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.263] GetProcessHeap () returned 0x4e0000 [0172.263] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.263] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.263] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.263] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.264] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.264] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.265] GetProcessHeap () returned 0x4e0000 [0172.265] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.265] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.265] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.265] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.265] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.265] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.265] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.265] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.265] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.265] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.265] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.265] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.265] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x47ec, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x47ec, lpOverlapped=0x0) returned 1 [0172.266] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x47f0, dwBufLen=0x47f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x47f0) returned 1 [0172.266] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.266] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x47f0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x47f0, lpOverlapped=0x0) returned 1 [0172.266] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.266] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x48c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.266] SetEndOfFile (hFile=0xdc) returned 1 [0172.268] GetProcessHeap () returned 0x4e0000 [0172.268] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.268] GetProcessHeap () returned 0x4e0000 [0172.268] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.268] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00052_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00052_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.270] CloseHandle (hObject=0xdc) returned 1 [0172.270] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8b4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00231_.WMF", cAlternateFileName="")) returned 1 [0172.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00231_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.270] GetProcessHeap () returned 0x4e0000 [0172.270] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.270] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.270] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.271] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0172.272] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.272] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.272] GetProcessHeap () returned 0x4e0000 [0172.272] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.272] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.273] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.273] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.273] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.273] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.273] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.273] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.273] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.273] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.273] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.273] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.273] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x8b4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x8b4, lpOverlapped=0x0) returned 1 [0172.273] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8c0, dwBufLen=0x8c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8c0) returned 1 [0172.273] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.273] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x8c0, lpOverlapped=0x0) returned 1 [0172.273] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.273] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.273] SetEndOfFile (hFile=0xdc) returned 1 [0172.276] GetProcessHeap () returned 0x4e0000 [0172.276] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.276] GetProcessHeap () returned 0x4e0000 [0172.276] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.276] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00231_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00231_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.277] CloseHandle (hObject=0xdc) returned 1 [0172.278] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaf4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00272_.WMF", cAlternateFileName="")) returned 1 [0172.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00272_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.279] GetProcessHeap () returned 0x4e0000 [0172.279] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.279] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.279] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.279] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0172.281] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.281] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.281] GetProcessHeap () returned 0x4e0000 [0172.281] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.281] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.281] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.281] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.281] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.281] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.281] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.282] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.282] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.282] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.282] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.282] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.282] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xaf4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xaf4, lpOverlapped=0x0) returned 1 [0172.282] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xb00, dwBufLen=0xb00 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xb00) returned 1 [0172.282] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.282] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xb00, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xb00, lpOverlapped=0x0) returned 1 [0172.282] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.282] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xbd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.282] SetEndOfFile (hFile=0xdc) returned 1 [0172.284] GetProcessHeap () returned 0x4e0000 [0172.284] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.284] GetProcessHeap () returned 0x4e0000 [0172.284] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.284] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00272_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00272_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.285] CloseHandle (hObject=0xdc) returned 1 [0172.286] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c9b200, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0c9b200, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x5aa4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00468_.WMF", cAlternateFileName="")) returned 1 [0172.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00468_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.287] GetProcessHeap () returned 0x4e0000 [0172.287] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.287] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.287] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.287] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0172.289] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.289] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.289] GetProcessHeap () returned 0x4e0000 [0172.289] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.289] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.289] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.289] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.289] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.289] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.290] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.290] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.290] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.290] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.290] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.290] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.290] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5aa4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x5aa4, lpOverlapped=0x0) returned 1 [0172.291] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5ab0, dwBufLen=0x5ab0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5ab0) returned 1 [0172.291] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.291] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5ab0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5ab0, lpOverlapped=0x0) returned 1 [0172.291] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.291] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5b84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.291] SetEndOfFile (hFile=0xdc) returned 1 [0172.294] GetProcessHeap () returned 0x4e0000 [0172.294] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.294] GetProcessHeap () returned 0x4e0000 [0172.294] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.294] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00468_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00468_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.296] CloseHandle (hObject=0xdc) returned 1 [0172.296] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d320700, ftCreationTime.dwHighDateTime=0x1bd4b43, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d320700, ftLastWriteTime.dwHighDateTime=0x1bd4b43, nFileSizeHigh=0x0, nFileSizeLow=0x1cf8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00478_.WMF", cAlternateFileName="")) returned 1 [0172.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00478_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.297] GetProcessHeap () returned 0x4e0000 [0172.297] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.297] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.297] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.297] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.299] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.299] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.299] GetProcessHeap () returned 0x4e0000 [0172.299] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.299] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.299] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.299] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.299] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.299] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.299] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.300] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.300] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.300] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.300] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.300] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.300] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1cf8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1cf8, lpOverlapped=0x0) returned 1 [0172.301] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1d00, dwBufLen=0x1d00 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1d00) returned 1 [0172.301] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.301] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1d00, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1d00, lpOverlapped=0x0) returned 1 [0172.301] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.301] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1dd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.301] SetEndOfFile (hFile=0xdc) returned 1 [0172.304] GetProcessHeap () returned 0x4e0000 [0172.304] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.304] GetProcessHeap () returned 0x4e0000 [0172.304] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.304] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00478_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00478_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.305] CloseHandle (hObject=0xdc) returned 1 [0172.305] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb32c0c00, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb32c0c00, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x4124, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00485_.WMF", cAlternateFileName="")) returned 1 [0172.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00485_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.306] GetProcessHeap () returned 0x4e0000 [0172.306] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.306] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.306] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.306] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0172.309] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.309] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.309] GetProcessHeap () returned 0x4e0000 [0172.309] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.309] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.309] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.309] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.309] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.309] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.309] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.309] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.310] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.310] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.310] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.310] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.310] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4124, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4124, lpOverlapped=0x0) returned 1 [0172.311] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4130, dwBufLen=0x4130 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4130) returned 1 [0172.311] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.311] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4130, lpOverlapped=0x0) returned 1 [0172.311] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.311] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.311] SetEndOfFile (hFile=0xdc) returned 1 [0172.314] GetProcessHeap () returned 0x4e0000 [0172.314] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.314] GetProcessHeap () returned 0x4e0000 [0172.314] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.314] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00485_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00485_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.316] CloseHandle (hObject=0xdc) returned 1 [0172.316] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d627000, ftCreationTime.dwHighDateTime=0x1bd98a5, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5d627000, ftLastWriteTime.dwHighDateTime=0x1bd98a5, nFileSizeHigh=0x0, nFileSizeLow=0x1402c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00489_.WMF", cAlternateFileName="")) returned 1 [0172.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00489_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.318] GetProcessHeap () returned 0x4e0000 [0172.318] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.318] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.318] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.318] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.320] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.320] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.320] GetProcessHeap () returned 0x4e0000 [0172.320] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.320] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.320] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.320] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.320] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.320] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.320] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.321] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.321] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.321] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.321] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.321] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.321] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1402c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1402c, lpOverlapped=0x0) returned 1 [0172.322] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x14030, dwBufLen=0x14030 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x14030) returned 1 [0172.323] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.323] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x14030, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x14030, lpOverlapped=0x0) returned 1 [0172.323] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.323] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x14104, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.323] SetEndOfFile (hFile=0xdc) returned 1 [0172.327] GetProcessHeap () returned 0x4e0000 [0172.327] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.327] GetProcessHeap () returned 0x4e0000 [0172.327] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.327] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00489_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00489_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.328] CloseHandle (hObject=0xdc) returned 1 [0172.328] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb32c0c00, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb32c0c00, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x1ee4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00531_.WMF", cAlternateFileName="")) returned 1 [0172.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00531_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.330] GetProcessHeap () returned 0x4e0000 [0172.330] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.330] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.330] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.330] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0172.332] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.332] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.333] GetProcessHeap () returned 0x4e0000 [0172.333] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.333] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.333] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.333] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.333] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.333] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.333] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.333] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.333] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.334] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.334] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.334] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.334] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1ee4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1ee4, lpOverlapped=0x0) returned 1 [0172.335] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1ef0, dwBufLen=0x1ef0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1ef0) returned 1 [0172.335] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.335] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1ef0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1ef0, lpOverlapped=0x0) returned 1 [0172.335] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.335] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1fc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.335] SetEndOfFile (hFile=0xdc) returned 1 [0172.338] GetProcessHeap () returned 0x4e0000 [0172.338] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.338] GetProcessHeap () returned 0x4e0000 [0172.338] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.338] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00531_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00531_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.339] CloseHandle (hObject=0xdc) returned 1 [0172.339] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33585700, ftCreationTime.dwHighDateTime=0x1bf3bda, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33585700, ftLastWriteTime.dwHighDateTime=0x1bf3bda, nFileSizeHigh=0x0, nFileSizeLow=0x8da8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00542_.WMF", cAlternateFileName="")) returned 1 [0172.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00542_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.340] GetProcessHeap () returned 0x4e0000 [0172.340] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.340] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.340] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.340] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.343] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.343] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.343] GetProcessHeap () returned 0x4e0000 [0172.343] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.343] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.343] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.343] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.344] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.344] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.344] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.344] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.344] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.344] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.344] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.344] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.344] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x8da8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x8da8, lpOverlapped=0x0) returned 1 [0172.345] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8db0, dwBufLen=0x8db0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8db0) returned 1 [0172.346] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.346] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x8db0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x8db0, lpOverlapped=0x0) returned 1 [0172.346] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.346] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x8e84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.346] SetEndOfFile (hFile=0xdc) returned 1 [0172.349] GetProcessHeap () returned 0x4e0000 [0172.349] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.349] GetProcessHeap () returned 0x4e0000 [0172.349] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.349] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00542_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00542_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.351] CloseHandle (hObject=0xdc) returned 1 [0172.351] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b853b00, ftCreationTime.dwHighDateTime=0x1bd4b14, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b853b00, ftLastWriteTime.dwHighDateTime=0x1bd4b14, nFileSizeHigh=0x0, nFileSizeLow=0x140c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00555_.WMF", cAlternateFileName="")) returned 1 [0172.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00555_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.352] GetProcessHeap () returned 0x4e0000 [0172.352] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.352] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.352] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.352] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.355] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.355] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.355] GetProcessHeap () returned 0x4e0000 [0172.355] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.355] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.355] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.355] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.355] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.355] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.355] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.355] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.355] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.355] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.355] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.355] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.355] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x140c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x140c, lpOverlapped=0x0) returned 1 [0172.356] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1410, dwBufLen=0x1410 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1410) returned 1 [0172.356] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.357] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1410, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1410, lpOverlapped=0x0) returned 1 [0172.357] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.357] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x14e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.357] SetEndOfFile (hFile=0xdc) returned 1 [0172.359] GetProcessHeap () returned 0x4e0000 [0172.360] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.360] GetProcessHeap () returned 0x4e0000 [0172.360] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.360] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00555_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00555_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.361] CloseHandle (hObject=0xdc) returned 1 [0172.361] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30066900, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x30066900, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x26b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00559_.WMF", cAlternateFileName="")) returned 1 [0172.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00559_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.362] GetProcessHeap () returned 0x4e0000 [0172.362] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.362] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.362] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.362] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.362] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.362] GetProcessHeap () returned 0x4e0000 [0172.362] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.363] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.363] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.363] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.364] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.364] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.364] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.365] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.365] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.365] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.365] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.365] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.365] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x26b0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x26b0, lpOverlapped=0x0) returned 1 [0172.366] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x26b0, dwBufLen=0x26b0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x26b0) returned 1 [0172.366] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.366] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x26b0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x26b0, lpOverlapped=0x0) returned 1 [0172.366] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.366] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2784, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.366] SetEndOfFile (hFile=0xdc) returned 1 [0172.368] GetProcessHeap () returned 0x4e0000 [0172.368] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.368] GetProcessHeap () returned 0x4e0000 [0172.368] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.368] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00559_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00559_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.369] CloseHandle (hObject=0xdc) returned 1 [0172.369] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17bf3a00, ftCreationTime.dwHighDateTime=0x1bd4b35, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bf3a00, ftLastWriteTime.dwHighDateTime=0x1bd4b35, nFileSizeHigh=0x0, nFileSizeLow=0x5670, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00563_.WMF", cAlternateFileName="")) returned 1 [0172.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00563_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.370] GetProcessHeap () returned 0x4e0000 [0172.370] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.370] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.370] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.370] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.370] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.370] GetProcessHeap () returned 0x4e0000 [0172.370] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.370] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.370] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.370] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.372] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.372] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.372] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.372] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.372] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.372] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.372] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.372] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.372] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5670, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x5670, lpOverlapped=0x0) returned 1 [0172.373] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5670, dwBufLen=0x5670 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5670) returned 1 [0172.373] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.373] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5670, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5670, lpOverlapped=0x0) returned 1 [0172.373] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.373] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5744, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.374] SetEndOfFile (hFile=0xdc) returned 1 [0172.376] GetProcessHeap () returned 0x4e0000 [0172.376] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.376] GetProcessHeap () returned 0x4e0000 [0172.376] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.376] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00563_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00563_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.377] CloseHandle (hObject=0xdc) returned 1 [0172.377] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ae6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00578_.WMF", cAlternateFileName="")) returned 1 [0172.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00578_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.377] GetProcessHeap () returned 0x4e0000 [0172.377] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.377] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.377] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.377] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0172.380] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.380] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.380] GetProcessHeap () returned 0x4e0000 [0172.380] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.380] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.380] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.380] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.380] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.380] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.380] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.380] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.380] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.381] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.381] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.381] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.381] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1ae6, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1ae6, lpOverlapped=0x0) returned 1 [0172.382] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1af0, dwBufLen=0x1af0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1af0) returned 1 [0172.382] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.382] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1af0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1af0, lpOverlapped=0x0) returned 1 [0172.382] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.382] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1bc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.382] SetEndOfFile (hFile=0xdc) returned 1 [0172.384] GetProcessHeap () returned 0x4e0000 [0172.384] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.384] GetProcessHeap () returned 0x4e0000 [0172.384] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.384] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00578_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00578_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.385] CloseHandle (hObject=0xdc) returned 1 [0172.385] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x896e9800, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x896e9800, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1928, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00608_.WMF", cAlternateFileName="")) returned 1 [0172.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00608_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.386] GetProcessHeap () returned 0x4e0000 [0172.386] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.386] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.386] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.386] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.392] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.392] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.392] GetProcessHeap () returned 0x4e0000 [0172.392] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.392] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.392] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.392] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.392] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.392] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.392] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.392] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.392] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.392] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.392] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.392] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.392] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1928, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1928, lpOverlapped=0x0) returned 1 [0172.393] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1930, dwBufLen=0x1930 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1930) returned 1 [0172.393] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.393] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1930, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1930, lpOverlapped=0x0) returned 1 [0172.394] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.394] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1a04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.394] SetEndOfFile (hFile=0xdc) returned 1 [0172.396] GetProcessHeap () returned 0x4e0000 [0172.396] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.396] GetProcessHeap () returned 0x4e0000 [0172.396] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.396] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00608_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00608_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.397] CloseHandle (hObject=0xdc) returned 1 [0172.398] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c352400, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c352400, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x4cea, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00633_.WMF", cAlternateFileName="")) returned 1 [0172.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00633_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.398] GetProcessHeap () returned 0x4e0000 [0172.398] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.398] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.398] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.398] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0172.401] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.401] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.401] GetProcessHeap () returned 0x4e0000 [0172.401] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.401] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.401] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.401] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.401] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.401] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.401] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.401] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.401] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.401] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.401] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.401] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.402] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4cea, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4cea, lpOverlapped=0x0) returned 1 [0172.402] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4cf0, dwBufLen=0x4cf0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4cf0) returned 1 [0172.402] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.402] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4cf0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4cf0, lpOverlapped=0x0) returned 1 [0172.403] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.403] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4dc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.403] SetEndOfFile (hFile=0xdc) returned 1 [0172.405] GetProcessHeap () returned 0x4e0000 [0172.405] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.405] GetProcessHeap () returned 0x4e0000 [0172.405] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.405] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00633_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00633_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.408] CloseHandle (hObject=0xdc) returned 1 [0172.408] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bd0f200, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bd0f200, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xb12c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00640_.WMF", cAlternateFileName="")) returned 1 [0172.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00640_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.409] GetProcessHeap () returned 0x4e0000 [0172.409] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.409] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.410] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.410] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.411] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.411] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.411] GetProcessHeap () returned 0x4e0000 [0172.411] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.411] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.411] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.412] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.412] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.412] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.412] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.412] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.412] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.412] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.412] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.412] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.412] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb12c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xb12c, lpOverlapped=0x0) returned 1 [0172.413] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xb130, dwBufLen=0xb130 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xb130) returned 1 [0172.414] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.414] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xb130, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xb130, lpOverlapped=0x0) returned 1 [0172.414] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.414] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xb204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.414] SetEndOfFile (hFile=0xdc) returned 1 [0172.416] GetProcessHeap () returned 0x4e0000 [0172.416] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.416] GetProcessHeap () returned 0x4e0000 [0172.416] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.416] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00640_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00640_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.417] CloseHandle (hObject=0xdc) returned 1 [0172.417] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x883d6b00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x883d6b00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x6028, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00668_.WMF", cAlternateFileName="")) returned 1 [0172.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00668_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.418] GetProcessHeap () returned 0x4e0000 [0172.418] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.418] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.418] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.418] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.420] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.420] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.420] GetProcessHeap () returned 0x4e0000 [0172.420] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.420] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.420] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.420] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.420] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.420] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.420] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.420] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.420] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.420] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.420] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.420] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.420] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x6028, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x6028, lpOverlapped=0x0) returned 1 [0172.421] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6030, dwBufLen=0x6030 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6030) returned 1 [0172.421] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.421] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6030, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x6030, lpOverlapped=0x0) returned 1 [0172.422] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.422] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6104, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.422] SetEndOfFile (hFile=0xdc) returned 1 [0172.424] GetProcessHeap () returned 0x4e0000 [0172.424] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.424] GetProcessHeap () returned 0x4e0000 [0172.424] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.424] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00668_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00668_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.425] CloseHandle (hObject=0xdc) returned 1 [0172.425] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a9c1f00, ftCreationTime.dwHighDateTime=0x1bd4b32, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3a9c1f00, ftLastWriteTime.dwHighDateTime=0x1bd4b32, nFileSizeHigh=0x0, nFileSizeLow=0x108a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00685_.WMF", cAlternateFileName="")) returned 1 [0172.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00685_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.425] GetProcessHeap () returned 0x4e0000 [0172.425] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.425] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.426] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.426] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0172.437] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.437] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.437] GetProcessHeap () returned 0x4e0000 [0172.437] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.437] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.437] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.437] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.437] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.437] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.438] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.438] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.438] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.438] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.438] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.438] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.438] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x108a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x108a, lpOverlapped=0x0) returned 1 [0172.495] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1090, dwBufLen=0x1090 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1090) returned 1 [0172.495] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.495] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1090, lpOverlapped=0x0) returned 1 [0172.496] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.496] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1164, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.496] SetEndOfFile (hFile=0xdc) returned 1 [0172.499] GetProcessHeap () returned 0x4e0000 [0172.499] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.499] GetProcessHeap () returned 0x4e0000 [0172.499] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.499] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00685_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00685_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.501] CloseHandle (hObject=0xdc) returned 1 [0172.501] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78490a00, ftCreationTime.dwHighDateTime=0x1bf0b13, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78490a00, ftLastWriteTime.dwHighDateTime=0x1bf0b13, nFileSizeHigh=0x0, nFileSizeLow=0x112e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00686_.WMF", cAlternateFileName="")) returned 1 [0172.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00686_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.502] GetProcessHeap () returned 0x4e0000 [0172.502] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.502] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.502] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.502] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0172.515] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.516] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.516] GetProcessHeap () returned 0x4e0000 [0172.516] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.516] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.516] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.516] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.516] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.516] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.516] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.516] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.516] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.516] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.516] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.517] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.517] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x112e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x112e, lpOverlapped=0x0) returned 1 [0172.517] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1130, dwBufLen=0x1130 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1130) returned 1 [0172.518] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.518] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1130, lpOverlapped=0x0) returned 1 [0172.518] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.518] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.518] SetEndOfFile (hFile=0xdc) returned 1 [0172.521] GetProcessHeap () returned 0x4e0000 [0172.521] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.521] GetProcessHeap () returned 0x4e0000 [0172.521] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.521] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00686_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00686_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.523] CloseHandle (hObject=0xdc) returned 1 [0172.523] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb45d3900, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb45d3900, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x1138, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00693_.WMF", cAlternateFileName="")) returned 1 [0172.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00693_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.524] GetProcessHeap () returned 0x4e0000 [0172.524] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.524] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.524] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.524] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.528] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.528] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.528] GetProcessHeap () returned 0x4e0000 [0172.528] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.529] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.529] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.529] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.529] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.529] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.529] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.529] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.529] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.529] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.529] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.529] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.529] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1138, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1138, lpOverlapped=0x0) returned 1 [0172.530] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1140, dwBufLen=0x1140 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1140) returned 1 [0172.530] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.530] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1140, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1140, lpOverlapped=0x0) returned 1 [0172.531] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.531] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.531] SetEndOfFile (hFile=0xdc) returned 1 [0172.533] GetProcessHeap () returned 0x4e0000 [0172.533] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.533] GetProcessHeap () returned 0x4e0000 [0172.533] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.533] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00693_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00693_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.535] CloseHandle (hObject=0xdc) returned 1 [0172.535] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49cc9e00, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x49cc9e00, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x3926, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00720_.WMF", cAlternateFileName="")) returned 1 [0172.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00720_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.536] GetProcessHeap () returned 0x4e0000 [0172.536] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.536] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.537] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.537] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0172.539] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.539] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.539] GetProcessHeap () returned 0x4e0000 [0172.539] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.539] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.539] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.539] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.539] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.539] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.539] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.539] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.539] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.540] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.540] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.540] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.540] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3926, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3926, lpOverlapped=0x0) returned 1 [0172.540] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3930, dwBufLen=0x3930 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3930) returned 1 [0172.541] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.541] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3930, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3930, lpOverlapped=0x0) returned 1 [0172.541] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.541] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3a04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.541] SetEndOfFile (hFile=0xdc) returned 1 [0172.544] GetProcessHeap () returned 0x4e0000 [0172.544] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.544] GetProcessHeap () returned 0x4e0000 [0172.544] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.544] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00720_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00720_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.545] CloseHandle (hObject=0xdc) returned 1 [0172.545] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe80c3400, ftCreationTime.dwHighDateTime=0x1bd4b2c, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe80c3400, ftLastWriteTime.dwHighDateTime=0x1bd4b2c, nFileSizeHigh=0x0, nFileSizeLow=0x1afc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00723_.WMF", cAlternateFileName="")) returned 1 [0172.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00723_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.546] GetProcessHeap () returned 0x4e0000 [0172.546] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.546] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.546] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.546] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.548] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.548] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.549] GetProcessHeap () returned 0x4e0000 [0172.549] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.549] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.549] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.549] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.549] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.549] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.549] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.549] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.549] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.549] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.549] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.549] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.549] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1afc, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1afc, lpOverlapped=0x0) returned 1 [0172.550] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1b00, dwBufLen=0x1b00 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1b00) returned 1 [0172.551] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.551] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1b00, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1b00, lpOverlapped=0x0) returned 1 [0172.551] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.551] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1bd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.551] SetEndOfFile (hFile=0xdc) returned 1 [0172.553] GetProcessHeap () returned 0x4e0000 [0172.554] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.554] GetProcessHeap () returned 0x4e0000 [0172.554] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.554] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00723_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00723_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.555] CloseHandle (hObject=0xdc) returned 1 [0172.555] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d02b300, ftCreationTime.dwHighDateTime=0x1c04210, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d02b300, ftLastWriteTime.dwHighDateTime=0x1c04210, nFileSizeHigh=0x0, nFileSizeLow=0xb1a4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00726_.WMF", cAlternateFileName="")) returned 1 [0172.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00726_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.556] GetProcessHeap () returned 0x4e0000 [0172.556] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.556] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.556] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.556] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0172.558] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.558] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.558] GetProcessHeap () returned 0x4e0000 [0172.558] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.558] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.558] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.558] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.558] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.558] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.558] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.558] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.559] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.559] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.559] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.559] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.559] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb1a4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xb1a4, lpOverlapped=0x0) returned 1 [0172.560] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xb1b0, dwBufLen=0xb1b0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xb1b0) returned 1 [0172.561] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.561] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xb1b0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xb1b0, lpOverlapped=0x0) returned 1 [0172.561] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.561] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xb284, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.561] SetEndOfFile (hFile=0xdc) returned 1 [0172.564] GetProcessHeap () returned 0x4e0000 [0172.564] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.564] GetProcessHeap () returned 0x4e0000 [0172.564] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.564] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00726_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00726_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.565] CloseHandle (hObject=0xdc) returned 1 [0172.565] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfefd5700, ftCreationTime.dwHighDateTime=0x1bd4b29, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfefd5700, ftLastWriteTime.dwHighDateTime=0x1bd4b29, nFileSizeHigh=0x0, nFileSizeLow=0x9e2c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00737_.WMF", cAlternateFileName="")) returned 1 [0172.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00737_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.567] GetProcessHeap () returned 0x4e0000 [0172.567] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.567] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.567] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.567] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.569] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.569] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.569] GetProcessHeap () returned 0x4e0000 [0172.569] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.569] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.569] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.569] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.570] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.570] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.570] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.570] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.570] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.570] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.570] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.570] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.570] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x9e2c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x9e2c, lpOverlapped=0x0) returned 1 [0172.571] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9e30, dwBufLen=0x9e30 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9e30) returned 1 [0172.572] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.572] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x9e30, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x9e30, lpOverlapped=0x0) returned 1 [0172.572] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.572] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x9f04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.572] SetEndOfFile (hFile=0xdc) returned 1 [0172.575] GetProcessHeap () returned 0x4e0000 [0172.575] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.575] GetProcessHeap () returned 0x4e0000 [0172.575] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.575] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00737_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00737_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.577] CloseHandle (hObject=0xdc) returned 1 [0172.577] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe289fc00, ftCreationTime.dwHighDateTime=0x1bd4ae2, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe289fc00, ftLastWriteTime.dwHighDateTime=0x1bd4ae2, nFileSizeHigh=0x0, nFileSizeLow=0x1ca0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00833_.WMF", cAlternateFileName="")) returned 1 [0172.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00833_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.578] GetProcessHeap () returned 0x4e0000 [0172.578] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.578] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.578] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.578] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.578] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.578] GetProcessHeap () returned 0x4e0000 [0172.578] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.578] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.578] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.578] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.580] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.580] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.581] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.581] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.581] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.581] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.581] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.581] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.581] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1ca0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1ca0, lpOverlapped=0x0) returned 1 [0172.582] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1ca0, dwBufLen=0x1ca0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1ca0) returned 1 [0172.582] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.582] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1ca0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1ca0, lpOverlapped=0x0) returned 1 [0172.582] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.582] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1d74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.582] SetEndOfFile (hFile=0xdc) returned 1 [0172.585] GetProcessHeap () returned 0x4e0000 [0172.585] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.585] GetProcessHeap () returned 0x4e0000 [0172.585] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.585] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00833_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00833_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.587] CloseHandle (hObject=0xdc) returned 1 [0172.587] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870c3e00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x870c3e00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1908, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00898_.WMF", cAlternateFileName="")) returned 1 [0172.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00898_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.588] GetProcessHeap () returned 0x4e0000 [0172.588] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.589] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.589] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.589] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.591] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.591] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.591] GetProcessHeap () returned 0x4e0000 [0172.591] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.591] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.591] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.591] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.591] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.591] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.591] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.591] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.591] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.591] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.592] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.592] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.592] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1908, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1908, lpOverlapped=0x0) returned 1 [0172.592] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1910, dwBufLen=0x1910 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1910) returned 1 [0172.593] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.593] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1910, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1910, lpOverlapped=0x0) returned 1 [0172.593] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.593] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x19e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.593] SetEndOfFile (hFile=0xdc) returned 1 [0172.596] GetProcessHeap () returned 0x4e0000 [0172.596] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.596] GetProcessHeap () returned 0x4e0000 [0172.596] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.596] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00898_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00898_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.597] CloseHandle (hObject=0xdc) returned 1 [0172.597] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bb8f800, ftCreationTime.dwHighDateTime=0x1bd4b1c, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9bb8f800, ftLastWriteTime.dwHighDateTime=0x1bd4b1c, nFileSizeHigh=0x0, nFileSizeLow=0x3100, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00934_.WMF", cAlternateFileName="")) returned 1 [0172.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00934_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.598] GetProcessHeap () returned 0x4e0000 [0172.598] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.598] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.598] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.598] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.598] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.598] GetProcessHeap () returned 0x4e0000 [0172.598] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.598] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.599] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.599] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.603] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.603] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.604] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.604] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.604] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.604] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.604] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.604] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.604] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3100, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3100, lpOverlapped=0x0) returned 1 [0172.605] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3100, dwBufLen=0x3100 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3100) returned 1 [0172.605] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.605] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3100, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3100, lpOverlapped=0x0) returned 1 [0172.605] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.605] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x31d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.606] SetEndOfFile (hFile=0xdc) returned 1 [0172.608] GetProcessHeap () returned 0x4e0000 [0172.608] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.608] GetProcessHeap () returned 0x4e0000 [0172.608] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.608] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00934_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00934_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.610] CloseHandle (hObject=0xdc) returned 1 [0172.610] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24ca3200, ftCreationTime.dwHighDateTime=0x1bd4b11, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x24ca3200, ftLastWriteTime.dwHighDateTime=0x1bd4b11, nFileSizeHigh=0x0, nFileSizeLow=0x2904, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00998_.WMF", cAlternateFileName="")) returned 1 [0172.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00998_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.610] GetProcessHeap () returned 0x4e0000 [0172.611] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.611] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.611] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.611] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0172.613] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.613] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.613] GetProcessHeap () returned 0x4e0000 [0172.613] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.613] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.613] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.613] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.613] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.613] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.613] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.613] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.613] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.614] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.614] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.614] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.614] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2904, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2904, lpOverlapped=0x0) returned 1 [0172.615] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2910, dwBufLen=0x2910 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2910) returned 1 [0172.615] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.615] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2910, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2910, lpOverlapped=0x0) returned 1 [0172.615] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.615] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x29e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.615] SetEndOfFile (hFile=0xdc) returned 1 [0172.618] GetProcessHeap () returned 0x4e0000 [0172.618] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.618] GetProcessHeap () returned 0x4e0000 [0172.618] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.618] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00998_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00998_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.619] CloseHandle (hObject=0xdc) returned 1 [0172.619] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c97c200, ftCreationTime.dwHighDateTime=0x1bf1118, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c97c200, ftLastWriteTime.dwHighDateTime=0x1bf1118, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE01160_.WMF", cAlternateFileName="")) returned 1 [0172.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.620] GetProcessHeap () returned 0x4e0000 [0172.620] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.620] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.620] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.621] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0172.622] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.622] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.622] GetProcessHeap () returned 0x4e0000 [0172.622] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.622] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.622] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.623] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.623] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.623] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.623] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.623] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.623] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.623] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.623] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.623] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.623] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x984, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x984, lpOverlapped=0x0) returned 1 [0172.623] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x990, dwBufLen=0x990 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x990) returned 1 [0172.623] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.623] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x990, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x990, lpOverlapped=0x0) returned 1 [0172.624] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.624] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xa64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.624] SetEndOfFile (hFile=0xdc) returned 1 [0172.626] GetProcessHeap () returned 0x4e0000 [0172.626] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.626] GetProcessHeap () returned 0x4e0000 [0172.626] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.626] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01160_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01160_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.627] CloseHandle (hObject=0xdc) returned 1 [0172.627] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5efa1c00, ftCreationTime.dwHighDateTime=0x1bf1118, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5efa1c00, ftLastWriteTime.dwHighDateTime=0x1bf1118, nFileSizeHigh=0x0, nFileSizeLow=0x59c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE01172_.WMF", cAlternateFileName="")) returned 1 [0172.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.628] GetProcessHeap () returned 0x4e0000 [0172.628] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.628] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.628] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.628] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.630] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.631] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.631] GetProcessHeap () returned 0x4e0000 [0172.631] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.631] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.631] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.631] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.631] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.631] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.631] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.631] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.631] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.631] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.631] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.631] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.631] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x59c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x59c, lpOverlapped=0x0) returned 1 [0172.632] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5a0, dwBufLen=0x5a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5a0) returned 1 [0172.632] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.632] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5a0, lpOverlapped=0x0) returned 1 [0172.632] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.632] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x674, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.632] SetEndOfFile (hFile=0xdc) returned 1 [0172.634] GetProcessHeap () returned 0x4e0000 [0172.634] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.634] GetProcessHeap () returned 0x4e0000 [0172.635] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.635] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01172_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01172_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.636] CloseHandle (hObject=0xdc) returned 1 [0172.636] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb58e6600, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb58e6600, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x3f9c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE01191_.WMF", cAlternateFileName="")) returned 1 [0172.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.637] GetProcessHeap () returned 0x4e0000 [0172.637] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.637] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.637] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.637] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.639] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.639] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.639] GetProcessHeap () returned 0x4e0000 [0172.639] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.640] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.640] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.640] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.640] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.640] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.640] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.640] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.640] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.640] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.640] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.640] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.641] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3f9c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3f9c, lpOverlapped=0x0) returned 1 [0172.641] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3fa0, dwBufLen=0x3fa0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3fa0) returned 1 [0172.642] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.642] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3fa0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3fa0, lpOverlapped=0x0) returned 1 [0172.642] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.642] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4074, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.642] SetEndOfFile (hFile=0xdc) returned 1 [0172.645] GetProcessHeap () returned 0x4e0000 [0172.645] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.645] GetProcessHeap () returned 0x4e0000 [0172.645] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.645] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01191_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01191_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.646] CloseHandle (hObject=0xdc) returned 1 [0172.647] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5e9600, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xea5e9600, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0x1418, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE01661_.WMF", cAlternateFileName="")) returned 1 [0172.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01661_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.648] GetProcessHeap () returned 0x4e0000 [0172.648] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.648] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.648] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.648] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.650] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.650] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.650] GetProcessHeap () returned 0x4e0000 [0172.650] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.650] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.650] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.650] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.650] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.650] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.650] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.651] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.651] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.651] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.651] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.651] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.651] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1418, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1418, lpOverlapped=0x0) returned 1 [0172.652] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1420, dwBufLen=0x1420 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1420) returned 1 [0172.652] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.652] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1420, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1420, lpOverlapped=0x0) returned 1 [0172.652] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.652] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x14f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.652] SetEndOfFile (hFile=0xdc) returned 1 [0172.655] GetProcessHeap () returned 0x4e0000 [0172.655] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.655] GetProcessHeap () returned 0x4e0000 [0172.655] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.655] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01661_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01661_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.657] CloseHandle (hObject=0xdc) returned 1 [0172.657] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xdda, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE01797_.WMF", cAlternateFileName="")) returned 1 [0172.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01797_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.658] GetProcessHeap () returned 0x4e0000 [0172.658] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.658] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.658] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.658] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0172.660] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.660] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.660] GetProcessHeap () returned 0x4e0000 [0172.660] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.660] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.660] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.660] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.661] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.661] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.661] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.661] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.661] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.661] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.661] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.661] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.661] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xdda, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xdda, lpOverlapped=0x0) returned 1 [0172.661] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xde0, dwBufLen=0xde0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xde0) returned 1 [0172.662] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.662] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xde0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xde0, lpOverlapped=0x0) returned 1 [0172.662] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.662] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xeb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.662] SetEndOfFile (hFile=0xdc) returned 1 [0172.664] GetProcessHeap () returned 0x4e0000 [0172.664] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.664] GetProcessHeap () returned 0x4e0000 [0172.665] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.665] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01797_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01797_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.666] CloseHandle (hObject=0xdc) returned 1 [0172.666] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x23d4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02120_.WMF", cAlternateFileName="")) returned 1 [0172.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02120_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.667] GetProcessHeap () returned 0x4e0000 [0172.667] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.667] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.667] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.667] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0172.670] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.670] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.670] GetProcessHeap () returned 0x4e0000 [0172.670] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.670] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.670] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.670] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.670] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.670] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.670] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.670] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.670] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.670] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.670] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.670] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.671] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x23d4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x23d4, lpOverlapped=0x0) returned 1 [0172.671] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x23e0, dwBufLen=0x23e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x23e0) returned 1 [0172.672] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.672] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x23e0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x23e0, lpOverlapped=0x0) returned 1 [0172.672] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.672] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x24b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.672] SetEndOfFile (hFile=0xdc) returned 1 [0172.675] GetProcessHeap () returned 0x4e0000 [0172.675] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.675] GetProcessHeap () returned 0x4e0000 [0172.675] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.675] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02120_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02120_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.676] CloseHandle (hObject=0xdc) returned 1 [0172.676] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1fc4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02169_.WMF", cAlternateFileName="")) returned 1 [0172.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02169_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.678] GetProcessHeap () returned 0x4e0000 [0172.678] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.678] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.678] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.678] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0172.682] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.682] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.682] GetProcessHeap () returned 0x4e0000 [0172.682] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.682] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.682] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.682] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.683] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.683] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.683] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.683] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.683] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.683] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.683] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.683] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.683] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1fc4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1fc4, lpOverlapped=0x0) returned 1 [0172.685] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1fd0, dwBufLen=0x1fd0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1fd0) returned 1 [0172.685] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.685] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1fd0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1fd0, lpOverlapped=0x0) returned 1 [0172.685] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.685] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x20a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.686] SetEndOfFile (hFile=0xdc) returned 1 [0172.688] GetProcessHeap () returned 0x4e0000 [0172.688] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.688] GetProcessHeap () returned 0x4e0000 [0172.688] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.688] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02169_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02169_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.691] CloseHandle (hObject=0xdc) returned 1 [0172.691] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8378b700, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8378b700, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x75e2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02262_.WMF", cAlternateFileName="")) returned 1 [0172.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02262_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.693] GetProcessHeap () returned 0x4e0000 [0172.693] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.693] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.693] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.693] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0172.695] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.695] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.695] GetProcessHeap () returned 0x4e0000 [0172.695] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.695] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.695] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.695] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.695] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.695] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.695] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.695] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.696] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.696] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.696] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.696] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.696] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x75e2, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x75e2, lpOverlapped=0x0) returned 1 [0172.697] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x75f0, dwBufLen=0x75f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x75f0) returned 1 [0172.697] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.697] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x75f0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x75f0, lpOverlapped=0x0) returned 1 [0172.698] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.698] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x76c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.698] SetEndOfFile (hFile=0xdc) returned 1 [0172.700] GetProcessHeap () returned 0x4e0000 [0172.700] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.700] GetProcessHeap () returned 0x4e0000 [0172.700] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.701] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02262_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02262_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.702] CloseHandle (hObject=0xdc) returned 1 [0172.702] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb983d700, ftCreationTime.dwHighDateTime=0x1bf148e, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb983d700, ftLastWriteTime.dwHighDateTime=0x1bf148e, nFileSizeHigh=0x0, nFileSizeLow=0x824e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02263_.WMF", cAlternateFileName="")) returned 1 [0172.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02263_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.703] GetProcessHeap () returned 0x4e0000 [0172.703] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.703] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.703] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.703] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0172.705] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.705] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.705] GetProcessHeap () returned 0x4e0000 [0172.705] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.705] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.705] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.705] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.705] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.706] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.706] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.706] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.706] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.706] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.706] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.706] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.706] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x824e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x824e, lpOverlapped=0x0) returned 1 [0172.707] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8250, dwBufLen=0x8250 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8250) returned 1 [0172.708] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.708] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x8250, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x8250, lpOverlapped=0x0) returned 1 [0172.708] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.708] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x8324, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.708] SetEndOfFile (hFile=0xdc) returned 1 [0172.710] GetProcessHeap () returned 0x4e0000 [0172.711] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.711] GetProcessHeap () returned 0x4e0000 [0172.711] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.711] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02263_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02263_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.712] CloseHandle (hObject=0xdc) returned 1 [0172.712] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa753f100, ftCreationTime.dwHighDateTime=0x1bd4b13, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa753f100, ftLastWriteTime.dwHighDateTime=0x1bd4b13, nFileSizeHigh=0x0, nFileSizeLow=0x62b2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02265_.WMF", cAlternateFileName="")) returned 1 [0172.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02265_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.713] GetProcessHeap () returned 0x4e0000 [0172.713] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.713] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.713] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.713] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0172.715] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.715] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.715] GetProcessHeap () returned 0x4e0000 [0172.715] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.715] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.715] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.715] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.715] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.715] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.715] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.716] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.716] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.716] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.716] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.716] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.716] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x62b2, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x62b2, lpOverlapped=0x0) returned 1 [0172.717] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x62c0, dwBufLen=0x62c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x62c0) returned 1 [0172.717] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.717] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x62c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x62c0, lpOverlapped=0x0) returned 1 [0172.717] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.717] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6394, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.717] SetEndOfFile (hFile=0xdc) returned 1 [0172.720] GetProcessHeap () returned 0x4e0000 [0172.720] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.720] GetProcessHeap () returned 0x4e0000 [0172.720] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.720] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02265_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02265_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.721] CloseHandle (hObject=0xdc) returned 1 [0172.721] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3f02900, ftCreationTime.dwHighDateTime=0x1bd4b13, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc3f02900, ftLastWriteTime.dwHighDateTime=0x1bd4b13, nFileSizeHigh=0x0, nFileSizeLow=0x78e0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02267_.WMF", cAlternateFileName="")) returned 1 [0172.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.723] GetProcessHeap () returned 0x4e0000 [0172.723] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.723] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.723] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.723] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.723] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.723] GetProcessHeap () returned 0x4e0000 [0172.723] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.723] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.723] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.723] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.725] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.725] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.725] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.725] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.725] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.726] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.726] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.726] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.726] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x78e0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x78e0, lpOverlapped=0x0) returned 1 [0172.727] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x78e0, dwBufLen=0x78e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x78e0) returned 1 [0172.727] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.727] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x78e0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x78e0, lpOverlapped=0x0) returned 1 [0172.727] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.727] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x79b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.727] SetEndOfFile (hFile=0xdc) returned 1 [0172.729] GetProcessHeap () returned 0x4e0000 [0172.729] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.729] GetProcessHeap () returned 0x4e0000 [0172.729] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.730] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02267_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02267_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.731] CloseHandle (hObject=0xdc) returned 1 [0172.731] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fe53000, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7fe53000, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x6f26, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02270_.WMF", cAlternateFileName="")) returned 1 [0172.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02270_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.732] GetProcessHeap () returned 0x4e0000 [0172.732] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.732] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.732] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.732] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0172.734] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.734] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.734] GetProcessHeap () returned 0x4e0000 [0172.734] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.734] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.734] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.734] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.734] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.734] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.734] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.734] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.734] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.734] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.734] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.734] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.734] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x6f26, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x6f26, lpOverlapped=0x0) returned 1 [0172.735] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6f30, dwBufLen=0x6f30 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6f30) returned 1 [0172.736] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.736] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6f30, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x6f30, lpOverlapped=0x0) returned 1 [0172.736] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.736] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7004, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.736] SetEndOfFile (hFile=0xdc) returned 1 [0172.738] GetProcessHeap () returned 0x4e0000 [0172.738] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.738] GetProcessHeap () returned 0x4e0000 [0172.738] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.738] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02270_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02270_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.739] CloseHandle (hObject=0xdc) returned 1 [0172.739] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f9ebd00, ftCreationTime.dwHighDateTime=0x1c0033f, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4f9ebd00, ftLastWriteTime.dwHighDateTime=0x1c0033f, nFileSizeHigh=0x0, nFileSizeLow=0xb9c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02278_.WMF", cAlternateFileName="")) returned 1 [0172.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02278_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.750] GetProcessHeap () returned 0x4e0000 [0172.750] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.750] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.750] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.750] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0172.757] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.757] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.757] GetProcessHeap () returned 0x4e0000 [0172.757] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.757] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.757] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.757] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.757] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.757] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.757] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.757] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.757] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.757] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.758] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.758] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.758] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb9c4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xb9c4, lpOverlapped=0x0) returned 1 [0172.759] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xb9d0, dwBufLen=0xb9d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xb9d0) returned 1 [0172.759] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.759] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xb9d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xb9d0, lpOverlapped=0x0) returned 1 [0172.759] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.759] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xbaa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.759] SetEndOfFile (hFile=0xdc) returned 1 [0172.762] GetProcessHeap () returned 0x4e0000 [0172.762] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.762] GetProcessHeap () returned 0x4e0000 [0172.762] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.762] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02278_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02278_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.763] CloseHandle (hObject=0xdc) returned 1 [0172.763] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2108500, ftCreationTime.dwHighDateTime=0x1bd4b17, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2108500, ftLastWriteTime.dwHighDateTime=0x1bd4b17, nFileSizeHigh=0x0, nFileSizeLow=0x6928, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02280_.WMF", cAlternateFileName="")) returned 1 [0172.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02280_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.764] GetProcessHeap () returned 0x4e0000 [0172.764] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.764] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.764] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.764] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.766] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.766] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.766] GetProcessHeap () returned 0x4e0000 [0172.766] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.766] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.766] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.766] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.766] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.766] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.767] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.767] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.767] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.767] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.767] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.767] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.767] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x6928, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x6928, lpOverlapped=0x0) returned 1 [0172.768] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6930, dwBufLen=0x6930 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6930) returned 1 [0172.768] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.768] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6930, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x6930, lpOverlapped=0x0) returned 1 [0172.768] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.768] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6a04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.768] SetEndOfFile (hFile=0xdc) returned 1 [0172.771] GetProcessHeap () returned 0x4e0000 [0172.771] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.771] GetProcessHeap () returned 0x4e0000 [0172.771] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.771] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02280_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02280_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.773] CloseHandle (hObject=0xdc) returned 1 [0172.773] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe32fdb00, ftCreationTime.dwHighDateTime=0x1bf3250, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe32fdb00, ftLastWriteTime.dwHighDateTime=0x1bf3250, nFileSizeHigh=0x0, nFileSizeLow=0x7400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02282_.WMF", cAlternateFileName="")) returned 1 [0172.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02282_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.774] GetProcessHeap () returned 0x4e0000 [0172.774] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.774] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.774] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.774] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.774] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.774] GetProcessHeap () returned 0x4e0000 [0172.774] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.774] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.774] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.774] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.776] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.776] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.776] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.777] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.777] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.777] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.777] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.777] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.777] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7400, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7400, lpOverlapped=0x0) returned 1 [0172.778] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7400, dwBufLen=0x7400 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7400) returned 1 [0172.778] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.778] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7400, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7400, lpOverlapped=0x0) returned 1 [0172.779] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.779] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x74d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.779] SetEndOfFile (hFile=0xdc) returned 1 [0172.782] GetProcessHeap () returned 0x4e0000 [0172.782] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.782] GetProcessHeap () returned 0x4e0000 [0172.782] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.782] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02282_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02282_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.784] CloseHandle (hObject=0xdc) returned 1 [0172.784] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffb65800, ftCreationTime.dwHighDateTime=0x1bf3488, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xffb65800, ftLastWriteTime.dwHighDateTime=0x1bf3488, nFileSizeHigh=0x0, nFileSizeLow=0x4090, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02285_.WMF", cAlternateFileName="")) returned 1 [0172.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02285_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.786] GetProcessHeap () returned 0x4e0000 [0172.786] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.786] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.786] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.786] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.786] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.786] GetProcessHeap () returned 0x4e0000 [0172.786] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.786] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.786] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.786] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.789] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.789] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.789] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.789] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.789] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.789] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.789] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.789] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.789] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4090, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4090, lpOverlapped=0x0) returned 1 [0172.790] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4090, dwBufLen=0x4090 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4090) returned 1 [0172.790] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.791] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4090, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4090, lpOverlapped=0x0) returned 1 [0172.791] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.791] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4164, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.791] SetEndOfFile (hFile=0xdc) returned 1 [0172.794] GetProcessHeap () returned 0x4e0000 [0172.794] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.794] GetProcessHeap () returned 0x4e0000 [0172.794] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.794] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02285_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02285_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.796] CloseHandle (hObject=0xdc) returned 1 [0172.796] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6bf9300, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb6bf9300, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x4584, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02287_.WMF", cAlternateFileName="")) returned 1 [0172.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02287_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.800] GetProcessHeap () returned 0x4e0000 [0172.800] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.800] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.800] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.800] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0172.803] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.803] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.803] GetProcessHeap () returned 0x4e0000 [0172.803] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.803] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.803] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.803] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.803] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.803] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.803] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.803] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.803] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.803] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.803] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.804] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.804] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4584, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4584, lpOverlapped=0x0) returned 1 [0172.804] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4590, dwBufLen=0x4590 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4590) returned 1 [0172.805] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.805] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4590, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4590, lpOverlapped=0x0) returned 1 [0172.805] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.805] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4664, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.805] SetEndOfFile (hFile=0xdc) returned 1 [0172.808] GetProcessHeap () returned 0x4e0000 [0172.808] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.808] GetProcessHeap () returned 0x4e0000 [0172.808] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.808] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02287_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02287_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.810] CloseHandle (hObject=0xdc) returned 1 [0172.810] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7f0c000, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7f0c000, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x76e0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02288_.WMF", cAlternateFileName="")) returned 1 [0172.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02288_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.811] GetProcessHeap () returned 0x4e0000 [0172.811] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.812] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.812] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.812] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.812] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.812] GetProcessHeap () returned 0x4e0000 [0172.812] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.812] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.812] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.812] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.815] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.815] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.815] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.815] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.815] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.815] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.815] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.815] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.815] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x76e0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x76e0, lpOverlapped=0x0) returned 1 [0172.816] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x76e0, dwBufLen=0x76e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x76e0) returned 1 [0172.817] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.818] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x76e0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x76e0, lpOverlapped=0x0) returned 1 [0172.818] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.818] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x77b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.818] SetEndOfFile (hFile=0xdc) returned 1 [0172.821] GetProcessHeap () returned 0x4e0000 [0172.821] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.821] GetProcessHeap () returned 0x4e0000 [0172.821] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.821] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02288_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02288_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.823] CloseHandle (hObject=0xdc) returned 1 [0172.823] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7f0c000, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7f0c000, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x5850, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02293_.WMF", cAlternateFileName="")) returned 1 [0172.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02293_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.824] GetProcessHeap () returned 0x4e0000 [0172.824] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.824] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.825] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.825] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.825] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.825] GetProcessHeap () returned 0x4e0000 [0172.825] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.825] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.825] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.825] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.827] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.827] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.827] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.827] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.827] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.828] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.828] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.828] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.828] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5850, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x5850, lpOverlapped=0x0) returned 1 [0172.829] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5850, dwBufLen=0x5850 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5850) returned 1 [0172.829] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.829] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5850, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5850, lpOverlapped=0x0) returned 1 [0172.829] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.829] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5924, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.829] SetEndOfFile (hFile=0xdc) returned 1 [0172.833] GetProcessHeap () returned 0x4e0000 [0172.833] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.833] GetProcessHeap () returned 0x4e0000 [0172.833] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.833] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02293_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02293_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.835] CloseHandle (hObject=0xdc) returned 1 [0172.835] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x406e600, ftCreationTime.dwHighDateTime=0x1bf3a32, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x406e600, ftLastWriteTime.dwHighDateTime=0x1bf3a32, nFileSizeHigh=0x0, nFileSizeLow=0x5328, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02296_.WMF", cAlternateFileName="")) returned 1 [0172.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.836] GetProcessHeap () returned 0x4e0000 [0172.836] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.836] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.836] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.836] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.838] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.838] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.839] GetProcessHeap () returned 0x4e0000 [0172.839] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.839] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.839] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.839] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.839] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.839] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.839] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.839] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.839] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.839] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.839] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.839] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.840] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5328, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x5328, lpOverlapped=0x0) returned 1 [0172.841] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5330, dwBufLen=0x5330 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5330) returned 1 [0172.841] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.841] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5330, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5330, lpOverlapped=0x0) returned 1 [0172.841] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.841] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5404, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.841] SetEndOfFile (hFile=0xdc) returned 1 [0172.844] GetProcessHeap () returned 0x4e0000 [0172.844] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.844] GetProcessHeap () returned 0x4e0000 [0172.844] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.844] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02296_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02296_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.846] CloseHandle (hObject=0xdc) returned 1 [0172.846] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf911f00, ftCreationTime.dwHighDateTime=0x1bd4b16, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf911f00, ftLastWriteTime.dwHighDateTime=0x1bd4b16, nFileSizeHigh=0x0, nFileSizeLow=0x8c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02369_.WMF", cAlternateFileName="")) returned 1 [0172.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.848] GetProcessHeap () returned 0x4e0000 [0172.848] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.848] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.848] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.848] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.848] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.848] GetProcessHeap () returned 0x4e0000 [0172.848] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.848] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.848] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.848] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.850] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.850] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.850] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.850] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.850] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.851] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.851] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.851] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.851] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x8c0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x8c0, lpOverlapped=0x0) returned 1 [0172.851] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8c0, dwBufLen=0x8c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8c0) returned 1 [0172.851] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.851] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x8c0, lpOverlapped=0x0) returned 1 [0172.851] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.851] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.851] SetEndOfFile (hFile=0xdc) returned 1 [0172.853] GetProcessHeap () returned 0x4e0000 [0172.853] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.853] GetProcessHeap () returned 0x4e0000 [0172.853] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.853] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02369_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02369_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.855] CloseHandle (hObject=0xdc) returned 1 [0172.855] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa494d400, ftCreationTime.dwHighDateTime=0x1bd4af2, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa494d400, ftLastWriteTime.dwHighDateTime=0x1bd4af2, nFileSizeHigh=0x0, nFileSizeLow=0x39f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02522_.WMF", cAlternateFileName="")) returned 1 [0172.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02522_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.856] GetProcessHeap () returned 0x4e0000 [0172.856] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.856] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.856] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.856] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.858] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.858] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.858] GetProcessHeap () returned 0x4e0000 [0172.858] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.858] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.858] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.858] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.858] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.858] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.859] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.859] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.859] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.859] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.859] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.859] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.859] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x39f8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x39f8, lpOverlapped=0x0) returned 1 [0172.860] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3a00, dwBufLen=0x3a00 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3a00) returned 1 [0172.860] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.860] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3a00, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3a00, lpOverlapped=0x0) returned 1 [0172.860] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.860] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3ad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.860] SetEndOfFile (hFile=0xdc) returned 1 [0172.863] GetProcessHeap () returned 0x4e0000 [0172.863] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.863] GetProcessHeap () returned 0x4e0000 [0172.863] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.863] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02522_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02522_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.865] CloseHandle (hObject=0xdc) returned 1 [0172.865] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d2a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02950_.WMF", cAlternateFileName="")) returned 1 [0172.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02950_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.866] GetProcessHeap () returned 0x4e0000 [0172.866] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.866] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.866] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.866] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0172.868] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.868] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.868] GetProcessHeap () returned 0x4e0000 [0172.868] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.868] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.868] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.868] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.868] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.868] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.868] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.869] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.869] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.869] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.869] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.869] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.869] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1d2a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1d2a, lpOverlapped=0x0) returned 1 [0172.881] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1d30, dwBufLen=0x1d30 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1d30) returned 1 [0172.881] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.881] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1d30, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1d30, lpOverlapped=0x0) returned 1 [0172.882] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.882] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1e04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.882] SetEndOfFile (hFile=0xdc) returned 1 [0172.885] GetProcessHeap () returned 0x4e0000 [0172.885] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.885] GetProcessHeap () returned 0x4e0000 [0172.885] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.885] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02950_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02950_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.887] CloseHandle (hObject=0xdc) returned 1 [0172.887] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc70, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02957_.WMF", cAlternateFileName="")) returned 1 [0172.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02957_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.888] GetProcessHeap () returned 0x4e0000 [0172.888] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.888] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.888] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.888] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.888] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.888] GetProcessHeap () returned 0x4e0000 [0172.888] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.888] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.888] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.888] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.890] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.890] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.890] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.890] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.890] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.890] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.890] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.890] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.890] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xc70, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xc70, lpOverlapped=0x0) returned 1 [0172.890] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xc70, dwBufLen=0xc70 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xc70) returned 1 [0172.890] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.890] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc70, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xc70, lpOverlapped=0x0) returned 1 [0172.891] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.891] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xd44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.891] SetEndOfFile (hFile=0xdc) returned 1 [0172.893] GetProcessHeap () returned 0x4e0000 [0172.893] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.893] GetProcessHeap () returned 0x4e0000 [0172.893] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.893] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02957_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02957_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.894] CloseHandle (hObject=0xdc) returned 1 [0172.894] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b17c400, ftCreationTime.dwHighDateTime=0x1bd4af8, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b17c400, ftLastWriteTime.dwHighDateTime=0x1bd4af8, nFileSizeHigh=0x0, nFileSizeLow=0x614, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE03236_.WMF", cAlternateFileName="")) returned 1 [0172.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03236_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.895] GetProcessHeap () returned 0x4e0000 [0172.896] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.896] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.896] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.896] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0172.898] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.898] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.898] GetProcessHeap () returned 0x4e0000 [0172.898] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.898] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.898] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.898] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.898] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.898] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.898] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.898] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.898] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.898] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.898] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.898] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.898] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x614, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x614, lpOverlapped=0x0) returned 1 [0172.898] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x620, dwBufLen=0x620 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x620) returned 1 [0172.898] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.898] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x620, lpOverlapped=0x0) returned 1 [0172.898] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.899] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.899] SetEndOfFile (hFile=0xdc) returned 1 [0172.901] GetProcessHeap () returned 0x4e0000 [0172.901] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.901] GetProcessHeap () returned 0x4e0000 [0172.901] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.901] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03236_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03236_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.902] CloseHandle (hObject=0xdc) returned 1 [0172.902] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b00e400, ftCreationTime.dwHighDateTime=0x1bd4afa, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2b00e400, ftLastWriteTime.dwHighDateTime=0x1bd4afa, nFileSizeHigh=0x0, nFileSizeLow=0x8b4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE03241_.WMF", cAlternateFileName="")) returned 1 [0172.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03241_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.903] GetProcessHeap () returned 0x4e0000 [0172.904] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.904] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.904] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.904] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0172.905] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.905] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.905] GetProcessHeap () returned 0x4e0000 [0172.905] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.905] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.905] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.906] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.906] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.906] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.906] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.906] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.906] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.906] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.906] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.906] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.906] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x8b4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x8b4, lpOverlapped=0x0) returned 1 [0172.906] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8c0, dwBufLen=0x8c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8c0) returned 1 [0172.906] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.906] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x8c0, lpOverlapped=0x0) returned 1 [0172.906] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.906] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.906] SetEndOfFile (hFile=0xdc) returned 1 [0172.909] GetProcessHeap () returned 0x4e0000 [0172.909] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.909] GetProcessHeap () returned 0x4e0000 [0172.909] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.909] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03241_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03241_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.910] CloseHandle (hObject=0xdc) returned 1 [0172.910] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb921ed00, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb921ed00, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x3380, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE03257_.WMF", cAlternateFileName="")) returned 1 [0172.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03257_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.911] GetProcessHeap () returned 0x4e0000 [0172.911] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.911] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.911] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.912] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.912] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.912] GetProcessHeap () returned 0x4e0000 [0172.912] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.912] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.912] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.912] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.914] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.914] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.914] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.914] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.914] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.914] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.914] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.914] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.914] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3380, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3380, lpOverlapped=0x0) returned 1 [0172.915] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3380, dwBufLen=0x3380 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3380) returned 1 [0172.915] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.915] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3380, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3380, lpOverlapped=0x0) returned 1 [0172.916] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.916] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3454, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.916] SetEndOfFile (hFile=0xdc) returned 1 [0172.918] GetProcessHeap () returned 0x4e0000 [0172.918] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.918] GetProcessHeap () returned 0x4e0000 [0172.918] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.918] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03257_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03257_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.919] CloseHandle (hObject=0xdc) returned 1 [0172.919] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31379600, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x31379600, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x692, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE03331_.WMF", cAlternateFileName="")) returned 1 [0172.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03331_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.921] GetProcessHeap () returned 0x4e0000 [0172.921] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.921] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.921] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.921] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0172.923] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.923] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.923] GetProcessHeap () returned 0x4e0000 [0172.923] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.923] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.923] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.923] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.923] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.923] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.923] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.923] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.924] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.924] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.924] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.924] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.924] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x692, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x692, lpOverlapped=0x0) returned 1 [0172.924] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6a0, dwBufLen=0x6a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6a0) returned 1 [0172.924] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.924] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x6a0, lpOverlapped=0x0) returned 1 [0172.924] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.924] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x774, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.924] SetEndOfFile (hFile=0xdc) returned 1 [0172.926] GetProcessHeap () returned 0x4e0000 [0172.926] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.926] GetProcessHeap () returned 0x4e0000 [0172.926] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.926] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03331_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03331_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.928] CloseHandle (hObject=0xdc) returned 1 [0172.928] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe160cb00, ftCreationTime.dwHighDateTime=0x1bd4af2, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe160cb00, ftLastWriteTime.dwHighDateTime=0x1bd4af2, nFileSizeHigh=0x0, nFileSizeLow=0x282c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE03339_.WMF", cAlternateFileName="")) returned 1 [0172.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03339_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.928] GetProcessHeap () returned 0x4e0000 [0172.928] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.929] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.929] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.929] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.930] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.930] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.930] GetProcessHeap () returned 0x4e0000 [0172.930] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.930] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.930] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.930] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.930] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.931] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.931] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.931] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.931] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.931] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.931] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.931] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.931] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x282c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x282c, lpOverlapped=0x0) returned 1 [0172.932] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2830, dwBufLen=0x2830 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2830) returned 1 [0172.932] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.932] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2830, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2830, lpOverlapped=0x0) returned 1 [0172.932] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.932] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2904, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.932] SetEndOfFile (hFile=0xdc) returned 1 [0172.934] GetProcessHeap () returned 0x4e0000 [0172.934] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.934] GetProcessHeap () returned 0x4e0000 [0172.934] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.934] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03339_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03339_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.935] CloseHandle (hObject=0xdc) returned 1 [0172.935] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2108, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE03451_.WMF", cAlternateFileName="")) returned 1 [0172.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03451_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.936] GetProcessHeap () returned 0x4e0000 [0172.936] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.936] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.936] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.936] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.938] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.938] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.938] GetProcessHeap () returned 0x4e0000 [0172.938] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.938] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.938] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.938] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.938] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.938] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.938] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.938] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.938] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.938] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.938] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.938] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.939] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2108, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2108, lpOverlapped=0x0) returned 1 [0172.939] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2110, dwBufLen=0x2110 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2110) returned 1 [0172.939] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.939] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2110, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2110, lpOverlapped=0x0) returned 1 [0172.940] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.940] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x21e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.940] SetEndOfFile (hFile=0xdc) returned 1 [0172.942] GetProcessHeap () returned 0x4e0000 [0172.942] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.942] GetProcessHeap () returned 0x4e0000 [0172.942] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.942] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03451_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03451_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.943] CloseHandle (hObject=0xdc) returned 1 [0172.943] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d695e00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d695e00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x1f24, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE03453_.WMF", cAlternateFileName="")) returned 1 [0172.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03453_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.944] GetProcessHeap () returned 0x4e0000 [0172.944] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.944] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.944] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.944] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0172.946] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.946] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.946] GetProcessHeap () returned 0x4e0000 [0172.946] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.946] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.946] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.946] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.946] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.946] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.946] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.946] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.946] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.946] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.946] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.946] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.946] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1f24, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1f24, lpOverlapped=0x0) returned 1 [0172.947] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1f30, dwBufLen=0x1f30 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1f30) returned 1 [0172.947] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.947] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1f30, lpOverlapped=0x0) returned 1 [0172.947] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.947] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2004, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.947] SetEndOfFile (hFile=0xdc) returned 1 [0172.950] GetProcessHeap () returned 0x4e0000 [0172.950] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.950] GetProcessHeap () returned 0x4e0000 [0172.950] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.950] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03453_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03453_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.951] CloseHandle (hObject=0xdc) returned 1 [0172.951] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2178, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE03459_.WMF", cAlternateFileName="")) returned 1 [0172.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03459_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.952] GetProcessHeap () returned 0x4e0000 [0172.952] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.952] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.952] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.952] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.954] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.954] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.954] GetProcessHeap () returned 0x4e0000 [0172.954] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.954] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.954] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.954] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.954] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.954] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.955] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.955] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.955] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.955] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.955] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.955] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.955] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2178, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2178, lpOverlapped=0x0) returned 1 [0172.956] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2180, dwBufLen=0x2180 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2180) returned 1 [0172.956] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.956] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2180, lpOverlapped=0x0) returned 1 [0172.956] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.956] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2254, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.956] SetEndOfFile (hFile=0xdc) returned 1 [0172.958] GetProcessHeap () returned 0x4e0000 [0172.958] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.958] GetProcessHeap () returned 0x4e0000 [0172.958] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.958] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03459_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03459_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.959] CloseHandle (hObject=0xdc) returned 1 [0172.959] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1664, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE03464_.WMF", cAlternateFileName="")) returned 1 [0172.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03464_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.960] GetProcessHeap () returned 0x4e0000 [0172.960] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.960] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.960] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.960] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0172.962] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.962] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.962] GetProcessHeap () returned 0x4e0000 [0172.962] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.962] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.962] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.962] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.962] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.962] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.962] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.962] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.962] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.963] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.963] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.963] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.963] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1664, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1664, lpOverlapped=0x0) returned 1 [0172.963] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1670, dwBufLen=0x1670 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1670) returned 1 [0172.963] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.963] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1670, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1670, lpOverlapped=0x0) returned 1 [0172.964] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.964] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1744, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.964] SetEndOfFile (hFile=0xdc) returned 1 [0172.966] GetProcessHeap () returned 0x4e0000 [0172.966] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.966] GetProcessHeap () returned 0x4e0000 [0172.966] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.966] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03464_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03464_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.967] CloseHandle (hObject=0xdc) returned 1 [0172.967] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x41a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE03466_.WMF", cAlternateFileName="")) returned 1 [0172.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03466_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.967] GetProcessHeap () returned 0x4e0000 [0172.967] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.967] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.967] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.967] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.967] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.967] GetProcessHeap () returned 0x4e0000 [0172.967] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.967] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.968] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.968] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.969] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.969] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.969] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.969] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.969] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.970] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.970] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.970] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.970] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x41a0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x41a0, lpOverlapped=0x0) returned 1 [0172.970] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x41a0, dwBufLen=0x41a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x41a0) returned 1 [0172.971] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.971] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x41a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x41a0, lpOverlapped=0x0) returned 1 [0172.971] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.971] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4274, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.971] SetEndOfFile (hFile=0xdc) returned 1 [0172.973] GetProcessHeap () returned 0x4e0000 [0172.973] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.973] GetProcessHeap () returned 0x4e0000 [0172.973] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.973] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03466_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03466_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.974] CloseHandle (hObject=0xdc) returned 1 [0172.974] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3998, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE03470_.WMF", cAlternateFileName="")) returned 1 [0172.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03470_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.975] GetProcessHeap () returned 0x4e0000 [0172.975] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.975] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.975] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.975] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.976] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.976] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.976] GetProcessHeap () returned 0x4e0000 [0172.976] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.976] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.977] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.977] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.977] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.977] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.977] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.977] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.977] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.977] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.977] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.977] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.977] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3998, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3998, lpOverlapped=0x0) returned 1 [0172.978] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x39a0, dwBufLen=0x39a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x39a0) returned 1 [0172.978] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.978] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x39a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x39a0, lpOverlapped=0x0) returned 1 [0172.978] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.978] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3a74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.978] SetEndOfFile (hFile=0xdc) returned 1 [0172.980] GetProcessHeap () returned 0x4e0000 [0172.980] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.980] GetProcessHeap () returned 0x4e0000 [0172.980] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.980] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03470_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03470_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.981] CloseHandle (hObject=0xdc) returned 1 [0172.981] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3716500, ftCreationTime.dwHighDateTime=0x1bd4be9, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3716500, ftLastWriteTime.dwHighDateTime=0x1bd4be9, nFileSizeHigh=0x0, nFileSizeLow=0xec4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE03513_.WMF", cAlternateFileName="")) returned 1 [0172.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03513_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.982] GetProcessHeap () returned 0x4e0000 [0172.982] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0172.982] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0172.982] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0172.982] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0172.994] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.994] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.994] GetProcessHeap () returned 0x4e0000 [0172.994] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0172.995] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0172.995] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.995] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0172.995] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0172.995] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0172.995] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0172.995] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0172.995] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0172.995] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0172.995] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0172.995] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.995] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xec4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xec4, lpOverlapped=0x0) returned 1 [0172.995] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xed0, dwBufLen=0xed0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xed0) returned 1 [0172.995] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.995] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xed0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xed0, lpOverlapped=0x0) returned 1 [0172.995] CryptDestroyKey (hKey=0x522f98) returned 1 [0172.995] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xfa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.995] SetEndOfFile (hFile=0xdc) returned 1 [0172.997] GetProcessHeap () returned 0x4e0000 [0172.998] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0172.998] GetProcessHeap () returned 0x4e0000 [0172.998] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0172.998] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03513_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03513_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0172.999] CloseHandle (hObject=0xdc) returned 1 [0172.999] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32062000, ftCreationTime.dwHighDateTime=0x1bd4be8, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x32062000, ftLastWriteTime.dwHighDateTime=0x1bd4be8, nFileSizeHigh=0x0, nFileSizeLow=0x1868, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE03668_.WMF", cAlternateFileName="")) returned 1 [0172.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03668_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.000] GetProcessHeap () returned 0x4e0000 [0173.000] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.000] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.000] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.000] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.002] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.002] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.002] GetProcessHeap () returned 0x4e0000 [0173.002] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.002] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.002] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.002] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.002] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.002] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.002] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.002] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.002] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.002] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.002] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.002] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.002] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1868, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1868, lpOverlapped=0x0) returned 1 [0173.003] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1870, dwBufLen=0x1870 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1870) returned 1 [0173.003] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.003] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1870, lpOverlapped=0x0) returned 1 [0173.003] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.003] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1944, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.004] SetEndOfFile (hFile=0xdc) returned 1 [0173.006] GetProcessHeap () returned 0x4e0000 [0173.006] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.006] GetProcessHeap () returned 0x4e0000 [0173.006] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.006] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03668_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03668_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.007] CloseHandle (hObject=0xdc) returned 1 [0173.007] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb300a00, ftCreationTime.dwHighDateTime=0x1bd4be7, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfb300a00, ftLastWriteTime.dwHighDateTime=0x1bd4be7, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE03731_.WMF", cAlternateFileName="")) returned 1 [0173.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03731_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.008] GetProcessHeap () returned 0x4e0000 [0173.008] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.008] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.008] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.008] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.010] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.010] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.010] GetProcessHeap () returned 0x4e0000 [0173.010] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.010] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.010] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.010] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.010] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.010] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.010] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.010] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.011] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.011] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.011] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.011] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.011] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x9fc, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x9fc, lpOverlapped=0x0) returned 1 [0173.011] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa00, dwBufLen=0xa00 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa00) returned 1 [0173.011] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.011] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xa00, lpOverlapped=0x0) returned 1 [0173.011] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.011] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.011] SetEndOfFile (hFile=0xdc) returned 1 [0173.013] GetProcessHeap () returned 0x4e0000 [0173.013] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.013] GetProcessHeap () returned 0x4e0000 [0173.013] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.013] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03731_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03731_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.014] CloseHandle (hObject=0xdc) returned 1 [0173.014] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd176e300, ftCreationTime.dwHighDateTime=0x1bd4be7, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd176e300, ftLastWriteTime.dwHighDateTime=0x1bd4be7, nFileSizeHigh=0x0, nFileSizeLow=0x78a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE03795_.WMF", cAlternateFileName="")) returned 1 [0173.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03795_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.015] GetProcessHeap () returned 0x4e0000 [0173.015] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.015] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.015] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.015] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0173.017] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.017] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.017] GetProcessHeap () returned 0x4e0000 [0173.017] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.017] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.017] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.017] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.018] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.018] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.018] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.018] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.018] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.018] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.018] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.018] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.018] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x78a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x78a, lpOverlapped=0x0) returned 1 [0173.018] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x790, dwBufLen=0x790 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x790) returned 1 [0173.018] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.018] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x790, lpOverlapped=0x0) returned 1 [0173.018] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.018] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x864, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.018] SetEndOfFile (hFile=0xdc) returned 1 [0173.022] GetProcessHeap () returned 0x4e0000 [0173.022] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.022] GetProcessHeap () returned 0x4e0000 [0173.022] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.022] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03795_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03795_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.023] CloseHandle (hObject=0xdc) returned 1 [0173.023] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14937f00, ftCreationTime.dwHighDateTime=0x1bd4c05, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14937f00, ftLastWriteTime.dwHighDateTime=0x1bd4c05, nFileSizeHigh=0x0, nFileSizeLow=0x1020, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE04050_.WMF", cAlternateFileName="")) returned 1 [0173.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe04050_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.024] GetProcessHeap () returned 0x4e0000 [0173.024] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.024] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.024] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.024] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.024] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.024] GetProcessHeap () returned 0x4e0000 [0173.024] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.024] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.024] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.024] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.026] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.026] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.026] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.026] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.026] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.026] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.026] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.026] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.026] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1020, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1020, lpOverlapped=0x0) returned 1 [0173.027] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1020, dwBufLen=0x1020 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1020) returned 1 [0173.027] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.027] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1020, lpOverlapped=0x0) returned 1 [0173.027] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.027] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x10f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.027] SetEndOfFile (hFile=0xdc) returned 1 [0173.029] GetProcessHeap () returned 0x4e0000 [0173.029] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.029] GetProcessHeap () returned 0x4e0000 [0173.030] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.030] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe04050_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe04050_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.031] CloseHandle (hObject=0xdc) returned 1 [0173.031] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x37f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE05665_.WMF", cAlternateFileName="")) returned 1 [0173.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05665_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.031] GetProcessHeap () returned 0x4e0000 [0173.031] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.031] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.031] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.031] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.033] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.033] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.033] GetProcessHeap () returned 0x4e0000 [0173.033] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.033] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.033] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.033] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.033] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.033] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.033] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.034] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.034] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.034] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.034] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.034] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.034] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x37f8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x37f8, lpOverlapped=0x0) returned 1 [0173.035] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3800, dwBufLen=0x3800 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3800) returned 1 [0173.035] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.035] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3800, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3800, lpOverlapped=0x0) returned 1 [0173.035] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.035] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x38d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.035] SetEndOfFile (hFile=0xdc) returned 1 [0173.038] GetProcessHeap () returned 0x4e0000 [0173.038] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.038] GetProcessHeap () returned 0x4e0000 [0173.038] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.039] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05665_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05665_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.039] CloseHandle (hObject=0xdc) returned 1 [0173.040] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f24df00, ftCreationTime.dwHighDateTime=0x1bd4bf5, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f24df00, ftLastWriteTime.dwHighDateTime=0x1bd4bf5, nFileSizeHigh=0x0, nFileSizeLow=0x167c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE05710_.WMF", cAlternateFileName="")) returned 1 [0173.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05710_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.040] GetProcessHeap () returned 0x4e0000 [0173.040] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.040] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.040] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.040] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.042] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.042] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.042] GetProcessHeap () returned 0x4e0000 [0173.042] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.042] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.042] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.042] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.042] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.042] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.043] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.043] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.043] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.043] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.043] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.043] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.043] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x167c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x167c, lpOverlapped=0x0) returned 1 [0173.044] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1680, dwBufLen=0x1680 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1680) returned 1 [0173.044] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.044] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1680, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1680, lpOverlapped=0x0) returned 1 [0173.044] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.044] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1754, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.044] SetEndOfFile (hFile=0xdc) returned 1 [0173.046] GetProcessHeap () returned 0x4e0000 [0173.046] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.046] GetProcessHeap () returned 0x4e0000 [0173.046] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.046] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05710_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05710_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.047] CloseHandle (hObject=0xdc) returned 1 [0173.047] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49073b00, ftCreationTime.dwHighDateTime=0x1bd4c05, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x49073b00, ftLastWriteTime.dwHighDateTime=0x1bd4c05, nFileSizeHigh=0x0, nFileSizeLow=0x608, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE05869_.WMF", cAlternateFileName="")) returned 1 [0173.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05869_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.048] GetProcessHeap () returned 0x4e0000 [0173.048] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.049] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.049] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.049] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.050] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.050] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.050] GetProcessHeap () returned 0x4e0000 [0173.050] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.050] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.050] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.050] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.051] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.051] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.051] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.051] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.051] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.051] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.051] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.051] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.051] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x608, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x608, lpOverlapped=0x0) returned 1 [0173.051] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x610, dwBufLen=0x610 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x610) returned 1 [0173.051] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.051] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x610, lpOverlapped=0x0) returned 1 [0173.051] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.051] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.051] SetEndOfFile (hFile=0xdc) returned 1 [0173.053] GetProcessHeap () returned 0x4e0000 [0173.053] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.053] GetProcessHeap () returned 0x4e0000 [0173.053] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.053] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05869_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05869_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.054] CloseHandle (hObject=0xdc) returned 1 [0173.054] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44428700, ftCreationTime.dwHighDateTime=0x1bd4c05, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x44428700, ftLastWriteTime.dwHighDateTime=0x1bd4c05, nFileSizeHigh=0x0, nFileSizeLow=0x634, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE05870_.WMF", cAlternateFileName="")) returned 1 [0173.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05870_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.056] GetProcessHeap () returned 0x4e0000 [0173.056] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.056] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.056] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.056] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0173.060] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.060] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.060] GetProcessHeap () returned 0x4e0000 [0173.060] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.060] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.060] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.060] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.060] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.060] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.060] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.060] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.060] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.060] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.060] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.061] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.061] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x634, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x634, lpOverlapped=0x0) returned 1 [0173.061] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x640, dwBufLen=0x640 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x640) returned 1 [0173.061] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.061] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x640, lpOverlapped=0x0) returned 1 [0173.061] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.061] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.061] SetEndOfFile (hFile=0xdc) returned 1 [0173.063] GetProcessHeap () returned 0x4e0000 [0173.063] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.063] GetProcessHeap () returned 0x4e0000 [0173.063] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.063] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05870_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05870_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.064] CloseHandle (hObject=0xdc) returned 1 [0173.064] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x671b6e00, ftCreationTime.dwHighDateTime=0x1bd4bfa, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x671b6e00, ftLastWriteTime.dwHighDateTime=0x1bd4bfa, nFileSizeHigh=0x0, nFileSizeLow=0x7fce, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE05930_.WMF", cAlternateFileName="")) returned 1 [0173.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05930_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.064] GetProcessHeap () returned 0x4e0000 [0173.064] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.064] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.064] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.065] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0173.066] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.066] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.066] GetProcessHeap () returned 0x4e0000 [0173.066] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.066] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.066] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.066] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.067] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.067] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.067] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.067] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.067] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.067] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.067] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.067] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.067] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7fce, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7fce, lpOverlapped=0x0) returned 1 [0173.068] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7fd0, dwBufLen=0x7fd0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7fd0) returned 1 [0173.068] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.068] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7fd0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7fd0, lpOverlapped=0x0) returned 1 [0173.068] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.068] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x80a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.068] SetEndOfFile (hFile=0xdc) returned 1 [0173.070] GetProcessHeap () returned 0x4e0000 [0173.070] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.071] GetProcessHeap () returned 0x4e0000 [0173.071] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.071] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05930_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05930_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.072] CloseHandle (hObject=0xdc) returned 1 [0173.072] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf03a600, ftCreationTime.dwHighDateTime=0x1bd4bf5, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf03a600, ftLastWriteTime.dwHighDateTime=0x1bd4bf5, nFileSizeHigh=0x0, nFileSizeLow=0x121c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE06049_.WMF", cAlternateFileName="")) returned 1 [0173.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06049_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.072] GetProcessHeap () returned 0x4e0000 [0173.072] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.072] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.072] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.072] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.074] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.074] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.074] GetProcessHeap () returned 0x4e0000 [0173.074] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.074] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.074] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.074] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.074] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.074] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.074] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.074] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.075] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.075] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.075] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.075] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.075] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x121c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x121c, lpOverlapped=0x0) returned 1 [0173.075] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1220, dwBufLen=0x1220 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1220) returned 1 [0173.076] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.076] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1220, lpOverlapped=0x0) returned 1 [0173.076] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.076] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x12f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.076] SetEndOfFile (hFile=0xdc) returned 1 [0173.078] GetProcessHeap () returned 0x4e0000 [0173.078] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.078] GetProcessHeap () returned 0x4e0000 [0173.078] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.078] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06049_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06049_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.079] CloseHandle (hObject=0xdc) returned 1 [0173.079] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59d01210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4048, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE06450_.WMF", cAlternateFileName="")) returned 1 [0173.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06450_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.080] GetProcessHeap () returned 0x4e0000 [0173.080] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.080] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.080] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.080] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.081] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.081] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.082] GetProcessHeap () returned 0x4e0000 [0173.082] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.082] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.082] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.082] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.082] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.082] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.082] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.082] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.082] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.082] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.082] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.082] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.082] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4048, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4048, lpOverlapped=0x0) returned 1 [0173.083] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4050, dwBufLen=0x4050 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4050) returned 1 [0173.083] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.083] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4050, lpOverlapped=0x0) returned 1 [0173.084] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.084] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4124, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.084] SetEndOfFile (hFile=0xdc) returned 1 [0173.086] GetProcessHeap () returned 0x4e0000 [0173.086] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.086] GetProcessHeap () returned 0x4e0000 [0173.086] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.086] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06450_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06450_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.087] CloseHandle (hObject=0xdc) returned 1 [0173.087] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf15a1100, ftCreationTime.dwHighDateTime=0x1bd4e4a, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf15a1100, ftLastWriteTime.dwHighDateTime=0x1bd4e4a, nFileSizeHigh=0x0, nFileSizeLow=0x629, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH00601G.GIF", cAlternateFileName="")) returned 1 [0173.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00601g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.088] GetProcessHeap () returned 0x4e0000 [0173.088] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.088] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.088] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.088] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x7, lpOverlapped=0x0) returned 1 [0173.089] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.089] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.089] GetProcessHeap () returned 0x4e0000 [0173.089] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.089] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.090] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.090] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.090] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.090] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.090] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.090] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.090] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.090] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.090] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.090] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.090] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x629, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x629, lpOverlapped=0x0) returned 1 [0173.090] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x630, dwBufLen=0x630 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x630) returned 1 [0173.090] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.090] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x630, lpOverlapped=0x0) returned 1 [0173.090] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.090] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x704, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.090] SetEndOfFile (hFile=0xdc) returned 1 [0173.092] GetProcessHeap () returned 0x4e0000 [0173.093] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.093] GetProcessHeap () returned 0x4e0000 [0173.093] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.093] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00601g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00601g.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.094] CloseHandle (hObject=0xdc) returned 1 [0173.094] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe86e3d00, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe86e3d00, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x8628, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH00780U.BMP", cAlternateFileName="")) returned 1 [0173.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00780u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.094] GetProcessHeap () returned 0x4e0000 [0173.094] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.094] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.094] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.094] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.096] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.096] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.096] GetProcessHeap () returned 0x4e0000 [0173.096] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.096] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.096] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.096] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.096] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.096] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.096] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.097] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.097] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.097] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.097] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.097] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.097] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x8628, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x8628, lpOverlapped=0x0) returned 1 [0173.098] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8630, dwBufLen=0x8630 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8630) returned 1 [0173.098] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.098] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x8630, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x8630, lpOverlapped=0x0) returned 1 [0173.098] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.098] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x8704, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.098] SetEndOfFile (hFile=0xdc) returned 1 [0173.101] GetProcessHeap () returned 0x4e0000 [0173.101] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.101] GetProcessHeap () returned 0x4e0000 [0173.101] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.101] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00780u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00780u.bmp.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.102] CloseHandle (hObject=0xdc) returned 1 [0173.102] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45c100, ftCreationTime.dwHighDateTime=0x1bd4e55, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x45c100, ftLastWriteTime.dwHighDateTime=0x1bd4e55, nFileSizeHigh=0x0, nFileSizeLow=0x7e90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH01035U.BMP", cAlternateFileName="")) returned 1 [0173.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01035u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.103] GetProcessHeap () returned 0x4e0000 [0173.103] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.103] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.103] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.103] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.103] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.103] GetProcessHeap () returned 0x4e0000 [0173.103] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.103] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.103] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.103] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.105] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.105] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.105] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.105] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.105] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.105] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.105] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.105] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.105] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7e90, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7e90, lpOverlapped=0x0) returned 1 [0173.106] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7e90, dwBufLen=0x7e90 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7e90) returned 1 [0173.107] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.107] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7e90, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7e90, lpOverlapped=0x0) returned 1 [0173.107] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.107] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7f64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.107] SetEndOfFile (hFile=0xdc) returned 1 [0173.109] GetProcessHeap () returned 0x4e0000 [0173.109] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.109] GetProcessHeap () returned 0x4e0000 [0173.109] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.109] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01035u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01035u.bmp.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.110] CloseHandle (hObject=0xdc) returned 1 [0173.110] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x211bb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH01046J.JPG", cAlternateFileName="")) returned 1 [0173.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01046j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.112] GetProcessHeap () returned 0x4e0000 [0173.112] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.112] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.112] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.112] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x5, lpOverlapped=0x0) returned 1 [0173.113] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.113] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.113] GetProcessHeap () returned 0x4e0000 [0173.113] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.113] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.113] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.113] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.114] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.114] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.114] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.114] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.114] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.114] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.114] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.114] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.114] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x211bb, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x211bb, lpOverlapped=0x0) returned 1 [0173.116] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x211c0, dwBufLen=0x211c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x211c0) returned 1 [0173.117] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.117] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x211c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x211c0, lpOverlapped=0x0) returned 1 [0173.118] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.118] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x21294, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.118] SetEndOfFile (hFile=0xdc) returned 1 [0173.121] GetProcessHeap () returned 0x4e0000 [0173.121] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.121] GetProcessHeap () returned 0x4e0000 [0173.121] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.121] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01046j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01046j.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.122] CloseHandle (hObject=0xdc) returned 1 [0173.122] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd4a3a00, ftCreationTime.dwHighDateTime=0x1bd50ad, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcd4a3a00, ftLastWriteTime.dwHighDateTime=0x1bd50ad, nFileSizeHigh=0x0, nFileSizeLow=0xa202, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH01179J.JPG", cAlternateFileName="")) returned 1 [0173.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01179j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.123] GetProcessHeap () returned 0x4e0000 [0173.123] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.123] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.123] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.123] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0173.126] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.126] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.126] GetProcessHeap () returned 0x4e0000 [0173.126] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.126] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.126] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.126] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.126] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.126] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.126] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.127] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.127] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.127] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.127] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.127] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.127] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xa202, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xa202, lpOverlapped=0x0) returned 1 [0173.128] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa210, dwBufLen=0xa210 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa210) returned 1 [0173.128] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.128] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xa210, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xa210, lpOverlapped=0x0) returned 1 [0173.128] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.128] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xa2e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.128] SetEndOfFile (hFile=0xdc) returned 1 [0173.131] GetProcessHeap () returned 0x4e0000 [0173.131] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.131] GetProcessHeap () returned 0x4e0000 [0173.131] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.131] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01179j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01179j.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.133] CloseHandle (hObject=0xdc) returned 1 [0173.133] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x18be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH01213K.JPG", cAlternateFileName="")) returned 1 [0173.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01213k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.134] GetProcessHeap () returned 0x4e0000 [0173.134] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.134] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.134] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.134] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0173.137] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.137] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.138] GetProcessHeap () returned 0x4e0000 [0173.138] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.138] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.138] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.138] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.138] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.138] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.138] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.138] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.138] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.138] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.138] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.138] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.138] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x18be, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x18be, lpOverlapped=0x0) returned 1 [0173.139] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x18c0, dwBufLen=0x18c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x18c0) returned 1 [0173.139] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.139] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x18c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x18c0, lpOverlapped=0x0) returned 1 [0173.139] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.139] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.139] SetEndOfFile (hFile=0xdc) returned 1 [0173.141] GetProcessHeap () returned 0x4e0000 [0173.141] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.141] GetProcessHeap () returned 0x4e0000 [0173.141] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.141] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01213k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01213k.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.143] CloseHandle (hObject=0xdc) returned 1 [0173.143] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1c94, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH01221K.JPG", cAlternateFileName="")) returned 1 [0173.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01221k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.143] GetProcessHeap () returned 0x4e0000 [0173.143] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.143] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.143] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.144] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0173.145] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.145] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.145] GetProcessHeap () returned 0x4e0000 [0173.145] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.145] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.145] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.146] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.146] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.146] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.146] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.146] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.146] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.146] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.146] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.146] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.146] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1c94, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1c94, lpOverlapped=0x0) returned 1 [0173.147] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1ca0, dwBufLen=0x1ca0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1ca0) returned 1 [0173.147] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.147] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1ca0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1ca0, lpOverlapped=0x0) returned 1 [0173.147] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.147] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1d74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.147] SetEndOfFile (hFile=0xdc) returned 1 [0173.149] GetProcessHeap () returned 0x4e0000 [0173.149] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.149] GetProcessHeap () returned 0x4e0000 [0173.149] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.149] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01221k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01221k.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.150] CloseHandle (hObject=0xdc) returned 1 [0173.151] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37b36e00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x37b36e00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH01235U.BMP", cAlternateFileName="")) returned 1 [0173.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01235u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.151] GetProcessHeap () returned 0x4e0000 [0173.151] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.151] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.151] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.151] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.153] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.153] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.153] GetProcessHeap () returned 0x4e0000 [0173.153] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.153] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.153] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.153] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.153] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.154] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.154] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.154] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.154] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.154] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.154] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.154] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.154] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7db8, lpOverlapped=0x0) returned 1 [0173.155] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7dc0) returned 1 [0173.155] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.155] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7dc0, lpOverlapped=0x0) returned 1 [0173.155] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.155] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.155] SetEndOfFile (hFile=0xdc) returned 1 [0173.158] GetProcessHeap () returned 0x4e0000 [0173.158] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.158] GetProcessHeap () returned 0x4e0000 [0173.158] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.158] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01235u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01235u.bmp.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.159] CloseHandle (hObject=0xdc) returned 1 [0173.159] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc83e7e00, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc83e7e00, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH01236U.BMP", cAlternateFileName="")) returned 1 [0173.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01236u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.159] GetProcessHeap () returned 0x4e0000 [0173.159] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.160] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.160] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.160] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.160] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.160] GetProcessHeap () returned 0x4e0000 [0173.160] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.160] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.160] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.160] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.162] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.162] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.162] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.162] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.162] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.162] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.162] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.162] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.162] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7ce0, lpOverlapped=0x0) returned 1 [0173.163] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7ce0, dwBufLen=0x7ce0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7ce0) returned 1 [0173.163] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.163] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7ce0, lpOverlapped=0x0) returned 1 [0173.164] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.164] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.164] SetEndOfFile (hFile=0xdc) returned 1 [0173.166] GetProcessHeap () returned 0x4e0000 [0173.166] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.166] GetProcessHeap () returned 0x4e0000 [0173.166] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.166] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01236u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01236u.bmp.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.167] CloseHandle (hObject=0xdc) returned 1 [0173.167] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1764, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH01239K.JPG", cAlternateFileName="")) returned 1 [0173.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01239k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.168] GetProcessHeap () returned 0x4e0000 [0173.168] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.168] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.168] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.168] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0173.170] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.170] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.170] GetProcessHeap () returned 0x4e0000 [0173.170] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.170] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.170] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.170] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.170] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.170] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.170] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.170] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.171] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.171] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.171] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.171] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.171] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1764, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1764, lpOverlapped=0x0) returned 1 [0173.171] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1770, dwBufLen=0x1770 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1770) returned 1 [0173.172] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.172] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1770, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1770, lpOverlapped=0x0) returned 1 [0173.172] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.172] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1844, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.172] SetEndOfFile (hFile=0xdc) returned 1 [0173.174] GetProcessHeap () returned 0x4e0000 [0173.174] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.174] GetProcessHeap () returned 0x4e0000 [0173.174] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.174] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01239k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01239k.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.175] CloseHandle (hObject=0xdc) returned 1 [0173.175] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbeb51600, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbeb51600, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7c08, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH01247U.BMP", cAlternateFileName="")) returned 1 [0173.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01247u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.176] GetProcessHeap () returned 0x4e0000 [0173.176] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.176] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.176] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.176] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.177] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.177] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.177] GetProcessHeap () returned 0x4e0000 [0173.177] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.177] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.177] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.177] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.178] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.178] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.178] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.178] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.178] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.178] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.178] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.178] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.178] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7c08, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7c08, lpOverlapped=0x0) returned 1 [0173.179] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7c10, dwBufLen=0x7c10 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7c10) returned 1 [0173.179] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.179] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7c10, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7c10, lpOverlapped=0x0) returned 1 [0173.179] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.179] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7ce4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.179] SetEndOfFile (hFile=0xdc) returned 1 [0173.181] GetProcessHeap () returned 0x4e0000 [0173.181] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.182] GetProcessHeap () returned 0x4e0000 [0173.182] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.182] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01247u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01247u.bmp.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.183] CloseHandle (hObject=0xdc) returned 1 [0173.183] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72230800, ftCreationTime.dwHighDateTime=0x1bd4e5f, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x72230800, ftLastWriteTime.dwHighDateTime=0x1bd4e5f, nFileSizeHigh=0x0, nFileSizeLow=0x1e55, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH01255G.GIF", cAlternateFileName="")) returned 1 [0173.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01255g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.184] GetProcessHeap () returned 0x4e0000 [0173.184] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.184] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.184] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.184] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xb, lpOverlapped=0x0) returned 1 [0173.185] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.186] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.186] GetProcessHeap () returned 0x4e0000 [0173.186] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.186] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.186] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.186] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.186] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.186] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.186] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.186] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.186] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.186] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.186] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.186] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.186] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1e55, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1e55, lpOverlapped=0x0) returned 1 [0173.190] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1e60, dwBufLen=0x1e60 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1e60) returned 1 [0173.190] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.190] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1e60, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1e60, lpOverlapped=0x0) returned 1 [0173.190] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.190] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1f34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.190] SetEndOfFile (hFile=0xdc) returned 1 [0173.192] GetProcessHeap () returned 0x4e0000 [0173.192] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.192] GetProcessHeap () returned 0x4e0000 [0173.192] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.192] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01255g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01255g.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.193] CloseHandle (hObject=0xdc) returned 1 [0173.193] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d799000, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d799000, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7c08, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH01265U.BMP", cAlternateFileName="")) returned 1 [0173.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01265u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.194] GetProcessHeap () returned 0x4e0000 [0173.194] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.194] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.194] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.194] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.196] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.196] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.196] GetProcessHeap () returned 0x4e0000 [0173.196] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.196] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.196] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.196] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.196] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.196] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.196] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.197] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.197] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.197] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.197] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.197] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.197] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7c08, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7c08, lpOverlapped=0x0) returned 1 [0173.198] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7c10, dwBufLen=0x7c10 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7c10) returned 1 [0173.198] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.198] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7c10, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7c10, lpOverlapped=0x0) returned 1 [0173.198] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.198] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7ce4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.198] SetEndOfFile (hFile=0xdc) returned 1 [0173.200] GetProcessHeap () returned 0x4e0000 [0173.200] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.201] GetProcessHeap () returned 0x4e0000 [0173.201] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.201] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01265u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01265u.bmp.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.202] CloseHandle (hObject=0xdc) returned 1 [0173.202] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8bf3500, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb8bf3500, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH01332U.BMP", cAlternateFileName="")) returned 1 [0173.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01332u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.203] GetProcessHeap () returned 0x4e0000 [0173.203] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.203] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.203] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.203] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.205] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.205] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.205] GetProcessHeap () returned 0x4e0000 [0173.205] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.205] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.205] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.205] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.205] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.205] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.205] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.205] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.205] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.205] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.205] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.205] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.205] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7db8, lpOverlapped=0x0) returned 1 [0173.206] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7dc0) returned 1 [0173.206] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.207] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7dc0, lpOverlapped=0x0) returned 1 [0173.207] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.207] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.207] SetEndOfFile (hFile=0xdc) returned 1 [0173.209] GetProcessHeap () returned 0x4e0000 [0173.209] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.209] GetProcessHeap () returned 0x4e0000 [0173.209] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.210] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01332u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01332u.bmp.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.211] CloseHandle (hObject=0xdc) returned 1 [0173.211] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa711900, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaa711900, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH01478U.BMP", cAlternateFileName="")) returned 1 [0173.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01478u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.212] GetProcessHeap () returned 0x4e0000 [0173.212] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.212] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.212] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.212] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.212] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.212] GetProcessHeap () returned 0x4e0000 [0173.212] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.212] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.212] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.212] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.215] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.215] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.215] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.215] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.215] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.215] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.215] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.215] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.215] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7ce0, lpOverlapped=0x0) returned 1 [0173.217] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7ce0, dwBufLen=0x7ce0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7ce0) returned 1 [0173.217] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.217] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7ce0, lpOverlapped=0x0) returned 1 [0173.217] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.217] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.217] SetEndOfFile (hFile=0xdc) returned 1 [0173.220] GetProcessHeap () returned 0x4e0000 [0173.220] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.220] GetProcessHeap () returned 0x4e0000 [0173.220] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.220] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01478u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01478u.bmp.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.222] CloseHandle (hObject=0xdc) returned 1 [0173.223] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa47b3800, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa47b3800, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH01562U.BMP", cAlternateFileName="")) returned 1 [0173.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01562u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.227] GetProcessHeap () returned 0x4e0000 [0173.227] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.227] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.227] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.227] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.229] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.229] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.229] GetProcessHeap () returned 0x4e0000 [0173.229] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.229] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.229] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.229] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.229] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.229] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.229] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.229] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.229] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.230] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.230] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.230] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.230] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7db8, lpOverlapped=0x0) returned 1 [0173.230] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7dc0) returned 1 [0173.231] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.231] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7dc0, lpOverlapped=0x0) returned 1 [0173.231] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.231] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.231] SetEndOfFile (hFile=0xdc) returned 1 [0173.234] GetProcessHeap () returned 0x4e0000 [0173.234] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.234] GetProcessHeap () returned 0x4e0000 [0173.234] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.234] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01562u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01562u.bmp.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.236] CloseHandle (hObject=0xdc) returned 1 [0173.236] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fb68400, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9fb68400, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH01607U.BMP", cAlternateFileName="")) returned 1 [0173.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01607u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.237] GetProcessHeap () returned 0x4e0000 [0173.237] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.237] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.237] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.237] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.237] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.237] GetProcessHeap () returned 0x4e0000 [0173.238] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.238] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.238] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.238] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.240] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.240] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.240] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.240] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.240] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.240] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.241] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.241] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.241] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7ce0, lpOverlapped=0x0) returned 1 [0173.242] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7ce0, dwBufLen=0x7ce0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7ce0) returned 1 [0173.242] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.242] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7ce0, lpOverlapped=0x0) returned 1 [0173.242] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.242] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.243] SetEndOfFile (hFile=0xdc) returned 1 [0173.245] GetProcessHeap () returned 0x4e0000 [0173.245] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.245] GetProcessHeap () returned 0x4e0000 [0173.245] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.245] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01607u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01607u.bmp.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.247] CloseHandle (hObject=0xdc) returned 1 [0173.247] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35a3dc00, ftCreationTime.dwHighDateTime=0x1bd4e60, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35a3dc00, ftLastWriteTime.dwHighDateTime=0x1bd4e60, nFileSizeHigh=0x0, nFileSizeLow=0x9abe, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH01931J.JPG", cAlternateFileName="")) returned 1 [0173.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01931j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.248] GetProcessHeap () returned 0x4e0000 [0173.248] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.248] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.248] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.248] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0173.250] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.251] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.251] GetProcessHeap () returned 0x4e0000 [0173.251] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.251] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.251] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.251] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.251] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.251] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.251] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.251] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.251] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.251] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.251] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.251] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.251] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x9abe, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x9abe, lpOverlapped=0x0) returned 1 [0173.255] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9ac0, dwBufLen=0x9ac0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9ac0) returned 1 [0173.256] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.256] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x9ac0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x9ac0, lpOverlapped=0x0) returned 1 [0173.256] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.256] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x9b94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.256] SetEndOfFile (hFile=0xdc) returned 1 [0173.259] GetProcessHeap () returned 0x4e0000 [0173.259] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.259] GetProcessHeap () returned 0x4e0000 [0173.259] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.259] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01931j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01931j.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.261] CloseHandle (hObject=0xdc) returned 1 [0173.261] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x451e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02028K.JPG", cAlternateFileName="")) returned 1 [0173.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02028k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.262] GetProcessHeap () returned 0x4e0000 [0173.262] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.262] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.262] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.263] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0173.264] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.264] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.264] GetProcessHeap () returned 0x4e0000 [0173.264] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.265] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.265] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.265] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.265] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.265] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.265] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.265] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.265] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.265] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.265] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.265] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.265] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x451e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x451e, lpOverlapped=0x0) returned 1 [0173.266] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4520, dwBufLen=0x4520 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4520) returned 1 [0173.266] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.266] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4520, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4520, lpOverlapped=0x0) returned 1 [0173.267] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.267] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x45f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.267] SetEndOfFile (hFile=0xdc) returned 1 [0173.269] GetProcessHeap () returned 0x4e0000 [0173.269] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.269] GetProcessHeap () returned 0x4e0000 [0173.270] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.270] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02028k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02028k.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.271] CloseHandle (hObject=0xdc) returned 1 [0173.271] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a415a00, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a415a00, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02039U.BMP", cAlternateFileName="")) returned 1 [0173.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02039u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.272] GetProcessHeap () returned 0x4e0000 [0173.272] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.272] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.272] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.272] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.272] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.272] GetProcessHeap () returned 0x4e0000 [0173.272] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.272] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.272] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.272] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.287] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.287] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.287] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.287] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.287] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.287] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.287] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.287] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.287] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7ce0, lpOverlapped=0x0) returned 1 [0173.288] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7ce0, dwBufLen=0x7ce0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7ce0) returned 1 [0173.289] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.289] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7ce0, lpOverlapped=0x0) returned 1 [0173.289] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.289] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.289] SetEndOfFile (hFile=0xdc) returned 1 [0173.292] GetProcessHeap () returned 0x4e0000 [0173.292] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.292] GetProcessHeap () returned 0x4e0000 [0173.292] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.292] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02039u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02039u.bmp.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.294] CloseHandle (hObject=0xdc) returned 1 [0173.294] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x857ca600, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x857ca600, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02040U.BMP", cAlternateFileName="")) returned 1 [0173.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02040u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.295] GetProcessHeap () returned 0x4e0000 [0173.295] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.295] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.295] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.295] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.297] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.297] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.297] GetProcessHeap () returned 0x4e0000 [0173.297] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.297] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.297] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.297] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.297] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.298] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.298] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.298] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.298] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.298] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.298] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.298] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.298] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7db8, lpOverlapped=0x0) returned 1 [0173.299] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7dc0) returned 1 [0173.299] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.299] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7dc0, lpOverlapped=0x0) returned 1 [0173.300] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.300] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.300] SetEndOfFile (hFile=0xdc) returned 1 [0173.303] GetProcessHeap () returned 0x4e0000 [0173.303] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.303] GetProcessHeap () returned 0x4e0000 [0173.303] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.303] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02040u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02040u.bmp.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.304] CloseHandle (hObject=0xdc) returned 1 [0173.304] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf32cd000, ftCreationTime.dwHighDateTime=0x1bd4e5c, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf32cd000, ftLastWriteTime.dwHighDateTime=0x1bd4e5c, nFileSizeHigh=0x0, nFileSizeLow=0x6afc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02053J.JPG", cAlternateFileName="")) returned 1 [0173.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02053j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.306] GetProcessHeap () returned 0x4e0000 [0173.306] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.306] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.306] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.306] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.309] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.309] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.309] GetProcessHeap () returned 0x4e0000 [0173.309] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.309] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.309] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.309] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.309] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.309] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.309] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.310] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.310] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.310] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.310] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.310] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.310] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x6afc, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x6afc, lpOverlapped=0x0) returned 1 [0173.311] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6b00, dwBufLen=0x6b00 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6b00) returned 1 [0173.311] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.312] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6b00, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x6b00, lpOverlapped=0x0) returned 1 [0173.312] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.312] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6bd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.312] SetEndOfFile (hFile=0xdc) returned 1 [0173.315] GetProcessHeap () returned 0x4e0000 [0173.315] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.315] GetProcessHeap () returned 0x4e0000 [0173.315] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.315] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02053j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02053j.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.317] CloseHandle (hObject=0xdc) returned 1 [0173.317] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b7f200, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80b7f200, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02058U.BMP", cAlternateFileName="")) returned 1 [0173.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02058u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.318] GetProcessHeap () returned 0x4e0000 [0173.318] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.318] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.318] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.319] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.319] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.319] GetProcessHeap () returned 0x4e0000 [0173.319] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.319] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.319] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.319] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.321] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.321] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.321] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.321] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.321] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.321] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.321] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.321] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.321] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7ce0, lpOverlapped=0x0) returned 1 [0173.322] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7ce0, dwBufLen=0x7ce0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7ce0) returned 1 [0173.322] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.322] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7ce0, lpOverlapped=0x0) returned 1 [0173.323] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.323] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.323] SetEndOfFile (hFile=0xdc) returned 1 [0173.326] GetProcessHeap () returned 0x4e0000 [0173.326] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.326] GetProcessHeap () returned 0x4e0000 [0173.326] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.326] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02058u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02058u.bmp.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.327] CloseHandle (hObject=0xdc) returned 1 [0173.327] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c73f500, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c73f500, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02062U.BMP", cAlternateFileName="")) returned 1 [0173.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02062u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.328] GetProcessHeap () returned 0x4e0000 [0173.328] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.328] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.328] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.328] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.328] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.328] GetProcessHeap () returned 0x4e0000 [0173.328] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.328] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.328] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.329] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.339] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.339] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.339] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.339] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.339] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.339] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.339] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.339] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.340] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7ce0, lpOverlapped=0x0) returned 1 [0173.341] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7ce0, dwBufLen=0x7ce0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7ce0) returned 1 [0173.341] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.341] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7ce0, lpOverlapped=0x0) returned 1 [0173.341] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.341] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.341] SetEndOfFile (hFile=0xdc) returned 1 [0173.344] GetProcessHeap () returned 0x4e0000 [0173.344] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.344] GetProcessHeap () returned 0x4e0000 [0173.344] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.344] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02062u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02062u.bmp.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.346] CloseHandle (hObject=0xdc) returned 1 [0173.346] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa943ea00, ftCreationTime.dwHighDateTime=0x1bd4e5c, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa943ea00, ftLastWriteTime.dwHighDateTime=0x1bd4e5c, nFileSizeHigh=0x0, nFileSizeLow=0x7297, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02069J.JPG", cAlternateFileName="")) returned 1 [0173.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02069j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.348] GetProcessHeap () returned 0x4e0000 [0173.348] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.348] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.348] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.348] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x9, lpOverlapped=0x0) returned 1 [0173.350] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.350] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.350] GetProcessHeap () returned 0x4e0000 [0173.350] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.350] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.350] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.351] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.351] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.351] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.351] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.351] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.351] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.351] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.351] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.351] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.351] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7297, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7297, lpOverlapped=0x0) returned 1 [0173.352] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x72a0, dwBufLen=0x72a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x72a0) returned 1 [0173.353] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.353] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x72a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x72a0, lpOverlapped=0x0) returned 1 [0173.353] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.353] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7374, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.353] SetEndOfFile (hFile=0xdc) returned 1 [0173.356] GetProcessHeap () returned 0x4e0000 [0173.356] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.356] GetProcessHeap () returned 0x4e0000 [0173.356] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.356] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02069j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02069j.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.357] CloseHandle (hObject=0xdc) returned 1 [0173.357] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67af4100, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67af4100, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02071U.BMP", cAlternateFileName="")) returned 1 [0173.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02071u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.358] GetProcessHeap () returned 0x4e0000 [0173.358] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.358] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.358] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.359] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.361] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.361] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.361] GetProcessHeap () returned 0x4e0000 [0173.361] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.361] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.361] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.361] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.361] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.361] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.361] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.361] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.361] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.362] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.362] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.362] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.362] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7db8, lpOverlapped=0x0) returned 1 [0173.363] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7dc0) returned 1 [0173.363] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.363] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7dc0, lpOverlapped=0x0) returned 1 [0173.363] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.364] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.364] SetEndOfFile (hFile=0xdc) returned 1 [0173.366] GetProcessHeap () returned 0x4e0000 [0173.366] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.366] GetProcessHeap () returned 0x4e0000 [0173.366] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.366] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02071u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02071u.bmp.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.368] CloseHandle (hObject=0xdc) returned 1 [0173.368] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55cd9e00, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x55cd9e00, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02074U.BMP", cAlternateFileName="")) returned 1 [0173.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02074u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.369] GetProcessHeap () returned 0x4e0000 [0173.369] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.369] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.369] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.370] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.370] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.370] GetProcessHeap () returned 0x4e0000 [0173.370] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.370] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.370] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.370] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.372] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.372] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.372] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.372] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.372] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.372] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.372] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.372] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.372] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7ce0, lpOverlapped=0x0) returned 1 [0173.373] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7ce0, dwBufLen=0x7ce0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7ce0) returned 1 [0173.374] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.374] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7ce0, lpOverlapped=0x0) returned 1 [0173.374] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.374] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.374] SetEndOfFile (hFile=0xdc) returned 1 [0173.377] GetProcessHeap () returned 0x4e0000 [0173.377] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.377] GetProcessHeap () returned 0x4e0000 [0173.377] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.377] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02074u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02074u.bmp.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.380] CloseHandle (hObject=0xdc) returned 1 [0173.380] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c443600, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4c443600, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02208U.BMP", cAlternateFileName="")) returned 1 [0173.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02208u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.382] GetProcessHeap () returned 0x4e0000 [0173.382] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.382] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.382] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.382] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.382] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.382] GetProcessHeap () returned 0x4e0000 [0173.382] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.382] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.382] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.382] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.385] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.385] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.385] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.385] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.385] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.385] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.385] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.385] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.386] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7ce0, lpOverlapped=0x0) returned 1 [0173.386] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7ce0, dwBufLen=0x7ce0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7ce0) returned 1 [0173.387] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.387] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7ce0, lpOverlapped=0x0) returned 1 [0173.387] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.387] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.387] SetEndOfFile (hFile=0xdc) returned 1 [0173.390] GetProcessHeap () returned 0x4e0000 [0173.390] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.390] GetProcessHeap () returned 0x4e0000 [0173.390] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.390] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02208u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02208u.bmp.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.391] CloseHandle (hObject=0xdc) returned 1 [0173.391] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e0cfa00, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e0cfa00, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02223U.BMP", cAlternateFileName="")) returned 1 [0173.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02223u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.392] GetProcessHeap () returned 0x4e0000 [0173.392] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.392] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.392] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.392] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.395] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.396] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.396] GetProcessHeap () returned 0x4e0000 [0173.396] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.396] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.396] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.396] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.396] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.396] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.396] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.396] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.396] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.396] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.396] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.396] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.396] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7db8, lpOverlapped=0x0) returned 1 [0173.398] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7dc0) returned 1 [0173.398] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.398] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7dc0, lpOverlapped=0x0) returned 1 [0173.398] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.398] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.399] SetEndOfFile (hFile=0xdc) returned 1 [0173.401] GetProcessHeap () returned 0x4e0000 [0173.401] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.401] GetProcessHeap () returned 0x4e0000 [0173.401] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.401] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02223u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02223u.bmp.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.403] CloseHandle (hObject=0xdc) returned 1 [0173.403] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30d92b00, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x30d92b00, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02291U.BMP", cAlternateFileName="")) returned 1 [0173.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02291u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.405] GetProcessHeap () returned 0x4e0000 [0173.405] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.405] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.405] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.405] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.413] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.413] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.413] GetProcessHeap () returned 0x4e0000 [0173.413] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.414] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.414] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.414] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.414] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.414] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.414] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.414] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.414] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.414] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.414] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.414] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.414] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7db8, lpOverlapped=0x0) returned 1 [0173.415] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7dc0) returned 1 [0173.416] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.416] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7dc0, lpOverlapped=0x0) returned 1 [0173.416] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.416] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.416] SetEndOfFile (hFile=0xdc) returned 1 [0173.419] GetProcessHeap () returned 0x4e0000 [0173.419] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.419] GetProcessHeap () returned 0x4e0000 [0173.419] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.419] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02291u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02291u.bmp.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.421] CloseHandle (hObject=0xdc) returned 1 [0173.421] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2880f000, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2880f000, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02398U.BMP", cAlternateFileName="")) returned 1 [0173.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02398u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.423] GetProcessHeap () returned 0x4e0000 [0173.423] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.423] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.423] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.423] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.423] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.423] GetProcessHeap () returned 0x4e0000 [0173.423] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.423] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.423] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.423] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.437] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.438] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.438] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.438] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.438] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.438] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.438] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.438] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.438] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7ce0, lpOverlapped=0x0) returned 1 [0173.439] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7ce0, dwBufLen=0x7ce0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7ce0) returned 1 [0173.439] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.440] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7ce0, lpOverlapped=0x0) returned 1 [0173.440] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.440] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.440] SetEndOfFile (hFile=0xdc) returned 1 [0173.443] GetProcessHeap () returned 0x4e0000 [0173.443] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.443] GetProcessHeap () returned 0x4e0000 [0173.443] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.443] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02398u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02398u.bmp.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.445] CloseHandle (hObject=0xdc) returned 1 [0173.445] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xdd5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02412K.JPG", cAlternateFileName="")) returned 1 [0173.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02412k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.446] GetProcessHeap () returned 0x4e0000 [0173.446] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.446] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.446] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.446] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xb, lpOverlapped=0x0) returned 1 [0173.463] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.463] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.463] GetProcessHeap () returned 0x4e0000 [0173.463] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.463] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.463] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.463] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.463] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.463] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.463] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.463] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.463] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.463] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.463] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.464] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.464] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xdd5, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xdd5, lpOverlapped=0x0) returned 1 [0173.464] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xde0, dwBufLen=0xde0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xde0) returned 1 [0173.464] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.464] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xde0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xde0, lpOverlapped=0x0) returned 1 [0173.464] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.464] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xeb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.464] SetEndOfFile (hFile=0xdc) returned 1 [0173.467] GetProcessHeap () returned 0x4e0000 [0173.467] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.467] GetProcessHeap () returned 0x4e0000 [0173.467] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.467] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02412k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02412k.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.469] CloseHandle (hObject=0xdc) returned 1 [0173.469] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x156e2000, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x156e2000, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02417U.BMP", cAlternateFileName="")) returned 1 [0173.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02417u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.470] GetProcessHeap () returned 0x4e0000 [0173.470] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.470] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.470] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.470] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.470] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.470] GetProcessHeap () returned 0x4e0000 [0173.470] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.471] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.471] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.471] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.473] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.473] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.473] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.473] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.473] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.473] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.473] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.473] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.473] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7ce0, lpOverlapped=0x0) returned 1 [0173.474] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7ce0, dwBufLen=0x7ce0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7ce0) returned 1 [0173.475] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.475] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7ce0, lpOverlapped=0x0) returned 1 [0173.475] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.475] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.475] SetEndOfFile (hFile=0xdc) returned 1 [0173.478] GetProcessHeap () returned 0x4e0000 [0173.478] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.478] GetProcessHeap () returned 0x4e0000 [0173.478] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.478] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02417u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02417u.bmp.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.480] CloseHandle (hObject=0xdc) returned 1 [0173.480] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf783f00, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf783f00, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7c08, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02466U.BMP", cAlternateFileName="")) returned 1 [0173.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02466u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.481] GetProcessHeap () returned 0x4e0000 [0173.481] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.481] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.481] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.481] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.483] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.483] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.483] GetProcessHeap () returned 0x4e0000 [0173.484] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.484] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.484] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.484] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.484] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.484] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.484] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.484] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.484] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.484] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.484] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.484] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.484] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7c08, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7c08, lpOverlapped=0x0) returned 1 [0173.486] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7c10, dwBufLen=0x7c10 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7c10) returned 1 [0173.486] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.486] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7c10, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7c10, lpOverlapped=0x0) returned 1 [0173.486] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.486] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7ce4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.486] SetEndOfFile (hFile=0xdc) returned 1 [0173.489] GetProcessHeap () returned 0x4e0000 [0173.490] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.490] GetProcessHeap () returned 0x4e0000 [0173.490] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.490] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02466u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02466u.bmp.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.492] CloseHandle (hObject=0xdc) returned 1 [0173.492] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78519700, ftCreationTime.dwHighDateTime=0x1bf111d, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78519700, ftLastWriteTime.dwHighDateTime=0x1bf111d, nFileSizeHigh=0x0, nFileSizeLow=0x48fc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02470U.BMP", cAlternateFileName="")) returned 1 [0173.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02470u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.494] GetProcessHeap () returned 0x4e0000 [0173.494] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.494] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.494] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.494] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.496] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.496] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.496] GetProcessHeap () returned 0x4e0000 [0173.496] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.496] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.496] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.496] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.496] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.496] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.496] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.497] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.497] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.497] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.497] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.497] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.497] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x48fc, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x48fc, lpOverlapped=0x0) returned 1 [0173.498] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4900, dwBufLen=0x4900 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4900) returned 1 [0173.498] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.498] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4900, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4900, lpOverlapped=0x0) returned 1 [0173.498] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.498] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x49d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.498] SetEndOfFile (hFile=0xdc) returned 1 [0173.501] GetProcessHeap () returned 0x4e0000 [0173.501] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.501] GetProcessHeap () returned 0x4e0000 [0173.501] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.501] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02470u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02470u.bmp.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.503] CloseHandle (hObject=0xdc) returned 1 [0173.503] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7a0bb00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7a0bb00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02503U.BMP", cAlternateFileName="")) returned 1 [0173.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02503u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.505] GetProcessHeap () returned 0x4e0000 [0173.505] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.506] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.506] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.506] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.506] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.506] GetProcessHeap () returned 0x4e0000 [0173.506] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.506] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.506] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.506] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.508] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.508] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.508] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.508] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.508] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.508] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.508] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.508] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.509] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7ce0, lpOverlapped=0x0) returned 1 [0173.510] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7ce0, dwBufLen=0x7ce0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7ce0) returned 1 [0173.510] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.510] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7ce0, lpOverlapped=0x0) returned 1 [0173.510] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.510] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.510] SetEndOfFile (hFile=0xdc) returned 1 [0173.513] GetProcessHeap () returned 0x4e0000 [0173.513] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.514] GetProcessHeap () returned 0x4e0000 [0173.514] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.514] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02503u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02503u.bmp.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.516] CloseHandle (hObject=0xdc) returned 1 [0173.516] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83b1e300, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83b1e300, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0x8499, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02567J.JPG", cAlternateFileName="")) returned 1 [0173.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02567j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.517] GetProcessHeap () returned 0x4e0000 [0173.517] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.517] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.517] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.517] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x7, lpOverlapped=0x0) returned 1 [0173.533] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.533] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.533] GetProcessHeap () returned 0x4e0000 [0173.533] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.533] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.533] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.533] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.533] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.533] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.533] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.533] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.533] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.533] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.533] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.534] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.534] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x8499, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x8499, lpOverlapped=0x0) returned 1 [0173.535] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x84a0, dwBufLen=0x84a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x84a0) returned 1 [0173.535] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.535] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x84a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x84a0, lpOverlapped=0x0) returned 1 [0173.536] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.536] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x8574, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.536] SetEndOfFile (hFile=0xdc) returned 1 [0173.539] GetProcessHeap () returned 0x4e0000 [0173.539] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.539] GetProcessHeap () returned 0x4e0000 [0173.539] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.539] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02567j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02567j.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.541] CloseHandle (hObject=0xdc) returned 1 [0173.541] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd929e00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd929e00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x639b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02736G.GIF", cAlternateFileName="")) returned 1 [0173.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.542] GetProcessHeap () returned 0x4e0000 [0173.542] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.542] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.542] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.542] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x5, lpOverlapped=0x0) returned 1 [0173.544] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.544] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.544] GetProcessHeap () returned 0x4e0000 [0173.545] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.545] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.545] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.545] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.545] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.545] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.545] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.545] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.545] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.545] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.545] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.545] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.545] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x639b, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x639b, lpOverlapped=0x0) returned 1 [0173.547] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x63a0, dwBufLen=0x63a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x63a0) returned 1 [0173.547] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.547] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x63a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x63a0, lpOverlapped=0x0) returned 1 [0173.547] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.547] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.547] SetEndOfFile (hFile=0xdc) returned 1 [0173.550] GetProcessHeap () returned 0x4e0000 [0173.550] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.550] GetProcessHeap () returned 0x4e0000 [0173.550] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.550] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736g.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.552] CloseHandle (hObject=0xdc) returned 1 [0173.552] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x924cca00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x924cca00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7e90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02736U.BMP", cAlternateFileName="")) returned 1 [0173.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.553] GetProcessHeap () returned 0x4e0000 [0173.553] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.553] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.553] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.553] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.553] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.553] GetProcessHeap () returned 0x4e0000 [0173.553] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.553] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.553] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.553] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.555] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.555] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.555] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.555] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.555] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.556] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.556] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.556] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.556] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7e90, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7e90, lpOverlapped=0x0) returned 1 [0173.557] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7e90, dwBufLen=0x7e90 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7e90) returned 1 [0173.557] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.557] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7e90, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7e90, lpOverlapped=0x0) returned 1 [0173.558] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.558] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7f64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.558] SetEndOfFile (hFile=0xdc) returned 1 [0173.560] GetProcessHeap () returned 0x4e0000 [0173.560] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.560] GetProcessHeap () returned 0x4e0000 [0173.561] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.561] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736u.bmp.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.562] CloseHandle (hObject=0xdc) returned 1 [0173.562] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88c36200, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x88c36200, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x8118, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02738U.BMP", cAlternateFileName="")) returned 1 [0173.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02738u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.563] GetProcessHeap () returned 0x4e0000 [0173.563] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.563] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.563] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.563] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.565] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.565] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.565] GetProcessHeap () returned 0x4e0000 [0173.565] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.565] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.565] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.565] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.565] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.566] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.566] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.566] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.566] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.566] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.566] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.566] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.566] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x8118, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x8118, lpOverlapped=0x0) returned 1 [0173.567] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8120, dwBufLen=0x8120 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8120) returned 1 [0173.568] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.568] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x8120, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x8120, lpOverlapped=0x0) returned 1 [0173.568] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.568] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x81f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.568] SetEndOfFile (hFile=0xdc) returned 1 [0173.571] GetProcessHeap () returned 0x4e0000 [0173.571] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.571] GetProcessHeap () returned 0x4e0000 [0173.572] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.572] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02738u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02738u.bmp.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.573] CloseHandle (hObject=0xdc) returned 1 [0173.573] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9ff1700, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9ff1700, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x5f2b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02740G.GIF", cAlternateFileName="")) returned 1 [0173.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.575] GetProcessHeap () returned 0x4e0000 [0173.575] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.575] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.575] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.575] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x5, lpOverlapped=0x0) returned 1 [0173.580] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.580] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.580] GetProcessHeap () returned 0x4e0000 [0173.580] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.580] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.580] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.580] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.580] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.580] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.580] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.581] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.581] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.581] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.581] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.581] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.581] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5f2b, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x5f2b, lpOverlapped=0x0) returned 1 [0173.582] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5f30, dwBufLen=0x5f30 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5f30) returned 1 [0173.583] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.583] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5f30, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5f30, lpOverlapped=0x0) returned 1 [0173.583] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.583] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6004, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.583] SetEndOfFile (hFile=0xdc) returned 1 [0173.586] GetProcessHeap () returned 0x4e0000 [0173.586] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.586] GetProcessHeap () returned 0x4e0000 [0173.586] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.586] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740g.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.588] CloseHandle (hObject=0xdc) returned 1 [0173.589] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x747f6500, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x747f6500, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7f68, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02740U.BMP", cAlternateFileName="")) returned 1 [0173.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.590] GetProcessHeap () returned 0x4e0000 [0173.590] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.590] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.590] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.590] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.592] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.592] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.592] GetProcessHeap () returned 0x4e0000 [0173.592] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.592] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.592] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.592] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.592] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.593] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.593] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.593] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.593] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.593] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.593] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.593] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.593] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7f68, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7f68, lpOverlapped=0x0) returned 1 [0173.594] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7f70, dwBufLen=0x7f70 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7f70) returned 1 [0173.595] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.595] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7f70, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7f70, lpOverlapped=0x0) returned 1 [0173.595] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.595] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x8044, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.595] SetEndOfFile (hFile=0xdc) returned 1 [0173.598] GetProcessHeap () returned 0x4e0000 [0173.598] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.598] GetProcessHeap () returned 0x4e0000 [0173.598] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.598] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740u.bmp.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.600] CloseHandle (hObject=0xdc) returned 1 [0173.600] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf53a6300, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53a6300, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x50a5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02742G.GIF", cAlternateFileName="")) returned 1 [0173.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.601] GetProcessHeap () returned 0x4e0000 [0173.601] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.601] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.601] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.601] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xb, lpOverlapped=0x0) returned 1 [0173.603] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.604] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.604] GetProcessHeap () returned 0x4e0000 [0173.604] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.604] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.604] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.604] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.604] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.604] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.604] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.604] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.604] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.604] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.604] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.604] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.605] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x50a5, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x50a5, lpOverlapped=0x0) returned 1 [0173.606] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x50b0, dwBufLen=0x50b0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x50b0) returned 1 [0173.606] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.606] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x50b0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x50b0, lpOverlapped=0x0) returned 1 [0173.606] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.606] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5184, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.606] SetEndOfFile (hFile=0xdc) returned 1 [0173.609] GetProcessHeap () returned 0x4e0000 [0173.609] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.609] GetProcessHeap () returned 0x4e0000 [0173.609] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.609] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742g.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.611] CloseHandle (hObject=0xdc) returned 1 [0173.611] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d585700, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d585700, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02742U.BMP", cAlternateFileName="")) returned 1 [0173.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.612] GetProcessHeap () returned 0x4e0000 [0173.612] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.612] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.612] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.612] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.612] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.612] GetProcessHeap () returned 0x4e0000 [0173.612] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.612] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.612] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.612] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.615] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.615] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.615] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.615] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.615] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.615] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.615] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.615] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.615] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7ce0, lpOverlapped=0x0) returned 1 [0173.616] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7ce0, dwBufLen=0x7ce0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7ce0) returned 1 [0173.617] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.617] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7ce0, lpOverlapped=0x0) returned 1 [0173.617] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.617] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.617] SetEndOfFile (hFile=0xdc) returned 1 [0173.620] GetProcessHeap () returned 0x4e0000 [0173.620] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.620] GetProcessHeap () returned 0x4e0000 [0173.620] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.620] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742u.bmp.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.622] CloseHandle (hObject=0xdc) returned 1 [0173.622] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1a6dc00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf1a6dc00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x6d86, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02743G.GIF", cAlternateFileName="")) returned 1 [0173.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02743g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.623] GetProcessHeap () returned 0x4e0000 [0173.623] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.623] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.623] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.623] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0173.625] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.625] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.625] GetProcessHeap () returned 0x4e0000 [0173.625] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.625] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.625] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.625] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.625] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.625] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.625] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.625] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.625] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.625] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.626] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.626] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.626] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x6d86, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x6d86, lpOverlapped=0x0) returned 1 [0173.626] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6d90, dwBufLen=0x6d90 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6d90) returned 1 [0173.627] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.627] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6d90, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x6d90, lpOverlapped=0x0) returned 1 [0173.627] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.627] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6e64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.627] SetEndOfFile (hFile=0xdc) returned 1 [0173.631] GetProcessHeap () returned 0x4e0000 [0173.631] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.631] GetProcessHeap () returned 0x4e0000 [0173.631] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.631] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02743g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02743g.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.634] CloseHandle (hObject=0xdc) returned 1 [0173.634] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe489ed00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe489ed00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x5e7b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02746G.GIF", cAlternateFileName="")) returned 1 [0173.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.635] GetProcessHeap () returned 0x4e0000 [0173.635] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.635] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.635] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.635] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x5, lpOverlapped=0x0) returned 1 [0173.646] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.647] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.647] GetProcessHeap () returned 0x4e0000 [0173.647] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.647] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.647] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.647] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.647] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.647] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.647] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.647] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.647] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.647] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.647] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.647] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.647] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5e7b, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x5e7b, lpOverlapped=0x0) returned 1 [0173.648] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5e80, dwBufLen=0x5e80 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5e80) returned 1 [0173.649] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.649] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5e80, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5e80, lpOverlapped=0x0) returned 1 [0173.649] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.649] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5f54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.649] SetEndOfFile (hFile=0xdc) returned 1 [0173.652] GetProcessHeap () returned 0x4e0000 [0173.652] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.652] GetProcessHeap () returned 0x4e0000 [0173.652] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.652] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746g.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.654] CloseHandle (hObject=0xdc) returned 1 [0173.654] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65001c00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65001c00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7d84, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02746U.BMP", cAlternateFileName="")) returned 1 [0173.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.656] GetProcessHeap () returned 0x4e0000 [0173.656] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.656] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.656] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.656] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0173.658] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.658] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.658] GetProcessHeap () returned 0x4e0000 [0173.658] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.658] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.658] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.658] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.658] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.658] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.658] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.658] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.658] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.658] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.658] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.658] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.658] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7d84, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7d84, lpOverlapped=0x0) returned 1 [0173.660] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7d90, dwBufLen=0x7d90 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7d90) returned 1 [0173.660] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.660] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7d90, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7d90, lpOverlapped=0x0) returned 1 [0173.660] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.660] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7e64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.660] SetEndOfFile (hFile=0xdc) returned 1 [0173.663] GetProcessHeap () returned 0x4e0000 [0173.663] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.663] GetProcessHeap () returned 0x4e0000 [0173.663] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.663] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746u.bmp.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.664] CloseHandle (hObject=0xdc) returned 1 [0173.664] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd62df00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd62df00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x6090, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02748G.GIF", cAlternateFileName="")) returned 1 [0173.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.665] GetProcessHeap () returned 0x4e0000 [0173.665] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.665] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.665] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.665] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.665] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.665] GetProcessHeap () returned 0x4e0000 [0173.665] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.665] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.665] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.665] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.688] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.688] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.688] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.689] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.689] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.689] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.689] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.689] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.689] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x6090, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x6090, lpOverlapped=0x0) returned 1 [0173.690] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6090, dwBufLen=0x6090 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6090) returned 1 [0173.690] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.690] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6090, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x6090, lpOverlapped=0x0) returned 1 [0173.691] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.691] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6164, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.691] SetEndOfFile (hFile=0xdc) returned 1 [0173.693] GetProcessHeap () returned 0x4e0000 [0173.693] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.693] GetProcessHeap () returned 0x4e0000 [0173.693] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.693] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748g.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.695] CloseHandle (hObject=0xdc) returned 1 [0173.695] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ca7e100, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5ca7e100, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7e90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02748U.BMP", cAlternateFileName="")) returned 1 [0173.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.696] GetProcessHeap () returned 0x4e0000 [0173.696] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.696] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.697] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.697] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.697] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.697] GetProcessHeap () returned 0x4e0000 [0173.697] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.697] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.697] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.697] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.698] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.698] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.698] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.699] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.699] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.699] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.699] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.699] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.699] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7e90, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7e90, lpOverlapped=0x0) returned 1 [0173.700] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7e90, dwBufLen=0x7e90 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7e90) returned 1 [0173.700] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.700] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7e90, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7e90, lpOverlapped=0x0) returned 1 [0173.700] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.700] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7f64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.700] SetEndOfFile (hFile=0xdc) returned 1 [0173.702] GetProcessHeap () returned 0x4e0000 [0173.702] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.702] GetProcessHeap () returned 0x4e0000 [0173.702] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.702] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748u.bmp.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.704] CloseHandle (hObject=0xdc) returned 1 [0173.704] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3d97700, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd3d97700, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x8795, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02749G.GIF", cAlternateFileName="")) returned 1 [0173.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.705] GetProcessHeap () returned 0x4e0000 [0173.705] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.705] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.705] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.705] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xb, lpOverlapped=0x0) returned 1 [0173.712] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.712] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.712] GetProcessHeap () returned 0x4e0000 [0173.712] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.712] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.712] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.712] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.712] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.712] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.713] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.713] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.713] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.713] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.713] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.713] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.713] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x8795, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x8795, lpOverlapped=0x0) returned 1 [0173.714] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x87a0, dwBufLen=0x87a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x87a0) returned 1 [0173.714] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.714] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x87a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x87a0, lpOverlapped=0x0) returned 1 [0173.714] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.714] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x8874, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.714] SetEndOfFile (hFile=0xdc) returned 1 [0173.717] GetProcessHeap () returned 0x4e0000 [0173.717] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.717] GetProcessHeap () returned 0x4e0000 [0173.717] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.717] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749g.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.718] CloseHandle (hObject=0xdc) returned 1 [0173.718] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46018a00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x46018a00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x8118, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02749U.BMP", cAlternateFileName="")) returned 1 [0173.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.720] GetProcessHeap () returned 0x4e0000 [0173.720] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.720] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.720] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.720] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.722] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.722] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.722] GetProcessHeap () returned 0x4e0000 [0173.722] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.722] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.722] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.722] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.722] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.722] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.722] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.722] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.723] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.723] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.723] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.723] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.723] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x8118, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x8118, lpOverlapped=0x0) returned 1 [0173.723] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8120, dwBufLen=0x8120 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8120) returned 1 [0173.724] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.724] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x8120, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x8120, lpOverlapped=0x0) returned 1 [0173.724] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.724] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x81f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.724] SetEndOfFile (hFile=0xdc) returned 1 [0173.726] GetProcessHeap () returned 0x4e0000 [0173.726] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.726] GetProcessHeap () returned 0x4e0000 [0173.726] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.726] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749u.bmp.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.728] CloseHandle (hObject=0xdc) returned 1 [0173.728] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd045f000, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd045f000, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x64c7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02750G.GIF", cAlternateFileName="")) returned 1 [0173.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.729] GetProcessHeap () returned 0x4e0000 [0173.729] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.729] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.729] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.729] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x9, lpOverlapped=0x0) returned 1 [0173.731] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.731] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.731] GetProcessHeap () returned 0x4e0000 [0173.731] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.731] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.731] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.731] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.731] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.731] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.731] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.731] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.731] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.731] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.731] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.731] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.732] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x64c7, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x64c7, lpOverlapped=0x0) returned 1 [0173.733] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x64d0, dwBufLen=0x64d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x64d0) returned 1 [0173.733] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.733] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x64d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x64d0, lpOverlapped=0x0) returned 1 [0173.733] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.733] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x65a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.733] SetEndOfFile (hFile=0xdc) returned 1 [0173.735] GetProcessHeap () returned 0x4e0000 [0173.735] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.735] GetProcessHeap () returned 0x4e0000 [0173.736] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.736] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750g.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.739] CloseHandle (hObject=0xdc) returned 1 [0173.739] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x105ca100, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x105ca100, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x16f40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02750U.BMP", cAlternateFileName="")) returned 1 [0173.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.751] GetProcessHeap () returned 0x4e0000 [0173.751] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.751] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.751] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.751] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.751] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.751] GetProcessHeap () returned 0x4e0000 [0173.751] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.751] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.751] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.751] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.753] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.753] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.753] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.754] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.754] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.754] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.754] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.754] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.754] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x16f40, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x16f40, lpOverlapped=0x0) returned 1 [0173.755] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x16f40, dwBufLen=0x16f40 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x16f40) returned 1 [0173.756] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.756] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x16f40, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x16f40, lpOverlapped=0x0) returned 1 [0173.756] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.756] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x17014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.756] SetEndOfFile (hFile=0xdc) returned 1 [0173.759] GetProcessHeap () returned 0x4e0000 [0173.759] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.759] GetProcessHeap () returned 0x4e0000 [0173.759] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.759] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750u.bmp.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.761] CloseHandle (hObject=0xdc) returned 1 [0173.761] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca500f00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca500f00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0xc382, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02752G.GIF", cAlternateFileName="")) returned 1 [0173.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.762] GetProcessHeap () returned 0x4e0000 [0173.762] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.762] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.762] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.762] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0173.763] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.763] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.763] GetProcessHeap () returned 0x4e0000 [0173.763] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.764] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.764] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.764] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.764] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.764] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.764] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.764] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.764] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.764] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.764] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.764] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.764] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xc382, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xc382, lpOverlapped=0x0) returned 1 [0173.765] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xc390, dwBufLen=0xc390 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xc390) returned 1 [0173.765] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.766] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc390, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xc390, lpOverlapped=0x0) returned 1 [0173.766] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.766] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xc464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.766] SetEndOfFile (hFile=0xdc) returned 1 [0173.769] GetProcessHeap () returned 0x4e0000 [0173.769] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.769] GetProcessHeap () returned 0x4e0000 [0173.769] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.769] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752g.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.771] CloseHandle (hObject=0xdc) returned 1 [0173.771] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88769700, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x88769700, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0x7c08, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02752U.BMP", cAlternateFileName="")) returned 1 [0173.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.772] GetProcessHeap () returned 0x4e0000 [0173.772] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.772] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.772] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.772] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.775] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.775] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.775] GetProcessHeap () returned 0x4e0000 [0173.775] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.775] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.775] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.775] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.776] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.776] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.776] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.776] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.776] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.776] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.776] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.776] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.776] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7c08, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7c08, lpOverlapped=0x0) returned 1 [0173.777] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7c10, dwBufLen=0x7c10 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7c10) returned 1 [0173.777] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.777] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7c10, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7c10, lpOverlapped=0x0) returned 1 [0173.777] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.778] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7ce4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.778] SetEndOfFile (hFile=0xdc) returned 1 [0173.780] GetProcessHeap () returned 0x4e0000 [0173.780] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.780] GetProcessHeap () returned 0x4e0000 [0173.780] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.780] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752u.bmp.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.781] CloseHandle (hObject=0xdc) returned 1 [0173.781] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xece62600, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xece62600, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x1a6b8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02753U.BMP", cAlternateFileName="")) returned 1 [0173.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02753u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.783] GetProcessHeap () returned 0x4e0000 [0173.783] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.783] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.783] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.783] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.785] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.785] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.785] GetProcessHeap () returned 0x4e0000 [0173.785] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.785] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.785] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.785] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.785] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.785] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.785] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.785] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.785] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.785] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.785] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.785] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.785] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1a6b8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1a6b8, lpOverlapped=0x0) returned 1 [0173.787] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1a6c0, dwBufLen=0x1a6c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1a6c0) returned 1 [0173.788] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.788] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1a6c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1a6c0, lpOverlapped=0x0) returned 1 [0173.788] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.788] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1a794, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.788] SetEndOfFile (hFile=0xdc) returned 1 [0173.791] GetProcessHeap () returned 0x4e0000 [0173.791] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.791] GetProcessHeap () returned 0x4e0000 [0173.791] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.791] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02753u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02753u.bmp.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.792] CloseHandle (hObject=0xdc) returned 1 [0173.793] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe48deb00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe48deb00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x1a7d8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02754U.BMP", cAlternateFileName="")) returned 1 [0173.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02754u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.793] GetProcessHeap () returned 0x4e0000 [0173.793] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.794] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.794] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.794] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.808] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.808] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.808] GetProcessHeap () returned 0x4e0000 [0173.808] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.808] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.808] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.808] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.808] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.808] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.808] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.809] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.809] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.809] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.809] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.809] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.809] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1a7d8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1a7d8, lpOverlapped=0x0) returned 1 [0173.810] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1a7e0, dwBufLen=0x1a7e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1a7e0) returned 1 [0173.811] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.811] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1a7e0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1a7e0, lpOverlapped=0x0) returned 1 [0173.812] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.812] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1a8b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.812] SetEndOfFile (hFile=0xdc) returned 1 [0173.814] GetProcessHeap () returned 0x4e0000 [0173.814] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.814] GetProcessHeap () returned 0x4e0000 [0173.814] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.815] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02754u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02754u.bmp.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.816] CloseHandle (hObject=0xdc) returned 1 [0173.816] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd50ea200, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd50ea200, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x1a7d8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02755U.BMP", cAlternateFileName="")) returned 1 [0173.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02755u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.818] GetProcessHeap () returned 0x4e0000 [0173.818] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.818] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.818] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.818] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.819] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.820] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.820] GetProcessHeap () returned 0x4e0000 [0173.820] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.820] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.820] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.820] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.820] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.820] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.820] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.820] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.820] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.820] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.820] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.820] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.820] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1a7d8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1a7d8, lpOverlapped=0x0) returned 1 [0173.822] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1a7e0, dwBufLen=0x1a7e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1a7e0) returned 1 [0173.823] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.823] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1a7e0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1a7e0, lpOverlapped=0x0) returned 1 [0173.823] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.823] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1a8b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.823] SetEndOfFile (hFile=0xdc) returned 1 [0173.826] GetProcessHeap () returned 0x4e0000 [0173.826] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.826] GetProcessHeap () returned 0x4e0000 [0173.826] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.826] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02755u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02755u.bmp.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.828] CloseHandle (hObject=0xdc) returned 1 [0173.828] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb853a00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcb853a00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x30408, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02756U.BMP", cAlternateFileName="")) returned 1 [0173.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02756u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.830] GetProcessHeap () returned 0x4e0000 [0173.830] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.830] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.830] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.830] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.833] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.833] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.833] GetProcessHeap () returned 0x4e0000 [0173.833] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.833] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.833] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.833] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.833] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.833] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.833] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.833] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.833] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.833] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.833] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.834] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.834] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x30408, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x30408, lpOverlapped=0x0) returned 1 [0173.836] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x30410, dwBufLen=0x30410 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x30410) returned 1 [0173.837] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.838] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x30410, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x30410, lpOverlapped=0x0) returned 1 [0173.838] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.838] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x304e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.838] SetEndOfFile (hFile=0xdc) returned 1 [0173.842] GetProcessHeap () returned 0x4e0000 [0173.842] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.842] GetProcessHeap () returned 0x4e0000 [0173.842] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.842] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02756u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02756u.bmp.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.844] CloseHandle (hObject=0xdc) returned 1 [0173.844] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe684b00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbe684b00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x30408, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02757U.BMP", cAlternateFileName="")) returned 1 [0173.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02757u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.845] GetProcessHeap () returned 0x4e0000 [0173.845] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.845] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.845] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.845] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.867] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.867] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.867] GetProcessHeap () returned 0x4e0000 [0173.868] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.868] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.868] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.868] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.868] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.868] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.868] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.868] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.868] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.868] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.868] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.868] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.868] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x30408, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x30408, lpOverlapped=0x0) returned 1 [0173.870] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x30410, dwBufLen=0x30410 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x30410) returned 1 [0173.872] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.872] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x30410, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x30410, lpOverlapped=0x0) returned 1 [0173.872] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.872] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x304e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.872] SetEndOfFile (hFile=0xdc) returned 1 [0173.876] GetProcessHeap () returned 0x4e0000 [0173.876] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.876] GetProcessHeap () returned 0x4e0000 [0173.876] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.876] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02757u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02757u.bmp.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.877] CloseHandle (hObject=0xdc) returned 1 [0173.877] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7c1f400, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa7c1f400, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x307f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02758U.BMP", cAlternateFileName="")) returned 1 [0173.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02758u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.879] GetProcessHeap () returned 0x4e0000 [0173.879] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.879] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.879] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.879] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.880] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.881] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.881] GetProcessHeap () returned 0x4e0000 [0173.881] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.881] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.881] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.881] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.881] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.881] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.881] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.881] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.881] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.881] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.881] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.881] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.881] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x307f8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x307f8, lpOverlapped=0x0) returned 1 [0173.883] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x30800, dwBufLen=0x30800 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x30800) returned 1 [0173.885] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.885] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x30800, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x30800, lpOverlapped=0x0) returned 1 [0173.886] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.886] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x308d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.886] SetEndOfFile (hFile=0xdc) returned 1 [0173.890] GetProcessHeap () returned 0x4e0000 [0173.891] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.891] GetProcessHeap () returned 0x4e0000 [0173.891] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.891] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02758u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02758u.bmp.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.892] CloseHandle (hObject=0xdc) returned 1 [0173.892] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2322a600, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2322a600, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0xa0d2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02759J.JPG", cAlternateFileName="")) returned 1 [0173.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.893] GetProcessHeap () returned 0x4e0000 [0173.893] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.893] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.893] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.893] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0173.895] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.895] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.895] GetProcessHeap () returned 0x4e0000 [0173.895] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.895] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.895] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.895] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.895] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.895] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.895] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.895] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.895] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.895] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.895] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.895] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.896] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xa0d2, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xa0d2, lpOverlapped=0x0) returned 1 [0173.896] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa0e0, dwBufLen=0xa0e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa0e0) returned 1 [0173.897] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.897] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xa0e0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xa0e0, lpOverlapped=0x0) returned 1 [0173.897] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.897] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xa1b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.897] SetEndOfFile (hFile=0xdc) returned 1 [0173.899] GetProcessHeap () returned 0x4e0000 [0173.899] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.899] GetProcessHeap () returned 0x4e0000 [0173.899] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.899] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.900] CloseHandle (hObject=0xdc) returned 1 [0173.900] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcb03b00, ftCreationTime.dwHighDateTime=0x1bd4e50, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfcb03b00, ftLastWriteTime.dwHighDateTime=0x1bd4e50, nFileSizeHigh=0x0, nFileSizeLow=0xc5d7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02810J.JPG", cAlternateFileName="")) returned 1 [0173.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.901] GetProcessHeap () returned 0x4e0000 [0173.901] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.901] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.901] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.901] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x9, lpOverlapped=0x0) returned 1 [0173.903] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.903] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.903] GetProcessHeap () returned 0x4e0000 [0173.903] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.903] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.903] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.903] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.903] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.903] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.903] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.903] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.903] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.903] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.903] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.903] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.903] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xc5d7, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xc5d7, lpOverlapped=0x0) returned 1 [0173.904] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xc5e0, dwBufLen=0xc5e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xc5e0) returned 1 [0173.905] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.905] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc5e0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xc5e0, lpOverlapped=0x0) returned 1 [0173.905] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.905] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xc6b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.905] SetEndOfFile (hFile=0xdc) returned 1 [0173.907] GetProcessHeap () returned 0x4e0000 [0173.907] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.907] GetProcessHeap () returned 0x4e0000 [0173.907] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.907] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.908] CloseHandle (hObject=0xdc) returned 1 [0173.908] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81187900, ftCreationTime.dwHighDateTime=0x1bd4c19, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81187900, ftLastWriteTime.dwHighDateTime=0x1bd4c19, nFileSizeHigh=0x0, nFileSizeLow=0xf438, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02829J.JPG", cAlternateFileName="")) returned 1 [0173.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.909] GetProcessHeap () returned 0x4e0000 [0173.909] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.909] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.909] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.909] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.911] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.911] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.911] GetProcessHeap () returned 0x4e0000 [0173.911] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.911] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.911] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.911] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.911] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.911] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.911] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.911] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.911] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.911] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.911] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.911] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.911] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xf438, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xf438, lpOverlapped=0x0) returned 1 [0173.912] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xf440, dwBufLen=0xf440 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xf440) returned 1 [0173.913] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.913] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xf440, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xf440, lpOverlapped=0x0) returned 1 [0173.913] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.913] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xf514, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.913] SetEndOfFile (hFile=0xdc) returned 1 [0173.915] GetProcessHeap () returned 0x4e0000 [0173.915] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.915] GetProcessHeap () returned 0x4e0000 [0173.915] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.915] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.916] CloseHandle (hObject=0xdc) returned 1 [0173.916] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66374600, ftCreationTime.dwHighDateTime=0x1bd4e5f, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66374600, ftLastWriteTime.dwHighDateTime=0x1bd4e5f, nFileSizeHigh=0x0, nFileSizeLow=0x30f2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02845G.GIF", cAlternateFileName="")) returned 1 [0173.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02845g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.917] GetProcessHeap () returned 0x4e0000 [0173.917] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.917] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.917] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.917] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0173.919] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.919] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.919] GetProcessHeap () returned 0x4e0000 [0173.919] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.919] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.919] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.919] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.919] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.919] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.919] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.919] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.919] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.920] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.920] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.920] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.920] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x30f2, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x30f2, lpOverlapped=0x0) returned 1 [0173.920] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3100, dwBufLen=0x3100 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3100) returned 1 [0173.920] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.920] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3100, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3100, lpOverlapped=0x0) returned 1 [0173.921] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.921] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x31d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.921] SetEndOfFile (hFile=0xdc) returned 1 [0173.923] GetProcessHeap () returned 0x4e0000 [0173.923] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.923] GetProcessHeap () returned 0x4e0000 [0173.923] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.923] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02845g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02845g.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.924] CloseHandle (hObject=0xdc) returned 1 [0173.924] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3c45, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02897J.JPG", cAlternateFileName="")) returned 1 [0173.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02897j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.925] GetProcessHeap () returned 0x4e0000 [0173.925] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.925] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.925] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.925] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xb, lpOverlapped=0x0) returned 1 [0173.958] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.958] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.958] GetProcessHeap () returned 0x4e0000 [0173.958] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.958] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.958] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.958] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.959] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.959] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.959] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.959] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.959] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.959] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.959] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.959] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.959] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3c45, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3c45, lpOverlapped=0x0) returned 1 [0173.963] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3c50, dwBufLen=0x3c50 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3c50) returned 1 [0173.963] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.963] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3c50, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3c50, lpOverlapped=0x0) returned 1 [0173.963] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.964] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3d24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.964] SetEndOfFile (hFile=0xdc) returned 1 [0173.966] GetProcessHeap () returned 0x4e0000 [0173.966] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.966] GetProcessHeap () returned 0x4e0000 [0173.966] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.966] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02897j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02897j.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.967] CloseHandle (hObject=0xdc) returned 1 [0173.968] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0f66600, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe0f66600, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x3c76, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH03011U.BMP", cAlternateFileName="")) returned 1 [0173.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03011u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.969] GetProcessHeap () returned 0x4e0000 [0173.969] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.969] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.969] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.969] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0173.984] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.984] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.984] GetProcessHeap () returned 0x4e0000 [0173.984] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0173.984] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0173.984] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.984] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0173.984] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0173.985] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0173.985] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0173.985] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0173.985] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0173.985] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0173.985] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0173.985] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.985] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3c76, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3c76, lpOverlapped=0x0) returned 1 [0173.986] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3c80, dwBufLen=0x3c80 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3c80) returned 1 [0173.986] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.986] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3c80, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3c80, lpOverlapped=0x0) returned 1 [0173.986] CryptDestroyKey (hKey=0x522f98) returned 1 [0173.986] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3d54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.986] SetEndOfFile (hFile=0xdc) returned 1 [0173.988] GetProcessHeap () returned 0x4e0000 [0173.988] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0173.988] GetProcessHeap () returned 0x4e0000 [0173.988] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0173.989] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03011u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03011u.bmp.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0173.990] CloseHandle (hObject=0xdc) returned 1 [0173.990] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa55b9c00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa55b9c00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x1016, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH03012U.BMP", cAlternateFileName="")) returned 1 [0173.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03012u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.991] GetProcessHeap () returned 0x4e0000 [0173.991] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0173.991] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0173.992] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0173.992] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0174.028] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0174.028] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0174.028] GetProcessHeap () returned 0x4e0000 [0174.028] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0174.028] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0174.028] CryptDestroyKey (hKey=0x522f98) returned 1 [0174.028] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0174.029] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0174.029] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0174.029] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0174.029] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0174.029] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0174.029] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0174.029] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0174.029] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.029] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1016, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1016, lpOverlapped=0x0) returned 1 [0174.056] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1020, dwBufLen=0x1020 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1020) returned 1 [0174.056] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.056] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1020, lpOverlapped=0x0) returned 1 [0174.057] CryptDestroyKey (hKey=0x522f98) returned 1 [0174.057] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x10f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.057] SetEndOfFile (hFile=0xdc) returned 1 [0174.059] GetProcessHeap () returned 0x4e0000 [0174.059] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0174.059] GetProcessHeap () returned 0x4e0000 [0174.059] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0174.059] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03012u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03012u.bmp.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0174.061] CloseHandle (hObject=0xdc) returned 1 [0174.061] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc44dfa00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc44dfa00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x49d2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH03014_.GIF", cAlternateFileName="")) returned 1 [0174.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03014_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0174.062] GetProcessHeap () returned 0x4e0000 [0174.062] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0174.062] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0174.062] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0174.062] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0174.085] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0174.085] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0174.085] GetProcessHeap () returned 0x4e0000 [0174.085] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0174.085] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0174.085] CryptDestroyKey (hKey=0x522f98) returned 1 [0174.085] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0174.085] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0174.085] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0174.085] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0174.085] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0174.085] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0174.085] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0174.085] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0174.086] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.086] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x49d2, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x49d2, lpOverlapped=0x0) returned 1 [0174.103] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x49e0, dwBufLen=0x49e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x49e0) returned 1 [0174.103] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.103] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x49e0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x49e0, lpOverlapped=0x0) returned 1 [0174.103] CryptDestroyKey (hKey=0x522f98) returned 1 [0174.103] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4ab4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.103] SetEndOfFile (hFile=0xdc) returned 1 [0174.105] GetProcessHeap () returned 0x4e0000 [0174.106] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0174.106] GetProcessHeap () returned 0x4e0000 [0174.106] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0174.106] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03014_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03014_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0174.248] CloseHandle (hObject=0xdc) returned 1 [0174.248] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x78af, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH03041I.JPG", cAlternateFileName="")) returned 1 [0174.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03041i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0174.249] GetProcessHeap () returned 0x4e0000 [0174.249] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0174.249] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0174.249] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0174.249] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x1, lpOverlapped=0x0) returned 1 [0174.287] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0174.287] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0174.287] GetProcessHeap () returned 0x4e0000 [0174.287] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0174.287] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0174.287] CryptDestroyKey (hKey=0x522f98) returned 1 [0174.287] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0174.287] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0174.287] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0174.287] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0174.288] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0174.288] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0174.288] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0174.288] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0174.288] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.288] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x78af, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x78af, lpOverlapped=0x0) returned 1 [0174.290] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x78b0, dwBufLen=0x78b0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x78b0) returned 1 [0174.291] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.291] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x78b0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x78b0, lpOverlapped=0x0) returned 1 [0174.291] CryptDestroyKey (hKey=0x522f98) returned 1 [0174.291] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7984, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.291] SetEndOfFile (hFile=0xdc) returned 1 [0174.293] GetProcessHeap () returned 0x4e0000 [0174.293] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0174.293] GetProcessHeap () returned 0x4e0000 [0174.293] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0174.293] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03041i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03041i.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0174.295] CloseHandle (hObject=0xdc) returned 1 [0174.295] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7450, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH03143I.JPG", cAlternateFileName="")) returned 1 [0174.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03143i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0174.296] GetProcessHeap () returned 0x4e0000 [0174.297] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0174.297] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0174.297] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0174.297] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0174.297] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0174.297] GetProcessHeap () returned 0x4e0000 [0174.297] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0174.297] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0174.297] CryptDestroyKey (hKey=0x522f98) returned 1 [0174.297] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0174.299] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0174.299] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0174.299] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0174.299] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0174.299] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0174.299] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0174.299] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0174.299] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.300] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7450, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7450, lpOverlapped=0x0) returned 1 [0174.325] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7450, dwBufLen=0x7450 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7450) returned 1 [0174.325] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.326] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7450, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7450, lpOverlapped=0x0) returned 1 [0174.326] CryptDestroyKey (hKey=0x522f98) returned 1 [0174.326] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7524, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.326] SetEndOfFile (hFile=0xdc) returned 1 [0174.328] GetProcessHeap () returned 0x4e0000 [0174.328] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0174.328] GetProcessHeap () returned 0x4e0000 [0174.328] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0174.328] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03143i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03143i.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0174.330] CloseHandle (hObject=0xdc) returned 1 [0174.330] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa343, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH03205I.JPG", cAlternateFileName="")) returned 1 [0174.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03205i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0174.332] GetProcessHeap () returned 0x4e0000 [0174.332] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0174.332] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0174.332] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0174.332] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xd, lpOverlapped=0x0) returned 1 [0174.335] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0174.335] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0174.335] GetProcessHeap () returned 0x4e0000 [0174.335] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0174.335] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0174.335] CryptDestroyKey (hKey=0x522f98) returned 1 [0174.335] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0174.335] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0174.335] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0174.335] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0174.335] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0174.335] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0174.335] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0174.335] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0174.335] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.335] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xa343, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xa343, lpOverlapped=0x0) returned 1 [0174.343] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa350, dwBufLen=0xa350 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa350) returned 1 [0174.343] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.343] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xa350, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xa350, lpOverlapped=0x0) returned 1 [0174.343] CryptDestroyKey (hKey=0x522f98) returned 1 [0174.343] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xa424, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.344] SetEndOfFile (hFile=0xdc) returned 1 [0174.346] GetProcessHeap () returned 0x4e0000 [0174.346] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0174.346] GetProcessHeap () returned 0x4e0000 [0174.346] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0174.346] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03205i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03205i.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0174.348] CloseHandle (hObject=0xdc) returned 1 [0174.348] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a44b570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa445, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH03224I.JPG", cAlternateFileName="")) returned 1 [0174.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0174.349] GetProcessHeap () returned 0x4e0000 [0174.349] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0174.349] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0174.349] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0174.349] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xb, lpOverlapped=0x0) returned 1 [0174.350] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0174.351] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0174.351] GetProcessHeap () returned 0x4e0000 [0174.351] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0174.351] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0174.351] CryptDestroyKey (hKey=0x522f98) returned 1 [0174.351] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0174.351] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0174.351] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0174.351] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0174.351] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0174.351] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0174.351] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0174.351] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0174.351] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.351] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xa445, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xa445, lpOverlapped=0x0) returned 1 [0174.352] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa450, dwBufLen=0xa450 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa450) returned 1 [0174.353] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.353] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xa450, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xa450, lpOverlapped=0x0) returned 1 [0174.353] CryptDestroyKey (hKey=0x522f98) returned 1 [0174.353] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xa524, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.353] SetEndOfFile (hFile=0xdc) returned 1 [0174.355] GetProcessHeap () returned 0x4e0000 [0174.355] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0174.355] GetProcessHeap () returned 0x4e0000 [0174.355] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0174.355] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0174.356] CloseHandle (hObject=0xdc) returned 1 [0174.356] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a44b570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2ba2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH03379I.JPG", cAlternateFileName="")) returned 1 [0174.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0174.358] GetProcessHeap () returned 0x4e0000 [0174.358] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0174.358] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0174.358] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0174.358] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0174.363] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0174.363] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0174.363] GetProcessHeap () returned 0x4e0000 [0174.363] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0174.363] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0174.363] CryptDestroyKey (hKey=0x522f98) returned 1 [0174.363] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0174.363] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0174.363] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0174.363] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0174.363] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0174.363] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0174.364] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0174.364] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0174.364] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.364] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2ba2, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2ba2, lpOverlapped=0x0) returned 1 [0174.365] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2bb0, dwBufLen=0x2bb0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2bb0) returned 1 [0174.365] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.365] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2bb0, lpOverlapped=0x0) returned 1 [0174.365] CryptDestroyKey (hKey=0x522f98) returned 1 [0174.365] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2c84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.365] SetEndOfFile (hFile=0xdc) returned 1 [0174.367] GetProcessHeap () returned 0x4e0000 [0174.367] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0174.367] GetProcessHeap () returned 0x4e0000 [0174.367] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0174.367] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0174.368] CloseHandle (hObject=0xdc) returned 1 [0174.368] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cee1d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x321f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH03380I.JPG", cAlternateFileName="")) returned 1 [0174.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0174.369] GetProcessHeap () returned 0x4e0000 [0174.369] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0174.369] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0174.369] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0174.369] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x1, lpOverlapped=0x0) returned 1 [0174.371] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0174.371] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0174.371] GetProcessHeap () returned 0x4e0000 [0174.371] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0174.371] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0174.371] CryptDestroyKey (hKey=0x522f98) returned 1 [0174.371] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0174.371] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0174.371] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0174.371] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0174.371] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0174.371] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0174.371] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0174.371] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0174.371] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.371] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x321f, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x321f, lpOverlapped=0x0) returned 1 [0174.372] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3220, dwBufLen=0x3220 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3220) returned 1 [0174.372] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.372] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3220, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3220, lpOverlapped=0x0) returned 1 [0174.372] CryptDestroyKey (hKey=0x522f98) returned 1 [0174.372] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x32f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.372] SetEndOfFile (hFile=0xdc) returned 1 [0174.374] GetProcessHeap () returned 0x4e0000 [0174.374] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0174.375] GetProcessHeap () returned 0x4e0000 [0174.375] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0174.375] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0174.376] CloseHandle (hObject=0xdc) returned 1 [0174.376] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a44b570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbdae, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH03425I.JPG", cAlternateFileName="")) returned 1 [0174.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0174.377] GetProcessHeap () returned 0x4e0000 [0174.377] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0174.377] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0174.377] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0174.377] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0174.378] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0174.378] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0174.378] GetProcessHeap () returned 0x4e0000 [0174.378] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0174.378] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0174.378] CryptDestroyKey (hKey=0x522f98) returned 1 [0174.379] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0174.379] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0174.379] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0174.379] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0174.379] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0174.379] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0174.379] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0174.379] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0174.379] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.379] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xbdae, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xbdae, lpOverlapped=0x0) returned 1 [0174.380] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xbdb0, dwBufLen=0xbdb0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xbdb0) returned 1 [0174.380] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.380] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xbdb0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xbdb0, lpOverlapped=0x0) returned 1 [0174.380] CryptDestroyKey (hKey=0x522f98) returned 1 [0174.380] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xbe84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.381] SetEndOfFile (hFile=0xdc) returned 1 [0174.383] GetProcessHeap () returned 0x4e0000 [0174.383] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0174.383] GetProcessHeap () returned 0x4e0000 [0174.383] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0174.383] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0174.384] CloseHandle (hObject=0xdc) returned 1 [0174.384] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6849b000, ftCreationTime.dwHighDateTime=0x1bd0318, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6849b000, ftLastWriteTime.dwHighDateTime=0x1bd0318, nFileSizeHigh=0x0, nFileSizeLow=0xef6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PRRT.WMF", cAlternateFileName="")) returned 1 [0174.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrt.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0174.385] GetProcessHeap () returned 0x4e0000 [0174.385] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0174.385] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0174.385] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0174.385] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0174.395] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0174.395] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0174.395] GetProcessHeap () returned 0x4e0000 [0174.395] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0174.395] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0174.395] CryptDestroyKey (hKey=0x522f98) returned 1 [0174.395] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0174.396] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0174.396] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0174.396] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0174.396] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0174.396] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0174.396] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0174.396] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0174.396] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.396] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xef6, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xef6, lpOverlapped=0x0) returned 1 [0174.396] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xf00, dwBufLen=0xf00 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xf00) returned 1 [0174.396] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.396] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xf00, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xf00, lpOverlapped=0x0) returned 1 [0174.396] CryptDestroyKey (hKey=0x522f98) returned 1 [0174.396] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xfc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.396] SetEndOfFile (hFile=0xdc) returned 1 [0174.399] GetProcessHeap () returned 0x4e0000 [0174.399] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0174.399] GetProcessHeap () returned 0x4e0000 [0174.399] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0174.399] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrt.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrt.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0174.400] CloseHandle (hObject=0xdc) returned 1 [0174.400] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ce30000, ftCreationTime.dwHighDateTime=0x1bd78be, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ce30000, ftLastWriteTime.dwHighDateTime=0x1bd78be, nFileSizeHigh=0x0, nFileSizeLow=0x7aac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PRRTINST.WMF", cAlternateFileName="")) returned 1 [0174.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrtinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0174.401] GetProcessHeap () returned 0x4e0000 [0174.401] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0174.401] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0174.401] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0174.402] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0174.403] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0174.403] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0174.403] GetProcessHeap () returned 0x4e0000 [0174.403] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0174.403] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0174.403] CryptDestroyKey (hKey=0x522f98) returned 1 [0174.404] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0174.404] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0174.404] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0174.404] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0174.404] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0174.404] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0174.404] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0174.404] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0174.404] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.404] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7aac, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7aac, lpOverlapped=0x0) returned 1 [0174.406] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7ab0, dwBufLen=0x7ab0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7ab0) returned 1 [0174.406] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.406] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7ab0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7ab0, lpOverlapped=0x0) returned 1 [0174.406] CryptDestroyKey (hKey=0x522f98) returned 1 [0174.406] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7b84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.406] SetEndOfFile (hFile=0xdc) returned 1 [0174.409] GetProcessHeap () returned 0x4e0000 [0174.409] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0174.409] GetProcessHeap () returned 0x4e0000 [0174.409] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0174.409] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrtinst.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrtinst.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0174.411] CloseHandle (hObject=0xdc) returned 1 [0174.411] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3d6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PSRETRO.WMF", cAlternateFileName="")) returned 1 [0174.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\psretro.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0174.413] GetProcessHeap () returned 0x4e0000 [0174.413] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0174.413] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0174.413] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0174.413] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0174.415] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0174.415] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0174.415] GetProcessHeap () returned 0x4e0000 [0174.415] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0174.415] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0174.415] CryptDestroyKey (hKey=0x522f98) returned 1 [0174.415] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0174.415] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0174.415] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0174.415] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0174.415] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0174.415] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0174.416] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0174.416] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0174.416] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.416] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3d6, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3d6, lpOverlapped=0x0) returned 1 [0174.416] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3e0, dwBufLen=0x3e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3e0) returned 1 [0174.416] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.416] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3e0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3e0, lpOverlapped=0x0) returned 1 [0174.416] CryptDestroyKey (hKey=0x522f98) returned 1 [0174.416] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.416] SetEndOfFile (hFile=0xdc) returned 1 [0174.419] GetProcessHeap () returned 0x4e0000 [0174.419] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0174.419] GetProcessHeap () returned 0x4e0000 [0174.419] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0174.419] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\psretro.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\psretro.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0174.420] CloseHandle (hObject=0xdc) returned 1 [0174.420] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe0a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PSSKETLG.WMF", cAlternateFileName="")) returned 1 [0174.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketlg.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0174.422] GetProcessHeap () returned 0x4e0000 [0174.422] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0174.422] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0174.422] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0174.422] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0174.432] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0174.432] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0174.432] GetProcessHeap () returned 0x4e0000 [0174.432] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0174.432] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0174.432] CryptDestroyKey (hKey=0x522f98) returned 1 [0174.432] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0174.432] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0174.432] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0174.432] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0174.432] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0174.432] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0174.432] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0174.433] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0174.433] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.433] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xe0a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xe0a, lpOverlapped=0x0) returned 1 [0174.433] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe10, dwBufLen=0xe10 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe10) returned 1 [0174.433] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.433] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xe10, lpOverlapped=0x0) returned 1 [0174.433] CryptDestroyKey (hKey=0x522f98) returned 1 [0174.433] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xee4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.433] SetEndOfFile (hFile=0xdc) returned 1 [0174.435] GetProcessHeap () returned 0x4e0000 [0174.435] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0174.435] GetProcessHeap () returned 0x4e0000 [0174.435] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0174.435] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketlg.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketlg.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0174.436] CloseHandle (hObject=0xdc) returned 1 [0174.436] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a7450f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x776, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PSSKETSM.WMF", cAlternateFileName="")) returned 1 [0174.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketsm.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0174.439] GetProcessHeap () returned 0x4e0000 [0174.439] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0174.439] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0174.439] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0174.439] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0174.441] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0174.441] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0174.441] GetProcessHeap () returned 0x4e0000 [0174.441] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0174.441] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0174.441] CryptDestroyKey (hKey=0x522f98) returned 1 [0174.441] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0174.441] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0174.441] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0174.441] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0174.441] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0174.441] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0174.442] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0174.442] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0174.442] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.442] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x776, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x776, lpOverlapped=0x0) returned 1 [0174.442] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x780, dwBufLen=0x780 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x780) returned 1 [0174.442] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.442] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x780, lpOverlapped=0x0) returned 1 [0174.442] CryptDestroyKey (hKey=0x522f98) returned 1 [0174.442] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x854, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.442] SetEndOfFile (hFile=0xdc) returned 1 [0174.444] GetProcessHeap () returned 0x4e0000 [0174.444] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0174.444] GetProcessHeap () returned 0x4e0000 [0174.444] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0174.444] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketsm.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketsm.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0174.445] CloseHandle (hObject=0xdc) returned 1 [0174.445] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d0aad90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb12, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PSWAVY.WMF", cAlternateFileName="")) returned 1 [0174.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pswavy.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0174.446] GetProcessHeap () returned 0x4e0000 [0174.446] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0174.446] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0174.446] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0174.446] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0174.622] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0174.622] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0174.622] GetProcessHeap () returned 0x4e0000 [0174.622] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0174.623] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0174.623] CryptDestroyKey (hKey=0x522f98) returned 1 [0174.623] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0174.623] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0174.623] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0174.623] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0174.623] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0174.623] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0174.623] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0174.623] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0174.623] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.623] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb12, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xb12, lpOverlapped=0x0) returned 1 [0174.623] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xb20, dwBufLen=0xb20 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xb20) returned 1 [0174.624] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.624] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xb20, lpOverlapped=0x0) returned 1 [0174.624] CryptDestroyKey (hKey=0x522f98) returned 1 [0174.624] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xbe4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.624] SetEndOfFile (hFile=0xdc) returned 1 [0174.627] GetProcessHeap () returned 0x4e0000 [0174.627] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0174.627] GetProcessHeap () returned 0x4e0000 [0174.627] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0174.627] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pswavy.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pswavy.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0174.629] CloseHandle (hObject=0xdc) returned 1 [0174.629] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a829930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6ec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RE00006_.WMF", cAlternateFileName="")) returned 1 [0174.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\re00006_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0174.631] GetProcessHeap () returned 0x4e0000 [0174.631] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0174.631] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0174.631] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0174.631] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0174.633] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0174.633] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0174.633] GetProcessHeap () returned 0x4e0000 [0174.633] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0174.633] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0174.633] CryptDestroyKey (hKey=0x522f98) returned 1 [0174.633] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0174.633] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0174.634] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0174.634] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0174.634] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0174.634] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0174.634] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0174.634] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0174.634] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.634] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x6ec, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x6ec, lpOverlapped=0x0) returned 1 [0174.634] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6f0, dwBufLen=0x6f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6f0) returned 1 [0174.634] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.634] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6f0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x6f0, lpOverlapped=0x0) returned 1 [0174.634] CryptDestroyKey (hKey=0x522f98) returned 1 [0174.634] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.635] SetEndOfFile (hFile=0xdc) returned 1 [0174.637] GetProcessHeap () returned 0x4e0000 [0174.637] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0174.637] GetProcessHeap () returned 0x4e0000 [0174.637] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0174.637] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\re00006_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\re00006_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0174.639] CloseHandle (hObject=0xdc) returned 1 [0174.639] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6849b000, ftCreationTime.dwHighDateTime=0x1bd0318, ftLastAccessTime.dwLowDateTime=0x5a84fa90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6849b000, ftLastWriteTime.dwHighDateTime=0x1bd0318, nFileSizeHigh=0x0, nFileSizeLow=0xd16, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RECYCLE.WMF", cAlternateFileName="")) returned 1 [0174.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\recycle.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0174.640] GetProcessHeap () returned 0x4e0000 [0174.640] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0174.640] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0174.640] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0174.640] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0174.643] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0174.643] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0174.643] GetProcessHeap () returned 0x4e0000 [0174.643] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0174.643] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0174.643] CryptDestroyKey (hKey=0x522f98) returned 1 [0174.643] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0174.643] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0174.643] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0174.643] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0174.643] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0174.644] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0174.644] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0174.644] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0174.644] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.644] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xd16, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xd16, lpOverlapped=0x0) returned 1 [0174.644] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xd20, dwBufLen=0xd20 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xd20) returned 1 [0174.644] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.644] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xd20, lpOverlapped=0x0) returned 1 [0174.644] CryptDestroyKey (hKey=0x522f98) returned 1 [0174.644] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xdf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.644] SetEndOfFile (hFile=0xdc) returned 1 [0174.647] GetProcessHeap () returned 0x4e0000 [0174.647] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0174.647] GetProcessHeap () returned 0x4e0000 [0174.647] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0174.647] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\recycle.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\recycle.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0174.648] CloseHandle (hObject=0xdc) returned 1 [0174.648] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x175f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ROAD_01.MID", cAlternateFileName="")) returned 1 [0174.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0174.650] GetProcessHeap () returned 0x4e0000 [0174.650] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0174.650] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0174.650] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0174.650] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x1, lpOverlapped=0x0) returned 1 [0174.719] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0174.719] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0174.719] GetProcessHeap () returned 0x4e0000 [0174.719] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0174.719] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0174.719] CryptDestroyKey (hKey=0x522f98) returned 1 [0174.719] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0174.719] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0174.719] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0174.719] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0174.719] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0174.720] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0174.720] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0174.720] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0174.720] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.720] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x175f, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x175f, lpOverlapped=0x0) returned 1 [0174.721] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1760, dwBufLen=0x1760 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1760) returned 1 [0174.721] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.721] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1760, lpOverlapped=0x0) returned 1 [0174.721] CryptDestroyKey (hKey=0x522f98) returned 1 [0174.721] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.721] SetEndOfFile (hFile=0xdc) returned 1 [0174.724] GetProcessHeap () returned 0x4e0000 [0174.724] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0174.724] GetProcessHeap () returned 0x4e0000 [0174.724] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0174.724] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0174.726] CloseHandle (hObject=0xdc) returned 1 [0174.726] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x278a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SAFRI_01.MID", cAlternateFileName="")) returned 1 [0174.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0174.728] GetProcessHeap () returned 0x4e0000 [0174.728] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0174.728] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0174.728] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0174.728] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0174.730] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0174.730] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0174.730] GetProcessHeap () returned 0x4e0000 [0174.730] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0174.730] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0174.730] CryptDestroyKey (hKey=0x522f98) returned 1 [0174.730] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0174.731] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0174.731] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0174.731] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0174.731] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0174.731] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0174.731] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0174.731] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0174.731] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.731] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x278a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x278a, lpOverlapped=0x0) returned 1 [0174.732] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2790, dwBufLen=0x2790 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2790) returned 1 [0174.732] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.732] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2790, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2790, lpOverlapped=0x0) returned 1 [0174.732] CryptDestroyKey (hKey=0x522f98) returned 1 [0174.732] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2864, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.733] SetEndOfFile (hFile=0xdc) returned 1 [0174.735] GetProcessHeap () returned 0x4e0000 [0174.735] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0174.735] GetProcessHeap () returned 0x4e0000 [0174.735] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0174.735] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0174.737] CloseHandle (hObject=0xdc) returned 1 [0174.737] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5a9342d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x13c2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SCHOL_02.MID", cAlternateFileName="")) returned 1 [0174.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0174.754] GetProcessHeap () returned 0x4e0000 [0174.754] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0174.755] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0174.755] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0174.755] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0174.757] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0174.757] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0174.757] GetProcessHeap () returned 0x4e0000 [0174.757] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0174.757] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0174.757] CryptDestroyKey (hKey=0x522f98) returned 1 [0174.757] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0174.757] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0174.757] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0174.757] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0174.757] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0174.758] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0174.758] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0174.758] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0174.758] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.758] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x13c2, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x13c2, lpOverlapped=0x0) returned 1 [0174.759] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x13d0, dwBufLen=0x13d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x13d0) returned 1 [0174.759] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.759] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x13d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x13d0, lpOverlapped=0x0) returned 1 [0174.759] CryptDestroyKey (hKey=0x522f98) returned 1 [0174.759] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x14a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.759] SetEndOfFile (hFile=0xdc) returned 1 [0174.762] GetProcessHeap () returned 0x4e0000 [0174.762] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0174.762] GetProcessHeap () returned 0x4e0000 [0174.762] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0174.762] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0174.764] CloseHandle (hObject=0xdc) returned 1 [0174.764] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x18f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SHOW_01.MID", cAlternateFileName="")) returned 1 [0174.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0174.765] GetProcessHeap () returned 0x4e0000 [0174.765] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0174.766] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0174.766] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0174.766] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0174.768] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0174.768] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0174.768] GetProcessHeap () returned 0x4e0000 [0174.768] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0174.768] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0174.768] CryptDestroyKey (hKey=0x522f98) returned 1 [0174.768] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0174.768] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0174.769] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0174.769] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0174.769] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0174.769] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0174.769] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0174.769] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0174.769] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.769] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x18f8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x18f8, lpOverlapped=0x0) returned 1 [0174.770] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1900, dwBufLen=0x1900 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1900) returned 1 [0174.770] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.770] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1900, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1900, lpOverlapped=0x0) returned 1 [0174.771] CryptDestroyKey (hKey=0x522f98) returned 1 [0174.771] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x19d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.771] SetEndOfFile (hFile=0xdc) returned 1 [0174.773] GetProcessHeap () returned 0x4e0000 [0174.773] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0174.773] GetProcessHeap () returned 0x4e0000 [0174.773] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0174.773] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0174.775] CloseHandle (hObject=0xdc) returned 1 [0174.775] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7d79200, ftCreationTime.dwHighDateTime=0x1bd4ae9, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa7d79200, ftLastWriteTime.dwHighDateTime=0x1bd4ae9, nFileSizeHigh=0x0, nFileSizeLow=0x2a0a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SL00256_.WMF", cAlternateFileName="")) returned 1 [0174.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00256_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0174.776] GetProcessHeap () returned 0x4e0000 [0174.776] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0174.776] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0174.776] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0174.776] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0174.778] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0174.778] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0174.779] GetProcessHeap () returned 0x4e0000 [0174.779] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0174.779] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0174.779] CryptDestroyKey (hKey=0x522f98) returned 1 [0174.779] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0174.779] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0174.779] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0174.779] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0174.779] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0174.779] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0174.779] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0174.779] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0174.779] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.779] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2a0a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2a0a, lpOverlapped=0x0) returned 1 [0174.780] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2a10, dwBufLen=0x2a10 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2a10) returned 1 [0174.781] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.781] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2a10, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2a10, lpOverlapped=0x0) returned 1 [0174.781] CryptDestroyKey (hKey=0x522f98) returned 1 [0174.781] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2ae4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.781] SetEndOfFile (hFile=0xdc) returned 1 [0174.784] GetProcessHeap () returned 0x4e0000 [0174.784] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0174.784] GetProcessHeap () returned 0x4e0000 [0174.784] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0174.784] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00256_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00256_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0174.785] CloseHandle (hObject=0xdc) returned 1 [0174.785] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4440b00, ftCreationTime.dwHighDateTime=0x1bd4ae9, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4440b00, ftLastWriteTime.dwHighDateTime=0x1bd4ae9, nFileSizeHigh=0x0, nFileSizeLow=0x7ca4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SL00260_.WMF", cAlternateFileName="")) returned 1 [0174.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00260_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0174.786] GetProcessHeap () returned 0x4e0000 [0174.787] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0174.787] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0174.787] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0174.787] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0174.789] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0174.789] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0174.789] GetProcessHeap () returned 0x4e0000 [0174.789] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0174.789] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0174.789] CryptDestroyKey (hKey=0x522f98) returned 1 [0174.789] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0174.789] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0174.789] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0174.789] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0174.789] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0174.789] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0174.790] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0174.790] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0174.790] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.790] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7ca4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7ca4, lpOverlapped=0x0) returned 1 [0174.791] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7cb0, dwBufLen=0x7cb0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7cb0) returned 1 [0174.791] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.791] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7cb0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7cb0, lpOverlapped=0x0) returned 1 [0174.792] CryptDestroyKey (hKey=0x522f98) returned 1 [0174.792] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7d84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.792] SetEndOfFile (hFile=0xdc) returned 1 [0174.796] GetProcessHeap () returned 0x4e0000 [0174.796] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0174.796] GetProcessHeap () returned 0x4e0000 [0174.796] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0174.796] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00260_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00260_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0174.798] CloseHandle (hObject=0xdc) returned 1 [0174.798] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33e6bb00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33e6bb00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0xf5c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SL00268_.WMF", cAlternateFileName="")) returned 1 [0174.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00268_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0174.800] GetProcessHeap () returned 0x4e0000 [0174.800] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0174.801] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0174.801] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0174.801] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0174.803] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0174.803] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0174.803] GetProcessHeap () returned 0x4e0000 [0174.803] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0174.803] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0174.803] CryptDestroyKey (hKey=0x522f98) returned 1 [0174.803] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0174.803] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0174.803] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0174.804] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0174.804] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0174.804] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0174.804] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0174.804] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0174.804] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.804] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xf5c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xf5c, lpOverlapped=0x0) returned 1 [0174.804] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xf60, dwBufLen=0xf60 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xf60) returned 1 [0174.804] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.804] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xf60, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xf60, lpOverlapped=0x0) returned 1 [0174.804] CryptDestroyKey (hKey=0x522f98) returned 1 [0174.804] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.805] SetEndOfFile (hFile=0xdc) returned 1 [0174.808] GetProcessHeap () returned 0x4e0000 [0174.808] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0174.808] GetProcessHeap () returned 0x4e0000 [0174.808] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0174.809] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00268_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00268_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0174.810] CloseHandle (hObject=0xdc) returned 1 [0174.810] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7c59500, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7c59500, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x1dac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SL00286_.WMF", cAlternateFileName="")) returned 1 [0174.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00286_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0174.813] GetProcessHeap () returned 0x4e0000 [0174.813] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0174.813] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0174.813] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0174.813] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0174.818] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0174.818] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0174.818] GetProcessHeap () returned 0x4e0000 [0174.818] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0174.818] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0174.818] CryptDestroyKey (hKey=0x522f98) returned 1 [0174.818] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0174.818] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0174.819] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0174.819] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0174.819] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0174.819] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0174.819] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0174.819] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0174.819] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.819] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1dac, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1dac, lpOverlapped=0x0) returned 1 [0174.821] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1db0, dwBufLen=0x1db0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1db0) returned 1 [0174.821] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.821] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1db0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1db0, lpOverlapped=0x0) returned 1 [0174.821] CryptDestroyKey (hKey=0x522f98) returned 1 [0174.821] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1e84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.821] SetEndOfFile (hFile=0xdc) returned 1 [0174.824] GetProcessHeap () returned 0x4e0000 [0174.824] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0174.824] GetProcessHeap () returned 0x4e0000 [0174.824] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0174.824] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00286_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00286_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0174.826] CloseHandle (hObject=0xdc) returned 1 [0174.826] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38ab6f00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x38ab6f00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x1268, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SL00298_.WMF", cAlternateFileName="")) returned 1 [0174.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00298_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0174.828] GetProcessHeap () returned 0x4e0000 [0174.828] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0174.828] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0174.828] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0174.828] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0174.916] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0174.916] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0174.916] GetProcessHeap () returned 0x4e0000 [0174.916] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0174.916] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0174.916] CryptDestroyKey (hKey=0x522f98) returned 1 [0174.916] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0174.916] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0174.916] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0174.917] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0174.917] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0174.917] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0174.917] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0174.917] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0174.917] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.917] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1268, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1268, lpOverlapped=0x0) returned 1 [0174.918] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1270, dwBufLen=0x1270 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1270) returned 1 [0174.918] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.918] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1270, lpOverlapped=0x0) returned 1 [0174.918] CryptDestroyKey (hKey=0x522f98) returned 1 [0174.918] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1344, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.918] SetEndOfFile (hFile=0xdc) returned 1 [0174.920] GetProcessHeap () returned 0x4e0000 [0174.920] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0174.920] GetProcessHeap () returned 0x4e0000 [0174.920] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0174.920] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00298_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00298_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0174.922] CloseHandle (hObject=0xdc) returned 1 [0174.922] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe89bcf00, ftCreationTime.dwHighDateTime=0x1bd4b1a, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe89bcf00, ftLastWriteTime.dwHighDateTime=0x1bd4b1a, nFileSizeHigh=0x0, nFileSizeLow=0x20e0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SL00308_.WMF", cAlternateFileName="")) returned 1 [0174.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00308_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0174.923] GetProcessHeap () returned 0x4e0000 [0174.923] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0174.923] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0174.923] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0174.923] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0174.923] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0174.923] GetProcessHeap () returned 0x4e0000 [0174.923] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0174.923] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0174.923] CryptDestroyKey (hKey=0x522f98) returned 1 [0174.923] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0174.925] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0174.925] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0174.925] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0174.925] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0174.925] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0174.925] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0174.925] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0174.925] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.925] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x20e0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x20e0, lpOverlapped=0x0) returned 1 [0174.926] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x20e0, dwBufLen=0x20e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x20e0) returned 1 [0174.926] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.926] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x20e0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x20e0, lpOverlapped=0x0) returned 1 [0174.926] CryptDestroyKey (hKey=0x522f98) returned 1 [0174.926] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x21b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.926] SetEndOfFile (hFile=0xdc) returned 1 [0174.928] GetProcessHeap () returned 0x4e0000 [0174.928] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0174.928] GetProcessHeap () returned 0x4e0000 [0174.929] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0174.929] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00308_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00308_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0174.930] CloseHandle (hObject=0xdc) returned 1 [0174.930] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81165d00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81165d00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xae4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SL00345_.WMF", cAlternateFileName="")) returned 1 [0174.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00345_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0174.931] GetProcessHeap () returned 0x4e0000 [0174.931] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0174.931] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0174.931] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0174.931] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0174.933] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0174.933] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0174.933] GetProcessHeap () returned 0x4e0000 [0174.933] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0174.933] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0174.933] CryptDestroyKey (hKey=0x522f98) returned 1 [0174.933] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0174.933] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0174.933] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0174.933] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0174.933] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0174.933] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0174.933] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0174.933] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0174.933] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.933] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xae4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xae4, lpOverlapped=0x0) returned 1 [0174.934] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xaf0, dwBufLen=0xaf0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xaf0) returned 1 [0174.934] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.934] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xaf0, lpOverlapped=0x0) returned 1 [0174.934] CryptDestroyKey (hKey=0x522f98) returned 1 [0174.934] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xbc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.934] SetEndOfFile (hFile=0xdc) returned 1 [0174.936] GetProcessHeap () returned 0x4e0000 [0174.936] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0174.936] GetProcessHeap () returned 0x4e0000 [0174.936] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0174.936] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00345_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00345_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0174.937] CloseHandle (hObject=0xdc) returned 1 [0174.937] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5aabee00, ftCreationTime.dwHighDateTime=0x1bd4af2, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5aabee00, ftLastWriteTime.dwHighDateTime=0x1bd4af2, nFileSizeHigh=0x0, nFileSizeLow=0x540, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SL00452_.WMF", cAlternateFileName="")) returned 1 [0174.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00452_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0174.938] GetProcessHeap () returned 0x4e0000 [0174.938] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0174.938] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0174.938] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0174.938] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0174.938] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0174.938] GetProcessHeap () returned 0x4e0000 [0174.938] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0174.938] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0174.938] CryptDestroyKey (hKey=0x522f98) returned 1 [0174.939] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0174.940] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0174.940] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0174.940] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0174.940] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0174.940] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0174.941] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0174.941] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0174.941] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.941] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x540, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x540, lpOverlapped=0x0) returned 1 [0174.941] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x540, dwBufLen=0x540 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x540) returned 1 [0174.941] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.941] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x540, lpOverlapped=0x0) returned 1 [0174.941] CryptDestroyKey (hKey=0x522f98) returned 1 [0174.941] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.941] SetEndOfFile (hFile=0xdc) returned 1 [0174.943] GetProcessHeap () returned 0x4e0000 [0174.943] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0174.943] GetProcessHeap () returned 0x4e0000 [0174.943] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0174.943] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00452_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00452_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0174.944] CloseHandle (hObject=0xdc) returned 1 [0174.944] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ff15900, ftCreationTime.dwHighDateTime=0x1bd4af2, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4ff15900, ftLastWriteTime.dwHighDateTime=0x1bd4af2, nFileSizeHigh=0x0, nFileSizeLow=0x1db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SL00712_.WMF", cAlternateFileName="")) returned 1 [0174.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00712_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0174.945] GetProcessHeap () returned 0x4e0000 [0174.945] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0174.945] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0174.945] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0174.945] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0174.947] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0174.947] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0174.947] GetProcessHeap () returned 0x4e0000 [0174.947] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0174.947] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0174.947] CryptDestroyKey (hKey=0x522f98) returned 1 [0174.947] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0174.947] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0174.947] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0174.947] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0174.947] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0174.947] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0174.947] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0174.947] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0174.947] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.947] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1db8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1db8, lpOverlapped=0x0) returned 1 [0174.951] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1dc0, dwBufLen=0x1dc0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1dc0) returned 1 [0174.951] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.951] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1dc0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1dc0, lpOverlapped=0x0) returned 1 [0174.951] CryptDestroyKey (hKey=0x522f98) returned 1 [0174.951] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.951] SetEndOfFile (hFile=0xdc) returned 1 [0174.953] GetProcessHeap () returned 0x4e0000 [0174.953] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0174.953] GetProcessHeap () returned 0x4e0000 [0174.953] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0174.953] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00712_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00712_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0174.955] CloseHandle (hObject=0xdc) returned 1 [0174.955] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17d63d00, ftCreationTime.dwHighDateTime=0x1bd4bfc, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17d63d00, ftLastWriteTime.dwHighDateTime=0x1bd4bfc, nFileSizeHigh=0x0, nFileSizeLow=0xcdc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SL01040_.WMF", cAlternateFileName="")) returned 1 [0174.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01040_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0174.956] GetProcessHeap () returned 0x4e0000 [0174.956] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0174.956] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0174.956] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0174.956] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0174.958] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0174.958] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0174.958] GetProcessHeap () returned 0x4e0000 [0174.958] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0174.958] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0174.958] CryptDestroyKey (hKey=0x522f98) returned 1 [0174.958] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0174.958] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0174.958] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0174.958] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0174.958] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0174.959] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0174.959] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0174.959] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0174.959] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.959] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xcdc, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xcdc, lpOverlapped=0x0) returned 1 [0174.959] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xce0, dwBufLen=0xce0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xce0) returned 1 [0174.959] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.959] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xce0, lpOverlapped=0x0) returned 1 [0174.959] CryptDestroyKey (hKey=0x522f98) returned 1 [0174.959] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xdb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.959] SetEndOfFile (hFile=0xdc) returned 1 [0174.961] GetProcessHeap () returned 0x4e0000 [0174.961] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0174.961] GetProcessHeap () returned 0x4e0000 [0174.961] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0174.961] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01040_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01040_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0174.963] CloseHandle (hObject=0xdc) returned 1 [0174.963] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1573e300, ftCreationTime.dwHighDateTime=0x1bd4bfc, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1573e300, ftLastWriteTime.dwHighDateTime=0x1bd4bfc, nFileSizeHigh=0x0, nFileSizeLow=0x60c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SL01041_.WMF", cAlternateFileName="")) returned 1 [0174.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01041_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0174.964] GetProcessHeap () returned 0x4e0000 [0174.964] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0174.964] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0174.964] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0174.964] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0174.966] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0174.966] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0174.966] GetProcessHeap () returned 0x4e0000 [0174.966] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0174.966] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0174.966] CryptDestroyKey (hKey=0x522f98) returned 1 [0174.966] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0174.966] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0174.966] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0174.966] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0174.966] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0174.966] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0174.966] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0174.966] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0174.966] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.967] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x60c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x60c, lpOverlapped=0x0) returned 1 [0174.967] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x610, dwBufLen=0x610 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x610) returned 1 [0174.967] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.967] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x610, lpOverlapped=0x0) returned 1 [0174.967] CryptDestroyKey (hKey=0x522f98) returned 1 [0174.967] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.967] SetEndOfFile (hFile=0xdc) returned 1 [0174.969] GetProcessHeap () returned 0x4e0000 [0174.969] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0174.969] GetProcessHeap () returned 0x4e0000 [0174.969] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0174.969] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01041_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01041_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0174.971] CloseHandle (hObject=0xdc) returned 1 [0174.971] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cd76600, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7cd76600, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x1b04, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SL01394_.WMF", cAlternateFileName="")) returned 1 [0174.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01394_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0174.972] GetProcessHeap () returned 0x4e0000 [0174.972] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0174.972] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0174.973] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0174.973] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0174.974] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0174.974] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0174.974] GetProcessHeap () returned 0x4e0000 [0174.974] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0174.975] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0174.975] CryptDestroyKey (hKey=0x522f98) returned 1 [0174.975] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0174.975] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0174.975] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0174.975] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0174.975] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0174.975] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0174.975] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0174.975] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0174.975] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.975] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1b04, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1b04, lpOverlapped=0x0) returned 1 [0174.976] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1b10, dwBufLen=0x1b10 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1b10) returned 1 [0174.976] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.976] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1b10, lpOverlapped=0x0) returned 1 [0174.976] CryptDestroyKey (hKey=0x522f98) returned 1 [0174.976] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1be4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.976] SetEndOfFile (hFile=0xdc) returned 1 [0174.978] GetProcessHeap () returned 0x4e0000 [0174.978] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0174.978] GetProcessHeap () returned 0x4e0000 [0174.979] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0174.979] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01394_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01394_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0174.980] CloseHandle (hObject=0xdc) returned 1 [0174.980] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x747f2b00, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x747f2b00, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x138c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SL01395_.WMF", cAlternateFileName="")) returned 1 [0174.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01395_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0174.981] GetProcessHeap () returned 0x4e0000 [0174.981] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0174.981] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0174.981] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0174.981] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0174.983] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0174.983] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0174.983] GetProcessHeap () returned 0x4e0000 [0174.983] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0174.983] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0174.983] CryptDestroyKey (hKey=0x522f98) returned 1 [0174.983] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0174.983] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0174.983] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0174.984] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0174.984] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0174.984] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0174.984] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0174.984] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0174.984] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.984] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x138c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x138c, lpOverlapped=0x0) returned 1 [0174.985] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1390, dwBufLen=0x1390 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1390) returned 1 [0174.985] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.985] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1390, lpOverlapped=0x0) returned 1 [0174.985] CryptDestroyKey (hKey=0x522f98) returned 1 [0174.985] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.985] SetEndOfFile (hFile=0xdc) returned 1 [0174.987] GetProcessHeap () returned 0x4e0000 [0174.987] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0174.987] GetProcessHeap () returned 0x4e0000 [0174.987] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0174.987] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01395_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01395_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0174.989] CloseHandle (hObject=0xdc) returned 1 [0174.989] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6cc4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SL01565_.WMF", cAlternateFileName="")) returned 1 [0174.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01565_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0174.990] GetProcessHeap () returned 0x4e0000 [0174.990] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0174.990] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0174.990] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0174.990] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0174.992] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0174.992] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0174.992] GetProcessHeap () returned 0x4e0000 [0174.992] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0174.992] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0174.992] CryptDestroyKey (hKey=0x522f98) returned 1 [0174.992] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0174.992] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0174.992] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0174.992] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0174.992] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0174.992] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0174.992] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0174.992] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0174.992] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.992] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x6cc4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x6cc4, lpOverlapped=0x0) returned 1 [0174.993] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6cd0, dwBufLen=0x6cd0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6cd0) returned 1 [0174.993] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.993] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6cd0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x6cd0, lpOverlapped=0x0) returned 1 [0174.993] CryptDestroyKey (hKey=0x522f98) returned 1 [0174.994] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6da4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.994] SetEndOfFile (hFile=0xdc) returned 1 [0174.996] GetProcessHeap () returned 0x4e0000 [0174.996] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0174.996] GetProcessHeap () returned 0x4e0000 [0174.996] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0174.996] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01565_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01565_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0174.997] CloseHandle (hObject=0xdc) returned 1 [0174.997] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8a6e400, ftCreationTime.dwHighDateTime=0x1bd4af7, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8a6e400, ftLastWriteTime.dwHighDateTime=0x1bd4af7, nFileSizeHigh=0x0, nFileSizeLow=0x36aa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00017_.WMF", cAlternateFileName="")) returned 1 [0174.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00017_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0174.999] GetProcessHeap () returned 0x4e0000 [0174.999] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0174.999] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0174.999] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0174.999] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0175.001] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.001] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.001] GetProcessHeap () returned 0x4e0000 [0175.001] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.001] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.001] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.001] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.001] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.001] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.001] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.001] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.001] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.002] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.002] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.002] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.002] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x36aa, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x36aa, lpOverlapped=0x0) returned 1 [0175.002] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x36b0, dwBufLen=0x36b0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x36b0) returned 1 [0175.003] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.003] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x36b0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x36b0, lpOverlapped=0x0) returned 1 [0175.003] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.003] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3784, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.003] SetEndOfFile (hFile=0xdc) returned 1 [0175.005] GetProcessHeap () returned 0x4e0000 [0175.005] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.005] GetProcessHeap () returned 0x4e0000 [0175.005] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.005] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00017_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00017_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.007] CloseHandle (hObject=0xdc) returned 1 [0175.007] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc775b700, ftCreationTime.dwHighDateTime=0x1bd4af7, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc775b700, ftLastWriteTime.dwHighDateTime=0x1bd4af7, nFileSizeHigh=0x0, nFileSizeLow=0x32f6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00018_.WMF", cAlternateFileName="")) returned 1 [0175.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00018_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.008] GetProcessHeap () returned 0x4e0000 [0175.008] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.008] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.008] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.008] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0175.010] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.010] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.010] GetProcessHeap () returned 0x4e0000 [0175.010] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.010] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.010] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.010] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.010] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.010] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.010] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.011] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.011] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.011] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.011] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.011] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.011] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x32f6, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x32f6, lpOverlapped=0x0) returned 1 [0175.012] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3300, dwBufLen=0x3300 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3300) returned 1 [0175.012] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.012] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3300, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3300, lpOverlapped=0x0) returned 1 [0175.012] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.012] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x33d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.012] SetEndOfFile (hFile=0xdc) returned 1 [0175.014] GetProcessHeap () returned 0x4e0000 [0175.014] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.014] GetProcessHeap () returned 0x4e0000 [0175.014] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.014] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00018_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00018_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.015] CloseHandle (hObject=0xdc) returned 1 [0175.016] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x419f3f00, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x419f3f00, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x7a80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00152_.WMF", cAlternateFileName="")) returned 1 [0175.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.017] GetProcessHeap () returned 0x4e0000 [0175.017] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.017] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.017] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.017] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.017] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.017] GetProcessHeap () returned 0x4e0000 [0175.017] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.017] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.017] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.017] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.019] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.019] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.019] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.019] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.019] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.019] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.019] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.019] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.019] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7a80, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7a80, lpOverlapped=0x0) returned 1 [0175.020] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7a80, dwBufLen=0x7a80 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7a80) returned 1 [0175.021] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.021] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7a80, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7a80, lpOverlapped=0x0) returned 1 [0175.021] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.021] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7b54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.021] SetEndOfFile (hFile=0xdc) returned 1 [0175.023] GetProcessHeap () returned 0x4e0000 [0175.023] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.023] GetProcessHeap () returned 0x4e0000 [0175.023] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.023] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00152_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00152_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.025] CloseHandle (hObject=0xdc) returned 1 [0175.025] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35bab100, ftCreationTime.dwHighDateTime=0x1bf3bda, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35bab100, ftLastWriteTime.dwHighDateTime=0x1bf3bda, nFileSizeHigh=0x0, nFileSizeLow=0x4754, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00157_.WMF", cAlternateFileName="")) returned 1 [0175.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00157_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.026] GetProcessHeap () returned 0x4e0000 [0175.026] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.026] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.026] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.026] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0175.028] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.028] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.028] GetProcessHeap () returned 0x4e0000 [0175.028] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.028] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.028] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.028] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.028] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.029] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.029] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.029] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.029] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.029] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.029] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.029] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.029] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4754, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4754, lpOverlapped=0x0) returned 1 [0175.030] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4760, dwBufLen=0x4760 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4760) returned 1 [0175.030] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.030] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4760, lpOverlapped=0x0) returned 1 [0175.030] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.030] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.030] SetEndOfFile (hFile=0xdc) returned 1 [0175.033] GetProcessHeap () returned 0x4e0000 [0175.033] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.033] GetProcessHeap () returned 0x4e0000 [0175.033] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.033] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00157_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00157_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.034] CloseHandle (hObject=0xdc) returned 1 [0175.034] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e388d00, ftCreationTime.dwHighDateTime=0x1bd4b14, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e388d00, ftLastWriteTime.dwHighDateTime=0x1bd4b14, nFileSizeHigh=0x0, nFileSizeLow=0x2026, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00159_.WMF", cAlternateFileName="")) returned 1 [0175.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00159_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.036] GetProcessHeap () returned 0x4e0000 [0175.036] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.036] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.036] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.036] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0175.037] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.038] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.038] GetProcessHeap () returned 0x4e0000 [0175.038] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.038] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.038] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.038] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.038] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.038] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.038] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.038] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.038] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.038] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.038] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.038] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.038] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2026, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2026, lpOverlapped=0x0) returned 1 [0175.039] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2030, dwBufLen=0x2030 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2030) returned 1 [0175.039] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.039] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2030, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2030, lpOverlapped=0x0) returned 1 [0175.039] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.039] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2104, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.039] SetEndOfFile (hFile=0xdc) returned 1 [0175.041] GetProcessHeap () returned 0x4e0000 [0175.041] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.041] GetProcessHeap () returned 0x4e0000 [0175.041] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.041] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00159_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00159_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.042] CloseHandle (hObject=0xdc) returned 1 [0175.043] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3815d700, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3815d700, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x35b2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00166_.WMF", cAlternateFileName="")) returned 1 [0175.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.043] GetProcessHeap () returned 0x4e0000 [0175.043] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.043] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.043] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.043] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0175.045] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.045] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.045] GetProcessHeap () returned 0x4e0000 [0175.045] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.045] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.045] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.045] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.045] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.045] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.045] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.045] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.046] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.046] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.046] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.046] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.046] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x35b2, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x35b2, lpOverlapped=0x0) returned 1 [0175.047] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x35c0, dwBufLen=0x35c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x35c0) returned 1 [0175.047] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.047] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x35c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x35c0, lpOverlapped=0x0) returned 1 [0175.047] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.047] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.047] SetEndOfFile (hFile=0xdc) returned 1 [0175.049] GetProcessHeap () returned 0x4e0000 [0175.049] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.049] GetProcessHeap () returned 0x4e0000 [0175.049] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.049] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00166_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00166_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.050] CloseHandle (hObject=0xdc) returned 1 [0175.050] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35b37d00, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35b37d00, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x3b2e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00168_.WMF", cAlternateFileName="")) returned 1 [0175.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00168_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.052] GetProcessHeap () returned 0x4e0000 [0175.052] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.052] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.052] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.052] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0175.054] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.054] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.054] GetProcessHeap () returned 0x4e0000 [0175.054] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.054] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.054] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.054] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.054] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.054] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.054] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.054] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.054] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.054] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.054] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.054] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.054] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3b2e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3b2e, lpOverlapped=0x0) returned 1 [0175.055] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3b30, dwBufLen=0x3b30 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3b30) returned 1 [0175.055] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.055] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3b30, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3b30, lpOverlapped=0x0) returned 1 [0175.055] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.055] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3c04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.055] SetEndOfFile (hFile=0xdc) returned 1 [0175.057] GetProcessHeap () returned 0x4e0000 [0175.057] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.057] GetProcessHeap () returned 0x4e0000 [0175.057] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.058] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00168_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00168_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.059] CloseHandle (hObject=0xdc) returned 1 [0175.059] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34825000, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34825000, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x2242, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00170_.WMF", cAlternateFileName="")) returned 1 [0175.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00170_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.060] GetProcessHeap () returned 0x4e0000 [0175.060] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.060] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.060] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.061] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0175.081] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.081] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.081] GetProcessHeap () returned 0x4e0000 [0175.081] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.081] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.081] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.081] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.081] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.081] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.081] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.081] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.081] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.081] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.081] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.081] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.081] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2242, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2242, lpOverlapped=0x0) returned 1 [0175.082] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2250, dwBufLen=0x2250 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2250) returned 1 [0175.082] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.082] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2250, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2250, lpOverlapped=0x0) returned 1 [0175.083] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.083] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2324, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.083] SetEndOfFile (hFile=0xdc) returned 1 [0175.085] GetProcessHeap () returned 0x4e0000 [0175.085] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.085] GetProcessHeap () returned 0x4e0000 [0175.085] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.085] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00170_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00170_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.087] CloseHandle (hObject=0xdc) returned 1 [0175.087] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2af8e800, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2af8e800, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x8f0e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00177_.WMF", cAlternateFileName="")) returned 1 [0175.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00177_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.089] GetProcessHeap () returned 0x4e0000 [0175.089] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.089] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.089] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.089] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0175.091] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.091] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.091] GetProcessHeap () returned 0x4e0000 [0175.091] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.091] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.091] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.091] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.091] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.091] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.091] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.091] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.092] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.092] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.092] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.092] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.092] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x8f0e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x8f0e, lpOverlapped=0x0) returned 1 [0175.093] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8f10, dwBufLen=0x8f10 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8f10) returned 1 [0175.093] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.093] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x8f10, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x8f10, lpOverlapped=0x0) returned 1 [0175.093] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.093] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x8fe4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.093] SetEndOfFile (hFile=0xdc) returned 1 [0175.096] GetProcessHeap () returned 0x4e0000 [0175.096] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.096] GetProcessHeap () returned 0x4e0000 [0175.096] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.096] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00177_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00177_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.097] CloseHandle (hObject=0xdc) returned 1 [0175.097] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x283c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00183_.WMF", cAlternateFileName="")) returned 1 [0175.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00183_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.098] GetProcessHeap () returned 0x4e0000 [0175.098] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.098] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.098] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.098] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.100] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.100] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.100] GetProcessHeap () returned 0x4e0000 [0175.100] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.100] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.100] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.100] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.100] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.101] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.101] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.101] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.101] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.101] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.101] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.101] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.101] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x283c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x283c, lpOverlapped=0x0) returned 1 [0175.102] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2840, dwBufLen=0x2840 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2840) returned 1 [0175.102] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.102] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2840, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2840, lpOverlapped=0x0) returned 1 [0175.102] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.102] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2914, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.102] SetEndOfFile (hFile=0xdc) returned 1 [0175.104] GetProcessHeap () returned 0x4e0000 [0175.104] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.104] GetProcessHeap () returned 0x4e0000 [0175.104] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.104] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00183_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00183_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.106] CloseHandle (hObject=0xdc) returned 1 [0175.106] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22a0ad00, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22a0ad00, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x514c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00190_.WMF", cAlternateFileName="")) returned 1 [0175.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00190_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.106] GetProcessHeap () returned 0x4e0000 [0175.106] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.106] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.107] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.107] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.108] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.108] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.108] GetProcessHeap () returned 0x4e0000 [0175.108] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.108] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.108] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.108] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.108] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.109] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.109] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.109] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.109] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.109] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.109] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.109] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.109] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x514c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x514c, lpOverlapped=0x0) returned 1 [0175.110] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5150, dwBufLen=0x5150 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5150) returned 1 [0175.110] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.110] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5150, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5150, lpOverlapped=0x0) returned 1 [0175.110] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.110] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.110] SetEndOfFile (hFile=0xdc) returned 1 [0175.112] GetProcessHeap () returned 0x4e0000 [0175.112] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.112] GetProcessHeap () returned 0x4e0000 [0175.112] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.112] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00190_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00190_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.114] CloseHandle (hObject=0xdc) returned 1 [0175.114] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2090, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00191_.WMF", cAlternateFileName="")) returned 1 [0175.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.115] GetProcessHeap () returned 0x4e0000 [0175.115] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.115] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.115] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.115] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.115] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.115] GetProcessHeap () returned 0x4e0000 [0175.115] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.115] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.115] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.115] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.117] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.117] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.117] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.117] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.117] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.117] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.117] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.117] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.117] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2090, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2090, lpOverlapped=0x0) returned 1 [0175.118] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2090, dwBufLen=0x2090 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2090) returned 1 [0175.118] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.118] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2090, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2090, lpOverlapped=0x0) returned 1 [0175.119] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.119] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2164, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.119] SetEndOfFile (hFile=0xdc) returned 1 [0175.121] GetProcessHeap () returned 0x4e0000 [0175.121] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.121] GetProcessHeap () returned 0x4e0000 [0175.121] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.121] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00191_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00191_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.122] CloseHandle (hObject=0xdc) returned 1 [0175.122] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x280c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00192_.WMF", cAlternateFileName="")) returned 1 [0175.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00192_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.123] GetProcessHeap () returned 0x4e0000 [0175.123] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.123] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.123] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.123] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.124] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.124] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.124] GetProcessHeap () returned 0x4e0000 [0175.124] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.125] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.125] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.125] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.125] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.125] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.125] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.125] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.125] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.125] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.125] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.125] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.125] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x280c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x280c, lpOverlapped=0x0) returned 1 [0175.126] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2810, dwBufLen=0x2810 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2810) returned 1 [0175.126] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.126] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2810, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2810, lpOverlapped=0x0) returned 1 [0175.126] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.126] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x28e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.126] SetEndOfFile (hFile=0xdc) returned 1 [0175.128] GetProcessHeap () returned 0x4e0000 [0175.128] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.128] GetProcessHeap () returned 0x4e0000 [0175.128] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.128] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00192_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00192_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.129] CloseHandle (hObject=0xdc) returned 1 [0175.130] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f0d2600, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1f0d2600, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x27c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00194_.WMF", cAlternateFileName="")) returned 1 [0175.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.130] GetProcessHeap () returned 0x4e0000 [0175.130] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.130] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.130] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.130] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.130] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.130] GetProcessHeap () returned 0x4e0000 [0175.131] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.131] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.131] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.131] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.132] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.132] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.132] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.132] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.132] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.133] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.133] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.133] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.133] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x27c0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x27c0, lpOverlapped=0x0) returned 1 [0175.133] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x27c0, dwBufLen=0x27c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x27c0) returned 1 [0175.134] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.134] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x27c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x27c0, lpOverlapped=0x0) returned 1 [0175.134] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.134] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2894, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.134] SetEndOfFile (hFile=0xdc) returned 1 [0175.136] GetProcessHeap () returned 0x4e0000 [0175.136] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.136] GetProcessHeap () returned 0x4e0000 [0175.136] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.136] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00194_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00194_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.137] CloseHandle (hObject=0xdc) returned 1 [0175.137] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x238c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00197_.WMF", cAlternateFileName="")) returned 1 [0175.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00197_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.138] GetProcessHeap () returned 0x4e0000 [0175.138] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.138] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.138] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.138] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.140] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.140] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.140] GetProcessHeap () returned 0x4e0000 [0175.140] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.140] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.140] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.140] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.140] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.140] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.140] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.140] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.140] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.140] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.140] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.140] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.141] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x238c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x238c, lpOverlapped=0x0) returned 1 [0175.141] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2390, dwBufLen=0x2390 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2390) returned 1 [0175.141] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.142] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2390, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2390, lpOverlapped=0x0) returned 1 [0175.142] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.142] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.142] SetEndOfFile (hFile=0xdc) returned 1 [0175.144] GetProcessHeap () returned 0x4e0000 [0175.144] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.144] GetProcessHeap () returned 0x4e0000 [0175.144] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.144] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00197_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00197_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.146] CloseHandle (hObject=0xdc) returned 1 [0175.146] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19174500, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19174500, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x15fe, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00199_.WMF", cAlternateFileName="")) returned 1 [0175.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00199_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.147] GetProcessHeap () returned 0x4e0000 [0175.147] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.147] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.147] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.148] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0175.149] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.149] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.149] GetProcessHeap () returned 0x4e0000 [0175.149] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.149] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.149] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.149] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.149] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.149] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.150] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.150] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.150] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.150] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.150] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.150] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.150] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x15fe, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x15fe, lpOverlapped=0x0) returned 1 [0175.151] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1600, dwBufLen=0x1600 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1600) returned 1 [0175.151] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.151] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1600, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1600, lpOverlapped=0x0) returned 1 [0175.151] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.151] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x16d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.151] SetEndOfFile (hFile=0xdc) returned 1 [0175.153] GetProcessHeap () returned 0x4e0000 [0175.153] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.153] GetProcessHeap () returned 0x4e0000 [0175.153] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.153] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00199_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00199_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.154] CloseHandle (hObject=0xdc) returned 1 [0175.155] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16b4eb00, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x16b4eb00, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x2926, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00200_.WMF", cAlternateFileName="")) returned 1 [0175.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.156] GetProcessHeap () returned 0x4e0000 [0175.156] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.156] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.156] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.156] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0175.158] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.158] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.158] GetProcessHeap () returned 0x4e0000 [0175.158] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.158] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.158] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.158] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.158] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.158] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.159] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.159] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.159] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.159] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.159] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.159] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.159] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2926, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2926, lpOverlapped=0x0) returned 1 [0175.160] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2930, dwBufLen=0x2930 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2930) returned 1 [0175.160] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.160] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2930, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2930, lpOverlapped=0x0) returned 1 [0175.160] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.160] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2a04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.160] SetEndOfFile (hFile=0xdc) returned 1 [0175.162] GetProcessHeap () returned 0x4e0000 [0175.162] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.162] GetProcessHeap () returned 0x4e0000 [0175.162] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.162] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00200_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00200_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.163] CloseHandle (hObject=0xdc) returned 1 [0175.163] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd90f00, ftCreationTime.dwHighDateTime=0x1bd4b14, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd90f00, ftLastWriteTime.dwHighDateTime=0x1bd4b14, nFileSizeHigh=0x0, nFileSizeLow=0x2ea0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00208_.WMF", cAlternateFileName="")) returned 1 [0175.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00208_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.164] GetProcessHeap () returned 0x4e0000 [0175.164] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.164] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.164] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.164] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.164] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.164] GetProcessHeap () returned 0x4e0000 [0175.164] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.164] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.165] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.165] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.166] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.166] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.166] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.166] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.166] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.167] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.167] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.167] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.167] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2ea0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2ea0, lpOverlapped=0x0) returned 1 [0175.167] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2ea0, dwBufLen=0x2ea0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2ea0) returned 1 [0175.167] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.167] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2ea0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2ea0, lpOverlapped=0x0) returned 1 [0175.168] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.168] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2f74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.168] SetEndOfFile (hFile=0xdc) returned 1 [0175.170] GetProcessHeap () returned 0x4e0000 [0175.170] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.170] GetProcessHeap () returned 0x4e0000 [0175.170] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.170] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00208_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00208_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.171] CloseHandle (hObject=0xdc) returned 1 [0175.171] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b20100, ftCreationTime.dwHighDateTime=0x1bd4b14, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b20100, ftLastWriteTime.dwHighDateTime=0x1bd4b14, nFileSizeHigh=0x0, nFileSizeLow=0x4f72, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00212_.WMF", cAlternateFileName="")) returned 1 [0175.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00212_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.173] GetProcessHeap () returned 0x4e0000 [0175.173] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.173] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.173] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.173] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0175.174] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.174] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.174] GetProcessHeap () returned 0x4e0000 [0175.174] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.174] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.174] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.174] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.175] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.175] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.175] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.175] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.175] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.175] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.175] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.175] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.175] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4f72, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4f72, lpOverlapped=0x0) returned 1 [0175.176] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4f80, dwBufLen=0x4f80 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4f80) returned 1 [0175.176] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.176] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4f80, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4f80, lpOverlapped=0x0) returned 1 [0175.176] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.176] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5054, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.176] SetEndOfFile (hFile=0xdc) returned 1 [0175.178] GetProcessHeap () returned 0x4e0000 [0175.178] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.178] GetProcessHeap () returned 0x4e0000 [0175.178] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.178] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00212_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00212_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.179] CloseHandle (hObject=0xdc) returned 1 [0175.179] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f74, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00221_.WMF", cAlternateFileName="")) returned 1 [0175.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00221_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.180] GetProcessHeap () returned 0x4e0000 [0175.180] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.180] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.180] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.180] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0175.182] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.182] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.182] GetProcessHeap () returned 0x4e0000 [0175.182] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.182] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.182] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.182] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.182] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.182] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.182] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.183] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.183] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.183] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.183] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.183] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.183] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1f74, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1f74, lpOverlapped=0x0) returned 1 [0175.184] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1f80, dwBufLen=0x1f80 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1f80) returned 1 [0175.184] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.184] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1f80, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1f80, lpOverlapped=0x0) returned 1 [0175.184] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.184] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2054, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.184] SetEndOfFile (hFile=0xdc) returned 1 [0175.186] GetProcessHeap () returned 0x4e0000 [0175.186] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.186] GetProcessHeap () returned 0x4e0000 [0175.186] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.186] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00221_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00221_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.189] CloseHandle (hObject=0xdc) returned 1 [0175.189] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e5c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00222_.WMF", cAlternateFileName="")) returned 1 [0175.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00222_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.190] GetProcessHeap () returned 0x4e0000 [0175.190] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.190] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.190] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.190] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.192] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.192] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.192] GetProcessHeap () returned 0x4e0000 [0175.192] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.192] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.192] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.192] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.192] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.192] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.192] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.193] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.193] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.193] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.193] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.193] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.193] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1e5c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1e5c, lpOverlapped=0x0) returned 1 [0175.195] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1e60, dwBufLen=0x1e60 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1e60) returned 1 [0175.195] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.195] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1e60, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1e60, lpOverlapped=0x0) returned 1 [0175.195] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.195] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1f34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.195] SetEndOfFile (hFile=0xdc) returned 1 [0175.197] GetProcessHeap () returned 0x4e0000 [0175.197] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.197] GetProcessHeap () returned 0x4e0000 [0175.197] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.197] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00222_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00222_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.199] CloseHandle (hObject=0xdc) returned 1 [0175.199] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3642, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00223_.WMF", cAlternateFileName="")) returned 1 [0175.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00223_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.200] GetProcessHeap () returned 0x4e0000 [0175.200] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.200] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.200] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.200] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0175.202] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.202] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.202] GetProcessHeap () returned 0x4e0000 [0175.202] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.202] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.202] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.202] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.202] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.202] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.202] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.202] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.202] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.202] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.203] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.203] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.203] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3642, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3642, lpOverlapped=0x0) returned 1 [0175.203] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3650, dwBufLen=0x3650 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3650) returned 1 [0175.203] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.204] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3650, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3650, lpOverlapped=0x0) returned 1 [0175.204] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.204] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3724, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.204] SetEndOfFile (hFile=0xdc) returned 1 [0175.206] GetProcessHeap () returned 0x4e0000 [0175.206] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.206] GetProcessHeap () returned 0x4e0000 [0175.206] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.206] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00223_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00223_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.207] CloseHandle (hObject=0xdc) returned 1 [0175.207] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf553ff00, ftCreationTime.dwHighDateTime=0x1bd4ae9, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf553ff00, ftLastWriteTime.dwHighDateTime=0x1bd4ae9, nFileSizeHigh=0x0, nFileSizeLow=0x476e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00257_.WMF", cAlternateFileName="")) returned 1 [0175.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00257_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.208] GetProcessHeap () returned 0x4e0000 [0175.208] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.208] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.208] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.208] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0175.211] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.211] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.211] GetProcessHeap () returned 0x4e0000 [0175.211] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.211] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.211] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.211] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.211] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.211] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.211] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.211] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.211] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.211] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.211] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.211] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.211] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x476e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x476e, lpOverlapped=0x0) returned 1 [0175.212] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4770, dwBufLen=0x4770 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4770) returned 1 [0175.212] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.212] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4770, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4770, lpOverlapped=0x0) returned 1 [0175.212] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.212] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4844, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.212] SetEndOfFile (hFile=0xdc) returned 1 [0175.215] GetProcessHeap () returned 0x4e0000 [0175.215] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.215] GetProcessHeap () returned 0x4e0000 [0175.215] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.215] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00257_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00257_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.216] CloseHandle (hObject=0xdc) returned 1 [0175.216] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7c6d00, ftCreationTime.dwHighDateTime=0x1bd4b13, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f7c6d00, ftLastWriteTime.dwHighDateTime=0x1bd4b13, nFileSizeHigh=0x0, nFileSizeLow=0xd8e0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00289_.WMF", cAlternateFileName="")) returned 1 [0175.216] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00289_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.217] GetProcessHeap () returned 0x4e0000 [0175.217] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.217] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.217] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.217] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.217] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.217] GetProcessHeap () returned 0x4e0000 [0175.217] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.217] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.217] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.217] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.250] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.250] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.250] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.250] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.251] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.251] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.251] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.251] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.251] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xd8e0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xd8e0, lpOverlapped=0x0) returned 1 [0175.252] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xd8e0, dwBufLen=0xd8e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xd8e0) returned 1 [0175.253] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.253] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xd8e0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xd8e0, lpOverlapped=0x0) returned 1 [0175.254] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.254] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xd9b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.254] SetEndOfFile (hFile=0xdc) returned 1 [0175.256] GetProcessHeap () returned 0x4e0000 [0175.256] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.256] GetProcessHeap () returned 0x4e0000 [0175.256] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.256] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00289_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00289_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.258] CloseHandle (hObject=0xdc) returned 1 [0175.258] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba531a00, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xba531a00, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x10cb8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00299_.WMF", cAlternateFileName="")) returned 1 [0175.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00299_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.259] GetProcessHeap () returned 0x4e0000 [0175.259] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.259] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.259] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.259] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.261] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.261] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.261] GetProcessHeap () returned 0x4e0000 [0175.261] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.261] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.261] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.261] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.261] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.261] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.261] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.262] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.262] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.262] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.262] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.262] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.262] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x10cb8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x10cb8, lpOverlapped=0x0) returned 1 [0175.263] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x10cc0, dwBufLen=0x10cc0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x10cc0) returned 1 [0175.263] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.263] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x10cc0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x10cc0, lpOverlapped=0x0) returned 1 [0175.264] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.264] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x10d94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.264] SetEndOfFile (hFile=0xdc) returned 1 [0175.266] GetProcessHeap () returned 0x4e0000 [0175.266] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.266] GetProcessHeap () returned 0x4e0000 [0175.266] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.266] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00299_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00299_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.268] CloseHandle (hObject=0xdc) returned 1 [0175.268] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d82d600, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7d82d600, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x7a04, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00305_.WMF", cAlternateFileName="")) returned 1 [0175.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00305_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.270] GetProcessHeap () returned 0x4e0000 [0175.270] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.270] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.270] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.270] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0175.271] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.271] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.271] GetProcessHeap () returned 0x4e0000 [0175.271] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.271] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.271] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.271] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.272] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.272] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.272] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.272] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.272] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.272] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.272] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.272] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.272] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7a04, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7a04, lpOverlapped=0x0) returned 1 [0175.275] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7a10, dwBufLen=0x7a10 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7a10) returned 1 [0175.276] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.276] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7a10, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7a10, lpOverlapped=0x0) returned 1 [0175.276] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.276] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7ae4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.276] SetEndOfFile (hFile=0xdc) returned 1 [0175.278] GetProcessHeap () returned 0x4e0000 [0175.278] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.278] GetProcessHeap () returned 0x4e0000 [0175.278] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.278] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00305_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00305_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.280] CloseHandle (hObject=0xdc) returned 1 [0175.280] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b207c00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b207c00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xee4a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00333_.WMF", cAlternateFileName="")) returned 1 [0175.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00333_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.281] GetProcessHeap () returned 0x4e0000 [0175.281] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.281] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.281] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.282] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0175.284] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.284] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.284] GetProcessHeap () returned 0x4e0000 [0175.284] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.284] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.284] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.284] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.284] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.284] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.284] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.284] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.284] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.284] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.284] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.284] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.284] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xee4a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xee4a, lpOverlapped=0x0) returned 1 [0175.285] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xee50, dwBufLen=0xee50 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xee50) returned 1 [0175.286] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.286] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xee50, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xee50, lpOverlapped=0x0) returned 1 [0175.286] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.286] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xef24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.286] SetEndOfFile (hFile=0xdc) returned 1 [0175.289] GetProcessHeap () returned 0x4e0000 [0175.289] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.289] GetProcessHeap () returned 0x4e0000 [0175.289] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.289] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00333_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00333_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.291] CloseHandle (hObject=0xdc) returned 1 [0175.291] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0e04300, ftCreationTime.dwHighDateTime=0x1bd4ae9, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc0e04300, ftLastWriteTime.dwHighDateTime=0x1bd4ae9, nFileSizeHigh=0x0, nFileSizeLow=0x8b96, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00345_.WMF", cAlternateFileName="")) returned 1 [0175.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00345_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.292] GetProcessHeap () returned 0x4e0000 [0175.292] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.292] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.292] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.292] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0175.294] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.294] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.294] GetProcessHeap () returned 0x4e0000 [0175.294] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.294] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.294] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.294] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.294] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.294] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.294] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.294] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.294] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.295] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.295] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.295] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.295] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x8b96, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x8b96, lpOverlapped=0x0) returned 1 [0175.296] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8ba0, dwBufLen=0x8ba0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8ba0) returned 1 [0175.296] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.296] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x8ba0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x8ba0, lpOverlapped=0x0) returned 1 [0175.296] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.296] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x8c74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.296] SetEndOfFile (hFile=0xdc) returned 1 [0175.299] GetProcessHeap () returned 0x4e0000 [0175.299] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.299] GetProcessHeap () returned 0x4e0000 [0175.299] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.299] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00345_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00345_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.300] CloseHandle (hObject=0xdc) returned 1 [0175.300] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb844700, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb844700, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0xbbe0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00350_.WMF", cAlternateFileName="")) returned 1 [0175.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00350_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.302] GetProcessHeap () returned 0x4e0000 [0175.302] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.302] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.302] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.302] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.302] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.302] GetProcessHeap () returned 0x4e0000 [0175.302] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.302] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.302] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.302] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.303] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.304] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.304] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.304] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.304] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.304] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.304] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.304] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.304] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xbbe0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xbbe0, lpOverlapped=0x0) returned 1 [0175.305] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xbbe0, dwBufLen=0xbbe0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xbbe0) returned 1 [0175.305] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.305] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xbbe0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xbbe0, lpOverlapped=0x0) returned 1 [0175.306] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.306] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xbcb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.306] SetEndOfFile (hFile=0xdc) returned 1 [0175.308] GetProcessHeap () returned 0x4e0000 [0175.308] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.308] GetProcessHeap () returned 0x4e0000 [0175.308] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.308] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00350_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00350_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.309] CloseHandle (hObject=0xdc) returned 1 [0175.309] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb844700, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb844700, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x934c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00352_.WMF", cAlternateFileName="")) returned 1 [0175.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00352_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.311] GetProcessHeap () returned 0x4e0000 [0175.311] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.311] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.311] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.311] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.313] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.313] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.313] GetProcessHeap () returned 0x4e0000 [0175.313] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.313] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.313] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.313] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.313] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.313] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.314] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.314] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.314] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.314] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.314] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.314] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.314] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x934c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x934c, lpOverlapped=0x0) returned 1 [0175.315] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9350, dwBufLen=0x9350 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9350) returned 1 [0175.315] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.315] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x9350, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x9350, lpOverlapped=0x0) returned 1 [0175.315] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.316] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x9424, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.316] SetEndOfFile (hFile=0xdc) returned 1 [0175.318] GetProcessHeap () returned 0x4e0000 [0175.318] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.318] GetProcessHeap () returned 0x4e0000 [0175.318] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.318] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00352_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00352_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.319] CloseHandle (hObject=0xdc) returned 1 [0175.319] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30533400, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x30533400, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x1948, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00364_.WMF", cAlternateFileName="")) returned 1 [0175.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00364_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.320] GetProcessHeap () returned 0x4e0000 [0175.320] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.320] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.320] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.321] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.323] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.323] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.323] GetProcessHeap () returned 0x4e0000 [0175.323] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.323] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.323] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.323] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.323] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.323] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.323] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.323] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.323] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.323] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.323] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.323] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.323] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1948, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1948, lpOverlapped=0x0) returned 1 [0175.324] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1950, dwBufLen=0x1950 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1950) returned 1 [0175.324] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.324] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1950, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1950, lpOverlapped=0x0) returned 1 [0175.324] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.324] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1a24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.324] SetEndOfFile (hFile=0xdc) returned 1 [0175.327] GetProcessHeap () returned 0x4e0000 [0175.327] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.327] GetProcessHeap () returned 0x4e0000 [0175.327] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.327] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00364_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00364_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.328] CloseHandle (hObject=0xdc) returned 1 [0175.328] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31846100, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x31846100, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x51ea, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00367_.WMF", cAlternateFileName="")) returned 1 [0175.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00367_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.329] GetProcessHeap () returned 0x4e0000 [0175.329] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.329] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.329] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.329] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0175.331] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.331] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.331] GetProcessHeap () returned 0x4e0000 [0175.331] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.331] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.331] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.331] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.331] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.331] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.331] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.331] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.332] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.332] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.332] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.332] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.332] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x51ea, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x51ea, lpOverlapped=0x0) returned 1 [0175.333] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x51f0, dwBufLen=0x51f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x51f0) returned 1 [0175.333] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.333] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x51f0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x51f0, lpOverlapped=0x0) returned 1 [0175.334] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.334] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x52c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.334] SetEndOfFile (hFile=0xdc) returned 1 [0175.336] GetProcessHeap () returned 0x4e0000 [0175.336] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.336] GetProcessHeap () returned 0x4e0000 [0175.336] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.336] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00367_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00367_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.337] CloseHandle (hObject=0xdc) returned 1 [0175.337] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3308, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00373_.WMF", cAlternateFileName="")) returned 1 [0175.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00373_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.338] GetProcessHeap () returned 0x4e0000 [0175.338] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.338] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.338] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.338] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.341] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.341] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.341] GetProcessHeap () returned 0x4e0000 [0175.341] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.341] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.341] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.341] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.341] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.341] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.341] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.341] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.341] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.341] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.341] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.341] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.341] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3308, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3308, lpOverlapped=0x0) returned 1 [0175.342] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3310, dwBufLen=0x3310 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3310) returned 1 [0175.342] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.342] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3310, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3310, lpOverlapped=0x0) returned 1 [0175.342] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.342] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x33e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.342] SetEndOfFile (hFile=0xdc) returned 1 [0175.345] GetProcessHeap () returned 0x4e0000 [0175.345] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.345] GetProcessHeap () returned 0x4e0000 [0175.345] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.345] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00373_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00373_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.346] CloseHandle (hObject=0xdc) returned 1 [0175.346] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32b58e00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x32b58e00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x27f4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00382_.WMF", cAlternateFileName="")) returned 1 [0175.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00382_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.347] GetProcessHeap () returned 0x4e0000 [0175.347] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.347] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.347] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.347] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0175.349] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.349] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.349] GetProcessHeap () returned 0x4e0000 [0175.349] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.349] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.349] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.349] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.350] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.350] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.350] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.350] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.350] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.350] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.350] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.350] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.350] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x27f4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x27f4, lpOverlapped=0x0) returned 1 [0175.352] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2800, dwBufLen=0x2800 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2800) returned 1 [0175.352] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.352] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2800, lpOverlapped=0x0) returned 1 [0175.352] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.352] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x28d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.352] SetEndOfFile (hFile=0xdc) returned 1 [0175.354] GetProcessHeap () returned 0x4e0000 [0175.354] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.354] GetProcessHeap () returned 0x4e0000 [0175.354] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.354] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00382_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00382_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.355] CloseHandle (hObject=0xdc) returned 1 [0175.355] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27894f00, ftCreationTime.dwHighDateTime=0x1bd4b32, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x27894f00, ftLastWriteTime.dwHighDateTime=0x1bd4b32, nFileSizeHigh=0x0, nFileSizeLow=0xb7c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00390_.WMF", cAlternateFileName="")) returned 1 [0175.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00390_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.356] GetProcessHeap () returned 0x4e0000 [0175.356] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.356] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.357] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.357] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.360] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.361] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.361] GetProcessHeap () returned 0x4e0000 [0175.361] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.361] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.361] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.361] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.361] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.361] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.361] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.361] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.361] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.361] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.361] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.361] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.361] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb7c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xb7c, lpOverlapped=0x0) returned 1 [0175.361] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xb80, dwBufLen=0xb80 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xb80) returned 1 [0175.361] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.361] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xb80, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xb80, lpOverlapped=0x0) returned 1 [0175.361] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.362] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xc54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.362] SetEndOfFile (hFile=0xdc) returned 1 [0175.364] GetProcessHeap () returned 0x4e0000 [0175.364] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.364] GetProcessHeap () returned 0x4e0000 [0175.364] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.364] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00390_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00390_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.365] CloseHandle (hObject=0xdc) returned 1 [0175.365] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22c49b00, ftCreationTime.dwHighDateTime=0x1bd4b32, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22c49b00, ftLastWriteTime.dwHighDateTime=0x1bd4b32, nFileSizeHigh=0x0, nFileSizeLow=0x828, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00391_.WMF", cAlternateFileName="")) returned 1 [0175.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00391_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.367] GetProcessHeap () returned 0x4e0000 [0175.367] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.367] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.367] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.367] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.368] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.368] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.368] GetProcessHeap () returned 0x4e0000 [0175.369] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.369] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.369] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.369] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.369] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.369] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.369] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.369] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.369] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.369] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.369] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.369] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.369] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x828, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x828, lpOverlapped=0x0) returned 1 [0175.369] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x830, dwBufLen=0x830 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x830) returned 1 [0175.369] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.369] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x830, lpOverlapped=0x0) returned 1 [0175.369] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.369] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x904, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.370] SetEndOfFile (hFile=0xdc) returned 1 [0175.372] GetProcessHeap () returned 0x4e0000 [0175.372] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.372] GetProcessHeap () returned 0x4e0000 [0175.372] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.372] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00391_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00391_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.373] CloseHandle (hObject=0xdc) returned 1 [0175.373] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59e57d00, ftCreationTime.dwHighDateTime=0x1bd4b2f, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x59e57d00, ftLastWriteTime.dwHighDateTime=0x1bd4b2f, nFileSizeHigh=0x0, nFileSizeLow=0x704e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00416_.WMF", cAlternateFileName="")) returned 1 [0175.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00416_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.374] GetProcessHeap () returned 0x4e0000 [0175.374] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.374] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.374] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.374] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0175.376] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.376] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.376] GetProcessHeap () returned 0x4e0000 [0175.376] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.376] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.376] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.376] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.376] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.376] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.376] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.376] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.376] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.376] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.376] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.377] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.377] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x704e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x704e, lpOverlapped=0x0) returned 1 [0175.377] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7050, dwBufLen=0x7050 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7050) returned 1 [0175.378] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.378] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7050, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7050, lpOverlapped=0x0) returned 1 [0175.378] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.378] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7124, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.378] SetEndOfFile (hFile=0xdc) returned 1 [0175.380] GetProcessHeap () returned 0x4e0000 [0175.380] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.380] GetProcessHeap () returned 0x4e0000 [0175.380] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.380] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00416_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00416_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.381] CloseHandle (hObject=0xdc) returned 1 [0175.381] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36491500, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x36491500, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x143c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00423_.WMF", cAlternateFileName="")) returned 1 [0175.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00423_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.382] GetProcessHeap () returned 0x4e0000 [0175.382] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.382] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.382] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.382] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.384] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.384] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.384] GetProcessHeap () returned 0x4e0000 [0175.384] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.384] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.384] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.384] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.384] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.384] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.384] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.384] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.384] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.384] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.384] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.384] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.384] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x143c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x143c, lpOverlapped=0x0) returned 1 [0175.385] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1440, dwBufLen=0x1440 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1440) returned 1 [0175.385] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.385] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1440, lpOverlapped=0x0) returned 1 [0175.385] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.385] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1514, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.385] SetEndOfFile (hFile=0xdc) returned 1 [0175.388] GetProcessHeap () returned 0x4e0000 [0175.388] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.388] GetProcessHeap () returned 0x4e0000 [0175.388] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.388] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00423_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00423_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.389] CloseHandle (hObject=0xdc) returned 1 [0175.389] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ef4f00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79ef4f00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1544, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00444_.WMF", cAlternateFileName="")) returned 1 [0175.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00444_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.390] GetProcessHeap () returned 0x4e0000 [0175.390] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.390] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.390] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.390] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0175.392] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.392] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.392] GetProcessHeap () returned 0x4e0000 [0175.392] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.392] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.392] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.392] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.392] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.392] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.392] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.392] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.392] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.392] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.392] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.392] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.392] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1544, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1544, lpOverlapped=0x0) returned 1 [0175.393] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1550, dwBufLen=0x1550 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1550) returned 1 [0175.393] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.393] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1550, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1550, lpOverlapped=0x0) returned 1 [0175.393] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.393] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1624, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.393] SetEndOfFile (hFile=0xdc) returned 1 [0175.395] GetProcessHeap () returned 0x4e0000 [0175.395] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.395] GetProcessHeap () returned 0x4e0000 [0175.395] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.395] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00444_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00444_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.397] CloseHandle (hObject=0xdc) returned 1 [0175.397] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf630100, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf630100, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x878, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00452_.WMF", cAlternateFileName="")) returned 1 [0175.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00452_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.398] GetProcessHeap () returned 0x4e0000 [0175.398] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.398] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.398] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.398] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.400] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.400] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.400] GetProcessHeap () returned 0x4e0000 [0175.400] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.400] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.400] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.400] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.400] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.400] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.401] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.401] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.401] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.401] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.401] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.401] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.401] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x878, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x878, lpOverlapped=0x0) returned 1 [0175.401] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x880, dwBufLen=0x880 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x880) returned 1 [0175.401] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.401] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x880, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x880, lpOverlapped=0x0) returned 1 [0175.401] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.401] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x954, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.401] SetEndOfFile (hFile=0xdc) returned 1 [0175.403] GetProcessHeap () returned 0x4e0000 [0175.403] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.403] GetProcessHeap () returned 0x4e0000 [0175.403] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.404] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00452_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00452_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.406] CloseHandle (hObject=0xdc) returned 1 [0175.406] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d2000, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x96d2000, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x59ec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00453_.WMF", cAlternateFileName="")) returned 1 [0175.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00453_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.407] GetProcessHeap () returned 0x4e0000 [0175.408] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.408] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.408] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.408] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.409] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.409] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.409] GetProcessHeap () returned 0x4e0000 [0175.409] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.410] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.410] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.410] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.410] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.410] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.410] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.410] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.410] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.410] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.410] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.410] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.410] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x59ec, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x59ec, lpOverlapped=0x0) returned 1 [0175.411] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x59f0, dwBufLen=0x59f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x59f0) returned 1 [0175.411] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.411] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x59f0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x59f0, lpOverlapped=0x0) returned 1 [0175.411] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.411] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5ac4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.412] SetEndOfFile (hFile=0xdc) returned 1 [0175.414] GetProcessHeap () returned 0x4e0000 [0175.414] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.414] GetProcessHeap () returned 0x4e0000 [0175.414] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.414] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00453_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00453_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.415] CloseHandle (hObject=0xdc) returned 1 [0175.415] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa04e1b00, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa04e1b00, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0xb6c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00454_.WMF", cAlternateFileName="")) returned 1 [0175.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00454_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.417] GetProcessHeap () returned 0x4e0000 [0175.417] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.417] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.417] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.417] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.419] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.419] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.419] GetProcessHeap () returned 0x4e0000 [0175.419] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.419] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.419] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.419] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.419] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.419] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.419] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.419] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.420] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.420] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.420] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.420] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.420] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb6c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xb6c, lpOverlapped=0x0) returned 1 [0175.420] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xb70, dwBufLen=0xb70 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xb70) returned 1 [0175.420] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.420] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xb70, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xb70, lpOverlapped=0x0) returned 1 [0175.420] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.420] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xc44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.420] SetEndOfFile (hFile=0xdc) returned 1 [0175.422] GetProcessHeap () returned 0x4e0000 [0175.422] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.422] GetProcessHeap () returned 0x4e0000 [0175.422] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.422] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00454_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00454_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.424] CloseHandle (hObject=0xdc) returned 1 [0175.424] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xac8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00466_.WMF", cAlternateFileName="")) returned 1 [0175.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00466_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.425] GetProcessHeap () returned 0x4e0000 [0175.425] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.425] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.425] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.425] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.427] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.427] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.427] GetProcessHeap () returned 0x4e0000 [0175.427] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.427] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.427] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.427] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.427] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.427] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.427] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.427] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.427] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.427] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.427] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.427] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.428] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xac8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xac8, lpOverlapped=0x0) returned 1 [0175.428] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xad0, dwBufLen=0xad0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xad0) returned 1 [0175.428] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.428] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xad0, lpOverlapped=0x0) returned 1 [0175.428] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.428] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xba4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.428] SetEndOfFile (hFile=0xdc) returned 1 [0175.430] GetProcessHeap () returned 0x4e0000 [0175.430] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.430] GetProcessHeap () returned 0x4e0000 [0175.430] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.430] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00466_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00466_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.431] CloseHandle (hObject=0xdc) returned 1 [0175.431] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78be2200, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78be2200, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xfc0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00476_.WMF", cAlternateFileName="")) returned 1 [0175.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00476_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.432] GetProcessHeap () returned 0x4e0000 [0175.432] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.432] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.432] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.432] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.432] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.432] GetProcessHeap () returned 0x4e0000 [0175.432] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.432] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.432] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.432] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.434] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.434] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.434] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.434] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.434] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.435] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.435] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.435] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.435] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xfc0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xfc0, lpOverlapped=0x0) returned 1 [0175.435] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xfc0, dwBufLen=0xfc0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xfc0) returned 1 [0175.435] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.435] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xfc0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xfc0, lpOverlapped=0x0) returned 1 [0175.435] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.435] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1094, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.435] SetEndOfFile (hFile=0xdc) returned 1 [0175.437] GetProcessHeap () returned 0x4e0000 [0175.437] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.437] GetProcessHeap () returned 0x4e0000 [0175.437] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.437] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00476_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00476_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.439] CloseHandle (hObject=0xdc) returned 1 [0175.439] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3ef600, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3c3ef600, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x5b08, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00479_.WMF", cAlternateFileName="")) returned 1 [0175.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00479_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.440] GetProcessHeap () returned 0x4e0000 [0175.440] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.440] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.440] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.440] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.441] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.441] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.441] GetProcessHeap () returned 0x4e0000 [0175.441] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.441] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.441] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.441] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.442] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.442] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.442] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.442] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.442] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.442] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.442] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.442] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.442] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5b08, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x5b08, lpOverlapped=0x0) returned 1 [0175.443] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5b10, dwBufLen=0x5b10 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5b10) returned 1 [0175.443] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.443] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5b10, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5b10, lpOverlapped=0x0) returned 1 [0175.443] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.443] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5be4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.443] SetEndOfFile (hFile=0xdc) returned 1 [0175.445] GetProcessHeap () returned 0x4e0000 [0175.445] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.445] GetProcessHeap () returned 0x4e0000 [0175.445] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.446] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00479_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00479_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.447] CloseHandle (hObject=0xdc) returned 1 [0175.447] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x778cf500, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x778cf500, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x2bb8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00483_.WMF", cAlternateFileName="")) returned 1 [0175.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00483_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.448] GetProcessHeap () returned 0x4e0000 [0175.448] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.448] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.448] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.448] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.449] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.449] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.449] GetProcessHeap () returned 0x4e0000 [0175.449] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.450] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.450] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.450] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.450] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.450] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.450] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.450] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.450] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.450] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.450] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.450] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.450] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2bb8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2bb8, lpOverlapped=0x0) returned 1 [0175.451] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2bc0, dwBufLen=0x2bc0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2bc0) returned 1 [0175.451] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.451] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2bc0, lpOverlapped=0x0) returned 1 [0175.451] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.451] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2c94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.451] SetEndOfFile (hFile=0xdc) returned 1 [0175.454] GetProcessHeap () returned 0x4e0000 [0175.454] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.454] GetProcessHeap () returned 0x4e0000 [0175.454] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.454] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00483_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00483_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.455] CloseHandle (hObject=0xdc) returned 1 [0175.455] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ad09800, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ad09800, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x1e58, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00486_.WMF", cAlternateFileName="")) returned 1 [0175.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00486_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.457] GetProcessHeap () returned 0x4e0000 [0175.457] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.457] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.457] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.457] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.459] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.459] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.459] GetProcessHeap () returned 0x4e0000 [0175.459] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.459] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.459] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.459] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.459] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.459] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.459] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.459] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.459] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.459] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.459] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.459] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.459] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1e58, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1e58, lpOverlapped=0x0) returned 1 [0175.460] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1e60, dwBufLen=0x1e60 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1e60) returned 1 [0175.460] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.460] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1e60, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1e60, lpOverlapped=0x0) returned 1 [0175.460] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.460] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1f34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.461] SetEndOfFile (hFile=0xdc) returned 1 [0175.463] GetProcessHeap () returned 0x4e0000 [0175.463] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.463] GetProcessHeap () returned 0x4e0000 [0175.463] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.463] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00486_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00486_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.464] CloseHandle (hObject=0xdc) returned 1 [0175.464] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4c3a800, ftCreationTime.dwHighDateTime=0x1bd4b20, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4c3a800, ftLastWriteTime.dwHighDateTime=0x1bd4b20, nFileSizeHigh=0x0, nFileSizeLow=0xaa4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00505_.WMF", cAlternateFileName="")) returned 1 [0175.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00505_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.465] GetProcessHeap () returned 0x4e0000 [0175.465] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.465] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.465] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.465] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0175.467] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.467] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.467] GetProcessHeap () returned 0x4e0000 [0175.467] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.467] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.467] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.467] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.467] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.467] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.467] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.467] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.467] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.467] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.467] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.467] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.467] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xaa4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xaa4, lpOverlapped=0x0) returned 1 [0175.468] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xab0, dwBufLen=0xab0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xab0) returned 1 [0175.468] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.468] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xab0, lpOverlapped=0x0) returned 1 [0175.468] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.468] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xb84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.468] SetEndOfFile (hFile=0xdc) returned 1 [0175.470] GetProcessHeap () returned 0x4e0000 [0175.470] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.470] GetProcessHeap () returned 0x4e0000 [0175.470] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.470] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00505_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00505_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.471] CloseHandle (hObject=0xdc) returned 1 [0175.472] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x765bc800, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x765bc800, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1724, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00513_.WMF", cAlternateFileName="")) returned 1 [0175.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00513_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.472] GetProcessHeap () returned 0x4e0000 [0175.472] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.472] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.472] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.472] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0175.474] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.474] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.474] GetProcessHeap () returned 0x4e0000 [0175.474] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.474] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.474] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.474] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.474] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.474] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.474] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.474] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.474] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.475] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.475] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.475] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.475] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1724, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1724, lpOverlapped=0x0) returned 1 [0175.475] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1730, dwBufLen=0x1730 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1730) returned 1 [0175.475] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.475] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1730, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1730, lpOverlapped=0x0) returned 1 [0175.476] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.476] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1804, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.476] SetEndOfFile (hFile=0xdc) returned 1 [0175.478] GetProcessHeap () returned 0x4e0000 [0175.478] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.478] GetProcessHeap () returned 0x4e0000 [0175.478] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.478] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00513_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00513_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.479] CloseHandle (hObject=0xdc) returned 1 [0175.479] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2602, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00555_.WMF", cAlternateFileName="")) returned 1 [0175.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00555_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.480] GetProcessHeap () returned 0x4e0000 [0175.480] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.480] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.480] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.480] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0175.482] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.482] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.482] GetProcessHeap () returned 0x4e0000 [0175.482] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.482] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.482] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.482] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.482] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.482] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.482] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.482] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.482] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.483] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.483] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.483] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.483] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2602, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2602, lpOverlapped=0x0) returned 1 [0175.483] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2610, dwBufLen=0x2610 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2610) returned 1 [0175.483] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.483] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2610, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2610, lpOverlapped=0x0) returned 1 [0175.484] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.484] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x26e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.484] SetEndOfFile (hFile=0xdc) returned 1 [0175.494] GetProcessHeap () returned 0x4e0000 [0175.494] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.494] GetProcessHeap () returned 0x4e0000 [0175.494] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.494] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00555_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00555_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.496] CloseHandle (hObject=0xdc) returned 1 [0175.496] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23879c00, ftCreationTime.dwHighDateTime=0x1c01c5d, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x23879c00, ftLastWriteTime.dwHighDateTime=0x1c01c5d, nFileSizeHigh=0x0, nFileSizeLow=0x6260, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00603_.WMF", cAlternateFileName="")) returned 1 [0175.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00603_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.497] GetProcessHeap () returned 0x4e0000 [0175.497] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.497] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.497] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.498] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.498] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.498] GetProcessHeap () returned 0x4e0000 [0175.498] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.498] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.498] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.498] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.499] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.499] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.499] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.499] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.500] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.500] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.500] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.500] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.500] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x6260, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x6260, lpOverlapped=0x0) returned 1 [0175.501] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6260, dwBufLen=0x6260 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6260) returned 1 [0175.501] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.501] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6260, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x6260, lpOverlapped=0x0) returned 1 [0175.501] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.501] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6334, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.501] SetEndOfFile (hFile=0xdc) returned 1 [0175.503] GetProcessHeap () returned 0x4e0000 [0175.503] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.503] GetProcessHeap () returned 0x4e0000 [0175.503] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.503] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00603_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00603_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.505] CloseHandle (hObject=0xdc) returned 1 [0175.505] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13335b00, ftCreationTime.dwHighDateTime=0x1bd4b0e, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x13335b00, ftLastWriteTime.dwHighDateTime=0x1bd4b0e, nFileSizeHigh=0x0, nFileSizeLow=0x9c80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00610_.WMF", cAlternateFileName="")) returned 1 [0175.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00610_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.506] GetProcessHeap () returned 0x4e0000 [0175.506] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.506] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.506] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.506] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.506] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.506] GetProcessHeap () returned 0x4e0000 [0175.506] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.506] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.506] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.506] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.508] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.508] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.508] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.508] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.508] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.508] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.508] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.508] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.508] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x9c80, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x9c80, lpOverlapped=0x0) returned 1 [0175.509] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9c80, dwBufLen=0x9c80 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9c80) returned 1 [0175.509] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.509] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x9c80, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x9c80, lpOverlapped=0x0) returned 1 [0175.510] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.510] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x9d54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.510] SetEndOfFile (hFile=0xdc) returned 1 [0175.512] GetProcessHeap () returned 0x4e0000 [0175.512] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.512] GetProcessHeap () returned 0x4e0000 [0175.512] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.512] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00610_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00610_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.514] CloseHandle (hObject=0xdc) returned 1 [0175.514] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8d0400, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8d0400, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0xfe6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00629_.WMF", cAlternateFileName="")) returned 1 [0175.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00629_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.516] GetProcessHeap () returned 0x4e0000 [0175.516] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.516] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.516] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.516] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0175.517] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.517] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.517] GetProcessHeap () returned 0x4e0000 [0175.517] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.517] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.518] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.518] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.518] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.518] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.518] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.518] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.518] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.518] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.518] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.518] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.518] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xfe6, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xfe6, lpOverlapped=0x0) returned 1 [0175.518] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xff0, dwBufLen=0xff0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xff0) returned 1 [0175.518] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.518] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xff0, lpOverlapped=0x0) returned 1 [0175.518] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.518] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x10c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.518] SetEndOfFile (hFile=0xdc) returned 1 [0175.521] GetProcessHeap () returned 0x4e0000 [0175.521] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.521] GetProcessHeap () returned 0x4e0000 [0175.521] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.521] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00629_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00629_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.522] CloseHandle (hObject=0xdc) returned 1 [0175.522] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x752a9b00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x752a9b00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x5006, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00633_.WMF", cAlternateFileName="")) returned 1 [0175.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00633_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.523] GetProcessHeap () returned 0x4e0000 [0175.523] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.523] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.523] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.523] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0175.525] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.525] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.525] GetProcessHeap () returned 0x4e0000 [0175.525] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.525] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.525] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.525] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.525] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.525] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.526] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.526] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.526] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.526] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.526] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.526] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.526] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5006, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x5006, lpOverlapped=0x0) returned 1 [0175.528] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5010, dwBufLen=0x5010 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5010) returned 1 [0175.528] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.528] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5010, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5010, lpOverlapped=0x0) returned 1 [0175.528] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.528] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x50e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.528] SetEndOfFile (hFile=0xdc) returned 1 [0175.532] GetProcessHeap () returned 0x4e0000 [0175.532] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.532] GetProcessHeap () returned 0x4e0000 [0175.532] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.532] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00633_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00633_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.533] CloseHandle (hObject=0xdc) returned 1 [0175.534] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3039c00, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3039c00, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0x1aba, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00638_.WMF", cAlternateFileName="")) returned 1 [0175.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00638_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.536] GetProcessHeap () returned 0x4e0000 [0175.536] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.536] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.536] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.536] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0175.537] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.537] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.537] GetProcessHeap () returned 0x4e0000 [0175.537] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.537] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.537] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.537] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.537] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.538] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.538] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.538] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.538] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.538] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.538] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.538] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.538] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1aba, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1aba, lpOverlapped=0x0) returned 1 [0175.539] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1ac0, dwBufLen=0x1ac0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1ac0) returned 1 [0175.539] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.539] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1ac0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1ac0, lpOverlapped=0x0) returned 1 [0175.539] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.539] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1b94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.539] SetEndOfFile (hFile=0xdc) returned 1 [0175.541] GetProcessHeap () returned 0x4e0000 [0175.541] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.541] GetProcessHeap () returned 0x4e0000 [0175.541] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.541] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00638_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00638_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.542] CloseHandle (hObject=0xdc) returned 1 [0175.542] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53153500, ftCreationTime.dwHighDateTime=0x1bd4b44, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x53153500, ftLastWriteTime.dwHighDateTime=0x1bd4b44, nFileSizeHigh=0x0, nFileSizeLow=0x584, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00656_.WMF", cAlternateFileName="")) returned 1 [0175.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00656_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.543] GetProcessHeap () returned 0x4e0000 [0175.543] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.543] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.543] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.543] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0175.544] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.544] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.544] GetProcessHeap () returned 0x4e0000 [0175.544] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.544] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.544] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.544] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.545] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.545] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.545] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.545] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.545] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.545] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.545] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.545] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.545] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x584, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x584, lpOverlapped=0x0) returned 1 [0175.545] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x590, dwBufLen=0x590 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x590) returned 1 [0175.545] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.545] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x590, lpOverlapped=0x0) returned 1 [0175.545] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.545] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x664, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.545] SetEndOfFile (hFile=0xdc) returned 1 [0175.547] GetProcessHeap () returned 0x4e0000 [0175.547] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.547] GetProcessHeap () returned 0x4e0000 [0175.547] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.547] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00656_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00656_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.548] CloseHandle (hObject=0xdc) returned 1 [0175.548] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1652, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00668_.WMF", cAlternateFileName="")) returned 1 [0175.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00668_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.549] GetProcessHeap () returned 0x4e0000 [0175.549] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.549] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.549] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.549] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0175.551] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.551] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.551] GetProcessHeap () returned 0x4e0000 [0175.551] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.551] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.551] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.551] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.551] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.551] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.551] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.551] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.551] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.551] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.551] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.551] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.552] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1652, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1652, lpOverlapped=0x0) returned 1 [0175.552] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1660, dwBufLen=0x1660 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1660) returned 1 [0175.552] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.552] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1660, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1660, lpOverlapped=0x0) returned 1 [0175.553] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.553] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1734, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.553] SetEndOfFile (hFile=0xdc) returned 1 [0175.555] GetProcessHeap () returned 0x4e0000 [0175.555] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.555] GetProcessHeap () returned 0x4e0000 [0175.555] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.555] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00668_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00668_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.556] CloseHandle (hObject=0xdc) returned 1 [0175.556] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00670_.WMF", cAlternateFileName="")) returned 1 [0175.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00670_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.556] GetProcessHeap () returned 0x4e0000 [0175.556] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.556] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.556] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.557] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.557] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.557] GetProcessHeap () returned 0x4e0000 [0175.557] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.557] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.557] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.557] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.558] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.558] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.558] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.558] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.558] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.559] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.559] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.559] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.559] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x16c0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x16c0, lpOverlapped=0x0) returned 1 [0175.559] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x16c0, dwBufLen=0x16c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x16c0) returned 1 [0175.560] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.560] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x16c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x16c0, lpOverlapped=0x0) returned 1 [0175.560] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.560] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1794, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.560] SetEndOfFile (hFile=0xdc) returned 1 [0175.562] GetProcessHeap () returned 0x4e0000 [0175.562] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.562] GetProcessHeap () returned 0x4e0000 [0175.562] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.562] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00670_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00670_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.563] CloseHandle (hObject=0xdc) returned 1 [0175.563] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5d0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00671_.WMF", cAlternateFileName="")) returned 1 [0175.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00671_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.563] GetProcessHeap () returned 0x4e0000 [0175.563] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.564] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.564] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.564] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.564] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.564] GetProcessHeap () returned 0x4e0000 [0175.564] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.564] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.564] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.564] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.565] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.565] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.566] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.566] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.566] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.566] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.566] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.566] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.566] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5d0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x5d0, lpOverlapped=0x0) returned 1 [0175.566] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5d0, dwBufLen=0x5d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5d0) returned 1 [0175.566] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.566] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5d0, lpOverlapped=0x0) returned 1 [0175.566] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.566] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.566] SetEndOfFile (hFile=0xdc) returned 1 [0175.568] GetProcessHeap () returned 0x4e0000 [0175.568] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.569] GetProcessHeap () returned 0x4e0000 [0175.569] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.569] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00671_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00671_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.570] CloseHandle (hObject=0xdc) returned 1 [0175.570] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f14c400, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f14c400, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0x62b6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00683_.WMF", cAlternateFileName="")) returned 1 [0175.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00683_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.571] GetProcessHeap () returned 0x4e0000 [0175.571] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.571] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.571] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.571] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0175.572] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.572] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.572] GetProcessHeap () returned 0x4e0000 [0175.572] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.572] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.572] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.573] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.573] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.573] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.573] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.573] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.573] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.573] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.573] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.573] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.573] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x62b6, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x62b6, lpOverlapped=0x0) returned 1 [0175.574] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x62c0, dwBufLen=0x62c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x62c0) returned 1 [0175.574] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.574] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x62c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x62c0, lpOverlapped=0x0) returned 1 [0175.574] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.574] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6394, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.574] SetEndOfFile (hFile=0xdc) returned 1 [0175.576] GetProcessHeap () returned 0x4e0000 [0175.576] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.576] GetProcessHeap () returned 0x4e0000 [0175.576] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.577] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00683_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00683_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.577] CloseHandle (hObject=0xdc) returned 1 [0175.577] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6302, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00694_.WMF", cAlternateFileName="")) returned 1 [0175.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00694_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.579] GetProcessHeap () returned 0x4e0000 [0175.579] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.579] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.579] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.579] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0175.581] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.581] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.581] GetProcessHeap () returned 0x4e0000 [0175.581] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.581] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.581] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.581] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.581] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.581] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.581] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.581] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.581] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.582] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.582] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.582] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.582] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x6302, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x6302, lpOverlapped=0x0) returned 1 [0175.583] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6310, dwBufLen=0x6310 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6310) returned 1 [0175.583] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.583] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6310, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x6310, lpOverlapped=0x0) returned 1 [0175.583] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.583] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x63e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.583] SetEndOfFile (hFile=0xdc) returned 1 [0175.585] GetProcessHeap () returned 0x4e0000 [0175.585] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.585] GetProcessHeap () returned 0x4e0000 [0175.585] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.585] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00694_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00694_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.586] CloseHandle (hObject=0xdc) returned 1 [0175.586] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3636, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00704_.WMF", cAlternateFileName="")) returned 1 [0175.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00704_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.587] GetProcessHeap () returned 0x4e0000 [0175.587] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.587] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.587] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.587] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0175.588] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.588] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.588] GetProcessHeap () returned 0x4e0000 [0175.588] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.588] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.589] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.589] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.589] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.589] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.589] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.589] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.589] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.589] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.589] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.589] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.589] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3636, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3636, lpOverlapped=0x0) returned 1 [0175.590] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3640, dwBufLen=0x3640 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3640) returned 1 [0175.590] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.590] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3640, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3640, lpOverlapped=0x0) returned 1 [0175.590] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.590] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.590] SetEndOfFile (hFile=0xdc) returned 1 [0175.592] GetProcessHeap () returned 0x4e0000 [0175.592] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.592] GetProcessHeap () returned 0x4e0000 [0175.592] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.592] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00704_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00704_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.593] CloseHandle (hObject=0xdc) returned 1 [0175.593] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6697b000, ftCreationTime.dwHighDateTime=0x1bd4af2, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6697b000, ftLastWriteTime.dwHighDateTime=0x1bd4af2, nFileSizeHigh=0x0, nFileSizeLow=0x16478, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00726_.WMF", cAlternateFileName="")) returned 1 [0175.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00726_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.594] GetProcessHeap () returned 0x4e0000 [0175.594] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.594] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.594] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.594] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.596] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.596] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.596] GetProcessHeap () returned 0x4e0000 [0175.596] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.596] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.596] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.596] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.596] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.596] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.596] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.596] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.596] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.596] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.596] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.596] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.596] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x16478, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x16478, lpOverlapped=0x0) returned 1 [0175.597] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x16480, dwBufLen=0x16480 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x16480) returned 1 [0175.598] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.598] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x16480, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x16480, lpOverlapped=0x0) returned 1 [0175.598] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.598] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x16554, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.598] SetEndOfFile (hFile=0xdc) returned 1 [0175.601] GetProcessHeap () returned 0x4e0000 [0175.601] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.601] GetProcessHeap () returned 0x4e0000 [0175.601] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.601] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00726_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00726_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.602] CloseHandle (hObject=0xdc) returned 1 [0175.602] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d1f5400, ftCreationTime.dwHighDateTime=0x1bd4b44, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d1f5400, ftLastWriteTime.dwHighDateTime=0x1bd4b44, nFileSizeHigh=0x0, nFileSizeLow=0x1758, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00728_.WMF", cAlternateFileName="")) returned 1 [0175.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00728_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.602] GetProcessHeap () returned 0x4e0000 [0175.602] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.602] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.602] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.602] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.604] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.604] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.604] GetProcessHeap () returned 0x4e0000 [0175.604] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.604] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.604] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.604] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.604] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.604] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.604] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.604] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.604] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.604] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.604] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.605] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.605] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1758, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1758, lpOverlapped=0x0) returned 1 [0175.605] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1760, dwBufLen=0x1760 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1760) returned 1 [0175.605] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.605] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1760, lpOverlapped=0x0) returned 1 [0175.605] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.605] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.605] SetEndOfFile (hFile=0xdc) returned 1 [0175.607] GetProcessHeap () returned 0x4e0000 [0175.607] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.607] GetProcessHeap () returned 0x4e0000 [0175.607] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.608] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00728_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00728_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.608] CloseHandle (hObject=0xdc) returned 1 [0175.608] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5096e900, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5096e900, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00732_.WMF", cAlternateFileName="")) returned 1 [0175.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00732_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.609] GetProcessHeap () returned 0x4e0000 [0175.609] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.609] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.609] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.609] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.611] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.611] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.611] GetProcessHeap () returned 0x4e0000 [0175.611] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.611] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.611] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.611] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.611] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.611] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.611] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.611] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.611] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.611] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.611] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.611] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.611] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x13fc, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x13fc, lpOverlapped=0x0) returned 1 [0175.612] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1400, dwBufLen=0x1400 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1400) returned 1 [0175.612] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.612] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1400, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1400, lpOverlapped=0x0) returned 1 [0175.612] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.612] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x14d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.613] SetEndOfFile (hFile=0xdc) returned 1 [0175.615] GetProcessHeap () returned 0x4e0000 [0175.615] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.615] GetProcessHeap () returned 0x4e0000 [0175.615] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.615] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00732_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00732_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.615] CloseHandle (hObject=0xdc) returned 1 [0175.615] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e348f00, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e348f00, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0x660, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00734_.WMF", cAlternateFileName="")) returned 1 [0175.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00734_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.616] GetProcessHeap () returned 0x4e0000 [0175.616] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.616] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.616] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.616] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.616] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.616] GetProcessHeap () returned 0x4e0000 [0175.616] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.616] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.616] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.616] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.618] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.618] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.618] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.618] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.618] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.618] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.618] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.618] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.618] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x660, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x660, lpOverlapped=0x0) returned 1 [0175.619] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x660, dwBufLen=0x660 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x660) returned 1 [0175.619] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.619] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x660, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x660, lpOverlapped=0x0) returned 1 [0175.619] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.619] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x734, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.619] SetEndOfFile (hFile=0xdc) returned 1 [0175.621] GetProcessHeap () returned 0x4e0000 [0175.621] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.621] GetProcessHeap () returned 0x4e0000 [0175.621] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.621] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00734_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00734_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.622] CloseHandle (hObject=0xdc) returned 1 [0175.622] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d036200, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d036200, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0x5cc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00735_.WMF", cAlternateFileName="")) returned 1 [0175.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00735_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.622] GetProcessHeap () returned 0x4e0000 [0175.622] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.622] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.622] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.622] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.624] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.624] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.624] GetProcessHeap () returned 0x4e0000 [0175.624] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.624] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.624] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.624] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.624] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.624] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.624] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.624] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.624] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.625] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.625] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.625] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.625] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5cc, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x5cc, lpOverlapped=0x0) returned 1 [0175.625] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5d0, dwBufLen=0x5d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5d0) returned 1 [0175.625] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.625] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5d0, lpOverlapped=0x0) returned 1 [0175.625] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.625] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.625] SetEndOfFile (hFile=0xdc) returned 1 [0175.628] GetProcessHeap () returned 0x4e0000 [0175.628] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.628] GetProcessHeap () returned 0x4e0000 [0175.628] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.628] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00735_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00735_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.628] CloseHandle (hObject=0xdc) returned 1 [0175.628] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x498bcd00, ftCreationTime.dwHighDateTime=0x1bd4b44, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x498bcd00, ftLastWriteTime.dwHighDateTime=0x1bd4b44, nFileSizeHigh=0x0, nFileSizeLow=0x184c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00736_.WMF", cAlternateFileName="")) returned 1 [0175.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00736_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.630] GetProcessHeap () returned 0x4e0000 [0175.630] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.630] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.630] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.630] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.632] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.632] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.632] GetProcessHeap () returned 0x4e0000 [0175.632] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.632] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.632] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.632] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.632] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.632] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.632] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.632] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.632] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.632] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.632] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.632] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.632] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x184c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x184c, lpOverlapped=0x0) returned 1 [0175.633] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1850, dwBufLen=0x1850 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1850) returned 1 [0175.633] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.633] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1850, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1850, lpOverlapped=0x0) returned 1 [0175.633] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.633] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1924, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.633] SetEndOfFile (hFile=0xdc) returned 1 [0175.635] GetProcessHeap () returned 0x4e0000 [0175.635] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.635] GetProcessHeap () returned 0x4e0000 [0175.635] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.635] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00736_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00736_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.636] CloseHandle (hObject=0xdc) returned 1 [0175.636] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73f96e00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73f96e00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x543a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00768_.WMF", cAlternateFileName="")) returned 1 [0175.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00768_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.637] GetProcessHeap () returned 0x4e0000 [0175.637] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.637] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.637] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.637] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0175.638] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.638] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.638] GetProcessHeap () returned 0x4e0000 [0175.638] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.638] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.638] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.638] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.638] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.639] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.639] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.639] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.639] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.639] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.639] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.639] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.639] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x543a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x543a, lpOverlapped=0x0) returned 1 [0175.640] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5440, dwBufLen=0x5440 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5440) returned 1 [0175.640] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.640] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5440, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5440, lpOverlapped=0x0) returned 1 [0175.640] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.640] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5514, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.640] SetEndOfFile (hFile=0xdc) returned 1 [0175.642] GetProcessHeap () returned 0x4e0000 [0175.642] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.642] GetProcessHeap () returned 0x4e0000 [0175.642] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.642] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00768_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00768_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.643] CloseHandle (hObject=0xdc) returned 1 [0175.643] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1db71a00, ftCreationTime.dwHighDateTime=0x1bd4b39, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1db71a00, ftLastWriteTime.dwHighDateTime=0x1bd4b39, nFileSizeHigh=0x0, nFileSizeLow=0x16ee, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00783_.WMF", cAlternateFileName="")) returned 1 [0175.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00783_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.644] GetProcessHeap () returned 0x4e0000 [0175.644] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.644] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.644] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.644] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0175.646] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.646] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.646] GetProcessHeap () returned 0x4e0000 [0175.646] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.646] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.646] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.646] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.646] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.646] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.646] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.646] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.646] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.646] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.646] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.646] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.646] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x16ee, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x16ee, lpOverlapped=0x0) returned 1 [0175.648] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x16f0, dwBufLen=0x16f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x16f0) returned 1 [0175.648] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.648] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x16f0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x16f0, lpOverlapped=0x0) returned 1 [0175.648] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.648] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x17c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.648] SetEndOfFile (hFile=0xdc) returned 1 [0175.650] GetProcessHeap () returned 0x4e0000 [0175.650] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.650] GetProcessHeap () returned 0x4e0000 [0175.650] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.650] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00783_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00783_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.651] CloseHandle (hObject=0xdc) returned 1 [0175.651] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x230f6700, ftCreationTime.dwHighDateTime=0x1bd4b2f, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x230f6700, ftLastWriteTime.dwHighDateTime=0x1bd4b2f, nFileSizeHigh=0x0, nFileSizeLow=0x41c2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00820_.WMF", cAlternateFileName="")) returned 1 [0175.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00820_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.652] GetProcessHeap () returned 0x4e0000 [0175.652] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.652] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.652] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.652] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0175.653] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.653] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.653] GetProcessHeap () returned 0x4e0000 [0175.653] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.653] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.653] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.653] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.654] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.654] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.654] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.654] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.654] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.654] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.654] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.654] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.654] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x41c2, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x41c2, lpOverlapped=0x0) returned 1 [0175.655] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x41d0, dwBufLen=0x41d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x41d0) returned 1 [0175.655] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.655] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x41d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x41d0, lpOverlapped=0x0) returned 1 [0175.655] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.655] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x42a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.655] SetEndOfFile (hFile=0xdc) returned 1 [0175.657] GetProcessHeap () returned 0x4e0000 [0175.657] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.657] GetProcessHeap () returned 0x4e0000 [0175.657] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.657] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00820_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00820_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.659] CloseHandle (hObject=0xdc) returned 1 [0175.659] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec395100, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xec395100, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x28ae, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00828_.WMF", cAlternateFileName="")) returned 1 [0175.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00828_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.659] GetProcessHeap () returned 0x4e0000 [0175.659] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.659] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.659] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.660] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0175.661] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.661] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.661] GetProcessHeap () returned 0x4e0000 [0175.661] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.661] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.661] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.661] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.661] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.661] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.661] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.661] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.662] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.662] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.662] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.662] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.662] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x28ae, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x28ae, lpOverlapped=0x0) returned 1 [0175.665] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x28b0, dwBufLen=0x28b0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x28b0) returned 1 [0175.665] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.665] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x28b0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x28b0, lpOverlapped=0x0) returned 1 [0175.666] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.666] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2984, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.666] SetEndOfFile (hFile=0xdc) returned 1 [0175.668] GetProcessHeap () returned 0x4e0000 [0175.668] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.668] GetProcessHeap () returned 0x4e0000 [0175.668] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.668] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00828_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00828_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00828_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.669] CloseHandle (hObject=0xdc) returned 1 [0175.669] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce6bec00, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xce6bec00, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x36da, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00834_.WMF", cAlternateFileName="")) returned 1 [0175.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00834_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00834_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.670] GetProcessHeap () returned 0x4e0000 [0175.670] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.670] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.670] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.670] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0175.671] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.671] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.671] GetProcessHeap () returned 0x4e0000 [0175.671] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.672] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.672] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.672] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.672] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.672] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.672] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.672] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.672] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.672] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.672] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.672] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.672] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x36da, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x36da, lpOverlapped=0x0) returned 1 [0175.673] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x36e0, dwBufLen=0x36e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x36e0) returned 1 [0175.673] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.673] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x36e0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x36e0, lpOverlapped=0x0) returned 1 [0175.673] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.673] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x37b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.673] SetEndOfFile (hFile=0xdc) returned 1 [0175.675] GetProcessHeap () returned 0x4e0000 [0175.675] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.675] GetProcessHeap () returned 0x4e0000 [0175.675] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.675] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00834_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00834_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00834_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00834_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.676] CloseHandle (hObject=0xdc) returned 1 [0175.676] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc613b100, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc613b100, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x3fe8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00837_.WMF", cAlternateFileName="")) returned 1 [0175.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00837_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00837_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.677] GetProcessHeap () returned 0x4e0000 [0175.677] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.677] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.677] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.677] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.679] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.679] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.679] GetProcessHeap () returned 0x4e0000 [0175.679] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.679] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.679] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.679] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.679] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.679] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.679] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.680] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.680] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.680] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.680] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.680] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.680] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3fe8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3fe8, lpOverlapped=0x0) returned 1 [0175.680] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3ff0, dwBufLen=0x3ff0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3ff0) returned 1 [0175.681] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.681] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3ff0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3ff0, lpOverlapped=0x0) returned 1 [0175.681] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.681] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x40c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.681] SetEndOfFile (hFile=0xdc) returned 1 [0175.683] GetProcessHeap () returned 0x4e0000 [0175.683] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.683] GetProcessHeap () returned 0x4e0000 [0175.683] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.683] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00837_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00837_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00837_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00837_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.684] CloseHandle (hObject=0xdc) returned 1 [0175.684] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1898, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00910_.WMF", cAlternateFileName="")) returned 1 [0175.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00910_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.684] GetProcessHeap () returned 0x4e0000 [0175.684] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.684] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.684] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.685] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.686] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.686] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.686] GetProcessHeap () returned 0x4e0000 [0175.686] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.686] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.686] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.686] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.686] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.686] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.687] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.687] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.687] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.687] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.687] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.687] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.687] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1898, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1898, lpOverlapped=0x0) returned 1 [0175.688] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x18a0, dwBufLen=0x18a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x18a0) returned 1 [0175.688] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.688] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x18a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x18a0, lpOverlapped=0x0) returned 1 [0175.688] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.688] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1974, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.688] SetEndOfFile (hFile=0xdc) returned 1 [0175.690] GetProcessHeap () returned 0x4e0000 [0175.690] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.690] GetProcessHeap () returned 0x4e0000 [0175.690] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.690] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00910_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00910_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.691] CloseHandle (hObject=0xdc) returned 1 [0175.691] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x29f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00911_.WMF", cAlternateFileName="")) returned 1 [0175.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00911_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.692] GetProcessHeap () returned 0x4e0000 [0175.692] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.692] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.692] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.692] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.694] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.694] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.694] GetProcessHeap () returned 0x4e0000 [0175.694] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.694] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.694] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.694] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.694] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.694] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.694] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.694] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.694] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.694] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.694] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.694] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.694] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x29f8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x29f8, lpOverlapped=0x0) returned 1 [0175.695] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2a00, dwBufLen=0x2a00 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2a00) returned 1 [0175.695] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.695] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2a00, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2a00, lpOverlapped=0x0) returned 1 [0175.695] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.696] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2ad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.696] SetEndOfFile (hFile=0xdc) returned 1 [0175.698] GetProcessHeap () returned 0x4e0000 [0175.698] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.698] GetProcessHeap () returned 0x4e0000 [0175.698] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.698] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00911_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00911_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.699] CloseHandle (hObject=0xdc) returned 1 [0175.699] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x28b4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00913_.WMF", cAlternateFileName="")) returned 1 [0175.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00913_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00913_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.700] GetProcessHeap () returned 0x4e0000 [0175.700] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.700] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.700] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.700] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0175.702] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.702] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.702] GetProcessHeap () returned 0x4e0000 [0175.702] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.702] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.702] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.702] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.702] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.702] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.702] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.702] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.702] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.702] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.702] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.702] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.702] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x28b4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x28b4, lpOverlapped=0x0) returned 1 [0175.703] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x28c0, dwBufLen=0x28c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x28c0) returned 1 [0175.703] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.703] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x28c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x28c0, lpOverlapped=0x0) returned 1 [0175.703] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.703] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.703] SetEndOfFile (hFile=0xdc) returned 1 [0175.705] GetProcessHeap () returned 0x4e0000 [0175.705] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.705] GetProcessHeap () returned 0x4e0000 [0175.705] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.705] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00913_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00913_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00913_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00913_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.706] CloseHandle (hObject=0xdc) returned 1 [0175.706] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b0c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00914_.WMF", cAlternateFileName="")) returned 1 [0175.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00914_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.707] GetProcessHeap () returned 0x4e0000 [0175.707] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.707] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.707] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.707] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.709] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.709] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.709] GetProcessHeap () returned 0x4e0000 [0175.709] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.709] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.709] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.709] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.709] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.709] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.709] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.709] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.709] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.709] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.709] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.709] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.709] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1b0c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1b0c, lpOverlapped=0x0) returned 1 [0175.710] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1b10, dwBufLen=0x1b10 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1b10) returned 1 [0175.710] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.710] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1b10, lpOverlapped=0x0) returned 1 [0175.710] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.710] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1be4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.710] SetEndOfFile (hFile=0xdc) returned 1 [0175.712] GetProcessHeap () returned 0x4e0000 [0175.712] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.712] GetProcessHeap () returned 0x4e0000 [0175.712] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.712] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00914_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00914_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00914_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.713] CloseHandle (hObject=0xdc) returned 1 [0175.713] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1bf8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00915_.WMF", cAlternateFileName="")) returned 1 [0175.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00915_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.714] GetProcessHeap () returned 0x4e0000 [0175.714] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.714] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.714] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.714] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.716] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.716] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.716] GetProcessHeap () returned 0x4e0000 [0175.716] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.716] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.716] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.716] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.716] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.716] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.716] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.716] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.716] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.716] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.716] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.716] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.716] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1bf8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1bf8, lpOverlapped=0x0) returned 1 [0175.717] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1c00, dwBufLen=0x1c00 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1c00) returned 1 [0175.717] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.717] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1c00, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1c00, lpOverlapped=0x0) returned 1 [0175.717] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.717] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1cd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.717] SetEndOfFile (hFile=0xdc) returned 1 [0175.719] GetProcessHeap () returned 0x4e0000 [0175.719] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.719] GetProcessHeap () returned 0x4e0000 [0175.720] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.720] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00915_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00915_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00915_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.721] CloseHandle (hObject=0xdc) returned 1 [0175.721] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1270, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00916_.WMF", cAlternateFileName="")) returned 1 [0175.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00916_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00916_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.721] GetProcessHeap () returned 0x4e0000 [0175.721] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.721] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.721] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.722] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.722] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.722] GetProcessHeap () returned 0x4e0000 [0175.722] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.722] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.722] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.722] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.723] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.723] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.723] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.723] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.723] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.724] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.724] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.724] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.724] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1270, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1270, lpOverlapped=0x0) returned 1 [0175.724] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1270, dwBufLen=0x1270 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1270) returned 1 [0175.724] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.724] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1270, lpOverlapped=0x0) returned 1 [0175.724] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.724] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1344, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.725] SetEndOfFile (hFile=0xdc) returned 1 [0175.726] GetProcessHeap () returned 0x4e0000 [0175.727] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.727] GetProcessHeap () returned 0x4e0000 [0175.727] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.727] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00916_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00916_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00916_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00916_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.728] CloseHandle (hObject=0xdc) returned 1 [0175.728] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x25ac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00917_.WMF", cAlternateFileName="")) returned 1 [0175.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00917_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00917_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.728] GetProcessHeap () returned 0x4e0000 [0175.728] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.728] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.729] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.729] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.731] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.731] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.731] GetProcessHeap () returned 0x4e0000 [0175.731] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.731] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.731] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.731] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.731] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.731] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.731] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.731] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.732] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.732] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.732] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.732] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.732] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x25ac, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x25ac, lpOverlapped=0x0) returned 1 [0175.732] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x25b0, dwBufLen=0x25b0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x25b0) returned 1 [0175.732] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.732] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x25b0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x25b0, lpOverlapped=0x0) returned 1 [0175.733] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.733] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.733] SetEndOfFile (hFile=0xdc) returned 1 [0175.735] GetProcessHeap () returned 0x4e0000 [0175.735] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.735] GetProcessHeap () returned 0x4e0000 [0175.735] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.735] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00917_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00917_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00917_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00917_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.736] CloseHandle (hObject=0xdc) returned 1 [0175.736] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f5c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00918_.WMF", cAlternateFileName="")) returned 1 [0175.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00918_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00918_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.737] GetProcessHeap () returned 0x4e0000 [0175.737] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.737] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.737] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.737] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.739] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.739] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.739] GetProcessHeap () returned 0x4e0000 [0175.739] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.739] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.739] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.739] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.739] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.739] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.739] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.739] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.739] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.739] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.739] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.739] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.739] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1f5c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1f5c, lpOverlapped=0x0) returned 1 [0175.765] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1f60, dwBufLen=0x1f60 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1f60) returned 1 [0175.765] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.766] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1f60, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1f60, lpOverlapped=0x0) returned 1 [0175.766] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.766] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.766] SetEndOfFile (hFile=0xdc) returned 1 [0175.768] GetProcessHeap () returned 0x4e0000 [0175.768] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.768] GetProcessHeap () returned 0x4e0000 [0175.768] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.768] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00918_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00918_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00918_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00918_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.771] CloseHandle (hObject=0xdc) returned 1 [0175.771] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2944, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00935_.WMF", cAlternateFileName="")) returned 1 [0175.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00935_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00935_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.773] GetProcessHeap () returned 0x4e0000 [0175.773] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.773] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.773] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.773] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0175.774] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.774] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.775] GetProcessHeap () returned 0x4e0000 [0175.775] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.775] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.775] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.775] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.775] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.775] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.775] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.775] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.775] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.775] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.775] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.775] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.775] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2944, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2944, lpOverlapped=0x0) returned 1 [0175.776] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2950, dwBufLen=0x2950 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2950) returned 1 [0175.776] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.776] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2950, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2950, lpOverlapped=0x0) returned 1 [0175.776] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.776] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2a24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.776] SetEndOfFile (hFile=0xdc) returned 1 [0175.778] GetProcessHeap () returned 0x4e0000 [0175.778] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.778] GetProcessHeap () returned 0x4e0000 [0175.778] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.779] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00935_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00935_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00935_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00935_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.780] CloseHandle (hObject=0xdc) returned 1 [0175.780] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1960, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00938_.WMF", cAlternateFileName="")) returned 1 [0175.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00938_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00938_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.781] GetProcessHeap () returned 0x4e0000 [0175.781] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.781] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.781] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.781] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.781] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.781] GetProcessHeap () returned 0x4e0000 [0175.781] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.781] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.782] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.782] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.783] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.783] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.783] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.784] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.784] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.784] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.784] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.784] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.784] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1960, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1960, lpOverlapped=0x0) returned 1 [0175.784] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1960, dwBufLen=0x1960 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1960) returned 1 [0175.785] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.785] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1960, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1960, lpOverlapped=0x0) returned 1 [0175.785] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.785] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1a34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.785] SetEndOfFile (hFile=0xdc) returned 1 [0175.787] GetProcessHeap () returned 0x4e0000 [0175.787] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.787] GetProcessHeap () returned 0x4e0000 [0175.787] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.787] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00938_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00938_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00938_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00938_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.788] CloseHandle (hObject=0xdc) returned 1 [0175.788] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1708, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00941_.WMF", cAlternateFileName="")) returned 1 [0175.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00941_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00941_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.789] GetProcessHeap () returned 0x4e0000 [0175.789] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.789] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.789] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.789] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.791] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.791] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.791] GetProcessHeap () returned 0x4e0000 [0175.791] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.791] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.791] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.791] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.791] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.791] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.791] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.791] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.791] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.791] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.791] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.791] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.791] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1708, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1708, lpOverlapped=0x0) returned 1 [0175.792] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1710, dwBufLen=0x1710 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1710) returned 1 [0175.792] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.792] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1710, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1710, lpOverlapped=0x0) returned 1 [0175.795] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.795] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x17e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.795] SetEndOfFile (hFile=0xdc) returned 1 [0175.798] GetProcessHeap () returned 0x4e0000 [0175.798] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.798] GetProcessHeap () returned 0x4e0000 [0175.798] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.798] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00941_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00941_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00941_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00941_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.799] CloseHandle (hObject=0xdc) returned 1 [0175.800] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1264, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00942_.WMF", cAlternateFileName="")) returned 1 [0175.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00942_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00942_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.801] GetProcessHeap () returned 0x4e0000 [0175.801] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.801] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.801] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.801] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0175.802] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.802] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.802] GetProcessHeap () returned 0x4e0000 [0175.802] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.803] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.803] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.803] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.803] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.803] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.803] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.803] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.803] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.803] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.803] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.803] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.803] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1264, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1264, lpOverlapped=0x0) returned 1 [0175.804] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1270, dwBufLen=0x1270 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1270) returned 1 [0175.804] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.804] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1270, lpOverlapped=0x0) returned 1 [0175.804] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.804] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1344, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.804] SetEndOfFile (hFile=0xdc) returned 1 [0175.806] GetProcessHeap () returned 0x4e0000 [0175.806] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.806] GetProcessHeap () returned 0x4e0000 [0175.806] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.806] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00942_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00942_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00942_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00942_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.807] CloseHandle (hObject=0xdc) returned 1 [0175.808] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d84, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00943_.WMF", cAlternateFileName="")) returned 1 [0175.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00943_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00943_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.809] GetProcessHeap () returned 0x4e0000 [0175.809] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.809] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.809] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.809] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0175.821] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.821] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.821] GetProcessHeap () returned 0x4e0000 [0175.821] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.822] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.822] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.822] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.822] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.822] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.822] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.822] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.822] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.822] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.822] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.822] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.822] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1d84, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1d84, lpOverlapped=0x0) returned 1 [0175.823] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1d90, dwBufLen=0x1d90 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1d90) returned 1 [0175.823] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.823] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1d90, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1d90, lpOverlapped=0x0) returned 1 [0175.823] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.823] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1e64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.823] SetEndOfFile (hFile=0xdc) returned 1 [0175.825] GetProcessHeap () returned 0x4e0000 [0175.825] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.825] GetProcessHeap () returned 0x4e0000 [0175.825] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.825] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00943_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00943_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00943_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00943_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.829] CloseHandle (hObject=0xdc) returned 1 [0175.829] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5505900, ftCreationTime.dwHighDateTime=0x1bd4b38, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5505900, ftLastWriteTime.dwHighDateTime=0x1bd4b38, nFileSizeHigh=0x0, nFileSizeLow=0xae1a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO01044_.WMF", cAlternateFileName="")) returned 1 [0175.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01044_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.830] GetProcessHeap () returned 0x4e0000 [0175.830] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.830] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.830] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.830] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0175.832] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.832] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.832] GetProcessHeap () returned 0x4e0000 [0175.832] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.832] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.832] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.832] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.832] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.832] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.832] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.832] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.832] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.833] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.833] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.833] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.833] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xae1a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xae1a, lpOverlapped=0x0) returned 1 [0175.833] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xae20, dwBufLen=0xae20 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xae20) returned 1 [0175.834] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.834] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xae20, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xae20, lpOverlapped=0x0) returned 1 [0175.834] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.834] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xaef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.834] SetEndOfFile (hFile=0xdc) returned 1 [0175.836] GetProcessHeap () returned 0x4e0000 [0175.836] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.836] GetProcessHeap () returned 0x4e0000 [0175.836] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.836] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01044_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01044_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01044_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.838] CloseHandle (hObject=0xdc) returned 1 [0175.838] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98336a00, ftCreationTime.dwHighDateTime=0x1bd4b38, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x98336a00, ftLastWriteTime.dwHighDateTime=0x1bd4b38, nFileSizeHigh=0x0, nFileSizeLow=0x5b38, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO01063_.WMF", cAlternateFileName="")) returned 1 [0175.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01063_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01063_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.839] GetProcessHeap () returned 0x4e0000 [0175.839] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.839] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.839] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.839] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.841] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.841] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.841] GetProcessHeap () returned 0x4e0000 [0175.841] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.841] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.841] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.841] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.842] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.842] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.842] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.842] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.842] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.842] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.842] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.842] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.842] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5b38, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x5b38, lpOverlapped=0x0) returned 1 [0175.843] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5b40, dwBufLen=0x5b40 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5b40) returned 1 [0175.843] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.843] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5b40, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5b40, lpOverlapped=0x0) returned 1 [0175.843] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.843] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5c14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.844] SetEndOfFile (hFile=0xdc) returned 1 [0175.846] GetProcessHeap () returned 0x4e0000 [0175.846] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.846] GetProcessHeap () returned 0x4e0000 [0175.846] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.846] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01063_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01063_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01063_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01063_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.847] CloseHandle (hObject=0xdc) returned 1 [0175.847] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1075e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO01236_.WMF", cAlternateFileName="")) returned 1 [0175.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01236_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.848] GetProcessHeap () returned 0x4e0000 [0175.848] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.848] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.848] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.848] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0175.850] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.850] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.850] GetProcessHeap () returned 0x4e0000 [0175.850] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.850] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.850] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.850] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.850] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.850] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.850] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.850] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.850] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.851] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.851] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.851] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.851] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1075e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1075e, lpOverlapped=0x0) returned 1 [0175.851] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x10760, dwBufLen=0x10760 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x10760) returned 1 [0175.852] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.852] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x10760, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x10760, lpOverlapped=0x0) returned 1 [0175.852] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.852] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x10834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.852] SetEndOfFile (hFile=0xdc) returned 1 [0175.855] GetProcessHeap () returned 0x4e0000 [0175.855] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.855] GetProcessHeap () returned 0x4e0000 [0175.855] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.855] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01236_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01236_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01236_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.856] CloseHandle (hObject=0xdc) returned 1 [0175.856] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e49c00, ftCreationTime.dwHighDateTime=0x1bd4b13, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe8e49c00, ftLastWriteTime.dwHighDateTime=0x1bd4b13, nFileSizeHigh=0x0, nFileSizeLow=0x43b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO01560_.WMF", cAlternateFileName="")) returned 1 [0175.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01560_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01560_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.857] GetProcessHeap () returned 0x4e0000 [0175.857] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.857] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.857] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.857] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.857] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.857] GetProcessHeap () returned 0x4e0000 [0175.857] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.857] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.857] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.857] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.861] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.861] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.861] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.861] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.861] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.861] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.862] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.862] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.862] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x43b0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x43b0, lpOverlapped=0x0) returned 1 [0175.862] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x43b0, dwBufLen=0x43b0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x43b0) returned 1 [0175.863] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.863] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x43b0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x43b0, lpOverlapped=0x0) returned 1 [0175.863] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.863] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4484, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.863] SetEndOfFile (hFile=0xdc) returned 1 [0175.865] GetProcessHeap () returned 0x4e0000 [0175.865] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.865] GetProcessHeap () returned 0x4e0000 [0175.865] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.865] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01560_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01560_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01560_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01560_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.866] CloseHandle (hObject=0xdc) returned 1 [0175.866] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2b10300, ftCreationTime.dwHighDateTime=0x1bd4af7, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc2b10300, ftLastWriteTime.dwHighDateTime=0x1bd4af7, nFileSizeHigh=0x0, nFileSizeLow=0x59d8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO01561_.WMF", cAlternateFileName="")) returned 1 [0175.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01561_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01561_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.867] GetProcessHeap () returned 0x4e0000 [0175.867] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.867] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.867] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.868] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.869] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.869] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.869] GetProcessHeap () returned 0x4e0000 [0175.869] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.869] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.869] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.869] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.869] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.869] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.870] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.870] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.870] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.870] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.870] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.870] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.870] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x59d8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x59d8, lpOverlapped=0x0) returned 1 [0175.871] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x59e0, dwBufLen=0x59e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x59e0) returned 1 [0175.871] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.871] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x59e0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x59e0, lpOverlapped=0x0) returned 1 [0175.871] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.871] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5ab4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.871] SetEndOfFile (hFile=0xdc) returned 1 [0175.874] GetProcessHeap () returned 0x4e0000 [0175.874] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.874] GetProcessHeap () returned 0x4e0000 [0175.874] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.874] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01561_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01561_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01561_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01561_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.875] CloseHandle (hObject=0xdc) returned 1 [0175.875] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc04ea900, ftCreationTime.dwHighDateTime=0x1bd4af7, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc04ea900, ftLastWriteTime.dwHighDateTime=0x1bd4af7, nFileSizeHigh=0x0, nFileSizeLow=0x75ca, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO01563_.WMF", cAlternateFileName="")) returned 1 [0175.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01563_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.876] GetProcessHeap () returned 0x4e0000 [0175.876] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.876] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.876] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.876] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0175.878] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.878] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.878] GetProcessHeap () returned 0x4e0000 [0175.878] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.878] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.878] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.878] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.878] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.878] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.878] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.878] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.878] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.878] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.878] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.878] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.878] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x75ca, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x75ca, lpOverlapped=0x0) returned 1 [0175.879] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x75d0, dwBufLen=0x75d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x75d0) returned 1 [0175.880] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.880] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x75d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x75d0, lpOverlapped=0x0) returned 1 [0175.880] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.880] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x76a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.880] SetEndOfFile (hFile=0xdc) returned 1 [0175.882] GetProcessHeap () returned 0x4e0000 [0175.882] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.882] GetProcessHeap () returned 0x4e0000 [0175.882] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.882] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01563_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01563_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01563_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.883] CloseHandle (hObject=0xdc) returned 1 [0175.883] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcbb2200, ftCreationTime.dwHighDateTime=0x1bd4af7, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcbb2200, ftLastWriteTime.dwHighDateTime=0x1bd4af7, nFileSizeHigh=0x0, nFileSizeLow=0x51a8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO01566_.WMF", cAlternateFileName="")) returned 1 [0175.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01566_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01566_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.885] GetProcessHeap () returned 0x4e0000 [0175.885] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.885] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.885] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.885] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.886] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.886] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.887] GetProcessHeap () returned 0x4e0000 [0175.887] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.887] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.887] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.887] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.887] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.887] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.887] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.887] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.887] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.887] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.887] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.887] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.887] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x51a8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x51a8, lpOverlapped=0x0) returned 1 [0175.888] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x51b0, dwBufLen=0x51b0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x51b0) returned 1 [0175.888] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.888] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x51b0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x51b0, lpOverlapped=0x0) returned 1 [0175.889] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.889] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5284, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.889] SetEndOfFile (hFile=0xdc) returned 1 [0175.891] GetProcessHeap () returned 0x4e0000 [0175.891] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.891] GetProcessHeap () returned 0x4e0000 [0175.891] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.891] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01566_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01566_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01566_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01566_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.892] CloseHandle (hObject=0xdc) returned 1 [0175.892] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xebb7200, ftCreationTime.dwHighDateTime=0x1bd4b0f, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xebb7200, ftLastWriteTime.dwHighDateTime=0x1bd4b0f, nFileSizeHigh=0x0, nFileSizeLow=0x54b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO01568_.WMF", cAlternateFileName="")) returned 1 [0175.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01568_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01568_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.893] GetProcessHeap () returned 0x4e0000 [0175.893] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.893] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.893] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.893] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.893] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.893] GetProcessHeap () returned 0x4e0000 [0175.893] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.893] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.893] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.893] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.895] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.895] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.895] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.895] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.895] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.895] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.895] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.895] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.895] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x54b0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x54b0, lpOverlapped=0x0) returned 1 [0175.896] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x54b0, dwBufLen=0x54b0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x54b0) returned 1 [0175.897] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.897] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x54b0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x54b0, lpOverlapped=0x0) returned 1 [0175.897] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.897] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5584, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.897] SetEndOfFile (hFile=0xdc) returned 1 [0175.899] GetProcessHeap () returned 0x4e0000 [0175.899] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.899] GetProcessHeap () returned 0x4e0000 [0175.899] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.899] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01568_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01568_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01568_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01568_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.900] CloseHandle (hObject=0xdc) returned 1 [0175.900] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcb57400, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcb57400, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x47a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO01569_.WMF", cAlternateFileName="")) returned 1 [0175.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01569_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01569_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.902] GetProcessHeap () returned 0x4e0000 [0175.902] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.902] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.902] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.902] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.902] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.902] GetProcessHeap () returned 0x4e0000 [0175.902] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.902] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.902] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.902] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.904] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.904] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.904] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.904] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.904] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.904] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.904] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.904] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.904] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x47a0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x47a0, lpOverlapped=0x0) returned 1 [0175.905] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x47a0, dwBufLen=0x47a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x47a0) returned 1 [0175.905] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.906] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x47a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x47a0, lpOverlapped=0x0) returned 1 [0175.906] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.906] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4874, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.906] SetEndOfFile (hFile=0xdc) returned 1 [0175.908] GetProcessHeap () returned 0x4e0000 [0175.908] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.908] GetProcessHeap () returned 0x4e0000 [0175.908] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.908] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01569_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01569_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01569_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01569_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.910] CloseHandle (hObject=0xdc) returned 1 [0175.910] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd5f9e00, ftCreationTime.dwHighDateTime=0x1bd4adf, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcd5f9e00, ftLastWriteTime.dwHighDateTime=0x1bd4adf, nFileSizeHigh=0x0, nFileSizeLow=0xa8a6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO01575_.WMF", cAlternateFileName="")) returned 1 [0175.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01575_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01575_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.911] GetProcessHeap () returned 0x4e0000 [0175.911] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.911] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.911] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.911] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0175.912] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.912] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.912] GetProcessHeap () returned 0x4e0000 [0175.912] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.912] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.912] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.912] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.912] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.913] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.913] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.913] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.913] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.913] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.913] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.913] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.913] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xa8a6, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xa8a6, lpOverlapped=0x0) returned 1 [0175.914] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa8b0, dwBufLen=0xa8b0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa8b0) returned 1 [0175.914] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.914] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xa8b0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xa8b0, lpOverlapped=0x0) returned 1 [0175.914] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.914] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xa984, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.914] SetEndOfFile (hFile=0xdc) returned 1 [0175.917] GetProcessHeap () returned 0x4e0000 [0175.917] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.917] GetProcessHeap () returned 0x4e0000 [0175.917] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.917] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01575_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01575_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01575_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01575_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.918] CloseHandle (hObject=0xdc) returned 1 [0175.918] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd892e800, ftCreationTime.dwHighDateTime=0x1bd4b38, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd892e800, ftLastWriteTime.dwHighDateTime=0x1bd4b38, nFileSizeHigh=0x0, nFileSizeLow=0x2566, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO01777_.WMF", cAlternateFileName="")) returned 1 [0175.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01777_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01777_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.919] GetProcessHeap () returned 0x4e0000 [0175.919] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.919] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.919] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.919] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0175.921] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.921] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.921] GetProcessHeap () returned 0x4e0000 [0175.921] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.921] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.921] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.921] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.921] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.921] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.922] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.922] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.922] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.922] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.922] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.922] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.922] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2566, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2566, lpOverlapped=0x0) returned 1 [0175.923] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2570, dwBufLen=0x2570 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2570) returned 1 [0175.924] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.924] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2570, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2570, lpOverlapped=0x0) returned 1 [0175.924] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.924] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2644, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.924] SetEndOfFile (hFile=0xdc) returned 1 [0175.926] GetProcessHeap () returned 0x4e0000 [0175.926] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.926] GetProcessHeap () returned 0x4e0000 [0175.926] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.926] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01777_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01777_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01777_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01777_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.927] CloseHandle (hObject=0xdc) returned 1 [0175.927] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6ca8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO01785_.WMF", cAlternateFileName="")) returned 1 [0175.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01785_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01785_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.928] GetProcessHeap () returned 0x4e0000 [0175.928] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.928] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.928] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.928] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.930] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.930] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.930] GetProcessHeap () returned 0x4e0000 [0175.930] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.930] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.930] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.930] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.930] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.930] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.930] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.930] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.930] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.930] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.931] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.931] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.931] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x6ca8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x6ca8, lpOverlapped=0x0) returned 1 [0175.932] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6cb0, dwBufLen=0x6cb0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6cb0) returned 1 [0175.932] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.932] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6cb0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x6cb0, lpOverlapped=0x0) returned 1 [0175.932] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.932] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6d84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.932] SetEndOfFile (hFile=0xdc) returned 1 [0175.934] GetProcessHeap () returned 0x4e0000 [0175.934] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.934] GetProcessHeap () returned 0x4e0000 [0175.934] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.934] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01785_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01785_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01785_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01785_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.935] CloseHandle (hObject=0xdc) returned 1 [0175.936] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8632900, ftCreationTime.dwHighDateTime=0x1bd4b38, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb8632900, ftLastWriteTime.dwHighDateTime=0x1bd4b38, nFileSizeHigh=0x0, nFileSizeLow=0x1088, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO01805_.WMF", cAlternateFileName="")) returned 1 [0175.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01805_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01805_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.936] GetProcessHeap () returned 0x4e0000 [0175.936] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.936] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.936] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.936] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.938] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.938] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.938] GetProcessHeap () returned 0x4e0000 [0175.938] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.938] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.938] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.938] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.939] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.939] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.939] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.939] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.939] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.939] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.939] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.939] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.939] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1088, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1088, lpOverlapped=0x0) returned 1 [0175.940] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1090, dwBufLen=0x1090 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1090) returned 1 [0175.940] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.940] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1090, lpOverlapped=0x0) returned 1 [0175.940] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.940] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1164, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.940] SetEndOfFile (hFile=0xdc) returned 1 [0175.942] GetProcessHeap () returned 0x4e0000 [0175.942] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.942] GetProcessHeap () returned 0x4e0000 [0175.942] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.942] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01805_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01805_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01805_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01805_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.943] CloseHandle (hObject=0xdc) returned 1 [0175.943] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe32d8d00, ftCreationTime.dwHighDateTime=0x1bd4af8, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe32d8d00, ftLastWriteTime.dwHighDateTime=0x1bd4af8, nFileSizeHigh=0x0, nFileSizeLow=0x578, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO01905_.WMF", cAlternateFileName="")) returned 1 [0175.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01905_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01905_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.944] GetProcessHeap () returned 0x4e0000 [0175.944] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.944] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.944] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.944] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.946] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.946] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.946] GetProcessHeap () returned 0x4e0000 [0175.946] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.946] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.946] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.946] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.946] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.946] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.946] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.946] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.946] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.946] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.946] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.946] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.946] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x578, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x578, lpOverlapped=0x0) returned 1 [0175.946] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x580, dwBufLen=0x580 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x580) returned 1 [0175.946] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.947] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x580, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x580, lpOverlapped=0x0) returned 1 [0175.947] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.947] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x654, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.947] SetEndOfFile (hFile=0xdc) returned 1 [0175.949] GetProcessHeap () returned 0x4e0000 [0175.949] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.949] GetProcessHeap () returned 0x4e0000 [0175.949] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.949] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01905_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01905_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01905_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01905_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.950] CloseHandle (hObject=0xdc) returned 1 [0175.950] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3086, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO01954_.WMF", cAlternateFileName="")) returned 1 [0175.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01954_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01954_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.951] GetProcessHeap () returned 0x4e0000 [0175.951] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.951] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.951] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.951] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0175.953] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.953] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.953] GetProcessHeap () returned 0x4e0000 [0175.953] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.953] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.953] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.953] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.953] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.953] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.953] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.953] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.953] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.953] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.953] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.953] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.954] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3086, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3086, lpOverlapped=0x0) returned 1 [0175.954] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3090, dwBufLen=0x3090 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3090) returned 1 [0175.954] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.954] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3090, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3090, lpOverlapped=0x0) returned 1 [0175.954] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.954] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3164, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.954] SetEndOfFile (hFile=0xdc) returned 1 [0175.957] GetProcessHeap () returned 0x4e0000 [0175.957] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.957] GetProcessHeap () returned 0x4e0000 [0175.957] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.957] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01954_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01954_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01954_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01954_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.958] CloseHandle (hObject=0xdc) returned 1 [0175.958] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d14, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02009_.WMF", cAlternateFileName="")) returned 1 [0175.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02009_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02009_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.959] GetProcessHeap () returned 0x4e0000 [0175.959] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.959] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.959] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.959] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0175.961] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.961] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.961] GetProcessHeap () returned 0x4e0000 [0175.961] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.961] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.961] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.961] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.961] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.961] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.961] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.961] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.961] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.962] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.962] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.962] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.962] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1d14, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1d14, lpOverlapped=0x0) returned 1 [0175.962] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1d20, dwBufLen=0x1d20 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1d20) returned 1 [0175.962] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.962] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1d20, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1d20, lpOverlapped=0x0) returned 1 [0175.963] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.963] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1df4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.963] SetEndOfFile (hFile=0xdc) returned 1 [0175.965] GetProcessHeap () returned 0x4e0000 [0175.965] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.965] GetProcessHeap () returned 0x4e0000 [0175.965] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.965] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02009_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02009_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02009_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02009_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.966] CloseHandle (hObject=0xdc) returned 1 [0175.966] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d68, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02022_.WMF", cAlternateFileName="")) returned 1 [0175.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02022_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02022_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.967] GetProcessHeap () returned 0x4e0000 [0175.967] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.967] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.967] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.967] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.969] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.969] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.969] GetProcessHeap () returned 0x4e0000 [0175.969] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.969] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.969] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.969] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.969] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.969] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.969] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.969] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.970] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.970] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.970] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.970] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.970] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1d68, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1d68, lpOverlapped=0x0) returned 1 [0175.971] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1d70, dwBufLen=0x1d70 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1d70) returned 1 [0175.971] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.971] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1d70, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1d70, lpOverlapped=0x0) returned 1 [0175.971] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.971] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1e44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.971] SetEndOfFile (hFile=0xdc) returned 1 [0175.973] GetProcessHeap () returned 0x4e0000 [0175.973] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.973] GetProcessHeap () returned 0x4e0000 [0175.973] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.973] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02022_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02022_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02022_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02022_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.975] CloseHandle (hObject=0xdc) returned 1 [0175.975] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x23a8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02024_.WMF", cAlternateFileName="")) returned 1 [0175.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02024_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02024_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.975] GetProcessHeap () returned 0x4e0000 [0175.976] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.976] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.976] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.976] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.977] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.977] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.977] GetProcessHeap () returned 0x4e0000 [0175.977] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.977] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.977] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.977] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.977] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.977] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.978] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.978] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.978] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.978] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.978] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.978] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.978] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x23a8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x23a8, lpOverlapped=0x0) returned 1 [0175.978] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x23b0, dwBufLen=0x23b0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x23b0) returned 1 [0175.979] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.979] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x23b0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x23b0, lpOverlapped=0x0) returned 1 [0175.979] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.979] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2484, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.979] SetEndOfFile (hFile=0xdc) returned 1 [0175.981] GetProcessHeap () returned 0x4e0000 [0175.981] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0175.981] GetProcessHeap () returned 0x4e0000 [0175.981] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0175.981] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02024_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02024_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02024_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02024_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0175.982] CloseHandle (hObject=0xdc) returned 1 [0175.983] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2016, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02025_.WMF", cAlternateFileName="")) returned 1 [0175.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02025_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02025_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0175.984] GetProcessHeap () returned 0x4e0000 [0175.984] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0175.984] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0175.984] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0175.984] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0175.997] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.997] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.997] GetProcessHeap () returned 0x4e0000 [0175.997] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0175.997] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0175.997] CryptDestroyKey (hKey=0x522f98) returned 1 [0175.997] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0175.997] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0175.997] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0175.997] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0175.997] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0175.997] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0175.998] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0175.998] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0175.998] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.998] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2016, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2016, lpOverlapped=0x0) returned 1 [0176.005] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2020, dwBufLen=0x2020 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2020) returned 1 [0176.005] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.006] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2020, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2020, lpOverlapped=0x0) returned 1 [0176.006] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.006] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x20f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.006] SetEndOfFile (hFile=0xdc) returned 1 [0176.008] GetProcessHeap () returned 0x4e0000 [0176.008] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.008] GetProcessHeap () returned 0x4e0000 [0176.008] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.008] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02025_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02025_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02025_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02025_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.010] CloseHandle (hObject=0xdc) returned 1 [0176.010] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x24c8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02028_.WMF", cAlternateFileName="")) returned 1 [0176.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02028_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02028_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.011] GetProcessHeap () returned 0x4e0000 [0176.011] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.011] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.011] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.011] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.013] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.013] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.013] GetProcessHeap () returned 0x4e0000 [0176.013] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.013] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.013] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.013] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.013] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.013] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.013] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.013] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.013] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.013] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.013] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.013] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.013] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x24c8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x24c8, lpOverlapped=0x0) returned 1 [0176.014] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x24d0, dwBufLen=0x24d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x24d0) returned 1 [0176.014] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.014] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x24d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x24d0, lpOverlapped=0x0) returned 1 [0176.015] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.015] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x25a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.015] SetEndOfFile (hFile=0xdc) returned 1 [0176.017] GetProcessHeap () returned 0x4e0000 [0176.017] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.017] GetProcessHeap () returned 0x4e0000 [0176.017] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.017] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02028_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02028_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02028_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02028_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.019] CloseHandle (hObject=0xdc) returned 1 [0176.019] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x266c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02045_.WMF", cAlternateFileName="")) returned 1 [0176.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02045_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.020] GetProcessHeap () returned 0x4e0000 [0176.020] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.020] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.020] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.021] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.023] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.023] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.023] GetProcessHeap () returned 0x4e0000 [0176.024] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.024] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.024] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.024] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.024] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.024] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.024] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.024] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.024] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.024] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.024] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.024] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.024] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x266c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x266c, lpOverlapped=0x0) returned 1 [0176.025] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2670, dwBufLen=0x2670 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2670) returned 1 [0176.025] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.025] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2670, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2670, lpOverlapped=0x0) returned 1 [0176.025] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.025] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2744, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.025] SetEndOfFile (hFile=0xdc) returned 1 [0176.027] GetProcessHeap () returned 0x4e0000 [0176.027] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.027] GetProcessHeap () returned 0x4e0000 [0176.027] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.027] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02045_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02045_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02045_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.029] CloseHandle (hObject=0xdc) returned 1 [0176.029] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1fde, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02048_.WMF", cAlternateFileName="")) returned 1 [0176.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02048_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02048_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.032] GetProcessHeap () returned 0x4e0000 [0176.032] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.032] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.032] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.032] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0176.033] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.033] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.033] GetProcessHeap () returned 0x4e0000 [0176.034] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.034] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.034] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.034] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.034] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.034] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.034] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.034] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.034] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.034] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.034] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.034] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.034] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1fde, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1fde, lpOverlapped=0x0) returned 1 [0176.035] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1fe0, dwBufLen=0x1fe0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1fe0) returned 1 [0176.035] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.035] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1fe0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1fe0, lpOverlapped=0x0) returned 1 [0176.035] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.035] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x20b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.035] SetEndOfFile (hFile=0xdc) returned 1 [0176.037] GetProcessHeap () returned 0x4e0000 [0176.037] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.037] GetProcessHeap () returned 0x4e0000 [0176.038] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.038] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02048_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02048_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02048_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02048_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.039] CloseHandle (hObject=0xdc) returned 1 [0176.039] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2c2c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02051_.WMF", cAlternateFileName="")) returned 1 [0176.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02051_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02051_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.040] GetProcessHeap () returned 0x4e0000 [0176.040] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.040] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.040] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.040] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.042] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.042] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.042] GetProcessHeap () returned 0x4e0000 [0176.042] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.042] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.042] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.042] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.042] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.042] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.042] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.042] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.042] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.042] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.042] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.042] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.043] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2c2c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2c2c, lpOverlapped=0x0) returned 1 [0176.043] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2c30, dwBufLen=0x2c30 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2c30) returned 1 [0176.043] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.043] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2c30, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2c30, lpOverlapped=0x0) returned 1 [0176.043] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.043] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2d04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.043] SetEndOfFile (hFile=0xdc) returned 1 [0176.045] GetProcessHeap () returned 0x4e0000 [0176.046] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.046] GetProcessHeap () returned 0x4e0000 [0176.046] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.046] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02051_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02051_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02051_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02051_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.047] CloseHandle (hObject=0xdc) returned 1 [0176.047] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e1d7400, ftCreationTime.dwHighDateTime=0x1bd4be9, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e1d7400, ftLastWriteTime.dwHighDateTime=0x1bd4be9, nFileSizeHigh=0x0, nFileSizeLow=0x30ca, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02054_.WMF", cAlternateFileName="")) returned 1 [0176.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02054_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02054_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.049] GetProcessHeap () returned 0x4e0000 [0176.049] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.049] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.049] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.049] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0176.050] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.050] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.050] GetProcessHeap () returned 0x4e0000 [0176.050] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.050] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.050] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.050] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.050] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.051] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.051] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.051] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.051] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.051] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.051] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.051] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.051] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x30ca, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x30ca, lpOverlapped=0x0) returned 1 [0176.052] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x30d0, dwBufLen=0x30d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x30d0) returned 1 [0176.052] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.052] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x30d0, lpOverlapped=0x0) returned 1 [0176.052] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.052] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x31a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.052] SetEndOfFile (hFile=0xdc) returned 1 [0176.054] GetProcessHeap () returned 0x4e0000 [0176.054] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.054] GetProcessHeap () returned 0x4e0000 [0176.054] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.054] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02054_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02054_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02054_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02054_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.056] CloseHandle (hObject=0xdc) returned 1 [0176.056] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cec4700, ftCreationTime.dwHighDateTime=0x1bd4be9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8cec4700, ftLastWriteTime.dwHighDateTime=0x1bd4be9, nFileSizeHigh=0x0, nFileSizeLow=0x4c4c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02055_.WMF", cAlternateFileName="")) returned 1 [0176.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02055_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.057] GetProcessHeap () returned 0x4e0000 [0176.057] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.057] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.057] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.057] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.059] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.059] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.059] GetProcessHeap () returned 0x4e0000 [0176.059] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.059] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.059] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.059] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.059] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.059] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.059] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.059] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.059] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.060] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.060] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.060] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.060] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4c4c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4c4c, lpOverlapped=0x0) returned 1 [0176.060] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4c50, dwBufLen=0x4c50 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4c50) returned 1 [0176.061] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.061] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4c50, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4c50, lpOverlapped=0x0) returned 1 [0176.061] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.061] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4d24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.061] SetEndOfFile (hFile=0xdc) returned 1 [0176.063] GetProcessHeap () returned 0x4e0000 [0176.063] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.063] GetProcessHeap () returned 0x4e0000 [0176.063] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.063] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02055_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02055_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.065] CloseHandle (hObject=0xdc) returned 1 [0176.065] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8362df00, ftCreationTime.dwHighDateTime=0x1bd4be9, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8362df00, ftLastWriteTime.dwHighDateTime=0x1bd4be9, nFileSizeHigh=0x0, nFileSizeLow=0x382a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02067_.WMF", cAlternateFileName="")) returned 1 [0176.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02067_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.066] GetProcessHeap () returned 0x4e0000 [0176.066] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.066] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.066] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.066] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0176.067] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.067] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.067] GetProcessHeap () returned 0x4e0000 [0176.067] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.067] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.068] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.068] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.068] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.068] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.068] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.068] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.068] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.068] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.068] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.068] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.068] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x382a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x382a, lpOverlapped=0x0) returned 1 [0176.069] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3830, dwBufLen=0x3830 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3830) returned 1 [0176.069] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.069] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3830, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3830, lpOverlapped=0x0) returned 1 [0176.070] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.070] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3904, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.070] SetEndOfFile (hFile=0xdc) returned 1 [0176.072] GetProcessHeap () returned 0x4e0000 [0176.072] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.072] GetProcessHeap () returned 0x4e0000 [0176.072] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.072] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02067_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02067_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.074] CloseHandle (hObject=0xdc) returned 1 [0176.074] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63332000, ftCreationTime.dwHighDateTime=0x1bd4be9, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x63332000, ftLastWriteTime.dwHighDateTime=0x1bd4be9, nFileSizeHigh=0x0, nFileSizeLow=0x1b4a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02094_.WMF", cAlternateFileName="")) returned 1 [0176.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02094_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.075] GetProcessHeap () returned 0x4e0000 [0176.075] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.075] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.075] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.075] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0176.076] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.076] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.076] GetProcessHeap () returned 0x4e0000 [0176.076] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.076] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.076] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.076] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.077] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.077] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.077] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.077] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.077] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.077] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.077] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.077] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.077] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1b4a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1b4a, lpOverlapped=0x0) returned 1 [0176.078] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1b50, dwBufLen=0x1b50 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1b50) returned 1 [0176.078] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.078] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1b50, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1b50, lpOverlapped=0x0) returned 1 [0176.078] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.078] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1c24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.078] SetEndOfFile (hFile=0xdc) returned 1 [0176.080] GetProcessHeap () returned 0x4e0000 [0176.080] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.080] GetProcessHeap () returned 0x4e0000 [0176.080] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.081] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02094_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02094_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.082] CloseHandle (hObject=0xdc) returned 1 [0176.082] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95d01f00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95d01f00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x540, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02227_.WMF", cAlternateFileName="")) returned 1 [0176.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02227_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.083] GetProcessHeap () returned 0x4e0000 [0176.083] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.083] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.083] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.083] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.083] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.083] GetProcessHeap () returned 0x4e0000 [0176.083] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.083] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.083] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.083] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.085] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.085] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.085] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.085] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.085] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.085] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.085] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.085] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.085] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x540, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x540, lpOverlapped=0x0) returned 1 [0176.085] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x540, dwBufLen=0x540 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x540) returned 1 [0176.085] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.085] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x540, lpOverlapped=0x0) returned 1 [0176.086] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.086] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.086] SetEndOfFile (hFile=0xdc) returned 1 [0176.088] GetProcessHeap () returned 0x4e0000 [0176.088] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.088] GetProcessHeap () returned 0x4e0000 [0176.088] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.088] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02227_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02227_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.089] CloseHandle (hObject=0xdc) returned 1 [0176.089] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf83e1500, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf83e1500, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0x334, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02228_.WMF", cAlternateFileName="")) returned 1 [0176.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02228_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.090] GetProcessHeap () returned 0x4e0000 [0176.090] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.090] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.090] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.090] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0176.092] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.092] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.092] GetProcessHeap () returned 0x4e0000 [0176.092] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.092] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.092] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.092] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.092] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.092] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.093] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.093] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.093] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.093] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.093] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.093] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.093] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x334, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x334, lpOverlapped=0x0) returned 1 [0176.093] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x340, dwBufLen=0x340 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x340) returned 1 [0176.093] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.093] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x340, lpOverlapped=0x0) returned 1 [0176.093] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.093] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x414, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.093] SetEndOfFile (hFile=0xdc) returned 1 [0176.095] GetProcessHeap () returned 0x4e0000 [0176.095] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.095] GetProcessHeap () returned 0x4e0000 [0176.095] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.096] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02228_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02228_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.097] CloseHandle (hObject=0xdc) returned 1 [0176.097] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcd30a00, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdcd30a00, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0x900, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02233_.WMF", cAlternateFileName="")) returned 1 [0176.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02233_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.098] GetProcessHeap () returned 0x4e0000 [0176.098] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.098] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.098] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.099] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.099] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.099] GetProcessHeap () returned 0x4e0000 [0176.099] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.099] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.099] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.099] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.101] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.101] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.101] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.101] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.101] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.101] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.101] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.101] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.102] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x900, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x900, lpOverlapped=0x0) returned 1 [0176.102] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x900, dwBufLen=0x900 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x900) returned 1 [0176.102] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.102] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x900, lpOverlapped=0x0) returned 1 [0176.102] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.102] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x9d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.102] SetEndOfFile (hFile=0xdc) returned 1 [0176.105] GetProcessHeap () returned 0x4e0000 [0176.105] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.105] GetProcessHeap () returned 0x4e0000 [0176.105] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.105] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02233_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02233_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.106] CloseHandle (hObject=0xdc) returned 1 [0176.106] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73eb9200, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73eb9200, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0xe88, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02252_.WMF", cAlternateFileName="")) returned 1 [0176.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02252_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.108] GetProcessHeap () returned 0x4e0000 [0176.108] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.108] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.108] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.108] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.110] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.111] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.111] GetProcessHeap () returned 0x4e0000 [0176.111] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.111] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.111] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.111] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.111] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.111] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.111] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.111] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.111] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.111] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.111] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.111] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.111] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xe88, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xe88, lpOverlapped=0x0) returned 1 [0176.112] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe90, dwBufLen=0xe90 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe90) returned 1 [0176.112] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.112] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xe90, lpOverlapped=0x0) returned 1 [0176.112] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.112] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xf64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.112] SetEndOfFile (hFile=0xdc) returned 1 [0176.115] GetProcessHeap () returned 0x4e0000 [0176.115] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.115] GetProcessHeap () returned 0x4e0000 [0176.115] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.115] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02252_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02252_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.116] CloseHandle (hObject=0xdc) returned 1 [0176.116] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f26de00, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f26de00, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0x8e0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02253_.WMF", cAlternateFileName="")) returned 1 [0176.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02253_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.117] GetProcessHeap () returned 0x4e0000 [0176.118] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.118] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.118] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.118] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.118] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.118] GetProcessHeap () returned 0x4e0000 [0176.118] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.118] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.118] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.118] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.123] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.123] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.123] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.123] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.123] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.123] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.123] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.123] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.123] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x8e0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x8e0, lpOverlapped=0x0) returned 1 [0176.123] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8e0, dwBufLen=0x8e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8e0) returned 1 [0176.123] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.123] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x8e0, lpOverlapped=0x0) returned 1 [0176.124] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.124] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x9b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.124] SetEndOfFile (hFile=0xdc) returned 1 [0176.126] GetProcessHeap () returned 0x4e0000 [0176.127] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.127] GetProcessHeap () returned 0x4e0000 [0176.127] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.127] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02253_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02253_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.128] CloseHandle (hObject=0xdc) returned 1 [0176.128] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1436bc00, ftCreationTime.dwHighDateTime=0x1bd4be4, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1436bc00, ftLastWriteTime.dwHighDateTime=0x1bd4be4, nFileSizeHigh=0x0, nFileSizeLow=0x818, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02261_.WMF", cAlternateFileName="")) returned 1 [0176.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.130] GetProcessHeap () returned 0x4e0000 [0176.130] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.130] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.130] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.130] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.133] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.133] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.133] GetProcessHeap () returned 0x4e0000 [0176.133] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.133] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.133] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.133] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.133] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.133] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.133] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.133] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.133] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.134] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.134] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.134] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.134] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x818, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x818, lpOverlapped=0x0) returned 1 [0176.134] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x820, dwBufLen=0x820 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x820) returned 1 [0176.134] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.134] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x820, lpOverlapped=0x0) returned 1 [0176.134] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.134] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x8f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.134] SetEndOfFile (hFile=0xdc) returned 1 [0176.137] GetProcessHeap () returned 0x4e0000 [0176.137] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.137] GetProcessHeap () returned 0x4e0000 [0176.137] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.137] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02261_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02261_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.138] CloseHandle (hObject=0xdc) returned 1 [0176.140] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3be44f00, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3be44f00, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0xa94, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02263_.WMF", cAlternateFileName="")) returned 1 [0176.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02263_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.142] GetProcessHeap () returned 0x4e0000 [0176.142] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.142] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.142] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.143] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0176.144] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.145] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.145] GetProcessHeap () returned 0x4e0000 [0176.145] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.145] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.145] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.145] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.145] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.145] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.145] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.145] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.145] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.145] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.145] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.145] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.145] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xa94, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xa94, lpOverlapped=0x0) returned 1 [0176.146] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xaa0, dwBufLen=0xaa0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xaa0) returned 1 [0176.146] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.146] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xaa0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xaa0, lpOverlapped=0x0) returned 1 [0176.146] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.146] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xb74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.146] SetEndOfFile (hFile=0xdc) returned 1 [0176.148] GetProcessHeap () returned 0x4e0000 [0176.149] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.149] GetProcessHeap () returned 0x4e0000 [0176.149] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.149] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02263_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02263_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.150] CloseHandle (hObject=0xdc) returned 1 [0176.150] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x325ae700, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x325ae700, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0x38c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02265_.WMF", cAlternateFileName="")) returned 1 [0176.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02265_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.151] GetProcessHeap () returned 0x4e0000 [0176.151] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.151] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.151] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.151] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.153] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.153] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.153] GetProcessHeap () returned 0x4e0000 [0176.153] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.153] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.153] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.153] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.153] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.154] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.154] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.154] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.154] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.154] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.154] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.154] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.154] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x38c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x38c, lpOverlapped=0x0) returned 1 [0176.154] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x390, dwBufLen=0x390 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x390) returned 1 [0176.154] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.154] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x390, lpOverlapped=0x0) returned 1 [0176.154] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.154] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.154] SetEndOfFile (hFile=0xdc) returned 1 [0176.157] GetProcessHeap () returned 0x4e0000 [0176.157] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.157] GetProcessHeap () returned 0x4e0000 [0176.157] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.157] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02265_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02265_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.159] CloseHandle (hObject=0xdc) returned 1 [0176.159] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e16ea00, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e16ea00, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0x61c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02268_.WMF", cAlternateFileName="")) returned 1 [0176.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02268_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.160] GetProcessHeap () returned 0x4e0000 [0176.160] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.160] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.160] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.160] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.162] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.162] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.162] GetProcessHeap () returned 0x4e0000 [0176.162] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.162] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.162] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.162] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.162] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.162] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.162] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.162] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.162] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.163] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.163] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.163] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.163] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x61c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x61c, lpOverlapped=0x0) returned 1 [0176.163] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x620, dwBufLen=0x620 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x620) returned 1 [0176.163] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.163] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x620, lpOverlapped=0x0) returned 1 [0176.163] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.163] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.163] SetEndOfFile (hFile=0xdc) returned 1 [0176.166] GetProcessHeap () returned 0x4e0000 [0176.166] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.166] GetProcessHeap () returned 0x4e0000 [0176.166] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.166] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02268_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02268_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.167] CloseHandle (hObject=0xdc) returned 1 [0176.167] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a836300, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1a836300, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0xaf0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02269_.WMF", cAlternateFileName="")) returned 1 [0176.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.168] GetProcessHeap () returned 0x4e0000 [0176.168] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.168] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.168] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.168] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.168] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.168] GetProcessHeap () returned 0x4e0000 [0176.168] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.168] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.168] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.169] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.171] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.171] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.171] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.172] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.172] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.172] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.172] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.172] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.172] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xaf0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xaf0, lpOverlapped=0x0) returned 1 [0176.172] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xaf0, dwBufLen=0xaf0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xaf0) returned 1 [0176.172] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.172] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xaf0, lpOverlapped=0x0) returned 1 [0176.172] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.172] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xbc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.172] SetEndOfFile (hFile=0xdc) returned 1 [0176.175] GetProcessHeap () returned 0x4e0000 [0176.175] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.175] GetProcessHeap () returned 0x4e0000 [0176.175] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.175] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02269_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02269_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.177] CloseHandle (hObject=0xdc) returned 1 [0176.177] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16efdc00, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x16efdc00, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0xa68, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02270_.WMF", cAlternateFileName="")) returned 1 [0176.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02270_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.178] GetProcessHeap () returned 0x4e0000 [0176.178] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.178] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.178] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.178] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.181] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.181] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.181] GetProcessHeap () returned 0x4e0000 [0176.181] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.181] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.181] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.181] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.181] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.181] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.181] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.181] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.181] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.181] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.181] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.181] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.182] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xa68, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xa68, lpOverlapped=0x0) returned 1 [0176.182] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa70, dwBufLen=0xa70 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa70) returned 1 [0176.182] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.182] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xa70, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xa70, lpOverlapped=0x0) returned 1 [0176.182] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.182] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xb44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.182] SetEndOfFile (hFile=0xdc) returned 1 [0176.185] GetProcessHeap () returned 0x4e0000 [0176.185] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.185] GetProcessHeap () returned 0x4e0000 [0176.185] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.185] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02270_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02270_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.186] CloseHandle (hObject=0xdc) returned 1 [0176.186] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3963e00, ftCreationTime.dwHighDateTime=0x1bd4c04, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3963e00, ftLastWriteTime.dwHighDateTime=0x1bd4c04, nFileSizeHigh=0x0, nFileSizeLow=0x30e4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02276_.WMF", cAlternateFileName="")) returned 1 [0176.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02276_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.187] GetProcessHeap () returned 0x4e0000 [0176.187] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.187] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.187] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.187] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0176.189] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.189] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.189] GetProcessHeap () returned 0x4e0000 [0176.189] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.189] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.190] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.190] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.190] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.190] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.190] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.190] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.190] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.190] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.190] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.190] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.190] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x30e4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x30e4, lpOverlapped=0x0) returned 1 [0176.191] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x30f0, dwBufLen=0x30f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x30f0) returned 1 [0176.191] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.191] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x30f0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x30f0, lpOverlapped=0x0) returned 1 [0176.192] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.192] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x31c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.192] SetEndOfFile (hFile=0xdc) returned 1 [0176.194] GetProcessHeap () returned 0x4e0000 [0176.194] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.194] GetProcessHeap () returned 0x4e0000 [0176.194] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.194] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02276_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02276_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.196] CloseHandle (hObject=0xdc) returned 1 [0176.196] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e7d7f00, ftCreationTime.dwHighDateTime=0x1bd4bce, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3e7d7f00, ftLastWriteTime.dwHighDateTime=0x1bd4bce, nFileSizeHigh=0x0, nFileSizeLow=0x17a1c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02413_.WMF", cAlternateFileName="")) returned 1 [0176.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02413_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.197] GetProcessHeap () returned 0x4e0000 [0176.197] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.197] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.197] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.198] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.199] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.199] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.199] GetProcessHeap () returned 0x4e0000 [0176.199] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.200] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.200] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.200] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.200] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.200] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.200] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.200] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.200] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.200] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.200] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.200] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.200] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x17a1c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x17a1c, lpOverlapped=0x0) returned 1 [0176.202] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x17a20, dwBufLen=0x17a20 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x17a20) returned 1 [0176.203] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.203] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x17a20, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x17a20, lpOverlapped=0x0) returned 1 [0176.203] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.203] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x17af4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.204] SetEndOfFile (hFile=0xdc) returned 1 [0176.207] GetProcessHeap () returned 0x4e0000 [0176.207] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.207] GetProcessHeap () returned 0x4e0000 [0176.207] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.207] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02413_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02413_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.208] CloseHandle (hObject=0xdc) returned 1 [0176.208] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9503b100, ftCreationTime.dwHighDateTime=0x1bd4c00, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9503b100, ftLastWriteTime.dwHighDateTime=0x1bd4c00, nFileSizeHigh=0x0, nFileSizeLow=0x670, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02431_.WMF", cAlternateFileName="")) returned 1 [0176.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02431_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.209] GetProcessHeap () returned 0x4e0000 [0176.209] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.209] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.209] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.209] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.209] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.209] GetProcessHeap () returned 0x4e0000 [0176.209] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.209] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.209] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.210] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.211] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.211] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.212] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.212] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.212] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.212] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.212] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.212] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.212] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x670, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x670, lpOverlapped=0x0) returned 1 [0176.212] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x670, dwBufLen=0x670 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x670) returned 1 [0176.212] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.212] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x670, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x670, lpOverlapped=0x0) returned 1 [0176.212] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.212] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x744, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.212] SetEndOfFile (hFile=0xdc) returned 1 [0176.215] GetProcessHeap () returned 0x4e0000 [0176.215] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.215] GetProcessHeap () returned 0x4e0000 [0176.215] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.215] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02431_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02431_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.216] CloseHandle (hObject=0xdc) returned 1 [0176.216] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x937fbc00, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x937fbc00, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x5b4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02437_.WMF", cAlternateFileName="")) returned 1 [0176.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02437_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.217] GetProcessHeap () returned 0x4e0000 [0176.217] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.217] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.217] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.217] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0176.220] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.220] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.220] GetProcessHeap () returned 0x4e0000 [0176.220] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.220] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.220] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.220] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.220] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.220] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.220] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.220] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.220] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.220] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.220] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.220] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.221] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5b4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x5b4, lpOverlapped=0x0) returned 1 [0176.221] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5c0, dwBufLen=0x5c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5c0) returned 1 [0176.221] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.221] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5c0, lpOverlapped=0x0) returned 1 [0176.221] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.221] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.221] SetEndOfFile (hFile=0xdc) returned 1 [0176.224] GetProcessHeap () returned 0x4e0000 [0176.224] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.224] GetProcessHeap () returned 0x4e0000 [0176.224] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.224] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02437_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02437_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.225] CloseHandle (hObject=0xdc) returned 1 [0176.225] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8793fa00, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8793fa00, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x504, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02439_.WMF", cAlternateFileName="")) returned 1 [0176.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02439_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.226] GetProcessHeap () returned 0x4e0000 [0176.226] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.226] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.226] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.226] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0176.228] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.228] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.228] GetProcessHeap () returned 0x4e0000 [0176.228] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.228] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.228] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.228] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.228] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.228] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.228] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.229] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.229] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.229] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.229] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.229] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.229] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x504, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x504, lpOverlapped=0x0) returned 1 [0176.229] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x510, dwBufLen=0x510 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x510) returned 1 [0176.229] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.229] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x510, lpOverlapped=0x0) returned 1 [0176.229] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.229] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.229] SetEndOfFile (hFile=0xdc) returned 1 [0176.232] GetProcessHeap () returned 0x4e0000 [0176.232] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.232] GetProcessHeap () returned 0x4e0000 [0176.232] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.232] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02439_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02439_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.234] CloseHandle (hObject=0xdc) returned 1 [0176.234] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1a54, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02464_.WMF", cAlternateFileName="")) returned 1 [0176.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02464_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.235] GetProcessHeap () returned 0x4e0000 [0176.235] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.235] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.235] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.235] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0176.237] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.237] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.237] GetProcessHeap () returned 0x4e0000 [0176.237] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.237] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.237] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.237] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.237] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.237] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.238] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.238] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.238] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.238] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.238] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.238] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.238] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1a54, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1a54, lpOverlapped=0x0) returned 1 [0176.239] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1a60, dwBufLen=0x1a60 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1a60) returned 1 [0176.240] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.240] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1a60, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1a60, lpOverlapped=0x0) returned 1 [0176.240] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.240] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1b34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.240] SetEndOfFile (hFile=0xdc) returned 1 [0176.243] GetProcessHeap () returned 0x4e0000 [0176.243] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.243] GetProcessHeap () returned 0x4e0000 [0176.243] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.243] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02464_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02464_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.244] CloseHandle (hObject=0xdc) returned 1 [0176.244] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe34c8c00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe34c8c00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x574, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02465_.WMF", cAlternateFileName="")) returned 1 [0176.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02465_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.245] GetProcessHeap () returned 0x4e0000 [0176.245] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.245] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.245] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.245] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0176.247] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.247] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.247] GetProcessHeap () returned 0x4e0000 [0176.247] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.248] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.248] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.248] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.248] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.248] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.248] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.248] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.248] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.248] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.248] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.248] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.248] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x574, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x574, lpOverlapped=0x0) returned 1 [0176.248] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x580, dwBufLen=0x580 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x580) returned 1 [0176.249] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.249] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x580, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x580, lpOverlapped=0x0) returned 1 [0176.249] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.249] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x654, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.249] SetEndOfFile (hFile=0xdc) returned 1 [0176.252] GetProcessHeap () returned 0x4e0000 [0176.252] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.252] GetProcessHeap () returned 0x4e0000 [0176.252] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.252] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02465_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02465_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.253] CloseHandle (hObject=0xdc) returned 1 [0176.253] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x19ca, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02578_.WMF", cAlternateFileName="")) returned 1 [0176.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02578_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.255] GetProcessHeap () returned 0x4e0000 [0176.255] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.255] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.255] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.255] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0176.257] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.257] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.257] GetProcessHeap () returned 0x4e0000 [0176.257] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.257] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.257] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.257] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.257] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.257] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.257] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.258] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.258] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.258] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.258] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.258] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.258] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x19ca, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x19ca, lpOverlapped=0x0) returned 1 [0176.259] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x19d0, dwBufLen=0x19d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x19d0) returned 1 [0176.259] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.259] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x19d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x19d0, lpOverlapped=0x0) returned 1 [0176.259] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.259] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1aa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.259] SetEndOfFile (hFile=0xdc) returned 1 [0176.262] GetProcessHeap () returned 0x4e0000 [0176.262] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.262] GetProcessHeap () returned 0x4e0000 [0176.262] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.262] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02578_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02578_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.263] CloseHandle (hObject=0xdc) returned 1 [0176.264] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6d32800, ftCreationTime.dwHighDateTime=0x1bd4c4e, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe6d32800, ftLastWriteTime.dwHighDateTime=0x1bd4c4e, nFileSizeHigh=0x0, nFileSizeLow=0x5fec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02617_.WMF", cAlternateFileName="")) returned 1 [0176.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02617_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.265] GetProcessHeap () returned 0x4e0000 [0176.265] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.265] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.265] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.265] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.267] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.267] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.267] GetProcessHeap () returned 0x4e0000 [0176.267] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.267] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.267] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.267] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.267] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.268] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.268] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.268] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.268] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.268] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.268] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.268] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.268] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5fec, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x5fec, lpOverlapped=0x0) returned 1 [0176.269] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5ff0, dwBufLen=0x5ff0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5ff0) returned 1 [0176.269] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.270] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5ff0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5ff0, lpOverlapped=0x0) returned 1 [0176.270] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.270] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x60c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.270] SetEndOfFile (hFile=0xdc) returned 1 [0176.273] GetProcessHeap () returned 0x4e0000 [0176.273] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.273] GetProcessHeap () returned 0x4e0000 [0176.273] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.273] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02617_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02617_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.274] CloseHandle (hObject=0xdc) returned 1 [0176.274] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7f4e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02790_.WMF", cAlternateFileName="")) returned 1 [0176.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02790_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.275] GetProcessHeap () returned 0x4e0000 [0176.275] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.275] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.275] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.275] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0176.277] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.277] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.277] GetProcessHeap () returned 0x4e0000 [0176.277] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.277] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.277] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.278] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.278] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.278] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.278] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.278] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.278] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.278] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.278] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.278] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.278] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7f4e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7f4e, lpOverlapped=0x0) returned 1 [0176.280] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7f50, dwBufLen=0x7f50 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7f50) returned 1 [0176.280] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.280] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7f50, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7f50, lpOverlapped=0x0) returned 1 [0176.280] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.280] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x8024, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.281] SetEndOfFile (hFile=0xdc) returned 1 [0176.283] GetProcessHeap () returned 0x4e0000 [0176.283] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.283] GetProcessHeap () returned 0x4e0000 [0176.283] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.284] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02790_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02790_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.285] CloseHandle (hObject=0xdc) returned 1 [0176.285] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x430c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02791_.WMF", cAlternateFileName="")) returned 1 [0176.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02791_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.286] GetProcessHeap () returned 0x4e0000 [0176.286] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.286] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.286] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.286] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.288] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.288] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.288] GetProcessHeap () returned 0x4e0000 [0176.288] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.289] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.289] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.289] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.289] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.289] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.289] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.289] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.289] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.289] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.289] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.289] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.289] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x430c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x430c, lpOverlapped=0x0) returned 1 [0176.290] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4310, dwBufLen=0x4310 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4310) returned 1 [0176.290] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.291] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4310, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4310, lpOverlapped=0x0) returned 1 [0176.291] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.291] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x43e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.291] SetEndOfFile (hFile=0xdc) returned 1 [0176.294] GetProcessHeap () returned 0x4e0000 [0176.294] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.294] GetProcessHeap () returned 0x4e0000 [0176.294] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.294] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02791_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02791_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.295] CloseHandle (hObject=0xdc) returned 1 [0176.295] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5b70, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02793_.WMF", cAlternateFileName="")) returned 1 [0176.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02793_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.297] GetProcessHeap () returned 0x4e0000 [0176.297] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.297] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.297] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.297] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.297] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.297] GetProcessHeap () returned 0x4e0000 [0176.297] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.297] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.297] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.297] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.299] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.299] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.299] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.299] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.299] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.299] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.300] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.300] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.300] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5b70, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x5b70, lpOverlapped=0x0) returned 1 [0176.300] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5b70, dwBufLen=0x5b70 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5b70) returned 1 [0176.301] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.301] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5b70, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5b70, lpOverlapped=0x0) returned 1 [0176.301] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.301] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5c44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.301] SetEndOfFile (hFile=0xdc) returned 1 [0176.304] GetProcessHeap () returned 0x4e0000 [0176.304] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.304] GetProcessHeap () returned 0x4e0000 [0176.304] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.304] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02793_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02793_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.305] CloseHandle (hObject=0xdc) returned 1 [0176.306] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b7a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02794_.WMF", cAlternateFileName="")) returned 1 [0176.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02794_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.307] GetProcessHeap () returned 0x4e0000 [0176.307] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.307] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.307] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.307] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0176.309] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.309] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.309] GetProcessHeap () returned 0x4e0000 [0176.309] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.309] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.309] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.309] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.310] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.310] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.310] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.310] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.310] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.310] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.310] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.310] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.310] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4b7a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4b7a, lpOverlapped=0x0) returned 1 [0176.312] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4b80, dwBufLen=0x4b80 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4b80) returned 1 [0176.312] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.312] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4b80, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4b80, lpOverlapped=0x0) returned 1 [0176.312] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.312] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4c54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.312] SetEndOfFile (hFile=0xdc) returned 1 [0176.315] GetProcessHeap () returned 0x4e0000 [0176.315] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.315] GetProcessHeap () returned 0x4e0000 [0176.315] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.315] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02794_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02794_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.317] CloseHandle (hObject=0xdc) returned 1 [0176.317] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1262e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02862_.WMF", cAlternateFileName="")) returned 1 [0176.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02862_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.318] GetProcessHeap () returned 0x4e0000 [0176.318] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.318] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.318] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.318] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0176.320] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.320] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.320] GetProcessHeap () returned 0x4e0000 [0176.320] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.320] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.320] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.320] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.320] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.320] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.320] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.321] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.321] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.321] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.321] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.321] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.321] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1262e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1262e, lpOverlapped=0x0) returned 1 [0176.322] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x12630, dwBufLen=0x12630 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x12630) returned 1 [0176.323] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.323] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x12630, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x12630, lpOverlapped=0x0) returned 1 [0176.323] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.323] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x12704, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.323] SetEndOfFile (hFile=0xdc) returned 1 [0176.326] GetProcessHeap () returned 0x4e0000 [0176.327] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.327] GetProcessHeap () returned 0x4e0000 [0176.327] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.327] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02862_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02862_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.329] CloseHandle (hObject=0xdc) returned 1 [0176.329] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x967a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02886_.WMF", cAlternateFileName="")) returned 1 [0176.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02886_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.332] GetProcessHeap () returned 0x4e0000 [0176.332] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.332] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.332] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.332] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0176.334] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.334] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.334] GetProcessHeap () returned 0x4e0000 [0176.334] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.334] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.334] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.334] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.335] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.335] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.335] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.335] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.335] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.335] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.335] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.335] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.335] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x967a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x967a, lpOverlapped=0x0) returned 1 [0176.336] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9680, dwBufLen=0x9680 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9680) returned 1 [0176.336] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.337] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x9680, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x9680, lpOverlapped=0x0) returned 1 [0176.337] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.337] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x9754, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.337] SetEndOfFile (hFile=0xdc) returned 1 [0176.340] GetProcessHeap () returned 0x4e0000 [0176.340] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.340] GetProcessHeap () returned 0x4e0000 [0176.340] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.340] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02886_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02886_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.342] CloseHandle (hObject=0xdc) returned 1 [0176.342] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x22f4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02958_.WMF", cAlternateFileName="")) returned 1 [0176.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02958_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.343] GetProcessHeap () returned 0x4e0000 [0176.343] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.343] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.343] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.343] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0176.345] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.345] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.345] GetProcessHeap () returned 0x4e0000 [0176.345] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.345] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.345] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.345] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.346] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.346] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.346] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.346] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.346] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.346] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.346] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.346] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.346] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x22f4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x22f4, lpOverlapped=0x0) returned 1 [0176.347] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2300, dwBufLen=0x2300 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2300) returned 1 [0176.347] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.347] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2300, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2300, lpOverlapped=0x0) returned 1 [0176.348] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.348] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x23d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.348] SetEndOfFile (hFile=0xdc) returned 1 [0176.350] GetProcessHeap () returned 0x4e0000 [0176.350] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.350] GetProcessHeap () returned 0x4e0000 [0176.350] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.350] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02958_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02958_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.352] CloseHandle (hObject=0xdc) returned 1 [0176.352] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x107b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SPACE_01.MID", cAlternateFileName="")) returned 1 [0176.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.353] GetProcessHeap () returned 0x4e0000 [0176.353] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.353] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.353] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.354] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x5, lpOverlapped=0x0) returned 1 [0176.356] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.356] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.356] GetProcessHeap () returned 0x4e0000 [0176.356] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.356] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.356] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.356] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.356] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.356] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.356] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.356] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.356] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.357] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.357] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.357] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.357] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x107b, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x107b, lpOverlapped=0x0) returned 1 [0176.358] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1080, dwBufLen=0x1080 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1080) returned 1 [0176.358] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.358] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1080, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1080, lpOverlapped=0x0) returned 1 [0176.358] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.358] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1154, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.358] SetEndOfFile (hFile=0xdc) returned 1 [0176.361] GetProcessHeap () returned 0x4e0000 [0176.361] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.361] GetProcessHeap () returned 0x4e0000 [0176.361] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.361] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.362] CloseHandle (hObject=0xdc) returned 1 [0176.362] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1a2c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SPRNG_01.MID", cAlternateFileName="")) returned 1 [0176.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.363] GetProcessHeap () returned 0x4e0000 [0176.363] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.363] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.364] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.364] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.366] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.366] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.366] GetProcessHeap () returned 0x4e0000 [0176.366] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.366] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.366] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.366] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.366] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.366] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.366] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.366] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.366] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.367] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.367] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.367] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.367] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1a2c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1a2c, lpOverlapped=0x0) returned 1 [0176.368] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1a30, dwBufLen=0x1a30 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1a30) returned 1 [0176.368] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.368] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1a30, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1a30, lpOverlapped=0x0) returned 1 [0176.368] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.368] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1b04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.368] SetEndOfFile (hFile=0xdc) returned 1 [0176.371] GetProcessHeap () returned 0x4e0000 [0176.371] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.371] GetProcessHeap () returned 0x4e0000 [0176.371] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.371] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.372] CloseHandle (hObject=0xdc) returned 1 [0176.372] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xbd6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="STUBBY1.WMF", cAlternateFileName="")) returned 1 [0176.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby1.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.374] GetProcessHeap () returned 0x4e0000 [0176.374] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.374] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.374] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.374] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0176.376] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.376] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.376] GetProcessHeap () returned 0x4e0000 [0176.376] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.376] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.377] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.377] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.377] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.377] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.377] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.377] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.377] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.377] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.377] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.377] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.377] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xbd6, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xbd6, lpOverlapped=0x0) returned 1 [0176.377] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xbe0, dwBufLen=0xbe0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xbe0) returned 1 [0176.377] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.377] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xbe0, lpOverlapped=0x0) returned 1 [0176.377] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.377] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xcb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.377] SetEndOfFile (hFile=0xdc) returned 1 [0176.379] GetProcessHeap () returned 0x4e0000 [0176.379] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.379] GetProcessHeap () returned 0x4e0000 [0176.379] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.380] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby1.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby1.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.381] CloseHandle (hObject=0xdc) returned 1 [0176.381] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xa16, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="STUBBY2.WMF", cAlternateFileName="")) returned 1 [0176.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby2.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.381] GetProcessHeap () returned 0x4e0000 [0176.381] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.381] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.381] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.381] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0176.383] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.383] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.383] GetProcessHeap () returned 0x4e0000 [0176.383] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.383] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.383] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.383] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.383] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.383] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.383] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.384] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.384] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.384] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.384] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.384] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.384] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xa16, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xa16, lpOverlapped=0x0) returned 1 [0176.384] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa20, dwBufLen=0xa20 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa20) returned 1 [0176.384] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.384] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xa20, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xa20, lpOverlapped=0x0) returned 1 [0176.384] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.384] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xaf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.384] SetEndOfFile (hFile=0xdc) returned 1 [0176.386] GetProcessHeap () returned 0x4e0000 [0176.386] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.386] GetProcessHeap () returned 0x4e0000 [0176.386] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.386] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby2.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby2.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.387] CloseHandle (hObject=0xdc) returned 1 [0176.387] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5ac7a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x36dc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SUMER_01.MID", cAlternateFileName="")) returned 1 [0176.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.388] GetProcessHeap () returned 0x4e0000 [0176.388] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.388] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.388] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.388] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.390] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.390] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.390] GetProcessHeap () returned 0x4e0000 [0176.390] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.390] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.390] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.390] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.390] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.390] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.390] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.390] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.390] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.390] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.390] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.390] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.390] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x36dc, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x36dc, lpOverlapped=0x0) returned 1 [0176.391] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x36e0, dwBufLen=0x36e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x36e0) returned 1 [0176.391] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.391] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x36e0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x36e0, lpOverlapped=0x0) returned 1 [0176.392] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.392] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x37b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.392] SetEndOfFile (hFile=0xdc) returned 1 [0176.394] GetProcessHeap () returned 0x4e0000 [0176.394] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.394] GetProcessHeap () returned 0x4e0000 [0176.394] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.394] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.395] CloseHandle (hObject=0xdc) returned 1 [0176.395] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2135, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SWEST_01.MID", cAlternateFileName="")) returned 1 [0176.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.396] GetProcessHeap () returned 0x4e0000 [0176.396] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.396] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.396] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.396] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xb, lpOverlapped=0x0) returned 1 [0176.397] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.397] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.397] GetProcessHeap () returned 0x4e0000 [0176.397] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.397] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.397] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.397] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.398] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.398] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.398] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.398] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.398] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.398] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.398] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.398] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.398] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2135, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2135, lpOverlapped=0x0) returned 1 [0176.399] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2140, dwBufLen=0x2140 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2140) returned 1 [0176.399] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.399] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2140, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2140, lpOverlapped=0x0) returned 1 [0176.399] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.399] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.399] SetEndOfFile (hFile=0xdc) returned 1 [0176.401] GetProcessHeap () returned 0x4e0000 [0176.401] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.401] GetProcessHeap () returned 0x4e0000 [0176.401] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.401] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.402] CloseHandle (hObject=0xdc) returned 1 [0176.402] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7065e700, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7065e700, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x4f0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY00110_.WMF", cAlternateFileName="")) returned 1 [0176.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00110_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.403] GetProcessHeap () returned 0x4e0000 [0176.403] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.404] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.404] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.404] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.404] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.404] GetProcessHeap () returned 0x4e0000 [0176.404] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.404] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.404] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.404] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.405] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.406] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.406] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.406] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.406] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.406] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.406] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.406] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.406] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4f0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4f0, lpOverlapped=0x0) returned 1 [0176.406] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4f0, dwBufLen=0x4f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4f0) returned 1 [0176.406] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.406] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4f0, lpOverlapped=0x0) returned 1 [0176.406] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.406] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.406] SetEndOfFile (hFile=0xdc) returned 1 [0176.408] GetProcessHeap () returned 0x4e0000 [0176.408] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.408] GetProcessHeap () returned 0x4e0000 [0176.408] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.408] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00110_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00110_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.409] CloseHandle (hObject=0xdc) returned 1 [0176.409] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb76ecf00, ftCreationTime.dwHighDateTime=0x1bd4b19, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb76ecf00, ftLastWriteTime.dwHighDateTime=0x1bd4b19, nFileSizeHigh=0x0, nFileSizeLow=0x1844, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY00127_.WMF", cAlternateFileName="")) returned 1 [0176.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00127_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.410] GetProcessHeap () returned 0x4e0000 [0176.410] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.410] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.410] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.410] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0176.412] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.412] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.412] GetProcessHeap () returned 0x4e0000 [0176.412] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.412] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.412] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.412] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.412] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.412] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.412] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.412] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.412] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.412] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.412] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.412] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.412] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1844, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1844, lpOverlapped=0x0) returned 1 [0176.413] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1850, dwBufLen=0x1850 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1850) returned 1 [0176.413] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.413] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1850, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1850, lpOverlapped=0x0) returned 1 [0176.413] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.413] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1924, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.413] SetEndOfFile (hFile=0xdc) returned 1 [0176.415] GetProcessHeap () returned 0x4e0000 [0176.415] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.415] GetProcessHeap () returned 0x4e0000 [0176.415] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.415] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00127_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00127_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.416] CloseHandle (hObject=0xdc) returned 1 [0176.416] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb62ee00, ftCreationTime.dwHighDateTime=0x1bd4ae2, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdb62ee00, ftLastWriteTime.dwHighDateTime=0x1bd4ae2, nFileSizeHigh=0x0, nFileSizeLow=0x81c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY00132_.WMF", cAlternateFileName="")) returned 1 [0176.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00132_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.417] GetProcessHeap () returned 0x4e0000 [0176.417] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.418] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.418] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.418] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.419] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.419] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.419] GetProcessHeap () returned 0x4e0000 [0176.419] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.419] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.419] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.419] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.419] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.419] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.420] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.420] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.420] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.420] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.420] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.420] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.420] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x81c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x81c, lpOverlapped=0x0) returned 1 [0176.420] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x820, dwBufLen=0x820 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x820) returned 1 [0176.420] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.420] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x820, lpOverlapped=0x0) returned 1 [0176.420] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.420] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x8f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.420] SetEndOfFile (hFile=0xdc) returned 1 [0176.422] GetProcessHeap () returned 0x4e0000 [0176.422] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.422] GetProcessHeap () returned 0x4e0000 [0176.422] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.422] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00132_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00132_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.423] CloseHandle (hObject=0xdc) returned 1 [0176.423] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f34ba00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f34ba00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1412, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY00170_.WMF", cAlternateFileName="")) returned 1 [0176.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00170_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.424] GetProcessHeap () returned 0x4e0000 [0176.424] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.424] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.424] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.424] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0176.426] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.426] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.426] GetProcessHeap () returned 0x4e0000 [0176.426] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.426] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.426] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.426] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.426] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.426] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.426] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.426] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.427] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.427] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.427] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.427] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.427] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1412, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1412, lpOverlapped=0x0) returned 1 [0176.427] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1420, dwBufLen=0x1420 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1420) returned 1 [0176.428] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.428] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1420, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1420, lpOverlapped=0x0) returned 1 [0176.428] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.428] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x14f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.428] SetEndOfFile (hFile=0xdc) returned 1 [0176.430] GetProcessHeap () returned 0x4e0000 [0176.430] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.430] GetProcessHeap () returned 0x4e0000 [0176.430] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.430] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00170_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00170_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.431] CloseHandle (hObject=0xdc) returned 1 [0176.431] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d702300, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3d702300, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x50c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY00560_.WMF", cAlternateFileName="")) returned 1 [0176.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00560_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.432] GetProcessHeap () returned 0x4e0000 [0176.432] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.432] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.432] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.432] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.435] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.435] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.435] GetProcessHeap () returned 0x4e0000 [0176.435] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.435] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.435] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.435] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.435] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.435] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.435] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.435] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.435] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.435] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.435] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.435] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.436] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x50c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x50c, lpOverlapped=0x0) returned 1 [0176.436] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x510, dwBufLen=0x510 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x510) returned 1 [0176.436] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.436] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x510, lpOverlapped=0x0) returned 1 [0176.436] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.436] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.436] SetEndOfFile (hFile=0xdc) returned 1 [0176.439] GetProcessHeap () returned 0x4e0000 [0176.439] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.439] GetProcessHeap () returned 0x4e0000 [0176.439] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.439] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00560_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00560_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.441] CloseHandle (hObject=0xdc) returned 1 [0176.441] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd194b700, ftCreationTime.dwHighDateTime=0x1bd4af1, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd194b700, ftLastWriteTime.dwHighDateTime=0x1bd4af1, nFileSizeHigh=0x0, nFileSizeLow=0x778, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY00642_.WMF", cAlternateFileName="")) returned 1 [0176.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00642_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.442] GetProcessHeap () returned 0x4e0000 [0176.442] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.442] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.442] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.442] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.444] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.444] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.444] GetProcessHeap () returned 0x4e0000 [0176.444] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.444] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.444] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.444] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.444] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.444] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.444] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.444] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.444] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.445] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.445] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.445] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.445] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x778, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x778, lpOverlapped=0x0) returned 1 [0176.445] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x780, dwBufLen=0x780 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x780) returned 1 [0176.445] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.445] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x780, lpOverlapped=0x0) returned 1 [0176.445] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.445] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x854, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.445] SetEndOfFile (hFile=0xdc) returned 1 [0176.448] GetProcessHeap () returned 0x4e0000 [0176.448] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.448] GetProcessHeap () returned 0x4e0000 [0176.448] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.448] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00642_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00642_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.453] CloseHandle (hObject=0xdc) returned 1 [0176.453] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2094, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY00788_.WMF", cAlternateFileName="")) returned 1 [0176.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00788_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.454] GetProcessHeap () returned 0x4e0000 [0176.454] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.454] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.454] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.454] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0176.456] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.456] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.456] GetProcessHeap () returned 0x4e0000 [0176.456] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.457] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.457] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.457] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.457] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.457] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.457] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.457] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.457] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.457] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.457] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.457] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.457] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2094, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2094, lpOverlapped=0x0) returned 1 [0176.460] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x20a0, dwBufLen=0x20a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x20a0) returned 1 [0176.460] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.460] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x20a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x20a0, lpOverlapped=0x0) returned 1 [0176.460] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.460] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2174, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.460] SetEndOfFile (hFile=0xdc) returned 1 [0176.463] GetProcessHeap () returned 0x4e0000 [0176.463] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.463] GetProcessHeap () returned 0x4e0000 [0176.463] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.463] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00788_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00788_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.465] CloseHandle (hObject=0xdc) returned 1 [0176.465] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2fdc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY00792_.WMF", cAlternateFileName="")) returned 1 [0176.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00792_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.468] GetProcessHeap () returned 0x4e0000 [0176.468] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.468] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.468] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.468] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.470] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.470] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.470] GetProcessHeap () returned 0x4e0000 [0176.470] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.470] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.470] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.470] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.470] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.470] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.471] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.471] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.471] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.471] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.471] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.471] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.471] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2fdc, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2fdc, lpOverlapped=0x0) returned 1 [0176.472] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2fe0, dwBufLen=0x2fe0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2fe0) returned 1 [0176.472] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.472] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2fe0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2fe0, lpOverlapped=0x0) returned 1 [0176.472] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.472] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x30b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.472] SetEndOfFile (hFile=0xdc) returned 1 [0176.475] GetProcessHeap () returned 0x4e0000 [0176.475] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.475] GetProcessHeap () returned 0x4e0000 [0176.475] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.475] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00792_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00792_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.477] CloseHandle (hObject=0xdc) returned 1 [0176.477] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2764, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY00795_.WMF", cAlternateFileName="")) returned 1 [0176.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00795_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.478] GetProcessHeap () returned 0x4e0000 [0176.478] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.478] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.478] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.478] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0176.480] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.480] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.480] GetProcessHeap () returned 0x4e0000 [0176.480] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.480] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.481] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.481] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.481] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.481] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.481] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.481] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.481] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.481] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.481] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.481] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.481] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2764, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2764, lpOverlapped=0x0) returned 1 [0176.482] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2770, dwBufLen=0x2770 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2770) returned 1 [0176.482] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.482] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2770, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2770, lpOverlapped=0x0) returned 1 [0176.482] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.483] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2844, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.483] SetEndOfFile (hFile=0xdc) returned 1 [0176.505] GetProcessHeap () returned 0x4e0000 [0176.505] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.505] GetProcessHeap () returned 0x4e0000 [0176.505] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.506] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00795_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00795_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.508] CloseHandle (hObject=0xdc) returned 1 [0176.508] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5ec100, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5ec100, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x9b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY00882_.WMF", cAlternateFileName="")) returned 1 [0176.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00882_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00882_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.516] GetProcessHeap () returned 0x4e0000 [0176.516] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.516] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.516] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.516] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.516] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.516] GetProcessHeap () returned 0x4e0000 [0176.516] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.516] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.517] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.517] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.522] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.524] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.524] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.605] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.605] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.605] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.623] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.623] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.631] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x9b0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x9b0, lpOverlapped=0x0) returned 1 [0176.631] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9b0, dwBufLen=0x9b0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9b0) returned 1 [0176.631] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.632] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x9b0, lpOverlapped=0x0) returned 1 [0176.632] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.632] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xa84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.632] SetEndOfFile (hFile=0xdc) returned 1 [0176.634] GetProcessHeap () returned 0x4e0000 [0176.634] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.634] GetProcessHeap () returned 0x4e0000 [0176.634] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.635] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00882_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00882_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00882_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00882_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.636] CloseHandle (hObject=0xdc) returned 1 [0176.636] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x634, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY01006_.WMF", cAlternateFileName="")) returned 1 [0176.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01006_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.638] GetProcessHeap () returned 0x4e0000 [0176.638] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.638] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.638] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.638] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0176.643] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.643] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.643] GetProcessHeap () returned 0x4e0000 [0176.643] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.643] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.643] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.643] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.643] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.643] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.643] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.643] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.643] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.644] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.644] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.644] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.644] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x634, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x634, lpOverlapped=0x0) returned 1 [0176.644] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x640, dwBufLen=0x640 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x640) returned 1 [0176.644] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.644] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x640, lpOverlapped=0x0) returned 1 [0176.644] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.644] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.644] SetEndOfFile (hFile=0xdc) returned 1 [0176.647] GetProcessHeap () returned 0x4e0000 [0176.647] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.647] GetProcessHeap () returned 0x4e0000 [0176.647] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.647] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01006_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01006_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01006_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.648] CloseHandle (hObject=0xdc) returned 1 [0176.648] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x865cd000, ftCreationTime.dwHighDateTime=0x1bd4be7, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x865cd000, ftLastWriteTime.dwHighDateTime=0x1bd4be7, nFileSizeHigh=0x0, nFileSizeLow=0x2734, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY01252_.WMF", cAlternateFileName="")) returned 1 [0176.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01252_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.650] GetProcessHeap () returned 0x4e0000 [0176.650] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.650] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.650] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.650] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0176.652] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.652] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.652] GetProcessHeap () returned 0x4e0000 [0176.652] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.652] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.652] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.652] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.652] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.652] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.652] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.652] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.652] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.652] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.652] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.652] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.652] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2734, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2734, lpOverlapped=0x0) returned 1 [0176.653] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2740, dwBufLen=0x2740 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2740) returned 1 [0176.653] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.653] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2740, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2740, lpOverlapped=0x0) returned 1 [0176.653] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.653] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.653] SetEndOfFile (hFile=0xdc) returned 1 [0176.656] GetProcessHeap () returned 0x4e0000 [0176.656] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.656] GetProcessHeap () returned 0x4e0000 [0176.656] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.656] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01252_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01252_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01252_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.657] CloseHandle (hObject=0xdc) returned 1 [0176.658] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x852ba300, ftCreationTime.dwHighDateTime=0x1bd4be7, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x852ba300, ftLastWriteTime.dwHighDateTime=0x1bd4be7, nFileSizeHigh=0x0, nFileSizeLow=0x78a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY01253_.WMF", cAlternateFileName="")) returned 1 [0176.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01253_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.659] GetProcessHeap () returned 0x4e0000 [0176.659] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.659] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.659] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.659] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0176.660] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.660] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.660] GetProcessHeap () returned 0x4e0000 [0176.660] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.661] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.661] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.661] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.661] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.661] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.661] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.661] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.661] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.661] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.661] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.661] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.661] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x78a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x78a, lpOverlapped=0x0) returned 1 [0176.661] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x790, dwBufLen=0x790 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x790) returned 1 [0176.661] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.661] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x790, lpOverlapped=0x0) returned 1 [0176.661] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.661] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x864, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.661] SetEndOfFile (hFile=0xdc) returned 1 [0176.663] GetProcessHeap () returned 0x4e0000 [0176.663] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.664] GetProcessHeap () returned 0x4e0000 [0176.664] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.664] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01253_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01253_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01253_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.665] CloseHandle (hObject=0xdc) returned 1 [0176.665] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf461c100, ftCreationTime.dwHighDateTime=0x1bd4c00, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf461c100, ftLastWriteTime.dwHighDateTime=0x1bd4c00, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY01462_.WMF", cAlternateFileName="")) returned 1 [0176.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01462_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01462_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.666] GetProcessHeap () returned 0x4e0000 [0176.666] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.666] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.666] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.666] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0176.668] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.668] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.668] GetProcessHeap () returned 0x4e0000 [0176.668] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.668] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.668] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.668] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.668] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.668] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.668] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.668] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.668] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.669] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.669] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.669] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.669] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x326, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x326, lpOverlapped=0x0) returned 1 [0176.669] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x330, dwBufLen=0x330 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x330) returned 1 [0176.669] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.669] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x330, lpOverlapped=0x0) returned 1 [0176.669] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.669] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x404, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.669] SetEndOfFile (hFile=0xdc) returned 1 [0176.671] GetProcessHeap () returned 0x4e0000 [0176.671] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.671] GetProcessHeap () returned 0x4e0000 [0176.671] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.671] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01462_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01462_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01462_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01462_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.672] CloseHandle (hObject=0xdc) returned 1 [0176.672] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6e15600, ftCreationTime.dwHighDateTime=0x1bd4bf8, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6e15600, ftLastWriteTime.dwHighDateTime=0x1bd4bf8, nFileSizeHigh=0x0, nFileSizeLow=0x470, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY01491_.WMF", cAlternateFileName="")) returned 1 [0176.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01491_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01491_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.673] GetProcessHeap () returned 0x4e0000 [0176.673] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.673] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.673] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.673] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.673] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.674] GetProcessHeap () returned 0x4e0000 [0176.674] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.674] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.674] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.674] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.675] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.675] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.675] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.676] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.676] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.676] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.676] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.676] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.676] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x470, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x470, lpOverlapped=0x0) returned 1 [0176.676] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x470, dwBufLen=0x470 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x470) returned 1 [0176.676] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.676] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x470, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x470, lpOverlapped=0x0) returned 1 [0176.676] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.676] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x544, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.676] SetEndOfFile (hFile=0xdc) returned 1 [0176.678] GetProcessHeap () returned 0x4e0000 [0176.678] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.678] GetProcessHeap () returned 0x4e0000 [0176.678] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.678] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01491_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01491_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01491_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01491_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.679] CloseHandle (hObject=0xdc) returned 1 [0176.679] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45a48d00, ftCreationTime.dwHighDateTime=0x1bd4bce, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x45a48d00, ftLastWriteTime.dwHighDateTime=0x1bd4bce, nFileSizeHigh=0x0, nFileSizeLow=0x13c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY01563_.WMF", cAlternateFileName="")) returned 1 [0176.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01563_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.680] GetProcessHeap () returned 0x4e0000 [0176.680] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.680] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.680] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.680] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0176.682] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.682] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.682] GetProcessHeap () returned 0x4e0000 [0176.682] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.682] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.683] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.683] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.683] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.683] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.683] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.683] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.683] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.683] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.683] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.683] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.683] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x13c4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x13c4, lpOverlapped=0x0) returned 1 [0176.684] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x13d0, dwBufLen=0x13d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x13d0) returned 1 [0176.684] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.684] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x13d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x13d0, lpOverlapped=0x0) returned 1 [0176.684] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.684] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x14a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.684] SetEndOfFile (hFile=0xdc) returned 1 [0176.687] GetProcessHeap () returned 0x4e0000 [0176.687] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.687] GetProcessHeap () returned 0x4e0000 [0176.687] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.687] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01563_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01563_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.688] CloseHandle (hObject=0xdc) returned 1 [0176.688] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f39c000, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f39c000, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0xce8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY01572_.WMF", cAlternateFileName="")) returned 1 [0176.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01572_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.689] GetProcessHeap () returned 0x4e0000 [0176.689] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.689] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.689] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.689] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.691] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.691] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.691] GetProcessHeap () returned 0x4e0000 [0176.691] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.691] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.691] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.691] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.691] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.691] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.691] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.692] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.692] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.692] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.692] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.692] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.692] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xce8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xce8, lpOverlapped=0x0) returned 1 [0176.692] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xcf0, dwBufLen=0xcf0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xcf0) returned 1 [0176.692] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.692] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xcf0, lpOverlapped=0x0) returned 1 [0176.692] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.692] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xdc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.692] SetEndOfFile (hFile=0xdc) returned 1 [0176.694] GetProcessHeap () returned 0x4e0000 [0176.694] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.694] GetProcessHeap () returned 0x4e0000 [0176.694] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.694] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01572_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01572_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.695] CloseHandle (hObject=0xdc) returned 1 [0176.695] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda9a9b00, ftCreationTime.dwHighDateTime=0x1bd4c4d, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xda9a9b00, ftLastWriteTime.dwHighDateTime=0x1bd4c4d, nFileSizeHigh=0x0, nFileSizeLow=0x338e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY01590_.WMF", cAlternateFileName="")) returned 1 [0176.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01590_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.696] GetProcessHeap () returned 0x4e0000 [0176.696] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.696] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.696] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.696] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0176.698] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.698] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.698] GetProcessHeap () returned 0x4e0000 [0176.698] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.698] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.698] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.698] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.698] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.698] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.698] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.699] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.699] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.699] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.699] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.699] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.699] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x338e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x338e, lpOverlapped=0x0) returned 1 [0176.700] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3390, dwBufLen=0x3390 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3390) returned 1 [0176.700] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.700] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3390, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3390, lpOverlapped=0x0) returned 1 [0176.700] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.700] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.700] SetEndOfFile (hFile=0xdc) returned 1 [0176.702] GetProcessHeap () returned 0x4e0000 [0176.702] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.702] GetProcessHeap () returned 0x4e0000 [0176.702] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.702] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01590_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01590_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.703] CloseHandle (hObject=0xdc) returned 1 [0176.704] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x8b6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TAIL.WMF", cAlternateFileName="")) returned 1 [0176.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TAIL.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tail.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.704] GetProcessHeap () returned 0x4e0000 [0176.704] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.704] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.704] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.705] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0176.708] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.708] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.708] GetProcessHeap () returned 0x4e0000 [0176.708] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0176.708] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0176.708] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.708] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0176.708] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.708] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.708] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.708] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.708] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.708] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.708] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.708] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.708] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x8b6, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x8b6, lpOverlapped=0x0) returned 1 [0176.708] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8c0, dwBufLen=0x8c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8c0) returned 1 [0176.708] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.709] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x8c0, lpOverlapped=0x0) returned 1 [0176.709] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.709] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x984, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.709] SetEndOfFile (hFile=0xdc) returned 1 [0176.711] GetProcessHeap () returned 0x4e0000 [0176.711] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0176.711] GetProcessHeap () returned 0x4e0000 [0176.711] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.711] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TAIL.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tail.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TAIL.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tail.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.712] CloseHandle (hObject=0xdc) returned 1 [0176.712] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9583f00, ftCreationTime.dwHighDateTime=0x1bd4b32, ftLastAccessTime.dwLowDateTime=0x5ae692f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9583f00, ftLastWriteTime.dwHighDateTime=0x1bd4b32, nFileSizeHigh=0x0, nFileSizeLow=0xbde2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN00011_.WMF", cAlternateFileName="")) returned 1 [0176.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00011_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.714] GetProcessHeap () returned 0x4e0000 [0176.714] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.714] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.714] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.714] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0176.715] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.715] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.715] GetProcessHeap () returned 0x4e0000 [0176.716] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.716] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.716] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.716] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.716] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.716] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.716] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.716] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.716] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.716] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.716] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.716] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.716] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xbde2, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xbde2, lpOverlapped=0x0) returned 1 [0176.717] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xbdf0, dwBufLen=0xbdf0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xbdf0) returned 1 [0176.718] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.718] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xbdf0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xbdf0, lpOverlapped=0x0) returned 1 [0176.718] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.718] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xbec4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.718] SetEndOfFile (hFile=0xdc) returned 1 [0176.720] GetProcessHeap () returned 0x4e0000 [0176.720] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.720] GetProcessHeap () returned 0x4e0000 [0176.720] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.720] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00011_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00011_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.722] CloseHandle (hObject=0xdc) returned 1 [0176.722] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5ae692f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d5e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN00014_.WMF", cAlternateFileName="")) returned 1 [0176.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00014_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.723] GetProcessHeap () returned 0x4e0000 [0176.723] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.723] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.723] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.723] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0176.725] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.725] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.725] GetProcessHeap () returned 0x4e0000 [0176.725] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.725] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.725] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.725] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.725] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.725] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.725] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.725] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.725] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.726] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.726] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.726] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.726] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1d5e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1d5e, lpOverlapped=0x0) returned 1 [0176.726] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1d60, dwBufLen=0x1d60 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1d60) returned 1 [0176.726] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.726] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1d60, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1d60, lpOverlapped=0x0) returned 1 [0176.727] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.727] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1e34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.727] SetEndOfFile (hFile=0xdc) returned 1 [0176.729] GetProcessHeap () returned 0x4e0000 [0176.729] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.729] GetProcessHeap () returned 0x4e0000 [0176.729] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.729] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00014_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00014_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.730] CloseHandle (hObject=0xdc) returned 1 [0176.731] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5ae692f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x243c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN00018_.WMF", cAlternateFileName="")) returned 1 [0176.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00018_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.731] GetProcessHeap () returned 0x4e0000 [0176.731] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.731] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.732] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.732] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.733] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.733] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.733] GetProcessHeap () returned 0x4e0000 [0176.733] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.733] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.733] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.733] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.734] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.734] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.734] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.734] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.734] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.734] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.734] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.734] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.734] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x243c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x243c, lpOverlapped=0x0) returned 1 [0176.735] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2440, dwBufLen=0x2440 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2440) returned 1 [0176.735] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.735] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2440, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2440, lpOverlapped=0x0) returned 1 [0176.735] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.735] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2514, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.735] SetEndOfFile (hFile=0xdc) returned 1 [0176.737] GetProcessHeap () returned 0x4e0000 [0176.737] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.737] GetProcessHeap () returned 0x4e0000 [0176.737] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.738] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00018_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00018_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.739] CloseHandle (hObject=0xdc) returned 1 [0176.739] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x175a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN00095_.WMF", cAlternateFileName="")) returned 1 [0176.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00095_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.750] GetProcessHeap () returned 0x4e0000 [0176.750] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.751] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.751] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.751] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0176.752] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.753] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.753] GetProcessHeap () returned 0x4e0000 [0176.753] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.753] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.753] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.753] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.753] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.753] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.753] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.753] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.753] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.753] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.753] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.753] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.753] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x175a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x175a, lpOverlapped=0x0) returned 1 [0176.754] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1760, dwBufLen=0x1760 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1760) returned 1 [0176.754] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.754] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1760, lpOverlapped=0x0) returned 1 [0176.754] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.754] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.754] SetEndOfFile (hFile=0xdc) returned 1 [0176.756] GetProcessHeap () returned 0x4e0000 [0176.757] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.757] GetProcessHeap () returned 0x4e0000 [0176.757] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.757] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00095_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00095_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.758] CloseHandle (hObject=0xdc) returned 1 [0176.758] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53c9af00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5ae692f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x53c9af00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1c12, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN00211_.WMF", cAlternateFileName="")) returned 1 [0176.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00211_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.760] GetProcessHeap () returned 0x4e0000 [0176.760] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.760] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.760] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.760] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0176.762] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.762] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.762] GetProcessHeap () returned 0x4e0000 [0176.762] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.762] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.762] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.762] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.763] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.763] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.763] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.763] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.763] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.763] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.763] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.763] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.763] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1c12, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1c12, lpOverlapped=0x0) returned 1 [0176.764] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1c20, dwBufLen=0x1c20 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1c20) returned 1 [0176.764] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.764] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1c20, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1c20, lpOverlapped=0x0) returned 1 [0176.764] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.764] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1cf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.764] SetEndOfFile (hFile=0xdc) returned 1 [0176.766] GetProcessHeap () returned 0x4e0000 [0176.766] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.766] GetProcessHeap () returned 0x4e0000 [0176.766] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.767] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00211_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00211_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.768] CloseHandle (hObject=0xdc) returned 1 [0176.768] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1b4a700, ftCreationTime.dwHighDateTime=0x1bd4b31, ftLastAccessTime.dwLowDateTime=0x5ae692f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd1b4a700, ftLastWriteTime.dwHighDateTime=0x1bd4b31, nFileSizeHigh=0x0, nFileSizeLow=0x1224, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN00217_.WMF", cAlternateFileName="")) returned 1 [0176.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00217_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.769] GetProcessHeap () returned 0x4e0000 [0176.769] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.769] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.769] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.769] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0176.773] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.773] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.773] GetProcessHeap () returned 0x4e0000 [0176.773] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.773] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.773] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.773] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.773] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.773] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.773] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.773] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.773] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.773] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.773] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.773] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.773] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1224, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1224, lpOverlapped=0x0) returned 1 [0176.774] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1230, dwBufLen=0x1230 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1230) returned 1 [0176.774] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.774] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1230, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1230, lpOverlapped=0x0) returned 1 [0176.774] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.774] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1304, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.774] SetEndOfFile (hFile=0xdc) returned 1 [0176.776] GetProcessHeap () returned 0x4e0000 [0176.776] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.777] GetProcessHeap () returned 0x4e0000 [0176.777] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.777] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00217_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00217_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.778] CloseHandle (hObject=0xdc) returned 1 [0176.778] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x851c9c00, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x851c9c00, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x1bc0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN00218_.WMF", cAlternateFileName="")) returned 1 [0176.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00218_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.779] GetProcessHeap () returned 0x4e0000 [0176.779] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.779] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.779] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.780] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.780] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.780] GetProcessHeap () returned 0x4e0000 [0176.780] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.780] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.780] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.780] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.782] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.782] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.782] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.782] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.782] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.782] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.782] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.782] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.782] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1bc0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1bc0, lpOverlapped=0x0) returned 1 [0176.783] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1bc0, dwBufLen=0x1bc0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1bc0) returned 1 [0176.783] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.783] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1bc0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1bc0, lpOverlapped=0x0) returned 1 [0176.784] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.784] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1c94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.784] SetEndOfFile (hFile=0xdc) returned 1 [0176.786] GetProcessHeap () returned 0x4e0000 [0176.786] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.786] GetProcessHeap () returned 0x4e0000 [0176.786] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.786] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00218_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00218_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.787] CloseHandle (hObject=0xdc) returned 1 [0176.787] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3399f000, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3399f000, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x738, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN00231_.WMF", cAlternateFileName="")) returned 1 [0176.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00231_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.788] GetProcessHeap () returned 0x4e0000 [0176.788] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.788] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.788] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.788] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.790] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.790] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.790] GetProcessHeap () returned 0x4e0000 [0176.790] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.790] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.790] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.790] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.790] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.790] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.790] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.791] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.791] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.791] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.791] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.791] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.791] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x738, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x738, lpOverlapped=0x0) returned 1 [0176.791] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x740, dwBufLen=0x740 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x740) returned 1 [0176.791] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.791] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x740, lpOverlapped=0x0) returned 1 [0176.791] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.791] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.791] SetEndOfFile (hFile=0xdc) returned 1 [0176.793] GetProcessHeap () returned 0x4e0000 [0176.793] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.793] GetProcessHeap () returned 0x4e0000 [0176.793] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.793] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00231_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00231_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.794] CloseHandle (hObject=0xdc) returned 1 [0176.795] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65787a00, ftCreationTime.dwHighDateTime=0x1bd4b16, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65787a00, ftLastWriteTime.dwHighDateTime=0x1bd4b16, nFileSizeHigh=0x0, nFileSizeLow=0xc68, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN00234_.WMF", cAlternateFileName="")) returned 1 [0176.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.796] GetProcessHeap () returned 0x4e0000 [0176.796] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.796] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.796] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.796] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.798] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.798] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.798] GetProcessHeap () returned 0x4e0000 [0176.798] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.798] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.798] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.798] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.798] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.798] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.798] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.798] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.798] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.799] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.799] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.799] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.799] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xc68, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xc68, lpOverlapped=0x0) returned 1 [0176.799] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xc70, dwBufLen=0xc70 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xc70) returned 1 [0176.799] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.799] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc70, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xc70, lpOverlapped=0x0) returned 1 [0176.799] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.799] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xd44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.799] SetEndOfFile (hFile=0xdc) returned 1 [0176.801] GetProcessHeap () returned 0x4e0000 [0176.801] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.801] GetProcessHeap () returned 0x4e0000 [0176.801] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.801] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00234_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00234_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00234_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.802] CloseHandle (hObject=0xdc) returned 1 [0176.802] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa3d200, ftCreationTime.dwHighDateTime=0x1bd4b16, ftLastAccessTime.dwLowDateTime=0x6d4fb570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa3d200, ftLastWriteTime.dwHighDateTime=0x1bd4b16, nFileSizeHigh=0x0, nFileSizeLow=0xf8c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN00241_.WMF", cAlternateFileName="")) returned 1 [0176.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00241_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.803] GetProcessHeap () returned 0x4e0000 [0176.803] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.803] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.803] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.803] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.805] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.805] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.805] GetProcessHeap () returned 0x4e0000 [0176.805] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.805] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.805] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.805] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.806] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.806] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.806] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.806] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.806] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.806] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.806] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.806] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.806] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xf8c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xf8c, lpOverlapped=0x0) returned 1 [0176.806] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xf90, dwBufLen=0xf90 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xf90) returned 1 [0176.806] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.806] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xf90, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xf90, lpOverlapped=0x0) returned 1 [0176.807] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.807] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1064, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.807] SetEndOfFile (hFile=0xdc) returned 1 [0176.809] GetProcessHeap () returned 0x4e0000 [0176.809] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.809] GetProcessHeap () returned 0x4e0000 [0176.809] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.809] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00241_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00241_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00241_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.811] CloseHandle (hObject=0xdc) returned 1 [0176.811] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e038d00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d4fb570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e038d00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xf74, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN00246_.WMF", cAlternateFileName="")) returned 1 [0176.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00246_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00246_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.812] GetProcessHeap () returned 0x4e0000 [0176.812] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.812] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.812] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.812] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0176.814] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.814] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.814] GetProcessHeap () returned 0x4e0000 [0176.814] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.814] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.814] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.814] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.814] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.814] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.815] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.815] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.815] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.815] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.815] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.815] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.815] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xf74, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xf74, lpOverlapped=0x0) returned 1 [0176.815] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xf80, dwBufLen=0xf80 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xf80) returned 1 [0176.815] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.815] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xf80, lpOverlapped=0x0) returned 1 [0176.815] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.815] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1054, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.815] SetEndOfFile (hFile=0xdc) returned 1 [0176.817] GetProcessHeap () returned 0x4e0000 [0176.817] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.817] GetProcessHeap () returned 0x4e0000 [0176.817] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.817] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00246_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00246_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00246_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00246_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.819] CloseHandle (hObject=0xdc) returned 1 [0176.819] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cd26000, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5ae692f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd26000, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x15bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN00253_.WMF", cAlternateFileName="")) returned 1 [0176.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00253_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.820] GetProcessHeap () returned 0x4e0000 [0176.820] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.820] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.820] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.820] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.821] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.821] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.821] GetProcessHeap () returned 0x4e0000 [0176.821] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.821] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.821] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.822] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.822] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.822] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.822] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.822] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.822] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.822] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.822] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.822] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.822] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x15bc, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x15bc, lpOverlapped=0x0) returned 1 [0176.823] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x15c0, dwBufLen=0x15c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x15c0) returned 1 [0176.823] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.823] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x15c0, lpOverlapped=0x0) returned 1 [0176.823] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.823] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.823] SetEndOfFile (hFile=0xdc) returned 1 [0176.825] GetProcessHeap () returned 0x4e0000 [0176.825] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.825] GetProcessHeap () returned 0x4e0000 [0176.825] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.825] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00253_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00253_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00253_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.826] CloseHandle (hObject=0xdc) returned 1 [0176.826] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64d4200, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d4fb570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64d4200, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1da8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN00255_.WMF", cAlternateFileName="")) returned 1 [0176.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00255_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.827] GetProcessHeap () returned 0x4e0000 [0176.827] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.827] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.827] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.827] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.829] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.829] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.829] GetProcessHeap () returned 0x4e0000 [0176.829] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.829] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.829] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.829] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.829] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.829] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.830] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.830] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.830] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.830] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.830] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.830] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.830] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1da8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1da8, lpOverlapped=0x0) returned 1 [0176.831] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1db0, dwBufLen=0x1db0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1db0) returned 1 [0176.831] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.831] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1db0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1db0, lpOverlapped=0x0) returned 1 [0176.831] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.831] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1e84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.831] SetEndOfFile (hFile=0xdc) returned 1 [0176.833] GetProcessHeap () returned 0x4e0000 [0176.833] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.833] GetProcessHeap () returned 0x4e0000 [0176.833] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.833] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00255_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00255_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00255_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.835] CloseHandle (hObject=0xdc) returned 1 [0176.835] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84184a00, ftCreationTime.dwHighDateTime=0x1bd4af1, ftLastAccessTime.dwLowDateTime=0x6d4fb570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84184a00, ftLastWriteTime.dwHighDateTime=0x1bd4af1, nFileSizeHigh=0x0, nFileSizeLow=0x7dc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN00330_.WMF", cAlternateFileName="")) returned 1 [0176.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00330_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00330_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.838] GetProcessHeap () returned 0x4e0000 [0176.838] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.838] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.838] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.838] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.840] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.840] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.840] GetProcessHeap () returned 0x4e0000 [0176.840] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.840] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.840] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.840] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.840] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.840] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.840] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.840] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.840] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.840] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.840] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.841] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.841] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7dc, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7dc, lpOverlapped=0x0) returned 1 [0176.841] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7e0, dwBufLen=0x7e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7e0) returned 1 [0176.841] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.841] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7e0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7e0, lpOverlapped=0x0) returned 1 [0176.841] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.841] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x8b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.841] SetEndOfFile (hFile=0xdc) returned 1 [0176.843] GetProcessHeap () returned 0x4e0000 [0176.843] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.843] GetProcessHeap () returned 0x4e0000 [0176.843] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.843] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00330_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00330_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00330_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00330_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.845] CloseHandle (hObject=0xdc) returned 1 [0176.845] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d4fb570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xf72, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN00411_.WMF", cAlternateFileName="")) returned 1 [0176.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00411_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00411_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.846] GetProcessHeap () returned 0x4e0000 [0176.846] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.846] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.846] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.846] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0176.848] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.848] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.848] GetProcessHeap () returned 0x4e0000 [0176.848] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.848] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.848] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.848] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.848] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.848] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.848] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.848] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.848] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.848] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.848] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.848] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.848] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xf72, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xf72, lpOverlapped=0x0) returned 1 [0176.849] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xf80, dwBufLen=0xf80 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xf80) returned 1 [0176.849] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.849] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xf80, lpOverlapped=0x0) returned 1 [0176.849] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.849] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1054, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.849] SetEndOfFile (hFile=0xdc) returned 1 [0176.851] GetProcessHeap () returned 0x4e0000 [0176.851] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.851] GetProcessHeap () returned 0x4e0000 [0176.851] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.851] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00411_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00411_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00411_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00411_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.852] CloseHandle (hObject=0xdc) returned 1 [0176.852] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e9e8900, ftCreationTime.dwHighDateTime=0x1bd4bd7, ftLastAccessTime.dwLowDateTime=0x6d4fb570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e9e8900, ftLastWriteTime.dwHighDateTime=0x1bd4bd7, nFileSizeHigh=0x0, nFileSizeLow=0x9d2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN00687_.WMF", cAlternateFileName="")) returned 1 [0176.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.853] GetProcessHeap () returned 0x4e0000 [0176.853] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.853] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.854] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.854] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0176.855] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.855] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.855] GetProcessHeap () returned 0x4e0000 [0176.855] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.855] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.855] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.855] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.856] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.856] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.856] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.856] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.856] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.856] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.856] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.856] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.856] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x9d2, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x9d2, lpOverlapped=0x0) returned 1 [0176.856] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9e0, dwBufLen=0x9e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9e0) returned 1 [0176.856] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.856] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x9e0, lpOverlapped=0x0) returned 1 [0176.856] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.856] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xab4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.856] SetEndOfFile (hFile=0xdc) returned 1 [0176.858] GetProcessHeap () returned 0x4e0000 [0176.858] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.858] GetProcessHeap () returned 0x4e0000 [0176.859] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.859] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00687_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00687_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00687_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.860] CloseHandle (hObject=0xdc) returned 1 [0176.860] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd723f700, ftCreationTime.dwHighDateTime=0x1bd4bee, ftLastAccessTime.dwLowDateTime=0x6d4fb570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd723f700, ftLastWriteTime.dwHighDateTime=0x1bd4bee, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN01164_.WMF", cAlternateFileName="")) returned 1 [0176.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01164_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01164_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.860] GetProcessHeap () returned 0x4e0000 [0176.860] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.860] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.860] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.861] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0176.862] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.862] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.862] GetProcessHeap () returned 0x4e0000 [0176.862] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.862] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.862] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.862] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.862] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.862] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.862] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.862] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.863] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.863] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.863] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.863] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.863] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x236, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x236, lpOverlapped=0x0) returned 1 [0176.863] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x240, dwBufLen=0x240 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x240) returned 1 [0176.863] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.863] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x240, lpOverlapped=0x0) returned 1 [0176.863] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.863] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.863] SetEndOfFile (hFile=0xdc) returned 1 [0176.865] GetProcessHeap () returned 0x4e0000 [0176.865] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.865] GetProcessHeap () returned 0x4e0000 [0176.865] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.865] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01164_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01164_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01164_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01164_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.866] CloseHandle (hObject=0xdc) returned 1 [0176.866] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fba7700, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x5ae692f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6fba7700, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x66a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN01165_.WMF", cAlternateFileName="")) returned 1 [0176.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01165_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01165_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.867] GetProcessHeap () returned 0x4e0000 [0176.867] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.867] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.867] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.867] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0176.869] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.869] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.869] GetProcessHeap () returned 0x4e0000 [0176.869] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.869] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.869] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.869] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.869] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.869] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.870] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.870] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.870] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.870] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.870] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.870] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.870] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x66a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x66a, lpOverlapped=0x0) returned 1 [0176.870] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x670, dwBufLen=0x670 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x670) returned 1 [0176.870] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.870] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x670, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x670, lpOverlapped=0x0) returned 1 [0176.870] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.870] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x744, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.870] SetEndOfFile (hFile=0xdc) returned 1 [0176.873] GetProcessHeap () returned 0x4e0000 [0176.873] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.873] GetProcessHeap () returned 0x4e0000 [0176.873] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.873] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01165_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01165_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01165_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01165_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.876] CloseHandle (hObject=0xdc) returned 1 [0176.876] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d5216d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4e02, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN01308_.WMF", cAlternateFileName="")) returned 1 [0176.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01308_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01308_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.877] GetProcessHeap () returned 0x4e0000 [0176.877] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.877] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.878] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.878] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0176.879] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.879] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.879] GetProcessHeap () returned 0x4e0000 [0176.879] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.879] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.879] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.879] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.880] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.880] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.880] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.880] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.880] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.880] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.880] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.880] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.880] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4e02, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4e02, lpOverlapped=0x0) returned 1 [0176.882] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4e10, dwBufLen=0x4e10 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4e10) returned 1 [0176.882] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.882] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4e10, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4e10, lpOverlapped=0x0) returned 1 [0176.882] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.882] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4ee4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.882] SetEndOfFile (hFile=0xdc) returned 1 [0176.884] GetProcessHeap () returned 0x4e0000 [0176.884] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.885] GetProcessHeap () returned 0x4e0000 [0176.885] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.885] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01308_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01308_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01308_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01308_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.886] CloseHandle (hObject=0xdc) returned 1 [0176.886] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56eeac00, ftCreationTime.dwHighDateTime=0x1bf1119, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56eeac00, ftLastWriteTime.dwHighDateTime=0x1bf1119, nFileSizeHigh=0x0, nFileSizeLow=0x276a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TR00006_.WMF", cAlternateFileName="")) returned 1 [0176.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00006_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.888] GetProcessHeap () returned 0x4e0000 [0176.888] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.888] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.888] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.888] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0176.890] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.890] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.890] GetProcessHeap () returned 0x4e0000 [0176.890] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.890] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.890] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.890] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.890] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.891] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.891] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.891] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.891] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.891] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.891] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.891] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.891] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x276a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x276a, lpOverlapped=0x0) returned 1 [0176.892] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2770, dwBufLen=0x2770 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2770) returned 1 [0176.892] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.892] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2770, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2770, lpOverlapped=0x0) returned 1 [0176.892] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.892] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2844, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.892] SetEndOfFile (hFile=0xdc) returned 1 [0176.894] GetProcessHeap () returned 0x4e0000 [0176.894] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.895] GetProcessHeap () returned 0x4e0000 [0176.895] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.895] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00006_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00006_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00006_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.896] CloseHandle (hObject=0xdc) returned 1 [0176.896] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6f3e600, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6f3e600, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x228c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TR00095_.WMF", cAlternateFileName="")) returned 1 [0176.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00095_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.898] GetProcessHeap () returned 0x4e0000 [0176.898] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.898] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.898] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.898] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.924] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.924] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.924] GetProcessHeap () returned 0x4e0000 [0176.924] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.924] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.924] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.924] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.924] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.924] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.924] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.924] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.925] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.925] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.925] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.925] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.925] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x228c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x228c, lpOverlapped=0x0) returned 1 [0176.926] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2290, dwBufLen=0x2290 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2290) returned 1 [0176.926] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.926] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2290, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2290, lpOverlapped=0x0) returned 1 [0176.926] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.926] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2364, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.926] SetEndOfFile (hFile=0xdc) returned 1 [0176.928] GetProcessHeap () returned 0x4e0000 [0176.928] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.928] GetProcessHeap () returned 0x4e0000 [0176.928] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.928] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00095_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00095_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.930] CloseHandle (hObject=0xdc) returned 1 [0176.930] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ba13300, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ba13300, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TR00097_.WMF", cAlternateFileName="")) returned 1 [0176.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00097_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.931] GetProcessHeap () returned 0x4e0000 [0176.931] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.931] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.931] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.931] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.933] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.933] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.933] GetProcessHeap () returned 0x4e0000 [0176.933] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.933] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.933] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.933] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.933] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.933] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.933] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.933] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.934] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.934] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.934] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.934] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.934] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x9fc, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x9fc, lpOverlapped=0x0) returned 1 [0176.934] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa00, dwBufLen=0xa00 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa00) returned 1 [0176.934] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.934] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xa00, lpOverlapped=0x0) returned 1 [0176.934] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.934] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.934] SetEndOfFile (hFile=0xdc) returned 1 [0176.937] GetProcessHeap () returned 0x4e0000 [0176.937] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.937] GetProcessHeap () returned 0x4e0000 [0176.937] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.937] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00097_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00097_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.938] CloseHandle (hObject=0xdc) returned 1 [0176.939] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98217300, ftCreationTime.dwHighDateTime=0x1bd4b14, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x98217300, ftLastWriteTime.dwHighDateTime=0x1bd4b14, nFileSizeHigh=0x0, nFileSizeLow=0x25bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TR00116_.WMF", cAlternateFileName="")) returned 1 [0176.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.941] GetProcessHeap () returned 0x4e0000 [0176.941] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.941] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.941] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.941] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.943] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.943] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.943] GetProcessHeap () returned 0x4e0000 [0176.943] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.943] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.943] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.943] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.943] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.943] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.943] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.943] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.943] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.943] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.943] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.943] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.944] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x25bc, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x25bc, lpOverlapped=0x0) returned 1 [0176.944] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x25c0, dwBufLen=0x25c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x25c0) returned 1 [0176.944] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.945] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x25c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x25c0, lpOverlapped=0x0) returned 1 [0176.945] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.945] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.945] SetEndOfFile (hFile=0xdc) returned 1 [0176.947] GetProcessHeap () returned 0x4e0000 [0176.947] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.947] GetProcessHeap () returned 0x4e0000 [0176.947] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.947] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00116_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00116_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00116_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.948] CloseHandle (hObject=0xdc) returned 1 [0176.949] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36ebde00, ftCreationTime.dwHighDateTime=0x1bf3bda, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x36ebde00, ftLastWriteTime.dwHighDateTime=0x1bf3bda, nFileSizeHigh=0x0, nFileSizeLow=0x1234, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TR00126_.WMF", cAlternateFileName="")) returned 1 [0176.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00126_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.950] GetProcessHeap () returned 0x4e0000 [0176.950] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.950] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.950] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.950] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0176.951] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.951] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.952] GetProcessHeap () returned 0x4e0000 [0176.952] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.952] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.952] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.952] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.952] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.952] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.952] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.952] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.952] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.952] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.952] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.952] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.952] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1234, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1234, lpOverlapped=0x0) returned 1 [0176.953] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1240, dwBufLen=0x1240 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1240) returned 1 [0176.953] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.953] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1240, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1240, lpOverlapped=0x0) returned 1 [0176.953] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.953] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.953] SetEndOfFile (hFile=0xdc) returned 1 [0176.955] GetProcessHeap () returned 0x4e0000 [0176.955] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.955] GetProcessHeap () returned 0x4e0000 [0176.955] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.955] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00126_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00126_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00126_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.957] CloseHandle (hObject=0xdc) returned 1 [0176.957] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x373d6f00, ftCreationTime.dwHighDateTime=0x1bd4b03, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x373d6f00, ftLastWriteTime.dwHighDateTime=0x1bd4b03, nFileSizeHigh=0x0, nFileSizeLow=0x235c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TR00172_.WMF", cAlternateFileName="")) returned 1 [0176.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.958] GetProcessHeap () returned 0x4e0000 [0176.958] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.958] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.958] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.958] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.960] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.960] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.960] GetProcessHeap () returned 0x4e0000 [0176.960] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.960] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.960] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.960] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.960] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.961] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.961] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.961] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.961] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.961] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.961] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.961] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.961] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x235c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x235c, lpOverlapped=0x0) returned 1 [0176.962] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2360, dwBufLen=0x2360 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2360) returned 1 [0176.962] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.962] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2360, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2360, lpOverlapped=0x0) returned 1 [0176.962] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.962] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2434, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.962] SetEndOfFile (hFile=0xdc) returned 1 [0176.964] GetProcessHeap () returned 0x4e0000 [0176.964] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.964] GetProcessHeap () returned 0x4e0000 [0176.964] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.964] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00172_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00172_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00172_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.970] CloseHandle (hObject=0xdc) returned 1 [0176.970] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75ca2e00, ftCreationTime.dwHighDateTime=0x1bd4af1, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x75ca2e00, ftLastWriteTime.dwHighDateTime=0x1bd4af1, nFileSizeHigh=0x0, nFileSizeLow=0x2142, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TR00178_.WMF", cAlternateFileName="")) returned 1 [0176.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00178_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.971] GetProcessHeap () returned 0x4e0000 [0176.971] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.971] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.971] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.971] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0176.973] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.973] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.973] GetProcessHeap () returned 0x4e0000 [0176.973] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.973] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.973] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.973] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.973] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.973] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.973] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.973] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.974] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.974] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.974] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.974] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.974] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2142, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2142, lpOverlapped=0x0) returned 1 [0176.974] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2150, dwBufLen=0x2150 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2150) returned 1 [0176.975] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.975] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2150, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2150, lpOverlapped=0x0) returned 1 [0176.975] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.975] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.975] SetEndOfFile (hFile=0xdc) returned 1 [0176.977] GetProcessHeap () returned 0x4e0000 [0176.977] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.977] GetProcessHeap () returned 0x4e0000 [0176.977] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.977] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00178_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00178_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00178_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.979] CloseHandle (hObject=0xdc) returned 1 [0176.979] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefc9200, ftCreationTime.dwHighDateTime=0x1bf324c, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xefc9200, ftLastWriteTime.dwHighDateTime=0x1bf324c, nFileSizeHigh=0x0, nFileSizeLow=0x6cc0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TR00232_.WMF", cAlternateFileName="")) returned 1 [0176.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00232_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00232_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.980] GetProcessHeap () returned 0x4e0000 [0176.980] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.980] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.980] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.980] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.980] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.980] GetProcessHeap () returned 0x4e0000 [0176.980] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.980] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.980] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.980] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.982] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.982] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.982] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.983] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.983] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.983] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.983] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.983] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.983] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x6cc0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x6cc0, lpOverlapped=0x0) returned 1 [0176.984] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6cc0, dwBufLen=0x6cc0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6cc0) returned 1 [0176.984] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.984] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6cc0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x6cc0, lpOverlapped=0x0) returned 1 [0176.984] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.984] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6d94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.984] SetEndOfFile (hFile=0xdc) returned 1 [0176.986] GetProcessHeap () returned 0x4e0000 [0176.987] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.987] GetProcessHeap () returned 0x4e0000 [0176.987] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.987] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00232_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00232_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00232_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00232_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.988] CloseHandle (hObject=0xdc) returned 1 [0176.988] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfba2a500, ftCreationTime.dwHighDateTime=0x1bd4b02, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfba2a500, ftLastWriteTime.dwHighDateTime=0x1bd4b02, nFileSizeHigh=0x0, nFileSizeLow=0x7c4a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TR00233_.WMF", cAlternateFileName="")) returned 1 [0176.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00233_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.989] GetProcessHeap () returned 0x4e0000 [0176.989] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.989] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.989] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.989] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0176.991] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.991] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.991] GetProcessHeap () returned 0x4e0000 [0176.991] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.991] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.991] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.991] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0176.991] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0176.991] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0176.991] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0176.992] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0176.992] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0176.992] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.992] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.992] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.992] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7c4a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7c4a, lpOverlapped=0x0) returned 1 [0176.993] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7c50, dwBufLen=0x7c50 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7c50) returned 1 [0176.993] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.993] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7c50, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7c50, lpOverlapped=0x0) returned 1 [0176.993] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.993] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7d24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.993] SetEndOfFile (hFile=0xdc) returned 1 [0176.995] GetProcessHeap () returned 0x4e0000 [0176.996] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0176.996] GetProcessHeap () returned 0x4e0000 [0176.996] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0176.996] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00233_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00233_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00233_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0176.997] CloseHandle (hObject=0xdc) returned 1 [0176.997] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8e0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TR00402_.WMF", cAlternateFileName="")) returned 1 [0176.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00402_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00402_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.999] GetProcessHeap () returned 0x4e0000 [0176.999] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0176.999] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0176.999] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0176.999] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0176.999] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0176.999] GetProcessHeap () returned 0x4e0000 [0176.999] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0176.999] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0176.999] CryptDestroyKey (hKey=0x522f98) returned 1 [0176.999] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0177.001] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0177.001] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0177.001] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0177.001] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0177.002] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0177.002] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.002] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.002] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.002] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x8e0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x8e0, lpOverlapped=0x0) returned 1 [0177.002] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8e0, dwBufLen=0x8e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8e0) returned 1 [0177.002] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.002] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x8e0, lpOverlapped=0x0) returned 1 [0177.002] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.002] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x9b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.002] SetEndOfFile (hFile=0xdc) returned 1 [0177.004] GetProcessHeap () returned 0x4e0000 [0177.004] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.004] GetProcessHeap () returned 0x4e0000 [0177.005] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.005] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00402_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00402_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00402_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00402_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.006] CloseHandle (hObject=0xdc) returned 1 [0177.006] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf396200, ftCreationTime.dwHighDateTime=0x1bd4c01, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdf396200, ftLastWriteTime.dwHighDateTime=0x1bd4c01, nFileSizeHigh=0x0, nFileSizeLow=0x2054, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TR00482_.WMF", cAlternateFileName="")) returned 1 [0177.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00482_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00482_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0177.007] GetProcessHeap () returned 0x4e0000 [0177.008] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.008] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.008] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0177.008] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0177.009] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.009] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.009] GetProcessHeap () returned 0x4e0000 [0177.009] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.009] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0177.010] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.010] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0177.010] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0177.010] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0177.010] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0177.010] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0177.010] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0177.010] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.010] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.010] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.010] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2054, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2054, lpOverlapped=0x0) returned 1 [0177.011] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2060, dwBufLen=0x2060 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2060) returned 1 [0177.011] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.011] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2060, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2060, lpOverlapped=0x0) returned 1 [0177.011] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.011] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2134, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.011] SetEndOfFile (hFile=0xdc) returned 1 [0177.013] GetProcessHeap () returned 0x4e0000 [0177.014] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.014] GetProcessHeap () returned 0x4e0000 [0177.014] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.014] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00482_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00482_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00482_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00482_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.015] CloseHandle (hObject=0xdc) returned 1 [0177.015] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd55d3200, ftCreationTime.dwHighDateTime=0x1bd4bf4, ftLastAccessTime.dwLowDateTime=0x5aeb55b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd55d3200, ftLastWriteTime.dwHighDateTime=0x1bd4bf4, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TR00494_.WMF", cAlternateFileName="")) returned 1 [0177.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00494_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0177.016] GetProcessHeap () returned 0x4e0000 [0177.016] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.016] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.016] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0177.016] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.017] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.017] GetProcessHeap () returned 0x4e0000 [0177.017] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.017] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0177.017] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.017] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0177.018] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0177.018] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0177.019] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0177.019] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0177.019] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0177.019] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.019] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.019] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.019] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1800, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1800, lpOverlapped=0x0) returned 1 [0177.020] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1800, dwBufLen=0x1800 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1800) returned 1 [0177.020] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.020] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1800, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1800, lpOverlapped=0x0) returned 1 [0177.020] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.020] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x18d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.020] SetEndOfFile (hFile=0xdc) returned 1 [0177.022] GetProcessHeap () returned 0x4e0000 [0177.022] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.022] GetProcessHeap () returned 0x4e0000 [0177.022] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.022] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00494_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00494_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.024] CloseHandle (hObject=0xdc) returned 1 [0177.024] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x70639c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x342e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="URBAN_01.MID", cAlternateFileName="")) returned 1 [0177.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0177.025] GetProcessHeap () returned 0x4e0000 [0177.025] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.025] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.025] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0177.025] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0177.027] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.027] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.027] GetProcessHeap () returned 0x4e0000 [0177.027] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.027] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0177.027] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.027] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0177.027] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0177.027] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0177.027] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0177.027] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0177.027] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0177.027] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.027] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.028] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.028] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x342e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x342e, lpOverlapped=0x0) returned 1 [0177.028] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3430, dwBufLen=0x3430 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3430) returned 1 [0177.029] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.029] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3430, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3430, lpOverlapped=0x0) returned 1 [0177.029] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.029] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3504, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.029] SetEndOfFile (hFile=0xdc) returned 1 [0177.031] GetProcessHeap () returned 0x4e0000 [0177.031] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.031] GetProcessHeap () returned 0x4e0000 [0177.031] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.031] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.033] CloseHandle (hObject=0xdc) returned 1 [0177.033] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1361, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VCTRN_01.MID", cAlternateFileName="")) returned 1 [0177.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0177.034] GetProcessHeap () returned 0x4e0000 [0177.034] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.034] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.034] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0177.034] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xf, lpOverlapped=0x0) returned 1 [0177.036] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.036] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.036] GetProcessHeap () returned 0x4e0000 [0177.036] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.036] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0177.036] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.036] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0177.036] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0177.036] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0177.037] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0177.037] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0177.037] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0177.037] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.037] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.037] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.037] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1361, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1361, lpOverlapped=0x0) returned 1 [0177.038] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1370, dwBufLen=0x1370 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1370) returned 1 [0177.038] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.038] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1370, lpOverlapped=0x0) returned 1 [0177.038] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.038] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1444, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.038] SetEndOfFile (hFile=0xdc) returned 1 [0177.040] GetProcessHeap () returned 0x4e0000 [0177.040] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.040] GetProcessHeap () returned 0x4e0000 [0177.040] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.040] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.041] CloseHandle (hObject=0xdc) returned 1 [0177.041] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ce1f900, ftCreationTime.dwHighDateTime=0x1bd4e55, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ce1f900, ftLastWriteTime.dwHighDateTime=0x1bd4e55, nFileSizeHigh=0x0, nFileSizeLow=0x2e4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01219_.GIF", cAlternateFileName="")) returned 1 [0177.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01219_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0177.043] GetProcessHeap () returned 0x4e0000 [0177.043] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.043] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.043] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0177.043] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0177.045] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.045] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.045] GetProcessHeap () returned 0x4e0000 [0177.045] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.045] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0177.045] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.045] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0177.045] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0177.045] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0177.045] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0177.045] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0177.045] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0177.045] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.045] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.045] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.045] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2e4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2e4, lpOverlapped=0x0) returned 1 [0177.045] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2f0, dwBufLen=0x2f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2f0) returned 1 [0177.045] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.045] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2f0, lpOverlapped=0x0) returned 1 [0177.046] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.046] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.046] SetEndOfFile (hFile=0xdc) returned 1 [0177.048] GetProcessHeap () returned 0x4e0000 [0177.048] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.048] GetProcessHeap () returned 0x4e0000 [0177.048] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.048] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01219_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01219_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.049] CloseHandle (hObject=0xdc) returned 1 [0177.049] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f000, ftCreationTime.dwHighDateTime=0x1bd4e6c, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4f000, ftLastWriteTime.dwHighDateTime=0x1bd4e6c, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01237_.GIF", cAlternateFileName="")) returned 1 [0177.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01237_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0177.050] GetProcessHeap () returned 0x4e0000 [0177.050] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.050] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.050] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0177.050] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x5, lpOverlapped=0x0) returned 1 [0177.051] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.051] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.051] GetProcessHeap () returned 0x4e0000 [0177.051] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.051] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0177.051] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.051] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0177.051] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0177.051] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0177.051] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0177.051] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0177.052] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0177.052] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.052] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.052] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.052] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x16b, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x16b, lpOverlapped=0x0) returned 1 [0177.052] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x170, dwBufLen=0x170 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x170) returned 1 [0177.052] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.052] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x170, lpOverlapped=0x0) returned 1 [0177.052] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.052] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x244, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.052] SetEndOfFile (hFile=0xdc) returned 1 [0177.054] GetProcessHeap () returned 0x4e0000 [0177.054] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.054] GetProcessHeap () returned 0x4e0000 [0177.054] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.054] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01237_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01237_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.057] CloseHandle (hObject=0xdc) returned 1 [0177.057] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe368b800, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe368b800, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x167, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01238_.GIF", cAlternateFileName="")) returned 1 [0177.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01238_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0177.057] GetProcessHeap () returned 0x4e0000 [0177.057] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.057] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.057] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0177.058] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x9, lpOverlapped=0x0) returned 1 [0177.059] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.059] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.059] GetProcessHeap () returned 0x4e0000 [0177.059] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.059] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0177.059] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.059] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0177.059] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0177.059] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0177.059] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0177.059] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0177.059] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0177.059] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.059] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.059] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.059] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x167, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x167, lpOverlapped=0x0) returned 1 [0177.059] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x170, dwBufLen=0x170 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x170) returned 1 [0177.060] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.060] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x170, lpOverlapped=0x0) returned 1 [0177.060] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.060] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x244, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.060] SetEndOfFile (hFile=0xdc) returned 1 [0177.062] GetProcessHeap () returned 0x4e0000 [0177.062] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.062] GetProcessHeap () returned 0x4e0000 [0177.062] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.062] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01238_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01238_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.064] CloseHandle (hObject=0xdc) returned 1 [0177.065] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfa57200, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbfa57200, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x19a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01239_.GIF", cAlternateFileName="")) returned 1 [0177.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01239_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0177.065] GetProcessHeap () returned 0x4e0000 [0177.066] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.066] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.066] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0177.066] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0177.067] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.067] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.067] GetProcessHeap () returned 0x4e0000 [0177.067] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.067] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0177.067] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.067] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0177.067] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0177.068] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0177.068] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0177.068] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0177.068] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0177.068] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.068] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.068] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.068] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x19a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x19a, lpOverlapped=0x0) returned 1 [0177.068] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1a0, dwBufLen=0x1a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1a0) returned 1 [0177.068] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.068] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1a0, lpOverlapped=0x0) returned 1 [0177.068] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.068] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x274, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.068] SetEndOfFile (hFile=0xdc) returned 1 [0177.071] GetProcessHeap () returned 0x4e0000 [0177.071] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.071] GetProcessHeap () returned 0x4e0000 [0177.071] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.071] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01239_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01239_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.073] CloseHandle (hObject=0xdc) returned 1 [0177.073] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1d80d00, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa1d80d00, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x14d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01240_.GIF", cAlternateFileName="")) returned 1 [0177.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01240_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0177.074] GetProcessHeap () returned 0x4e0000 [0177.074] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.075] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.075] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0177.075] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x3, lpOverlapped=0x0) returned 1 [0177.077] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.077] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.077] GetProcessHeap () returned 0x4e0000 [0177.077] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.077] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0177.077] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.077] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0177.077] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0177.077] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0177.077] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0177.078] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0177.078] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0177.078] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.078] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.078] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.078] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x14d, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x14d, lpOverlapped=0x0) returned 1 [0177.078] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x150, dwBufLen=0x150 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x150) returned 1 [0177.078] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.078] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x150, lpOverlapped=0x0) returned 1 [0177.078] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.078] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.078] SetEndOfFile (hFile=0xdc) returned 1 [0177.080] GetProcessHeap () returned 0x4e0000 [0177.080] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.080] GetProcessHeap () returned 0x4e0000 [0177.080] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.081] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01240_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01240_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.083] CloseHandle (hObject=0xdc) returned 1 [0177.083] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x866d0200, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x866d0200, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01241_.GIF", cAlternateFileName="")) returned 1 [0177.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01241_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0177.084] GetProcessHeap () returned 0x4e0000 [0177.084] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.084] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.084] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0177.084] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0177.086] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.086] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.086] GetProcessHeap () returned 0x4e0000 [0177.086] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.086] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0177.086] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.086] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0177.086] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0177.086] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0177.086] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0177.086] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0177.086] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0177.086] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.086] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.086] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.086] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x182, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x182, lpOverlapped=0x0) returned 1 [0177.086] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x190, dwBufLen=0x190 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x190) returned 1 [0177.086] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.086] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x190, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x190, lpOverlapped=0x0) returned 1 [0177.087] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.087] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x264, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.087] SetEndOfFile (hFile=0xdc) returned 1 [0177.089] GetProcessHeap () returned 0x4e0000 [0177.089] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.089] GetProcessHeap () returned 0x4e0000 [0177.089] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.089] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01241_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01241_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.091] CloseHandle (hObject=0xdc) returned 1 [0177.091] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e14c700, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e14c700, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x158, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01242_.GIF", cAlternateFileName="")) returned 1 [0177.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01242_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0177.092] GetProcessHeap () returned 0x4e0000 [0177.092] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.092] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.092] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0177.092] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0177.093] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.093] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.093] GetProcessHeap () returned 0x4e0000 [0177.093] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.093] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0177.093] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.093] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0177.093] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0177.093] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0177.094] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0177.094] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0177.094] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0177.094] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.094] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.094] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.094] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x158, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x158, lpOverlapped=0x0) returned 1 [0177.094] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x160, dwBufLen=0x160 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x160) returned 1 [0177.094] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.094] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x160, lpOverlapped=0x0) returned 1 [0177.094] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.094] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x234, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.094] SetEndOfFile (hFile=0xdc) returned 1 [0177.096] GetProcessHeap () returned 0x4e0000 [0177.096] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.096] GetProcessHeap () returned 0x4e0000 [0177.096] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.096] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01242_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01242_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.099] CloseHandle (hObject=0xdc) returned 1 [0177.099] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b01f700, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b01f700, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x1af, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01243_.GIF", cAlternateFileName="")) returned 1 [0177.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01243_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0177.101] GetProcessHeap () returned 0x4e0000 [0177.101] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.101] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.101] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0177.101] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x1, lpOverlapped=0x0) returned 1 [0177.102] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.102] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.102] GetProcessHeap () returned 0x4e0000 [0177.102] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.102] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0177.102] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.102] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0177.102] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0177.102] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0177.102] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0177.103] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0177.103] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0177.103] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.103] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.103] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.103] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1af, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1af, lpOverlapped=0x0) returned 1 [0177.103] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1b0, dwBufLen=0x1b0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1b0) returned 1 [0177.103] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.103] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1b0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1b0, lpOverlapped=0x0) returned 1 [0177.103] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.103] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x284, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.103] SetEndOfFile (hFile=0xdc) returned 1 [0177.105] GetProcessHeap () returned 0x4e0000 [0177.105] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.105] GetProcessHeap () returned 0x4e0000 [0177.105] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.105] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01243_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01243_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.107] CloseHandle (hObject=0xdc) returned 1 [0177.107] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b82ae00, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b82ae00, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x1d3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01244_.GIF", cAlternateFileName="")) returned 1 [0177.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01244_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0177.108] GetProcessHeap () returned 0x4e0000 [0177.108] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.108] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.108] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0177.108] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xd, lpOverlapped=0x0) returned 1 [0177.109] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.109] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.109] GetProcessHeap () returned 0x4e0000 [0177.109] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.109] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0177.110] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.110] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0177.110] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0177.110] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0177.110] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0177.110] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0177.110] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0177.110] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.110] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.110] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.110] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1d3, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1d3, lpOverlapped=0x0) returned 1 [0177.110] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1e0) returned 1 [0177.110] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.110] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1e0, lpOverlapped=0x0) returned 1 [0177.110] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.110] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.110] SetEndOfFile (hFile=0xdc) returned 1 [0177.112] GetProcessHeap () returned 0x4e0000 [0177.112] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.112] GetProcessHeap () returned 0x4e0000 [0177.112] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.113] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01244_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01244_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.115] CloseHandle (hObject=0xdc) returned 1 [0177.115] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x545ba000, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x545ba000, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01245_.GIF", cAlternateFileName="")) returned 1 [0177.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01245_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0177.117] GetProcessHeap () returned 0x4e0000 [0177.117] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.117] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.117] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0177.117] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xb, lpOverlapped=0x0) returned 1 [0177.118] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.118] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.118] GetProcessHeap () returned 0x4e0000 [0177.118] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.118] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0177.118] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.118] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0177.118] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0177.118] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0177.118] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0177.118] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0177.119] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0177.119] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.119] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.119] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.119] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x155, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x155, lpOverlapped=0x0) returned 1 [0177.119] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x160, dwBufLen=0x160 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x160) returned 1 [0177.119] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.119] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x160, lpOverlapped=0x0) returned 1 [0177.119] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.119] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x234, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.119] SetEndOfFile (hFile=0xdc) returned 1 [0177.121] GetProcessHeap () returned 0x4e0000 [0177.121] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.121] GetProcessHeap () returned 0x4e0000 [0177.121] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.121] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01245_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01245_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.123] CloseHandle (hObject=0xdc) returned 1 [0177.123] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x486fde00, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x486fde00, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x1ce, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01246_.GIF", cAlternateFileName="")) returned 1 [0177.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01246_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0177.124] GetProcessHeap () returned 0x4e0000 [0177.124] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.124] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.124] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0177.124] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0177.125] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.125] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.125] GetProcessHeap () returned 0x4e0000 [0177.125] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.125] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0177.125] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.125] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0177.125] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0177.125] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0177.125] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0177.126] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0177.126] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0177.126] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.126] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.126] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.126] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1ce, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1ce, lpOverlapped=0x0) returned 1 [0177.126] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1d0) returned 1 [0177.126] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.126] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1d0, lpOverlapped=0x0) returned 1 [0177.126] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.126] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.126] SetEndOfFile (hFile=0xdc) returned 1 [0177.128] GetProcessHeap () returned 0x4e0000 [0177.128] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.128] GetProcessHeap () returned 0x4e0000 [0177.128] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.129] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01246_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01246_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.130] CloseHandle (hObject=0xdc) returned 1 [0177.130] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d7f5e00, ftCreationTime.dwHighDateTime=0x1bd4e68, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d7f5e00, ftLastWriteTime.dwHighDateTime=0x1bd4e68, nFileSizeHigh=0x0, nFileSizeLow=0xff7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01253_.GIF", cAlternateFileName="")) returned 1 [0177.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01253_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0177.131] GetProcessHeap () returned 0x4e0000 [0177.131] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.131] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.131] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0177.131] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x9, lpOverlapped=0x0) returned 1 [0177.133] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.133] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.133] GetProcessHeap () returned 0x4e0000 [0177.134] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.134] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0177.134] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.134] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0177.134] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0177.134] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0177.134] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0177.134] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0177.134] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0177.134] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.134] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.134] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.134] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xff7, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xff7, lpOverlapped=0x0) returned 1 [0177.135] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1000, dwBufLen=0x1000 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1000) returned 1 [0177.135] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.135] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1000, lpOverlapped=0x0) returned 1 [0177.135] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.135] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x10d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.135] SetEndOfFile (hFile=0xdc) returned 1 [0177.137] GetProcessHeap () returned 0x4e0000 [0177.137] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.137] GetProcessHeap () returned 0x4e0000 [0177.137] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.137] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01253_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01253_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.139] CloseHandle (hObject=0xdc) returned 1 [0177.139] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9550b600, ftCreationTime.dwHighDateTime=0x1bd4e65, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9550b600, ftLastWriteTime.dwHighDateTime=0x1bd4e65, nFileSizeHigh=0x0, nFileSizeLow=0x1ab, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01268_.GIF", cAlternateFileName="")) returned 1 [0177.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01268_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0177.139] GetProcessHeap () returned 0x4e0000 [0177.139] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.139] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.139] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0177.140] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x5, lpOverlapped=0x0) returned 1 [0177.141] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.141] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.141] GetProcessHeap () returned 0x4e0000 [0177.141] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.141] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0177.141] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.141] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0177.141] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0177.141] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0177.141] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0177.141] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0177.141] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0177.141] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.142] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.142] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.142] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1ab, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1ab, lpOverlapped=0x0) returned 1 [0177.142] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1b0, dwBufLen=0x1b0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1b0) returned 1 [0177.142] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.142] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1b0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1b0, lpOverlapped=0x0) returned 1 [0177.142] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.142] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x284, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.142] SetEndOfFile (hFile=0xdc) returned 1 [0177.144] GetProcessHeap () returned 0x4e0000 [0177.144] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.144] GetProcessHeap () returned 0x4e0000 [0177.144] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.144] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01268_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01268_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.146] CloseHandle (hObject=0xdc) returned 1 [0177.146] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc336fa00, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc336fa00, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x255, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01292_.GIF", cAlternateFileName="")) returned 1 [0177.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01292_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0177.147] GetProcessHeap () returned 0x4e0000 [0177.147] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.147] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.147] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0177.147] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xb, lpOverlapped=0x0) returned 1 [0177.148] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.148] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.148] GetProcessHeap () returned 0x4e0000 [0177.148] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.148] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0177.148] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.148] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0177.148] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0177.148] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0177.149] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0177.149] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0177.149] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0177.149] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.149] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.149] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.149] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x255, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x255, lpOverlapped=0x0) returned 1 [0177.149] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x260, dwBufLen=0x260 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x260) returned 1 [0177.149] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.149] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x260, lpOverlapped=0x0) returned 1 [0177.149] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.149] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x334, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.149] SetEndOfFile (hFile=0xdc) returned 1 [0177.151] GetProcessHeap () returned 0x4e0000 [0177.151] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.151] GetProcessHeap () returned 0x4e0000 [0177.151] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.151] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01292_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01292_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.152] CloseHandle (hObject=0xdc) returned 1 [0177.152] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc0fec00, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc0fec00, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x2a7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01293_.GIF", cAlternateFileName="")) returned 1 [0177.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01293_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0177.154] GetProcessHeap () returned 0x4e0000 [0177.154] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.154] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.154] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0177.154] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x9, lpOverlapped=0x0) returned 1 [0177.155] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.155] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.155] GetProcessHeap () returned 0x4e0000 [0177.155] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.155] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0177.155] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.155] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0177.156] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0177.156] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0177.156] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0177.156] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0177.156] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0177.156] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.156] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.156] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.156] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2a7, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2a7, lpOverlapped=0x0) returned 1 [0177.156] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2b0, dwBufLen=0x2b0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2b0) returned 1 [0177.156] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.156] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2b0, lpOverlapped=0x0) returned 1 [0177.156] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.156] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x384, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.156] SetEndOfFile (hFile=0xdc) returned 1 [0177.158] GetProcessHeap () returned 0x4e0000 [0177.159] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.159] GetProcessHeap () returned 0x4e0000 [0177.159] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.159] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01293_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01293_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.160] CloseHandle (hObject=0xdc) returned 1 [0177.162] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0242a00, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0242a00, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x2ad, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01294_.GIF", cAlternateFileName="")) returned 1 [0177.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01294_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0177.163] GetProcessHeap () returned 0x4e0000 [0177.163] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.163] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.163] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0177.163] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x3, lpOverlapped=0x0) returned 1 [0177.164] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.164] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.164] GetProcessHeap () returned 0x4e0000 [0177.164] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.164] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0177.164] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.164] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0177.164] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0177.164] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0177.165] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0177.165] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0177.165] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0177.165] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.165] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.165] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.165] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2ad, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2ad, lpOverlapped=0x0) returned 1 [0177.165] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2b0, dwBufLen=0x2b0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2b0) returned 1 [0177.165] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.165] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2b0, lpOverlapped=0x0) returned 1 [0177.165] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.165] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x384, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.165] SetEndOfFile (hFile=0xdc) returned 1 [0177.168] GetProcessHeap () returned 0x4e0000 [0177.168] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.168] GetProcessHeap () returned 0x4e0000 [0177.168] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.168] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01294_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01294_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.169] CloseHandle (hObject=0xdc) returned 1 [0177.169] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3725d200, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3725d200, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x161, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01295_.GIF", cAlternateFileName="")) returned 1 [0177.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01295_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0177.170] GetProcessHeap () returned 0x4e0000 [0177.170] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.170] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.170] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0177.170] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xf, lpOverlapped=0x0) returned 1 [0177.172] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.172] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.172] GetProcessHeap () returned 0x4e0000 [0177.172] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.172] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0177.172] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.172] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0177.172] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0177.172] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0177.172] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0177.172] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0177.173] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0177.173] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.173] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.173] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.173] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x161, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x161, lpOverlapped=0x0) returned 1 [0177.173] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x170, dwBufLen=0x170 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x170) returned 1 [0177.173] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.173] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x170, lpOverlapped=0x0) returned 1 [0177.173] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.173] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x244, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.173] SetEndOfFile (hFile=0xdc) returned 1 [0177.175] GetProcessHeap () returned 0x4e0000 [0177.175] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.175] GetProcessHeap () returned 0x4e0000 [0177.175] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.175] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01295_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01295_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.177] CloseHandle (hObject=0xdc) returned 1 [0177.177] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x997dd300, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x997dd300, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x1ef, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01296_.GIF", cAlternateFileName="")) returned 1 [0177.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01296_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0177.178] GetProcessHeap () returned 0x4e0000 [0177.178] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.178] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.178] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0177.178] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x1, lpOverlapped=0x0) returned 1 [0177.179] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.179] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.179] GetProcessHeap () returned 0x4e0000 [0177.179] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.179] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0177.179] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.179] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0177.180] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0177.180] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0177.180] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0177.180] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0177.180] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0177.180] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.180] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.180] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.180] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1ef, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1ef, lpOverlapped=0x0) returned 1 [0177.180] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1f0) returned 1 [0177.180] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.180] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1f0, lpOverlapped=0x0) returned 1 [0177.180] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.180] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.180] SetEndOfFile (hFile=0xdc) returned 1 [0177.182] GetProcessHeap () returned 0x4e0000 [0177.182] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.182] GetProcessHeap () returned 0x4e0000 [0177.182] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.182] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01296_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01296_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.184] CloseHandle (hObject=0xdc) returned 1 [0177.185] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9387f200, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9387f200, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01297_.GIF", cAlternateFileName="")) returned 1 [0177.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01297_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0177.186] GetProcessHeap () returned 0x4e0000 [0177.186] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.186] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.186] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0177.186] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0177.187] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.187] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.187] GetProcessHeap () returned 0x4e0000 [0177.187] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.187] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0177.187] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.187] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0177.187] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0177.188] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0177.188] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0177.188] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0177.188] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0177.188] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.188] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.188] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.188] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x37e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x37e, lpOverlapped=0x0) returned 1 [0177.188] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x380, dwBufLen=0x380 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x380) returned 1 [0177.188] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.188] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x380, lpOverlapped=0x0) returned 1 [0177.188] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.188] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x454, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.188] SetEndOfFile (hFile=0xdc) returned 1 [0177.191] GetProcessHeap () returned 0x4e0000 [0177.191] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.191] GetProcessHeap () returned 0x4e0000 [0177.191] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.191] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01297_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01297_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.192] CloseHandle (hObject=0xdc) returned 1 [0177.192] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d921100, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d921100, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x2bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01298_.GIF", cAlternateFileName="")) returned 1 [0177.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01298_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0177.193] GetProcessHeap () returned 0x4e0000 [0177.193] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.193] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.193] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0177.193] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0177.195] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.195] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.195] GetProcessHeap () returned 0x4e0000 [0177.195] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.195] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0177.195] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.195] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0177.195] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0177.195] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0177.195] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0177.195] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0177.195] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0177.195] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.195] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.195] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.195] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2bc, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2bc, lpOverlapped=0x0) returned 1 [0177.196] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2c0) returned 1 [0177.196] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.196] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2c0, lpOverlapped=0x0) returned 1 [0177.196] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.196] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x394, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.196] SetEndOfFile (hFile=0xdc) returned 1 [0177.198] GetProcessHeap () returned 0x4e0000 [0177.198] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.198] GetProcessHeap () returned 0x4e0000 [0177.198] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.198] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01298_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01298_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.199] CloseHandle (hObject=0xdc) returned 1 [0177.199] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82d77c00, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82d77c00, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01299_.GIF", cAlternateFileName="")) returned 1 [0177.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01299_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0177.200] GetProcessHeap () returned 0x4e0000 [0177.200] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.200] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.200] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0177.200] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0177.201] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.201] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.201] GetProcessHeap () returned 0x4e0000 [0177.201] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.201] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0177.201] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.201] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0177.202] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0177.202] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0177.202] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0177.202] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0177.202] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0177.202] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.202] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.202] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.202] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x13e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x13e, lpOverlapped=0x0) returned 1 [0177.202] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x140, dwBufLen=0x140 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x140) returned 1 [0177.202] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.202] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x140, lpOverlapped=0x0) returned 1 [0177.202] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.202] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.202] SetEndOfFile (hFile=0xdc) returned 1 [0177.204] GetProcessHeap () returned 0x4e0000 [0177.205] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.205] GetProcessHeap () returned 0x4e0000 [0177.205] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.205] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01299_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01299_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.207] CloseHandle (hObject=0xdc) returned 1 [0177.207] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x794e1400, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x794e1400, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x250, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01300_.GIF", cAlternateFileName="")) returned 1 [0177.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01300_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0177.207] GetProcessHeap () returned 0x4e0000 [0177.207] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.207] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.207] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0177.208] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.208] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.208] GetProcessHeap () returned 0x4e0000 [0177.208] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.208] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0177.208] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.208] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0177.209] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0177.209] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0177.209] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0177.209] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0177.209] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0177.209] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.209] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.209] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.210] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x250, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x250, lpOverlapped=0x0) returned 1 [0177.210] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x250, dwBufLen=0x250 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x250) returned 1 [0177.210] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.210] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x250, lpOverlapped=0x0) returned 1 [0177.210] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.210] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x324, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.210] SetEndOfFile (hFile=0xdc) returned 1 [0177.212] GetProcessHeap () returned 0x4e0000 [0177.212] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.212] GetProcessHeap () returned 0x4e0000 [0177.212] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.212] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01300_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01300_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.213] CloseHandle (hObject=0xdc) returned 1 [0177.213] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74896000, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74896000, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x2a9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01301_.GIF", cAlternateFileName="")) returned 1 [0177.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01301_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0177.213] GetProcessHeap () returned 0x4e0000 [0177.213] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.214] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.214] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0177.214] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x7, lpOverlapped=0x0) returned 1 [0177.215] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.215] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.215] GetProcessHeap () returned 0x4e0000 [0177.215] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.215] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0177.215] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.215] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0177.215] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0177.215] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0177.215] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0177.215] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0177.215] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0177.216] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.216] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.216] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.216] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2a9, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2a9, lpOverlapped=0x0) returned 1 [0177.216] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2b0, dwBufLen=0x2b0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2b0) returned 1 [0177.216] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.216] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2b0, lpOverlapped=0x0) returned 1 [0177.216] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.216] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x384, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.216] SetEndOfFile (hFile=0xdc) returned 1 [0177.218] GetProcessHeap () returned 0x4e0000 [0177.218] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.218] GetProcessHeap () returned 0x4e0000 [0177.218] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.218] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01301_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01301_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.219] CloseHandle (hObject=0xdc) returned 1 [0177.219] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7a0ea00, ftCreationTime.dwHighDateTime=0x1bd4e4a, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a0ea00, ftLastWriteTime.dwHighDateTime=0x1bd4e4a, nFileSizeHigh=0x0, nFileSizeLow=0x2076, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01304G.GIF", cAlternateFileName="")) returned 1 [0177.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01304g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0177.220] GetProcessHeap () returned 0x4e0000 [0177.220] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.220] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.220] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0177.220] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0177.222] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.222] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.222] GetProcessHeap () returned 0x4e0000 [0177.222] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.222] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0177.222] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.222] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0177.222] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0177.222] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0177.222] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0177.222] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0177.222] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0177.222] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.222] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.222] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.222] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2076, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2076, lpOverlapped=0x0) returned 1 [0177.223] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2080, dwBufLen=0x2080 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2080) returned 1 [0177.223] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.223] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2080, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2080, lpOverlapped=0x0) returned 1 [0177.223] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.223] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2154, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.223] SetEndOfFile (hFile=0xdc) returned 1 [0177.225] GetProcessHeap () returned 0x4e0000 [0177.225] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.225] GetProcessHeap () returned 0x4e0000 [0177.225] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.225] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01304g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01304g.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.226] CloseHandle (hObject=0xdc) returned 1 [0177.226] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4c9d300, ftCreationTime.dwHighDateTime=0x1bd4e62, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4c9d300, ftLastWriteTime.dwHighDateTime=0x1bd4e62, nFileSizeHigh=0x0, nFileSizeLow=0x172, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01330_.GIF", cAlternateFileName="")) returned 1 [0177.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01330_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0177.230] GetProcessHeap () returned 0x4e0000 [0177.230] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.230] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.230] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0177.230] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0177.232] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.232] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.232] GetProcessHeap () returned 0x4e0000 [0177.232] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.232] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0177.232] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.232] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0177.232] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0177.232] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0177.232] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0177.232] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0177.233] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0177.233] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.233] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.233] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.233] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x172, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x172, lpOverlapped=0x0) returned 1 [0177.233] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x180, dwBufLen=0x180 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x180) returned 1 [0177.233] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.233] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x180, lpOverlapped=0x0) returned 1 [0177.233] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.233] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x254, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.233] SetEndOfFile (hFile=0xdc) returned 1 [0177.235] GetProcessHeap () returned 0x4e0000 [0177.235] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.235] GetProcessHeap () returned 0x4e0000 [0177.235] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.235] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01330_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01330_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.237] CloseHandle (hObject=0xdc) returned 1 [0177.237] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x976a4300, ftCreationTime.dwHighDateTime=0x1bd4e6c, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x976a4300, ftLastWriteTime.dwHighDateTime=0x1bd4e6c, nFileSizeHigh=0x0, nFileSizeLow=0x899, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01734_.GIF", cAlternateFileName="")) returned 1 [0177.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01734_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0177.238] GetProcessHeap () returned 0x4e0000 [0177.238] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.238] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.238] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0177.238] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x7, lpOverlapped=0x0) returned 1 [0177.240] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.240] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.240] GetProcessHeap () returned 0x4e0000 [0177.240] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.240] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0177.240] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.240] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0177.240] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0177.240] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0177.240] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0177.240] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0177.240] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0177.240] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.240] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.240] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.241] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x899, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x899, lpOverlapped=0x0) returned 1 [0177.241] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8a0, dwBufLen=0x8a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8a0) returned 1 [0177.241] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.241] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x8a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x8a0, lpOverlapped=0x0) returned 1 [0177.241] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.241] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x974, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.241] SetEndOfFile (hFile=0xdc) returned 1 [0177.243] GetProcessHeap () returned 0x4e0000 [0177.243] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.243] GetProcessHeap () returned 0x4e0000 [0177.243] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.243] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01734_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01734_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.244] CloseHandle (hObject=0xdc) returned 1 [0177.244] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b18d700, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b18d700, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x2c3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01740_.GIF", cAlternateFileName="")) returned 1 [0177.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01740_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0177.245] GetProcessHeap () returned 0x4e0000 [0177.245] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.245] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.245] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0177.245] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xd, lpOverlapped=0x0) returned 1 [0177.246] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.246] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.246] GetProcessHeap () returned 0x4e0000 [0177.246] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.246] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0177.246] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.246] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0177.247] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0177.247] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0177.247] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0177.247] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0177.247] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0177.247] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.247] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.247] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.247] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2c3, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2c3, lpOverlapped=0x0) returned 1 [0177.247] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2d0) returned 1 [0177.247] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.247] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2d0, lpOverlapped=0x0) returned 1 [0177.247] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.248] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.248] SetEndOfFile (hFile=0xdc) returned 1 [0177.250] GetProcessHeap () returned 0x4e0000 [0177.250] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.250] GetProcessHeap () returned 0x4e0000 [0177.250] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.250] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01740_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01740_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.251] CloseHandle (hObject=0xdc) returned 1 [0177.251] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49077500, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x49077500, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x253, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01742_.GIF", cAlternateFileName="")) returned 1 [0177.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01742_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0177.252] GetProcessHeap () returned 0x4e0000 [0177.252] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.252] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.252] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0177.252] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xd, lpOverlapped=0x0) returned 1 [0177.253] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.253] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.253] GetProcessHeap () returned 0x4e0000 [0177.253] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.253] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0177.253] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.253] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0177.254] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0177.254] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0177.254] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0177.254] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0177.254] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0177.254] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.254] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.254] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.254] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x253, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x253, lpOverlapped=0x0) returned 1 [0177.254] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x260, dwBufLen=0x260 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x260) returned 1 [0177.254] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.254] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x260, lpOverlapped=0x0) returned 1 [0177.254] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.254] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x334, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.254] SetEndOfFile (hFile=0xdc) returned 1 [0177.256] GetProcessHeap () returned 0x4e0000 [0177.256] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.256] GetProcessHeap () returned 0x4e0000 [0177.256] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.257] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01742_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01742_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.258] CloseHandle (hObject=0xdc) returned 1 [0177.258] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47d64800, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x47d64800, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x4d5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01743_.GIF", cAlternateFileName="")) returned 1 [0177.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01743_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0177.259] GetProcessHeap () returned 0x4e0000 [0177.259] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.259] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.259] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0177.259] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xb, lpOverlapped=0x0) returned 1 [0177.261] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.261] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.261] GetProcessHeap () returned 0x4e0000 [0177.261] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.261] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0177.261] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.261] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0177.261] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0177.261] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0177.261] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0177.261] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0177.261] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0177.261] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.261] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.262] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.262] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4d5, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4d5, lpOverlapped=0x0) returned 1 [0177.262] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4e0, dwBufLen=0x4e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4e0) returned 1 [0177.262] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.262] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4e0, lpOverlapped=0x0) returned 1 [0177.262] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.262] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.262] SetEndOfFile (hFile=0xdc) returned 1 [0177.264] GetProcessHeap () returned 0x4e0000 [0177.264] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.264] GetProcessHeap () returned 0x4e0000 [0177.264] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.264] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01743_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01743_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.265] CloseHandle (hObject=0xdc) returned 1 [0177.265] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9359300, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9359300, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x31f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01744_.GIF", cAlternateFileName="")) returned 1 [0177.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01744_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0177.266] GetProcessHeap () returned 0x4e0000 [0177.266] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.266] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.266] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0177.267] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x1, lpOverlapped=0x0) returned 1 [0177.268] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.268] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.268] GetProcessHeap () returned 0x4e0000 [0177.268] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.268] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0177.268] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.268] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0177.269] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0177.269] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0177.269] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0177.269] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0177.269] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0177.269] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.269] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.269] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.269] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x31f, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x31f, lpOverlapped=0x0) returned 1 [0177.269] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x320, dwBufLen=0x320 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x320) returned 1 [0177.269] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.269] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x320, lpOverlapped=0x0) returned 1 [0177.269] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.269] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.269] SetEndOfFile (hFile=0xdc) returned 1 [0177.271] GetProcessHeap () returned 0x4e0000 [0177.271] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.271] GetProcessHeap () returned 0x4e0000 [0177.271] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.271] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01744_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01744_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.273] CloseHandle (hObject=0xdc) returned 1 [0177.273] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43119400, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x43119400, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01745_.GIF", cAlternateFileName="")) returned 1 [0177.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01745_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0177.274] GetProcessHeap () returned 0x4e0000 [0177.274] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.274] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.274] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0177.274] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0177.276] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.276] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.276] GetProcessHeap () returned 0x4e0000 [0177.276] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.276] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0177.276] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.276] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0177.276] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0177.276] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0177.276] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0177.276] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0177.276] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0177.276] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.276] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.276] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.276] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5ac, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x5ac, lpOverlapped=0x0) returned 1 [0177.277] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5b0) returned 1 [0177.277] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.277] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5b0, lpOverlapped=0x0) returned 1 [0177.277] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.277] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.277] SetEndOfFile (hFile=0xdc) returned 1 [0177.279] GetProcessHeap () returned 0x4e0000 [0177.279] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.279] GetProcessHeap () returned 0x4e0000 [0177.279] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.279] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01745_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01745_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.281] CloseHandle (hObject=0xdc) returned 1 [0177.281] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ab95900, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3ab95900, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01746_.GIF", cAlternateFileName="")) returned 1 [0177.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01746_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0177.283] GetProcessHeap () returned 0x4e0000 [0177.283] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.283] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.283] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0177.283] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0177.285] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.285] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.285] GetProcessHeap () returned 0x4e0000 [0177.285] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.285] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0177.285] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.286] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0177.286] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0177.286] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0177.286] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0177.286] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0177.286] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0177.286] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.286] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.286] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.286] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2e2, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2e2, lpOverlapped=0x0) returned 1 [0177.286] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2f0, dwBufLen=0x2f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2f0) returned 1 [0177.286] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.286] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2f0, lpOverlapped=0x0) returned 1 [0177.286] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.286] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.286] SetEndOfFile (hFile=0xdc) returned 1 [0177.289] GetProcessHeap () returned 0x4e0000 [0177.289] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.289] GetProcessHeap () returned 0x4e0000 [0177.289] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.289] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01746_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01746_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.290] CloseHandle (hObject=0xdc) returned 1 [0177.291] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34c37800, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34c37800, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x387, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01747_.GIF", cAlternateFileName="")) returned 1 [0177.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01747_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0177.292] GetProcessHeap () returned 0x4e0000 [0177.292] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.292] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.292] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0177.292] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x9, lpOverlapped=0x0) returned 1 [0177.293] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.294] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.294] GetProcessHeap () returned 0x4e0000 [0177.294] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.294] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0177.294] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.294] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0177.294] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0177.294] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0177.294] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0177.294] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0177.294] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0177.294] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.294] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.294] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.294] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x387, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x387, lpOverlapped=0x0) returned 1 [0177.294] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x390, dwBufLen=0x390 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x390) returned 1 [0177.294] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.294] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x390, lpOverlapped=0x0) returned 1 [0177.294] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.294] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.295] SetEndOfFile (hFile=0xdc) returned 1 [0177.297] GetProcessHeap () returned 0x4e0000 [0177.297] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.297] GetProcessHeap () returned 0x4e0000 [0177.297] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.297] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01747_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01747_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.298] CloseHandle (hObject=0xdc) returned 1 [0177.298] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d9c6a00, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2d9c6a00, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01748_.GIF", cAlternateFileName="")) returned 1 [0177.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01748_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0177.300] GetProcessHeap () returned 0x4e0000 [0177.300] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.300] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.300] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0177.300] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x9, lpOverlapped=0x0) returned 1 [0177.302] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.302] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.302] GetProcessHeap () returned 0x4e0000 [0177.302] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.302] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0177.302] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.302] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0177.302] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0177.302] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0177.302] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0177.302] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0177.302] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0177.302] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.302] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.302] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.302] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2d7, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2d7, lpOverlapped=0x0) returned 1 [0177.302] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2e0) returned 1 [0177.302] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.303] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2e0, lpOverlapped=0x0) returned 1 [0177.303] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.303] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.303] SetEndOfFile (hFile=0xdc) returned 1 [0177.305] GetProcessHeap () returned 0x4e0000 [0177.305] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.305] GetProcessHeap () returned 0x4e0000 [0177.305] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.305] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01748_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01748_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.306] CloseHandle (hObject=0xdc) returned 1 [0177.306] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d7b600, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x28d7b600, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x3b4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01749_.GIF", cAlternateFileName="")) returned 1 [0177.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01749_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0177.307] GetProcessHeap () returned 0x4e0000 [0177.307] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.307] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.307] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0177.307] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0177.309] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.309] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.309] GetProcessHeap () returned 0x4e0000 [0177.309] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.309] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0177.309] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.309] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0177.309] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0177.309] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0177.309] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0177.309] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0177.309] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0177.310] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.310] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.310] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.310] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3b4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3b4, lpOverlapped=0x0) returned 1 [0177.310] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3c0, dwBufLen=0x3c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3c0) returned 1 [0177.310] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.310] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3c0, lpOverlapped=0x0) returned 1 [0177.310] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.310] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.310] SetEndOfFile (hFile=0xdc) returned 1 [0177.312] GetProcessHeap () returned 0x4e0000 [0177.312] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.312] GetProcessHeap () returned 0x4e0000 [0177.312] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.312] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01749_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01749_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.313] CloseHandle (hObject=0xdc) returned 1 [0177.313] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x207f7b00, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x207f7b00, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01750_.GIF", cAlternateFileName="")) returned 1 [0177.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01750_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0177.314] GetProcessHeap () returned 0x4e0000 [0177.314] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.314] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.314] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0177.314] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0177.316] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.316] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.316] GetProcessHeap () returned 0x4e0000 [0177.316] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.316] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0177.316] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.316] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0177.316] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0177.316] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0177.317] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0177.317] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0177.317] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0177.317] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.317] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.317] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.317] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x494, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x494, lpOverlapped=0x0) returned 1 [0177.317] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4a0, dwBufLen=0x4a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4a0) returned 1 [0177.317] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.317] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4a0, lpOverlapped=0x0) returned 1 [0177.317] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.317] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x574, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.317] SetEndOfFile (hFile=0xdc) returned 1 [0177.319] GetProcessHeap () returned 0x4e0000 [0177.319] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.319] GetProcessHeap () returned 0x4e0000 [0177.319] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.319] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01750_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01750_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.320] CloseHandle (hObject=0xdc) returned 1 [0177.321] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cebf400, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1cebf400, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x3b9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01751_.GIF", cAlternateFileName="")) returned 1 [0177.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01751_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0177.322] GetProcessHeap () returned 0x4e0000 [0177.322] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.322] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.322] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0177.322] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x7, lpOverlapped=0x0) returned 1 [0177.323] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.323] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.323] GetProcessHeap () returned 0x4e0000 [0177.323] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.323] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0177.323] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.324] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0177.324] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0177.324] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0177.324] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0177.324] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0177.324] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0177.324] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.324] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.324] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.324] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3b9, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3b9, lpOverlapped=0x0) returned 1 [0177.324] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3c0, dwBufLen=0x3c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3c0) returned 1 [0177.324] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.324] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3c0, lpOverlapped=0x0) returned 1 [0177.325] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.325] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.325] SetEndOfFile (hFile=0xdc) returned 1 [0177.327] GetProcessHeap () returned 0x4e0000 [0177.327] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.327] GetProcessHeap () returned 0x4e0000 [0177.327] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.327] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01751_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01751_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.329] CloseHandle (hObject=0xdc) returned 1 [0177.329] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3fc5100, ftCreationTime.dwHighDateTime=0x1bd4e61, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe3fc5100, ftLastWriteTime.dwHighDateTime=0x1bd4e61, nFileSizeHigh=0x0, nFileSizeLow=0x304, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01770_.GIF", cAlternateFileName="")) returned 1 [0177.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01770_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0177.330] GetProcessHeap () returned 0x4e0000 [0177.330] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.330] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.330] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0177.330] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0177.332] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.332] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.332] GetProcessHeap () returned 0x4e0000 [0177.332] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.332] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0177.332] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.332] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0177.332] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0177.332] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0177.332] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0177.332] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0177.332] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0177.332] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.332] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.333] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.333] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x304, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x304, lpOverlapped=0x0) returned 1 [0177.333] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x310, dwBufLen=0x310 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x310) returned 1 [0177.333] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.333] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x310, lpOverlapped=0x0) returned 1 [0177.333] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.333] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.333] SetEndOfFile (hFile=0xdc) returned 1 [0177.335] GetProcessHeap () returned 0x4e0000 [0177.335] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.335] GetProcessHeap () returned 0x4e0000 [0177.335] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.335] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01770_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01770_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.337] CloseHandle (hObject=0xdc) returned 1 [0177.337] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa42a6f00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa42a6f00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0xe44, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01838_.GIF", cAlternateFileName="")) returned 1 [0177.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01838_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0177.338] GetProcessHeap () returned 0x4e0000 [0177.338] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.338] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.338] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0177.338] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0177.340] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.340] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.340] GetProcessHeap () returned 0x4e0000 [0177.340] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.340] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0177.340] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.340] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0177.340] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0177.340] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0177.340] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0177.340] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0177.340] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0177.340] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.340] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.340] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.340] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xe44, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xe44, lpOverlapped=0x0) returned 1 [0177.340] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe50, dwBufLen=0xe50 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe50) returned 1 [0177.340] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.340] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe50, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xe50, lpOverlapped=0x0) returned 1 [0177.341] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.341] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xf24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.341] SetEndOfFile (hFile=0xdc) returned 1 [0177.343] GetProcessHeap () returned 0x4e0000 [0177.343] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.343] GetProcessHeap () returned 0x4e0000 [0177.343] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.343] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01838_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01838_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.344] CloseHandle (hObject=0xdc) returned 1 [0177.344] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1c81500, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa1c81500, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x446, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01839_.GIF", cAlternateFileName="")) returned 1 [0177.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01839_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0177.345] GetProcessHeap () returned 0x4e0000 [0177.345] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.345] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.345] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0177.345] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0177.347] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.347] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.347] GetProcessHeap () returned 0x4e0000 [0177.347] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.347] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0177.347] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.347] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0177.347] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0177.347] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0177.347] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0177.347] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0177.348] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0177.348] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.348] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.348] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.348] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x446, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x446, lpOverlapped=0x0) returned 1 [0177.348] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x450, dwBufLen=0x450 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x450) returned 1 [0177.348] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.348] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x450, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x450, lpOverlapped=0x0) returned 1 [0177.348] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.348] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x524, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.348] SetEndOfFile (hFile=0xdc) returned 1 [0177.350] GetProcessHeap () returned 0x4e0000 [0177.350] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.350] GetProcessHeap () returned 0x4e0000 [0177.350] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.350] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01839_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01839_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.351] CloseHandle (hObject=0xdc) returned 1 [0177.351] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d94800, ftCreationTime.dwHighDateTime=0x1bd4e55, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3d94800, ftLastWriteTime.dwHighDateTime=0x1bd4e55, nFileSizeHigh=0x0, nFileSizeLow=0x5fe, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01840_.GIF", cAlternateFileName="")) returned 1 [0177.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01840_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0177.352] GetProcessHeap () returned 0x4e0000 [0177.352] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.353] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.353] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0177.353] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0177.354] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.354] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.354] GetProcessHeap () returned 0x4e0000 [0177.354] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.354] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0177.354] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.354] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0177.354] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0177.355] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0177.355] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0177.355] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0177.355] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0177.355] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.355] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.355] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.355] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5fe, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x5fe, lpOverlapped=0x0) returned 1 [0177.355] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x600, dwBufLen=0x600 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x600) returned 1 [0177.355] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.355] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x600, lpOverlapped=0x0) returned 1 [0177.355] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.355] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.355] SetEndOfFile (hFile=0xdc) returned 1 [0177.357] GetProcessHeap () returned 0x4e0000 [0177.357] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.357] GetProcessHeap () returned 0x4e0000 [0177.357] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.357] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01840_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01840_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.359] CloseHandle (hObject=0xdc) returned 1 [0177.359] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x983ead00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x983ead00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x76c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01842_.GIF", cAlternateFileName="")) returned 1 [0177.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01842_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0177.359] GetProcessHeap () returned 0x4e0000 [0177.359] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.359] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.360] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0177.360] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0177.361] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.361] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.361] GetProcessHeap () returned 0x4e0000 [0177.361] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.361] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0177.361] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.361] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0177.361] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0177.362] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0177.362] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0177.362] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0177.362] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0177.362] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.362] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.362] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.362] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x76c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x76c, lpOverlapped=0x0) returned 1 [0177.362] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x770, dwBufLen=0x770 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x770) returned 1 [0177.362] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.362] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x770, lpOverlapped=0x0) returned 1 [0177.362] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.362] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x844, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.362] SetEndOfFile (hFile=0xdc) returned 1 [0177.364] GetProcessHeap () returned 0x4e0000 [0177.364] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.364] GetProcessHeap () returned 0x4e0000 [0177.364] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.364] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01842_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01842_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.366] CloseHandle (hObject=0xdc) returned 1 [0177.366] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x970d8000, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x970d8000, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x12d1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01843_.GIF", cAlternateFileName="")) returned 1 [0177.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01843_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0177.367] GetProcessHeap () returned 0x4e0000 [0177.367] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.367] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.367] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0177.367] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xf, lpOverlapped=0x0) returned 1 [0177.368] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.369] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.369] GetProcessHeap () returned 0x4e0000 [0177.369] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.369] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0177.369] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.369] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0177.369] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0177.369] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0177.369] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0177.369] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0177.369] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0177.369] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.369] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.369] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.369] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x12d1, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x12d1, lpOverlapped=0x0) returned 1 [0177.370] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x12e0, dwBufLen=0x12e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x12e0) returned 1 [0177.370] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.370] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x12e0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x12e0, lpOverlapped=0x0) returned 1 [0177.370] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.370] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x13b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.370] SetEndOfFile (hFile=0xdc) returned 1 [0177.373] GetProcessHeap () returned 0x4e0000 [0177.373] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.373] GetProcessHeap () returned 0x4e0000 [0177.373] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.373] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01843_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01843_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.374] CloseHandle (hObject=0xdc) returned 1 [0177.374] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb347100, ftCreationTime.dwHighDateTime=0x1bd4e4a, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcb347100, ftLastWriteTime.dwHighDateTime=0x1bd4e4a, nFileSizeHigh=0x0, nFileSizeLow=0x102b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB02229_.GIF", cAlternateFileName="")) returned 1 [0177.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb02229_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0177.375] GetProcessHeap () returned 0x4e0000 [0177.375] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.375] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.375] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0177.376] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x5, lpOverlapped=0x0) returned 1 [0177.377] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.377] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.377] GetProcessHeap () returned 0x4e0000 [0177.377] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.377] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0177.377] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.377] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0177.377] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0177.377] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0177.378] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0177.378] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0177.378] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0177.378] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.378] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.378] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.378] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x102b, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x102b, lpOverlapped=0x0) returned 1 [0177.379] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1030, dwBufLen=0x1030 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1030) returned 1 [0177.379] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.379] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1030, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1030, lpOverlapped=0x0) returned 1 [0177.379] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.379] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1104, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.379] SetEndOfFile (hFile=0xdc) returned 1 [0177.381] GetProcessHeap () returned 0x4e0000 [0177.381] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.381] GetProcessHeap () returned 0x4e0000 [0177.381] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.381] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb02229_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb02229_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.383] CloseHandle (hObject=0xdc) returned 1 [0177.383] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e5c1270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xa16, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WHIRL1.WMF", cAlternateFileName="")) returned 1 [0177.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl1.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0177.385] GetProcessHeap () returned 0x4e0000 [0177.385] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.385] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.385] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0177.385] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0177.387] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.387] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.387] GetProcessHeap () returned 0x4e0000 [0177.387] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0177.387] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0177.387] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.387] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0177.387] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0177.387] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0177.387] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0177.388] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0177.388] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0177.388] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.388] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.388] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.388] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xa16, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xa16, lpOverlapped=0x0) returned 1 [0177.388] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa20, dwBufLen=0xa20 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa20) returned 1 [0177.388] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.388] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xa20, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xa20, lpOverlapped=0x0) returned 1 [0177.388] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.388] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xae4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.388] SetEndOfFile (hFile=0xdc) returned 1 [0177.391] GetProcessHeap () returned 0x4e0000 [0177.391] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0177.391] GetProcessHeap () returned 0x4e0000 [0177.391] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.391] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl1.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl1.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.392] CloseHandle (hObject=0xdc) returned 1 [0177.392] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e5c1270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xb96, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WHIRL2.WMF", cAlternateFileName="")) returned 1 [0177.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl2.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0177.393] GetProcessHeap () returned 0x4e0000 [0177.393] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.393] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.393] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0177.394] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0177.395] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.395] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.395] GetProcessHeap () returned 0x4e0000 [0177.395] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0177.395] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0177.395] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.395] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0177.396] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0177.396] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0177.396] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0177.396] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0177.396] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0177.396] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.396] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.396] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.396] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb96, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xb96, lpOverlapped=0x0) returned 1 [0177.396] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xba0, dwBufLen=0xba0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xba0) returned 1 [0177.396] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.396] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xba0, lpOverlapped=0x0) returned 1 [0177.396] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.396] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xc64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.396] SetEndOfFile (hFile=0xdc) returned 1 [0177.398] GetProcessHeap () returned 0x4e0000 [0177.398] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0177.398] GetProcessHeap () returned 0x4e0000 [0177.398] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.398] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl2.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl2.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.400] CloseHandle (hObject=0xdc) returned 1 [0177.401] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e5c1270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xa16, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WING1.WMF", cAlternateFileName="")) returned 1 [0177.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing1.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0177.402] GetProcessHeap () returned 0x4e0000 [0177.403] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.403] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.403] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0177.403] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0177.405] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.405] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.405] GetProcessHeap () returned 0x4e0000 [0177.405] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0177.405] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0177.405] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.405] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0177.405] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0177.405] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0177.405] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0177.405] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0177.405] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0177.405] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.405] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.405] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.405] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xa16, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xa16, lpOverlapped=0x0) returned 1 [0177.405] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa20, dwBufLen=0xa20 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa20) returned 1 [0177.405] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.406] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xa20, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xa20, lpOverlapped=0x0) returned 1 [0177.406] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.406] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xae4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.406] SetEndOfFile (hFile=0xdc) returned 1 [0177.408] GetProcessHeap () returned 0x4e0000 [0177.408] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0177.408] GetProcessHeap () returned 0x4e0000 [0177.408] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.408] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing1.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing1.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.409] CloseHandle (hObject=0xdc) returned 1 [0177.409] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x976, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WING2.WMF", cAlternateFileName="")) returned 1 [0177.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing2.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0177.410] GetProcessHeap () returned 0x4e0000 [0177.410] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.410] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.411] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0177.411] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0177.412] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.412] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.412] GetProcessHeap () returned 0x4e0000 [0177.412] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0177.412] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0177.412] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.413] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0177.413] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0177.413] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0177.413] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0177.413] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0177.413] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0177.413] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.413] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.413] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.413] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x976, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x976, lpOverlapped=0x0) returned 1 [0177.413] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x980, dwBufLen=0x980 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x980) returned 1 [0177.413] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.413] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x980, lpOverlapped=0x0) returned 1 [0177.413] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.413] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xa44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.413] SetEndOfFile (hFile=0xdc) returned 1 [0177.415] GetProcessHeap () returned 0x4e0000 [0177.415] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0177.415] GetProcessHeap () returned 0x4e0000 [0177.415] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.415] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing2.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing2.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.417] CloseHandle (hObject=0xdc) returned 1 [0177.417] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1b03, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WNTER_01.MID", cAlternateFileName="")) returned 1 [0177.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0177.418] GetProcessHeap () returned 0x4e0000 [0177.418] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.418] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.418] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0177.418] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xd, lpOverlapped=0x0) returned 1 [0177.423] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.423] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.423] GetProcessHeap () returned 0x4e0000 [0177.423] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.423] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0177.423] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.423] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0177.423] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0177.423] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0177.423] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0177.424] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0177.424] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0177.424] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0177.424] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.424] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.424] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1b03, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1b03, lpOverlapped=0x0) returned 1 [0177.425] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1b10, dwBufLen=0x1b10 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1b10) returned 1 [0177.425] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.425] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1b10, lpOverlapped=0x0) returned 1 [0177.425] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.425] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1be4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.425] SetEndOfFile (hFile=0xdc) returned 1 [0177.427] GetProcessHeap () returned 0x4e0000 [0177.427] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.427] GetProcessHeap () returned 0x4e0000 [0177.427] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.427] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.428] CloseHandle (hObject=0xdc) returned 1 [0177.429] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1b03, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WNTER_01.MID", cAlternateFileName="")) returned 0 [0177.429] GetProcessHeap () returned 0x4e0000 [0177.429] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.429] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df248, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f98) returned 1 [0177.429] CryptDecrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df2b0 | out: pbData=0x4f53d8, pdwDataLen=0x24df2b0) returned 1 [0177.429] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.430] GetProcessHeap () returned 0x4e0000 [0177.430] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0177.430] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df248, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f98) returned 1 [0177.430] CryptDecrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df2b0 | out: pbData=0x4f5420, pdwDataLen=0x24df2b0) returned 1 [0177.430] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.430] GetProcessHeap () returned 0x4e0000 [0177.430] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x53a538 [0177.430] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df248, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f98) returned 1 [0177.430] CryptDecrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x53a538, pdwDataLen=0x24df2b0 | out: pbData=0x53a538, pdwDataLen=0x24df2b0) returned 1 [0177.430] CryptDestroyKey (hKey=0x522f98) returned 1 [0177.430] wsprintfW (in: param_1=0x24de28c, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\readme-warning.txt") returned 69 [0177.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\readme-warning.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0177.431] WriteFile (in: hFile=0xdc, lpBuffer=0x53a538*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24de288, lpOverlapped=0x0 | out: lpBuffer=0x53a538*, lpNumberOfBytesWritten=0x24de288*=0x6c3, lpOverlapped=0x0) returned 1 [0177.432] CloseHandle (hObject=0xdc) returned 1 [0177.432] GetProcessHeap () returned 0x4e0000 [0177.432] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x53a538 | out: hHeap=0x4e0000) returned 1 [0177.432] GetProcessHeap () returned 0x4e0000 [0177.432] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0177.432] GetProcessHeap () returned 0x4e0000 [0177.432] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.432] FindClose (in: hFindFile=0x522f58 | out: hFindFile=0x522f58) returned 1 [0177.432] GetProcessHeap () returned 0x4e0000 [0177.432] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x522768 | out: hHeap=0x4e0000) returned 1 [0177.432] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1 [0177.433] GetProcessHeap () returned 0x4e0000 [0177.433] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x78) returned 0x4f1b18 [0177.433] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\*.*", lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f58 [0177.433] GetProcessHeap () returned 0x4e0000 [0177.433] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1b18 | out: hHeap=0x4e0000) returned 1 [0177.433] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0177.434] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7089b290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Backgrounds", cAlternateFileName="BACKGR~1")) returned 1 [0177.434] GetProcessHeap () returned 0x4e0000 [0177.434] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x27a) returned 0x522768 [0177.434] GetProcessHeap () returned 0x4e0000 [0177.434] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x90) returned 0x524ea0 [0177.434] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7089b290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0177.435] GetProcessHeap () returned 0x4e0000 [0177.435] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x524ea0 | out: hHeap=0x4e0000) returned 1 [0177.436] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7089b290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0177.436] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f046d00, ftCreationTime.dwHighDateTime=0x1bd9a89, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f046d00, ftLastWriteTime.dwHighDateTime=0x1bd9a89, nFileSizeHigh=0x0, nFileSizeLow=0xf77, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0143743.GIF", cAlternateFileName="")) returned 1 [0177.436] GetProcessHeap () returned 0x4e0000 [0177.436] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x292) returned 0x541088 [0177.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143743.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0177.437] GetProcessHeap () returned 0x4e0000 [0177.437] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.437] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.437] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0177.437] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x9, lpOverlapped=0x0) returned 1 [0177.439] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0177.439] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.439] GetProcessHeap () returned 0x4e0000 [0177.439] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.439] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0177.439] CryptDestroyKey (hKey=0x522fd8) returned 1 [0177.439] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0177.439] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0177.439] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0177.439] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0177.439] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0177.439] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0177.440] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0177.440] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.440] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.440] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xf77, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xf77, lpOverlapped=0x0) returned 1 [0177.440] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xf80, dwBufLen=0xf80 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xf80) returned 1 [0177.440] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.440] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xf80, lpOverlapped=0x0) returned 1 [0177.440] CryptDestroyKey (hKey=0x522fd8) returned 1 [0177.440] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1054, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.440] SetEndOfFile (hFile=0x100) returned 1 [0177.442] GetProcessHeap () returned 0x4e0000 [0177.442] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.442] GetProcessHeap () returned 0x4e0000 [0177.442] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.443] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143743.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143743.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.444] CloseHandle (hObject=0x100) returned 1 [0177.444] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4ed3400, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4ed3400, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x2f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0143744.GIF", cAlternateFileName="")) returned 1 [0177.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143744.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0177.445] GetProcessHeap () returned 0x4e0000 [0177.445] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.445] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.445] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0177.445] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x1, lpOverlapped=0x0) returned 1 [0177.446] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0177.446] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.447] GetProcessHeap () returned 0x4e0000 [0177.447] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.447] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0177.447] CryptDestroyKey (hKey=0x522fd8) returned 1 [0177.447] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0177.447] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0177.447] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0177.447] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0177.447] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0177.447] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0177.447] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0177.447] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.447] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.447] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2f, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x2f, lpOverlapped=0x0) returned 1 [0177.447] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x30, dwBufLen=0x30 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x30) returned 1 [0177.448] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.448] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x30, lpOverlapped=0x0) returned 1 [0177.448] CryptDestroyKey (hKey=0x522fd8) returned 1 [0177.448] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x104, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.448] SetEndOfFile (hFile=0x100) returned 1 [0177.451] GetProcessHeap () returned 0x4e0000 [0177.451] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.451] GetProcessHeap () returned 0x4e0000 [0177.451] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.451] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143744.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143744.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.453] CloseHandle (hObject=0x100) returned 1 [0177.453] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac144200, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac144200, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x2dd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0143745.GIF", cAlternateFileName="")) returned 1 [0177.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143745.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0177.455] GetProcessHeap () returned 0x4e0000 [0177.455] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.455] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.455] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0177.455] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x3, lpOverlapped=0x0) returned 1 [0177.457] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0177.457] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.457] GetProcessHeap () returned 0x4e0000 [0177.457] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.457] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0177.457] CryptDestroyKey (hKey=0x522fd8) returned 1 [0177.457] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0177.457] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0177.457] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0177.457] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0177.457] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0177.457] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0177.457] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0177.457] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.457] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.458] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2dd, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x2dd, lpOverlapped=0x0) returned 1 [0177.458] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x2e0) returned 1 [0177.458] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.458] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x2e0, lpOverlapped=0x0) returned 1 [0177.458] CryptDestroyKey (hKey=0x522fd8) returned 1 [0177.458] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x3b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.458] SetEndOfFile (hFile=0x100) returned 1 [0177.460] GetProcessHeap () returned 0x4e0000 [0177.460] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.460] GetProcessHeap () returned 0x4e0000 [0177.460] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.460] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143745.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143745.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.461] CloseHandle (hObject=0x100) returned 1 [0177.461] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77a08600, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77a08600, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x595, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0143746.GIF", cAlternateFileName="")) returned 1 [0177.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143746.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0177.462] GetProcessHeap () returned 0x4e0000 [0177.462] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.462] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.462] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0177.462] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xb, lpOverlapped=0x0) returned 1 [0177.464] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0177.464] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.464] GetProcessHeap () returned 0x4e0000 [0177.464] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.464] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0177.464] CryptDestroyKey (hKey=0x522fd8) returned 1 [0177.464] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0177.464] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0177.464] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0177.465] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0177.465] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0177.465] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0177.465] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0177.465] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.465] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.465] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x595, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x595, lpOverlapped=0x0) returned 1 [0177.465] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x5a0, dwBufLen=0x5a0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x5a0) returned 1 [0177.465] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.465] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x5a0, lpOverlapped=0x0) returned 1 [0177.465] CryptDestroyKey (hKey=0x522fd8) returned 1 [0177.465] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x674, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.465] SetEndOfFile (hFile=0x100) returned 1 [0177.467] GetProcessHeap () returned 0x4e0000 [0177.467] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.467] GetProcessHeap () returned 0x4e0000 [0177.468] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.468] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143746.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143746.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.469] CloseHandle (hObject=0x100) returned 1 [0177.469] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4cbfb00, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4cbfb00, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x11d1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0143748.GIF", cAlternateFileName="")) returned 1 [0177.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143748.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0177.471] GetProcessHeap () returned 0x4e0000 [0177.471] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.471] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.471] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0177.471] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xf, lpOverlapped=0x0) returned 1 [0177.473] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0177.473] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.473] GetProcessHeap () returned 0x4e0000 [0177.473] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.473] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0177.473] CryptDestroyKey (hKey=0x522fd8) returned 1 [0177.473] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0177.473] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0177.473] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0177.473] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0177.474] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0177.474] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0177.474] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0177.474] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.474] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.474] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x11d1, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x11d1, lpOverlapped=0x0) returned 1 [0177.475] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x11e0, dwBufLen=0x11e0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x11e0) returned 1 [0177.475] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.475] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x11e0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x11e0, lpOverlapped=0x0) returned 1 [0177.475] CryptDestroyKey (hKey=0x522fd8) returned 1 [0177.475] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x12b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.475] SetEndOfFile (hFile=0x100) returned 1 [0177.478] GetProcessHeap () returned 0x4e0000 [0177.478] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.478] GetProcessHeap () returned 0x4e0000 [0177.478] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.478] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143748.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143748.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.480] CloseHandle (hObject=0x100) returned 1 [0177.480] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ef75300, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ef75300, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x1323, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0143749.GIF", cAlternateFileName="")) returned 1 [0177.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143749.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0177.493] GetProcessHeap () returned 0x4e0000 [0177.493] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.493] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.493] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0177.493] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xd, lpOverlapped=0x0) returned 1 [0177.495] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0177.496] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.496] GetProcessHeap () returned 0x4e0000 [0177.496] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.496] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0177.496] CryptDestroyKey (hKey=0x522fd8) returned 1 [0177.496] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0177.496] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0177.496] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0177.496] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0177.496] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0177.496] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0177.496] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0177.496] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.496] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.496] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1323, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x1323, lpOverlapped=0x0) returned 1 [0177.498] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1330, dwBufLen=0x1330 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1330) returned 1 [0177.498] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.498] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1330, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x1330, lpOverlapped=0x0) returned 1 [0177.498] CryptDestroyKey (hKey=0x522fd8) returned 1 [0177.498] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1404, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.498] SetEndOfFile (hFile=0x100) returned 1 [0177.500] GetProcessHeap () returned 0x4e0000 [0177.500] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.500] GetProcessHeap () returned 0x4e0000 [0177.500] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.501] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143749.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143749.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.502] CloseHandle (hObject=0x100) returned 1 [0177.503] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1896c00, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1896c00, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x43e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0143750.GIF", cAlternateFileName="")) returned 1 [0177.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143750.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0177.504] GetProcessHeap () returned 0x4e0000 [0177.504] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.504] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.504] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0177.504] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x2, lpOverlapped=0x0) returned 1 [0177.523] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0177.523] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.523] GetProcessHeap () returned 0x4e0000 [0177.523] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.523] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0177.523] CryptDestroyKey (hKey=0x522fd8) returned 1 [0177.523] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0177.523] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0177.523] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0177.523] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0177.523] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0177.523] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0177.524] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0177.524] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.524] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.524] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x43e, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x43e, lpOverlapped=0x0) returned 1 [0177.524] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x440, dwBufLen=0x440 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x440) returned 1 [0177.524] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.524] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x440, lpOverlapped=0x0) returned 1 [0177.524] CryptDestroyKey (hKey=0x522fd8) returned 1 [0177.524] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x514, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.524] SetEndOfFile (hFile=0x100) returned 1 [0177.529] GetProcessHeap () returned 0x4e0000 [0177.529] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.529] GetProcessHeap () returned 0x4e0000 [0177.529] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.529] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143750.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143750.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.532] CloseHandle (hObject=0x100) returned 1 [0177.532] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9313100, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9313100, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x412, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0143752.GIF", cAlternateFileName="")) returned 1 [0177.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143752.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0177.534] GetProcessHeap () returned 0x4e0000 [0177.534] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.534] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.534] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0177.534] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xe, lpOverlapped=0x0) returned 1 [0177.537] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0177.537] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.537] GetProcessHeap () returned 0x4e0000 [0177.537] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.537] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0177.537] CryptDestroyKey (hKey=0x522fd8) returned 1 [0177.537] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0177.537] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0177.537] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0177.537] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0177.537] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0177.537] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0177.537] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0177.538] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.538] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.538] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x412, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x412, lpOverlapped=0x0) returned 1 [0177.538] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x420, dwBufLen=0x420 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x420) returned 1 [0177.538] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.538] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x420, lpOverlapped=0x0) returned 1 [0177.538] CryptDestroyKey (hKey=0x522fd8) returned 1 [0177.538] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x4f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.538] SetEndOfFile (hFile=0x100) returned 1 [0177.541] GetProcessHeap () returned 0x4e0000 [0177.541] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.541] GetProcessHeap () returned 0x4e0000 [0177.541] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.541] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143752.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143752.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.544] CloseHandle (hObject=0x100) returned 1 [0177.544] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6fe9600, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd6fe9600, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x1b7f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0143753.GIF", cAlternateFileName="")) returned 1 [0177.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143753.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0177.546] GetProcessHeap () returned 0x4e0000 [0177.546] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.546] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.546] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0177.546] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x1, lpOverlapped=0x0) returned 1 [0177.549] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0177.549] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.549] GetProcessHeap () returned 0x4e0000 [0177.549] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.549] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0177.549] CryptDestroyKey (hKey=0x522fd8) returned 1 [0177.549] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0177.549] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0177.550] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0177.550] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0177.550] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0177.550] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0177.550] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0177.550] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.550] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.550] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1b7f, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x1b7f, lpOverlapped=0x0) returned 1 [0177.554] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1b80, dwBufLen=0x1b80 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1b80) returned 1 [0177.554] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.554] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1b80, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x1b80, lpOverlapped=0x0) returned 1 [0177.554] CryptDestroyKey (hKey=0x522fd8) returned 1 [0177.554] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1c54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.554] SetEndOfFile (hFile=0x100) returned 1 [0177.557] GetProcessHeap () returned 0x4e0000 [0177.557] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.557] GetProcessHeap () returned 0x4e0000 [0177.557] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.557] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143753.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143753.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.560] CloseHandle (hObject=0x100) returned 1 [0177.560] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbf30900, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfbf30900, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x6ad, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0143754.GIF", cAlternateFileName="")) returned 1 [0177.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143754.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0177.562] GetProcessHeap () returned 0x4e0000 [0177.562] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.562] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.562] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0177.562] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x3, lpOverlapped=0x0) returned 1 [0177.567] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0177.567] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.567] GetProcessHeap () returned 0x4e0000 [0177.567] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.567] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0177.567] CryptDestroyKey (hKey=0x522fd8) returned 1 [0177.567] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0177.567] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0177.568] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0177.568] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0177.568] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0177.568] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0177.568] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0177.568] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.568] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.568] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x6ad, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x6ad, lpOverlapped=0x0) returned 1 [0177.568] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x6b0, dwBufLen=0x6b0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x6b0) returned 1 [0177.568] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.568] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6b0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x6b0, lpOverlapped=0x0) returned 1 [0177.568] CryptDestroyKey (hKey=0x522fd8) returned 1 [0177.568] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x784, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.568] SetEndOfFile (hFile=0x100) returned 1 [0177.570] GetProcessHeap () returned 0x4e0000 [0177.570] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.570] GetProcessHeap () returned 0x4e0000 [0177.570] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.570] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143754.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143754.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.573] CloseHandle (hObject=0x100) returned 1 [0177.573] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8b07a00, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8b07a00, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x69f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0143758.GIF", cAlternateFileName="")) returned 1 [0177.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143758.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0177.574] GetProcessHeap () returned 0x4e0000 [0177.574] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.574] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.574] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0177.574] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x1, lpOverlapped=0x0) returned 1 [0177.576] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0177.577] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.577] GetProcessHeap () returned 0x4e0000 [0177.577] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.577] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0177.577] CryptDestroyKey (hKey=0x522fd8) returned 1 [0177.577] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0177.577] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0177.577] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0177.577] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0177.577] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0177.577] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0177.577] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0177.577] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.577] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.577] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x69f, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x69f, lpOverlapped=0x0) returned 1 [0177.577] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x6a0, dwBufLen=0x6a0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x6a0) returned 1 [0177.577] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.577] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x6a0, lpOverlapped=0x0) returned 1 [0177.578] CryptDestroyKey (hKey=0x522fd8) returned 1 [0177.578] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x774, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.578] SetEndOfFile (hFile=0x100) returned 1 [0177.580] GetProcessHeap () returned 0x4e0000 [0177.580] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.580] GetProcessHeap () returned 0x4e0000 [0177.580] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.580] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143758.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143758.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.585] CloseHandle (hObject=0x100) returned 1 [0177.585] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x124a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB00516L.GIF", cAlternateFileName="")) returned 1 [0177.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00516l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0177.587] GetProcessHeap () returned 0x4e0000 [0177.587] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.587] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.587] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0177.587] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x6, lpOverlapped=0x0) returned 1 [0177.598] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0177.598] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.598] GetProcessHeap () returned 0x4e0000 [0177.598] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.598] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0177.598] CryptDestroyKey (hKey=0x522fd8) returned 1 [0177.598] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0177.598] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0177.598] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0177.598] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0177.598] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0177.598] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0177.598] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0177.598] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.598] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.598] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x124a, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x124a, lpOverlapped=0x0) returned 1 [0177.602] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1250, dwBufLen=0x1250 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1250) returned 1 [0177.602] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.602] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1250, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x1250, lpOverlapped=0x0) returned 1 [0177.602] CryptDestroyKey (hKey=0x522fd8) returned 1 [0177.602] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1324, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.602] SetEndOfFile (hFile=0x100) returned 1 [0177.604] GetProcessHeap () returned 0x4e0000 [0177.604] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.604] GetProcessHeap () returned 0x4e0000 [0177.604] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.604] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00516l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00516l.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.606] CloseHandle (hObject=0x100) returned 1 [0177.606] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2017, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB00531L.GIF", cAlternateFileName="")) returned 1 [0177.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00531l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0177.607] GetProcessHeap () returned 0x4e0000 [0177.607] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.607] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.607] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0177.607] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x9, lpOverlapped=0x0) returned 1 [0177.646] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0177.646] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.646] GetProcessHeap () returned 0x4e0000 [0177.646] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.646] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0177.646] CryptDestroyKey (hKey=0x522fd8) returned 1 [0177.646] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0177.646] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0177.646] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0177.646] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0177.646] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0177.646] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0177.647] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0177.647] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.647] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.647] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2017, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x2017, lpOverlapped=0x0) returned 1 [0177.662] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x2020, dwBufLen=0x2020 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x2020) returned 1 [0177.662] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.662] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2020, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x2020, lpOverlapped=0x0) returned 1 [0177.662] CryptDestroyKey (hKey=0x522fd8) returned 1 [0177.662] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x20f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.662] SetEndOfFile (hFile=0x100) returned 1 [0177.664] GetProcessHeap () returned 0x4e0000 [0177.664] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.664] GetProcessHeap () returned 0x4e0000 [0177.664] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.664] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00531l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00531l.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.666] CloseHandle (hObject=0x100) returned 1 [0177.666] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x20ee, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB00673L.GIF", cAlternateFileName="")) returned 1 [0177.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00673l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0177.668] GetProcessHeap () returned 0x4e0000 [0177.668] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.668] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.668] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0177.668] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x2, lpOverlapped=0x0) returned 1 [0177.686] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0177.686] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.686] GetProcessHeap () returned 0x4e0000 [0177.686] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.686] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0177.686] CryptDestroyKey (hKey=0x522fd8) returned 1 [0177.686] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0177.686] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0177.686] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0177.686] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0177.687] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0177.687] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0177.687] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0177.687] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.687] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.687] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x20ee, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x20ee, lpOverlapped=0x0) returned 1 [0177.702] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x20f0, dwBufLen=0x20f0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x20f0) returned 1 [0177.703] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.703] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x20f0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x20f0, lpOverlapped=0x0) returned 1 [0177.703] CryptDestroyKey (hKey=0x522fd8) returned 1 [0177.703] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x21c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.703] SetEndOfFile (hFile=0x100) returned 1 [0177.705] GetProcessHeap () returned 0x4e0000 [0177.705] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.705] GetProcessHeap () returned 0x4e0000 [0177.705] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.705] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00673l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00673l.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.707] CloseHandle (hObject=0x100) returned 1 [0177.707] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2026, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB00703L.GIF", cAlternateFileName="")) returned 1 [0177.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00703l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0177.708] GetProcessHeap () returned 0x4e0000 [0177.708] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.708] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.709] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0177.709] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xa, lpOverlapped=0x0) returned 1 [0177.711] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0177.711] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.711] GetProcessHeap () returned 0x4e0000 [0177.712] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.712] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0177.712] CryptDestroyKey (hKey=0x522fd8) returned 1 [0177.712] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0177.712] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0177.712] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0177.712] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0177.712] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0177.712] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0177.712] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0177.712] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.712] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.712] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2026, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x2026, lpOverlapped=0x0) returned 1 [0177.714] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x2030, dwBufLen=0x2030 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x2030) returned 1 [0177.714] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.714] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2030, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x2030, lpOverlapped=0x0) returned 1 [0177.714] CryptDestroyKey (hKey=0x522fd8) returned 1 [0177.714] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x2104, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.714] SetEndOfFile (hFile=0x100) returned 1 [0177.717] GetProcessHeap () returned 0x4e0000 [0177.717] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.717] GetProcessHeap () returned 0x4e0000 [0177.717] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.717] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00703l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00703l.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.719] CloseHandle (hObject=0x100) returned 1 [0177.719] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2313, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB00760L.GIF", cAlternateFileName="")) returned 1 [0177.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00760l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0177.720] GetProcessHeap () returned 0x4e0000 [0177.720] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.720] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.720] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0177.720] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xd, lpOverlapped=0x0) returned 1 [0177.722] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0177.722] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.722] GetProcessHeap () returned 0x4e0000 [0177.722] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.722] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0177.722] CryptDestroyKey (hKey=0x522fd8) returned 1 [0177.722] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0177.722] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0177.722] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0177.722] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0177.722] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0177.723] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0177.723] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0177.723] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.723] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.723] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2313, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x2313, lpOverlapped=0x0) returned 1 [0177.725] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x2320, dwBufLen=0x2320 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x2320) returned 1 [0177.725] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.725] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2320, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x2320, lpOverlapped=0x0) returned 1 [0177.725] CryptDestroyKey (hKey=0x522fd8) returned 1 [0177.725] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x23f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.726] SetEndOfFile (hFile=0x100) returned 1 [0177.728] GetProcessHeap () returned 0x4e0000 [0177.728] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.728] GetProcessHeap () returned 0x4e0000 [0177.728] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.728] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00760l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00760l.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.729] CloseHandle (hObject=0x100) returned 1 [0177.729] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1f8f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB00780L.GIF", cAlternateFileName="")) returned 1 [0177.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00780l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0177.730] GetProcessHeap () returned 0x4e0000 [0177.730] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.730] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.730] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0177.730] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x1, lpOverlapped=0x0) returned 1 [0177.736] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0177.736] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.736] GetProcessHeap () returned 0x4e0000 [0177.736] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.736] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0177.736] CryptDestroyKey (hKey=0x522fd8) returned 1 [0177.736] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0177.736] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0177.736] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0177.736] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0177.736] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0177.736] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0177.736] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0177.736] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.737] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.737] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1f8f, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x1f8f, lpOverlapped=0x0) returned 1 [0177.737] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1f90, dwBufLen=0x1f90 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1f90) returned 1 [0177.738] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.738] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x1f90, lpOverlapped=0x0) returned 1 [0177.738] CryptDestroyKey (hKey=0x522fd8) returned 1 [0177.738] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x2064, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.738] SetEndOfFile (hFile=0x100) returned 1 [0177.740] GetProcessHeap () returned 0x4e0000 [0177.740] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.740] GetProcessHeap () returned 0x4e0000 [0177.740] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.740] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00780l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00780l.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.742] CloseHandle (hObject=0x100) returned 1 [0177.742] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xe1d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01741L.GIF", cAlternateFileName="")) returned 1 [0177.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb01741l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0177.743] GetProcessHeap () returned 0x4e0000 [0177.743] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.743] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.743] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0177.743] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x3, lpOverlapped=0x0) returned 1 [0177.756] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0177.756] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.756] GetProcessHeap () returned 0x4e0000 [0177.756] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.756] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0177.756] CryptDestroyKey (hKey=0x522fd8) returned 1 [0177.756] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0177.756] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0177.756] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0177.756] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0177.756] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0177.756] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0177.757] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0177.757] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.757] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.757] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xe1d, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xe1d, lpOverlapped=0x0) returned 1 [0177.757] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xe20, dwBufLen=0xe20 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xe20) returned 1 [0177.757] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.757] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xe20, lpOverlapped=0x0) returned 1 [0177.757] CryptDestroyKey (hKey=0x522fd8) returned 1 [0177.757] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.757] SetEndOfFile (hFile=0x100) returned 1 [0177.759] GetProcessHeap () returned 0x4e0000 [0177.759] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.759] GetProcessHeap () returned 0x4e0000 [0177.759] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.759] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb01741l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb01741l.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.761] CloseHandle (hObject=0x100) returned 1 [0177.761] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x38c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB02039_.GIF", cAlternateFileName="")) returned 1 [0177.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02039_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0177.763] GetProcessHeap () returned 0x4e0000 [0177.763] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.763] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.763] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0177.763] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0177.765] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0177.765] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.765] GetProcessHeap () returned 0x4e0000 [0177.765] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.765] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0177.765] CryptDestroyKey (hKey=0x522fd8) returned 1 [0177.765] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0177.765] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0177.765] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0177.765] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0177.765] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0177.765] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0177.765] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0177.765] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.765] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.765] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x38c, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x38c, lpOverlapped=0x0) returned 1 [0177.765] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x390, dwBufLen=0x390 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x390) returned 1 [0177.766] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.766] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x390, lpOverlapped=0x0) returned 1 [0177.766] CryptDestroyKey (hKey=0x522fd8) returned 1 [0177.766] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.766] SetEndOfFile (hFile=0x100) returned 1 [0177.768] GetProcessHeap () returned 0x4e0000 [0177.768] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.768] GetProcessHeap () returned 0x4e0000 [0177.768] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.768] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02039_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02039_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.769] CloseHandle (hObject=0x100) returned 1 [0177.769] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x987, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB02055_.GIF", cAlternateFileName="")) returned 1 [0177.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02055_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0177.771] GetProcessHeap () returned 0x4e0000 [0177.771] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.771] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.771] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0177.771] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x9, lpOverlapped=0x0) returned 1 [0177.772] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0177.772] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.772] GetProcessHeap () returned 0x4e0000 [0177.772] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.772] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0177.772] CryptDestroyKey (hKey=0x522fd8) returned 1 [0177.772] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0177.773] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0177.773] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0177.773] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0177.773] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0177.773] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0177.773] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0177.773] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.773] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.773] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x987, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x987, lpOverlapped=0x0) returned 1 [0177.773] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x990, dwBufLen=0x990 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x990) returned 1 [0177.773] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.773] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x990, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x990, lpOverlapped=0x0) returned 1 [0177.773] CryptDestroyKey (hKey=0x522fd8) returned 1 [0177.773] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xa64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.773] SetEndOfFile (hFile=0x100) returned 1 [0177.775] GetProcessHeap () returned 0x4e0000 [0177.775] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.775] GetProcessHeap () returned 0x4e0000 [0177.775] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.775] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02055_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02055_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.777] CloseHandle (hObject=0x100) returned 1 [0177.777] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x37d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB02073_.GIF", cAlternateFileName="")) returned 1 [0177.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02073_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0177.777] GetProcessHeap () returned 0x4e0000 [0177.777] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.777] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.777] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0177.778] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x3, lpOverlapped=0x0) returned 1 [0177.779] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0177.779] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.779] GetProcessHeap () returned 0x4e0000 [0177.779] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.779] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0177.779] CryptDestroyKey (hKey=0x522fd8) returned 1 [0177.779] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0177.780] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0177.780] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0177.780] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0177.780] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0177.780] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0177.780] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0177.780] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.780] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.780] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x37d, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x37d, lpOverlapped=0x0) returned 1 [0177.780] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x380, dwBufLen=0x380 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x380) returned 1 [0177.780] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.780] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x380, lpOverlapped=0x0) returned 1 [0177.780] CryptDestroyKey (hKey=0x522fd8) returned 1 [0177.780] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x454, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.780] SetEndOfFile (hFile=0x100) returned 1 [0177.782] GetProcessHeap () returned 0x4e0000 [0177.782] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.782] GetProcessHeap () returned 0x4e0000 [0177.782] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.782] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02073_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02073_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.783] CloseHandle (hObject=0x100) returned 1 [0177.784] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x516, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB02074_.GIF", cAlternateFileName="")) returned 1 [0177.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02074_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0177.784] GetProcessHeap () returned 0x4e0000 [0177.784] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.784] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.784] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0177.785] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xa, lpOverlapped=0x0) returned 1 [0177.786] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0177.786] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.786] GetProcessHeap () returned 0x4e0000 [0177.786] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.786] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0177.786] CryptDestroyKey (hKey=0x522fd8) returned 1 [0177.786] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0177.786] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0177.787] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0177.787] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0177.787] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0177.787] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0177.787] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0177.787] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.787] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.787] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x516, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x516, lpOverlapped=0x0) returned 1 [0177.787] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x520, dwBufLen=0x520 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x520) returned 1 [0177.787] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.787] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x520, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x520, lpOverlapped=0x0) returned 1 [0177.787] CryptDestroyKey (hKey=0x522fd8) returned 1 [0177.787] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x5f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.787] SetEndOfFile (hFile=0x100) returned 1 [0177.789] GetProcessHeap () returned 0x4e0000 [0177.789] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.789] GetProcessHeap () returned 0x4e0000 [0177.789] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.789] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02074_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02074_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.790] CloseHandle (hObject=0x100) returned 1 [0177.790] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2fd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB02077_.GIF", cAlternateFileName="")) returned 1 [0177.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02077_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0177.791] GetProcessHeap () returned 0x4e0000 [0177.791] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.791] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.791] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0177.791] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x3, lpOverlapped=0x0) returned 1 [0177.793] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0177.793] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.793] GetProcessHeap () returned 0x4e0000 [0177.793] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.793] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0177.793] CryptDestroyKey (hKey=0x522fd8) returned 1 [0177.793] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0177.793] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0177.793] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0177.794] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0177.794] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0177.794] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0177.794] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0177.794] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.794] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.794] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2fd, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x2fd, lpOverlapped=0x0) returned 1 [0177.794] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x300, dwBufLen=0x300 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x300) returned 1 [0177.794] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.794] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x300, lpOverlapped=0x0) returned 1 [0177.794] CryptDestroyKey (hKey=0x522fd8) returned 1 [0177.794] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x3d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.794] SetEndOfFile (hFile=0x100) returned 1 [0177.796] GetProcessHeap () returned 0x4e0000 [0177.796] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.796] GetProcessHeap () returned 0x4e0000 [0177.796] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.796] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02077_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02077_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.798] CloseHandle (hObject=0x100) returned 1 [0177.798] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x996, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB02082_.GIF", cAlternateFileName="")) returned 1 [0177.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02082_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0177.798] GetProcessHeap () returned 0x4e0000 [0177.798] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.798] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.799] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0177.799] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xa, lpOverlapped=0x0) returned 1 [0177.801] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0177.801] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.801] GetProcessHeap () returned 0x4e0000 [0177.801] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.801] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0177.801] CryptDestroyKey (hKey=0x522fd8) returned 1 [0177.801] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0177.801] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0177.801] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0177.801] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0177.801] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0177.801] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0177.801] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0177.801] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.801] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.801] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x996, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x996, lpOverlapped=0x0) returned 1 [0177.801] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x9a0, dwBufLen=0x9a0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x9a0) returned 1 [0177.802] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.802] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x9a0, lpOverlapped=0x0) returned 1 [0177.802] CryptDestroyKey (hKey=0x522fd8) returned 1 [0177.802] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xa74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.802] SetEndOfFile (hFile=0x100) returned 1 [0177.804] GetProcessHeap () returned 0x4e0000 [0177.804] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.804] GetProcessHeap () returned 0x4e0000 [0177.804] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.804] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02082_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02082_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.805] CloseHandle (hObject=0x100) returned 1 [0177.805] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x90c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB02085_.GIF", cAlternateFileName="")) returned 1 [0177.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02085_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0177.807] GetProcessHeap () returned 0x4e0000 [0177.807] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.807] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.807] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0177.807] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0177.808] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0177.809] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.809] GetProcessHeap () returned 0x4e0000 [0177.809] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.809] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0177.809] CryptDestroyKey (hKey=0x522fd8) returned 1 [0177.809] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0177.809] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0177.809] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0177.809] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0177.809] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0177.809] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0177.809] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0177.809] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.809] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.809] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x90c, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x90c, lpOverlapped=0x0) returned 1 [0177.810] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x910, dwBufLen=0x910 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x910) returned 1 [0177.810] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.810] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x910, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x910, lpOverlapped=0x0) returned 1 [0177.810] CryptDestroyKey (hKey=0x522fd8) returned 1 [0177.810] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x9e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.810] SetEndOfFile (hFile=0x100) returned 1 [0177.812] GetProcessHeap () returned 0x4e0000 [0177.812] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.812] GetProcessHeap () returned 0x4e0000 [0177.812] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.812] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02085_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02085_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.814] CloseHandle (hObject=0x100) returned 1 [0177.814] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x581, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB02097_.GIF", cAlternateFileName="")) returned 1 [0177.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02097_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0177.815] GetProcessHeap () returned 0x4e0000 [0177.815] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.815] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.815] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0177.815] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xf, lpOverlapped=0x0) returned 1 [0177.817] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0177.817] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.817] GetProcessHeap () returned 0x4e0000 [0177.817] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.817] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0177.817] CryptDestroyKey (hKey=0x522fd8) returned 1 [0177.817] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0177.817] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0177.817] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0177.817] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0177.817] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0177.817] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0177.817] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0177.817] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.817] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.817] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x581, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x581, lpOverlapped=0x0) returned 1 [0177.817] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x590, dwBufLen=0x590 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x590) returned 1 [0177.817] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.817] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x590, lpOverlapped=0x0) returned 1 [0177.818] CryptDestroyKey (hKey=0x522fd8) returned 1 [0177.818] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x664, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.818] SetEndOfFile (hFile=0x100) returned 1 [0177.820] GetProcessHeap () returned 0x4e0000 [0177.820] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.820] GetProcessHeap () returned 0x4e0000 [0177.820] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.820] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02097_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02097_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.822] CloseHandle (hObject=0x100) returned 1 [0177.823] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x15fa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB02106_.GIF", cAlternateFileName="")) returned 1 [0177.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02106_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0177.823] GetProcessHeap () returned 0x4e0000 [0177.823] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.824] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.824] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0177.824] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x6, lpOverlapped=0x0) returned 1 [0177.825] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0177.825] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.826] GetProcessHeap () returned 0x4e0000 [0177.826] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.826] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0177.826] CryptDestroyKey (hKey=0x522fd8) returned 1 [0177.826] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0177.826] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0177.826] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0177.826] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0177.826] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0177.826] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0177.826] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0177.826] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.826] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.826] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x15fa, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x15fa, lpOverlapped=0x0) returned 1 [0177.827] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1600, dwBufLen=0x1600 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1600) returned 1 [0177.827] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.827] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1600, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x1600, lpOverlapped=0x0) returned 1 [0177.827] CryptDestroyKey (hKey=0x522fd8) returned 1 [0177.827] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x16d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.827] SetEndOfFile (hFile=0x100) returned 1 [0177.829] GetProcessHeap () returned 0x4e0000 [0177.829] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.829] GetProcessHeap () returned 0x4e0000 [0177.829] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.829] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02106_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02106_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.833] CloseHandle (hObject=0x100) returned 1 [0177.833] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x3ef, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB02116_.GIF", cAlternateFileName="")) returned 1 [0177.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02116_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0177.834] GetProcessHeap () returned 0x4e0000 [0177.834] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.834] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.834] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0177.835] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x1, lpOverlapped=0x0) returned 1 [0177.843] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0177.843] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.843] GetProcessHeap () returned 0x4e0000 [0177.843] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.843] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0177.843] CryptDestroyKey (hKey=0x522fd8) returned 1 [0177.843] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0177.843] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0177.843] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0177.843] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0177.843] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0177.843] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0177.844] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0177.844] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.844] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.844] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3ef, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x3ef, lpOverlapped=0x0) returned 1 [0177.844] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x3f0, dwBufLen=0x3f0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x3f0) returned 1 [0177.844] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.844] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3f0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x3f0, lpOverlapped=0x0) returned 1 [0177.844] CryptDestroyKey (hKey=0x522fd8) returned 1 [0177.844] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x4c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.844] SetEndOfFile (hFile=0x100) returned 1 [0177.846] GetProcessHeap () returned 0x4e0000 [0177.846] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.846] GetProcessHeap () returned 0x4e0000 [0177.846] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.846] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02116_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02116_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.848] CloseHandle (hObject=0x100) returned 1 [0177.848] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x97f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB02134_.GIF", cAlternateFileName="")) returned 1 [0177.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02134_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0177.850] GetProcessHeap () returned 0x4e0000 [0177.850] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.850] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.850] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0177.850] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x1, lpOverlapped=0x0) returned 1 [0177.851] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0177.851] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.851] GetProcessHeap () returned 0x4e0000 [0177.852] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.852] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0177.852] CryptDestroyKey (hKey=0x522fd8) returned 1 [0177.852] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0177.852] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0177.852] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0177.852] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0177.852] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0177.852] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0177.852] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0177.852] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.852] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.852] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x97f, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x97f, lpOverlapped=0x0) returned 1 [0177.852] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x980, dwBufLen=0x980 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x980) returned 1 [0177.852] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.852] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x980, lpOverlapped=0x0) returned 1 [0177.852] CryptDestroyKey (hKey=0x522fd8) returned 1 [0177.852] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xa54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.852] SetEndOfFile (hFile=0x100) returned 1 [0177.854] GetProcessHeap () returned 0x4e0000 [0177.855] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.855] GetProcessHeap () returned 0x4e0000 [0177.855] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.855] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02134_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02134_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.856] CloseHandle (hObject=0x100) returned 1 [0177.856] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x579, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB02187_.GIF", cAlternateFileName="")) returned 1 [0177.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02187_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0177.857] GetProcessHeap () returned 0x4e0000 [0177.857] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.857] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.857] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0177.857] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x7, lpOverlapped=0x0) returned 1 [0177.859] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0177.859] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.859] GetProcessHeap () returned 0x4e0000 [0177.859] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.859] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0177.859] CryptDestroyKey (hKey=0x522fd8) returned 1 [0177.859] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0177.859] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0177.859] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0177.859] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0177.859] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0177.860] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0177.860] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0177.860] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.860] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.860] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x579, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x579, lpOverlapped=0x0) returned 1 [0177.860] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x580, dwBufLen=0x580 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x580) returned 1 [0177.860] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.860] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x580, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x580, lpOverlapped=0x0) returned 1 [0177.860] CryptDestroyKey (hKey=0x522fd8) returned 1 [0177.860] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x654, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.860] SetEndOfFile (hFile=0x100) returned 1 [0177.862] GetProcessHeap () returned 0x4e0000 [0177.862] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.862] GetProcessHeap () returned 0x4e0000 [0177.862] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.862] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02187_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02187_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.863] CloseHandle (hObject=0x100) returned 1 [0177.863] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x4abc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB02198_.GIF", cAlternateFileName="")) returned 1 [0177.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02198_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0177.864] GetProcessHeap () returned 0x4e0000 [0177.864] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.865] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.865] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0177.865] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0177.866] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0177.866] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.866] GetProcessHeap () returned 0x4e0000 [0177.866] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.866] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0177.866] CryptDestroyKey (hKey=0x522fd8) returned 1 [0177.866] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0177.867] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0177.867] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0177.867] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0177.867] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0177.867] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0177.867] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0177.867] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.867] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.867] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4abc, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x4abc, lpOverlapped=0x0) returned 1 [0177.868] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x4ac0, dwBufLen=0x4ac0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x4ac0) returned 1 [0177.868] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.868] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4ac0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x4ac0, lpOverlapped=0x0) returned 1 [0177.868] CryptDestroyKey (hKey=0x522fd8) returned 1 [0177.868] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x4b94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.868] SetEndOfFile (hFile=0x100) returned 1 [0177.870] GetProcessHeap () returned 0x4e0000 [0177.870] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.871] GetProcessHeap () returned 0x4e0000 [0177.871] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.871] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02198_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02198_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.872] CloseHandle (hObject=0x100) returned 1 [0177.872] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1653, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB02201_.GIF", cAlternateFileName="")) returned 1 [0177.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02201_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0177.873] GetProcessHeap () returned 0x4e0000 [0177.873] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.873] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.873] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0177.873] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xd, lpOverlapped=0x0) returned 1 [0177.878] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0177.878] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.878] GetProcessHeap () returned 0x4e0000 [0177.878] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.878] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0177.878] CryptDestroyKey (hKey=0x522fd8) returned 1 [0177.878] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0177.878] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0177.878] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0177.878] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0177.878] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0177.878] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0177.878] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0177.878] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.878] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.878] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1653, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x1653, lpOverlapped=0x0) returned 1 [0177.880] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1660, dwBufLen=0x1660 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1660) returned 1 [0177.880] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.880] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1660, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x1660, lpOverlapped=0x0) returned 1 [0177.880] CryptDestroyKey (hKey=0x522fd8) returned 1 [0177.880] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1734, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.880] SetEndOfFile (hFile=0x100) returned 1 [0177.882] GetProcessHeap () returned 0x4e0000 [0177.882] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.882] GetProcessHeap () returned 0x4e0000 [0177.883] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.883] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02201_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02201_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.884] CloseHandle (hObject=0x100) returned 1 [0177.884] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x136b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB02214_.GIF", cAlternateFileName="")) returned 1 [0177.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02214_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0177.885] GetProcessHeap () returned 0x4e0000 [0177.886] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.886] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.886] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0177.886] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x5, lpOverlapped=0x0) returned 1 [0177.888] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0177.888] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.888] GetProcessHeap () returned 0x4e0000 [0177.888] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.888] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0177.888] CryptDestroyKey (hKey=0x522fd8) returned 1 [0177.888] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0177.888] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0177.888] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0177.888] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0177.888] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0177.888] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0177.888] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0177.888] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.888] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.888] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x136b, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x136b, lpOverlapped=0x0) returned 1 [0177.889] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1370, dwBufLen=0x1370 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1370) returned 1 [0177.889] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.889] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x1370, lpOverlapped=0x0) returned 1 [0177.889] CryptDestroyKey (hKey=0x522fd8) returned 1 [0177.889] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1444, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.889] SetEndOfFile (hFile=0x100) returned 1 [0177.891] GetProcessHeap () returned 0x4e0000 [0177.891] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.891] GetProcessHeap () returned 0x4e0000 [0177.891] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.891] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02214_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02214_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.893] CloseHandle (hObject=0x100) returned 1 [0177.893] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xbc4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB02218_.GIF", cAlternateFileName="")) returned 1 [0177.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02218_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0177.895] GetProcessHeap () returned 0x4e0000 [0177.895] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.895] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.895] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0177.895] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xc, lpOverlapped=0x0) returned 1 [0177.897] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0177.897] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.897] GetProcessHeap () returned 0x4e0000 [0177.897] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.897] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0177.897] CryptDestroyKey (hKey=0x522fd8) returned 1 [0177.897] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0177.897] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0177.897] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0177.897] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0177.897] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0177.897] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0177.897] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0177.897] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.897] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.897] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xbc4, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xbc4, lpOverlapped=0x0) returned 1 [0177.897] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xbd0, dwBufLen=0xbd0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xbd0) returned 1 [0177.897] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.898] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xbd0, lpOverlapped=0x0) returned 1 [0177.898] CryptDestroyKey (hKey=0x522fd8) returned 1 [0177.898] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xca4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.898] SetEndOfFile (hFile=0x100) returned 1 [0177.900] GetProcessHeap () returned 0x4e0000 [0177.900] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.900] GetProcessHeap () returned 0x4e0000 [0177.900] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.900] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02218_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02218_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.901] CloseHandle (hObject=0x100) returned 1 [0177.901] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xbc4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB02218_.GIF", cAlternateFileName="")) returned 0 [0177.901] GetProcessHeap () returned 0x4e0000 [0177.901] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.901] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0177.901] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df020 | out: pbData=0x4f53d8, pdwDataLen=0x24df020) returned 1 [0177.901] CryptDestroyKey (hKey=0x522fd8) returned 1 [0177.902] GetProcessHeap () returned 0x4e0000 [0177.902] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0177.902] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0177.902] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df020 | out: pbData=0x4f5420, pdwDataLen=0x24df020) returned 1 [0177.902] CryptDestroyKey (hKey=0x522fd8) returned 1 [0177.902] GetProcessHeap () returned 0x4e0000 [0177.902] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x53a538 [0177.902] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0177.902] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x53a538, pdwDataLen=0x24df020 | out: pbData=0x53a538, pdwDataLen=0x24df020) returned 1 [0177.902] CryptDestroyKey (hKey=0x522fd8) returned 1 [0177.902] wsprintfW (in: param_1=0x24ddffc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\readme-warning.txt") returned 82 [0177.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\readme-warning.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0177.903] WriteFile (in: hFile=0x100, lpBuffer=0x53a538*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddff8, lpOverlapped=0x0 | out: lpBuffer=0x53a538*, lpNumberOfBytesWritten=0x24ddff8*=0x6c3, lpOverlapped=0x0) returned 1 [0177.904] CloseHandle (hObject=0x100) returned 1 [0177.904] GetProcessHeap () returned 0x4e0000 [0177.904] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x53a538 | out: hHeap=0x4e0000) returned 1 [0177.904] GetProcessHeap () returned 0x4e0000 [0177.904] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0177.904] GetProcessHeap () returned 0x4e0000 [0177.904] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.904] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0177.905] GetProcessHeap () returned 0x4e0000 [0177.905] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x541088 | out: hHeap=0x4e0000) returned 1 [0177.905] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7089b290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Backgrounds", cAlternateFileName="BACKGR~1")) returned 0 [0177.905] FindClose (in: hFindFile=0x522f58 | out: hFindFile=0x522f58) returned 1 [0177.905] GetProcessHeap () returned 0x4e0000 [0177.905] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x522768 | out: hHeap=0x4e0000) returned 1 [0177.905] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 0 [0177.905] FindClose (in: hFindFile=0x522ed8 | out: hFindFile=0x522ed8) returned 1 [0177.905] GetProcessHeap () returned 0x4e0000 [0177.905] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x53a2c8 | out: hHeap=0x4e0000) returned 1 [0177.905] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5cd5260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5cd5260, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Document Themes 14", cAlternateFileName="DOCUME~1")) returned 1 [0177.905] GetProcessHeap () returned 0x4e0000 [0177.905] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x7a) returned 0x4fa058 [0177.905] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5cd5260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5cd5260, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522ed8 [0177.907] GetProcessHeap () returned 0x4e0000 [0177.907] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0177.907] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5cd5260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5cd5260, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0177.909] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f664b00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5943160, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5f664b00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xd0aa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Adjacency.thmx", cAlternateFileName="ADJACE~1.THM")) returned 1 [0177.909] GetProcessHeap () returned 0x4e0000 [0177.909] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x27c) returned 0x53a2c8 [0177.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\adjacency.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0177.910] GetProcessHeap () returned 0x4e0000 [0177.910] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.910] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.910] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0177.910] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0x6, lpOverlapped=0x0) returned 1 [0177.912] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0177.912] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.912] GetProcessHeap () returned 0x4e0000 [0177.912] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.912] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40) returned 1 [0177.912] CryptDestroyKey (hKey=0x522f58) returned 1 [0177.912] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4e8*=0x40, lpOverlapped=0x0) returned 1 [0177.912] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0177.912] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0177.912] WriteFile (in: hFile=0x110, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0177.912] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0177.912] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0177.912] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0177.913] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.913] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.913] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xd0aa, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0xd0aa, lpOverlapped=0x0) returned 1 [0177.914] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0xd0b0, dwBufLen=0xd0b0 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0xd0b0) returned 1 [0177.914] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.914] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xd0b0, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0xd0b0, lpOverlapped=0x0) returned 1 [0177.914] CryptDestroyKey (hKey=0x522f58) returned 1 [0177.914] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xd184, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.914] SetEndOfFile (hFile=0x110) returned 1 [0177.917] GetProcessHeap () returned 0x4e0000 [0177.917] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.917] GetProcessHeap () returned 0x4e0000 [0177.917] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.917] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\adjacency.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\adjacency.thmx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.918] CloseHandle (hObject=0x110) returned 1 [0177.918] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62f9d200, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5943160, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x62f9d200, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x11098, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Angles.thmx", cAlternateFileName="ANGLES~1.THM")) returned 1 [0177.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\angles.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0177.919] GetProcessHeap () returned 0x4e0000 [0177.919] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.919] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.919] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0177.920] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0177.921] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0177.921] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.921] GetProcessHeap () returned 0x4e0000 [0177.921] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.921] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40) returned 1 [0177.921] CryptDestroyKey (hKey=0x522f58) returned 1 [0177.921] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4e8*=0x40, lpOverlapped=0x0) returned 1 [0177.921] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0177.922] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0177.922] WriteFile (in: hFile=0x110, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0177.922] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0177.922] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0177.922] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0177.922] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.922] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.922] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x11098, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0x11098, lpOverlapped=0x0) returned 1 [0177.923] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x110a0, dwBufLen=0x110a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x110a0) returned 1 [0177.924] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.924] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x110a0, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0x110a0, lpOverlapped=0x0) returned 1 [0177.924] CryptDestroyKey (hKey=0x522f58) returned 1 [0177.924] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x11174, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.924] SetEndOfFile (hFile=0x110) returned 1 [0177.926] GetProcessHeap () returned 0x4e0000 [0177.926] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.926] GetProcessHeap () returned 0x4e0000 [0177.927] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.927] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\angles.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\angles.thmx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.928] CloseHandle (hObject=0x110) returned 1 [0177.928] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfda5e100, ftCreationTime.dwHighDateTime=0x1cbded8, ftLastAccessTime.dwLowDateTime=0xe59692c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfda5e100, ftLastWriteTime.dwHighDateTime=0x1cbded8, nFileSizeHigh=0x0, nFileSizeLow=0x3f427, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Apex.thmx", cAlternateFileName="APEX~1.THM")) returned 1 [0177.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apex.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0177.929] GetProcessHeap () returned 0x4e0000 [0177.929] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.929] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.929] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0177.929] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0x9, lpOverlapped=0x0) returned 1 [0177.931] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0177.931] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.931] GetProcessHeap () returned 0x4e0000 [0177.931] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0177.931] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df4c8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df4c8*=0x30) returned 1 [0177.931] CryptDestroyKey (hKey=0x522f58) returned 1 [0177.931] WriteFile (in: hFile=0x110, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df4e8*=0x30, lpOverlapped=0x0) returned 1 [0177.931] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0177.931] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0177.931] WriteFile (in: hFile=0x110, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0177.931] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0177.931] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0177.931] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0177.931] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.931] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.931] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3f427, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0x3f427, lpOverlapped=0x0) returned 1 [0177.934] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x3f430, dwBufLen=0x3f430 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x3f430) returned 1 [0177.936] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.936] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3f430, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0x3f430, lpOverlapped=0x0) returned 1 [0177.937] CryptDestroyKey (hKey=0x522f58) returned 1 [0177.937] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x3f4f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.937] SetEndOfFile (hFile=0x110) returned 1 [0177.940] GetProcessHeap () returned 0x4e0000 [0177.940] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0177.940] GetProcessHeap () returned 0x4e0000 [0177.940] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.940] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apex.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apex.thmx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.941] CloseHandle (hObject=0x110) returned 1 [0177.941] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cd43200, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59692c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3cd43200, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x15a56, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Apothecary.thmx", cAlternateFileName="APOTHE~1.THM")) returned 1 [0177.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apothecary.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0177.942] GetProcessHeap () returned 0x4e0000 [0177.942] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.942] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.943] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0177.943] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0xa, lpOverlapped=0x0) returned 1 [0177.945] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0177.945] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.945] GetProcessHeap () returned 0x4e0000 [0177.946] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.946] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40) returned 1 [0177.946] CryptDestroyKey (hKey=0x522f58) returned 1 [0177.946] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4e8*=0x40, lpOverlapped=0x0) returned 1 [0177.946] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0177.946] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0177.946] WriteFile (in: hFile=0x110, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0177.946] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0177.946] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0177.946] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0177.946] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.946] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.946] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x15a56, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0x15a56, lpOverlapped=0x0) returned 1 [0177.948] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x15a60, dwBufLen=0x15a60 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x15a60) returned 1 [0177.948] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.948] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x15a60, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0x15a60, lpOverlapped=0x0) returned 1 [0177.949] CryptDestroyKey (hKey=0x522f58) returned 1 [0177.949] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x15b34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.949] SetEndOfFile (hFile=0x110) returned 1 [0177.952] GetProcessHeap () returned 0x4e0000 [0177.952] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.952] GetProcessHeap () returned 0x4e0000 [0177.952] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.952] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apothecary.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apothecary.thmx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.953] CloseHandle (hObject=0x110) returned 1 [0177.953] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1396800, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59692c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1396800, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x109e5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Aspect.thmx", cAlternateFileName="ASPECT~1.THM")) returned 1 [0177.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\aspect.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0177.954] GetProcessHeap () returned 0x4e0000 [0177.954] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.954] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.954] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0177.954] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0xb, lpOverlapped=0x0) returned 1 [0177.956] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0177.956] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.956] GetProcessHeap () returned 0x4e0000 [0177.956] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.956] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40) returned 1 [0177.956] CryptDestroyKey (hKey=0x522f58) returned 1 [0177.956] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4e8*=0x40, lpOverlapped=0x0) returned 1 [0177.956] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0177.956] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0177.956] WriteFile (in: hFile=0x110, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0177.956] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0177.957] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0177.957] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0177.957] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.957] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.957] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x109e5, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0x109e5, lpOverlapped=0x0) returned 1 [0177.958] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x109f0, dwBufLen=0x109f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x109f0) returned 1 [0177.959] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.959] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x109f0, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0x109f0, lpOverlapped=0x0) returned 1 [0177.959] CryptDestroyKey (hKey=0x522f58) returned 1 [0177.959] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x10ac4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.959] SetEndOfFile (hFile=0x110) returned 1 [0177.961] GetProcessHeap () returned 0x4e0000 [0177.961] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.961] GetProcessHeap () returned 0x4e0000 [0177.961] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.961] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\aspect.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\aspect.thmx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.962] CloseHandle (hObject=0x110) returned 1 [0177.962] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4067b900, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe598f420, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4067b900, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1763b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Austin.thmx", cAlternateFileName="AUSTIN~1.THM")) returned 1 [0177.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\austin.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0177.964] GetProcessHeap () returned 0x4e0000 [0177.964] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.964] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.964] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0177.964] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0x5, lpOverlapped=0x0) returned 1 [0177.965] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0177.965] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.966] GetProcessHeap () returned 0x4e0000 [0177.966] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.966] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40) returned 1 [0177.966] CryptDestroyKey (hKey=0x522f58) returned 1 [0177.966] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4e8*=0x40, lpOverlapped=0x0) returned 1 [0177.966] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0177.966] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0177.966] WriteFile (in: hFile=0x110, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0177.966] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0177.966] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0177.966] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0177.966] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.966] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.966] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1763b, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0x1763b, lpOverlapped=0x0) returned 1 [0177.968] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x17640, dwBufLen=0x17640 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x17640) returned 1 [0177.968] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.968] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x17640, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0x17640, lpOverlapped=0x0) returned 1 [0177.969] CryptDestroyKey (hKey=0x522f58) returned 1 [0177.969] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x17714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.969] SetEndOfFile (hFile=0x110) returned 1 [0177.971] GetProcessHeap () returned 0x4e0000 [0177.971] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.971] GetProcessHeap () returned 0x4e0000 [0177.972] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.972] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\austin.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\austin.thmx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0177.973] CloseHandle (hObject=0x110) returned 1 [0177.973] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x668d5900, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59b5580, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x668d5900, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x9ff03, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Black Tie.thmx", cAlternateFileName="BLACKT~1.THM")) returned 1 [0177.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\black tie.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0177.974] GetProcessHeap () returned 0x4e0000 [0177.974] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0177.974] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0177.974] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0177.974] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0xd, lpOverlapped=0x0) returned 1 [0177.976] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0177.976] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.976] GetProcessHeap () returned 0x4e0000 [0177.976] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0177.976] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40) returned 1 [0177.976] CryptDestroyKey (hKey=0x522f58) returned 1 [0177.976] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4e8*=0x40, lpOverlapped=0x0) returned 1 [0177.976] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0177.976] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0177.976] WriteFile (in: hFile=0x110, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0177.976] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0177.976] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0177.976] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0177.976] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0177.976] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.976] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x9ff03, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0x9ff03, lpOverlapped=0x0) returned 1 [0177.985] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x9ff10, dwBufLen=0x9ff10 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x9ff10) returned 1 [0177.992] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.993] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x9ff10, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0x9ff10, lpOverlapped=0x0) returned 1 [0177.995] CryptDestroyKey (hKey=0x522f58) returned 1 [0177.995] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x9ffe4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.995] SetEndOfFile (hFile=0x110) returned 1 [0177.999] GetProcessHeap () returned 0x4e0000 [0177.999] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0177.999] GetProcessHeap () returned 0x4e0000 [0177.999] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0177.999] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\black tie.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\black tie.thmx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0178.001] CloseHandle (hObject=0x110) returned 1 [0178.001] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ccef00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59b5580, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4ccef00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x18c11, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Civic.thmx", cAlternateFileName="CIVIC~1.THM")) returned 1 [0178.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\civic.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0178.004] GetProcessHeap () returned 0x4e0000 [0178.004] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0178.004] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0178.004] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0178.004] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0xf, lpOverlapped=0x0) returned 1 [0178.010] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0178.010] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.010] GetProcessHeap () returned 0x4e0000 [0178.010] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0178.010] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df4c8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df4c8*=0x30) returned 1 [0178.010] CryptDestroyKey (hKey=0x522f58) returned 1 [0178.010] WriteFile (in: hFile=0x110, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df4e8*=0x30, lpOverlapped=0x0) returned 1 [0178.011] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0178.011] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0178.011] WriteFile (in: hFile=0x110, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0178.011] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0178.011] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0178.011] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0178.011] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.011] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.011] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x18c11, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0x18c11, lpOverlapped=0x0) returned 1 [0178.013] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x18c20, dwBufLen=0x18c20 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x18c20) returned 1 [0178.014] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.014] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x18c20, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0x18c20, lpOverlapped=0x0) returned 1 [0178.015] CryptDestroyKey (hKey=0x522f58) returned 1 [0178.015] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x18ce4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.015] SetEndOfFile (hFile=0x110) returned 1 [0178.018] GetProcessHeap () returned 0x4e0000 [0178.018] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0178.018] GetProcessHeap () returned 0x4e0000 [0178.018] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0178.018] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\civic.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\civic.thmx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0178.020] CloseHandle (hObject=0x110) returned 1 [0178.020] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43fb4000, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59db6e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x43fb4000, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x105f4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Clarity.thmx", cAlternateFileName="CLARIT~1.THM")) returned 1 [0178.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\clarity.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0178.022] GetProcessHeap () returned 0x4e0000 [0178.022] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0178.022] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0178.022] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0178.023] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0xc, lpOverlapped=0x0) returned 1 [0178.024] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0178.024] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.024] GetProcessHeap () returned 0x4e0000 [0178.025] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0178.025] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40) returned 1 [0178.025] CryptDestroyKey (hKey=0x522f58) returned 1 [0178.025] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4e8*=0x40, lpOverlapped=0x0) returned 1 [0178.025] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0178.025] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0178.025] WriteFile (in: hFile=0x110, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0178.025] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0178.025] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0178.025] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0178.025] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.025] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.025] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x105f4, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0x105f4, lpOverlapped=0x0) returned 1 [0178.026] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x10600, dwBufLen=0x10600 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x10600) returned 1 [0178.028] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.028] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x10600, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0x10600, lpOverlapped=0x0) returned 1 [0178.028] CryptDestroyKey (hKey=0x522f58) returned 1 [0178.028] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x106d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.028] SetEndOfFile (hFile=0x110) returned 1 [0178.031] GetProcessHeap () returned 0x4e0000 [0178.031] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0178.031] GetProcessHeap () returned 0x4e0000 [0178.031] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0178.031] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\clarity.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\clarity.thmx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0178.033] CloseHandle (hObject=0x110) returned 1 [0178.033] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a20e000, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a01840, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6a20e000, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x8ad4d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Composite.thmx", cAlternateFileName="COMPOS~1.THM")) returned 1 [0178.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\composite.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0178.035] GetProcessHeap () returned 0x4e0000 [0178.035] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0178.035] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0178.035] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0178.035] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0x3, lpOverlapped=0x0) returned 1 [0178.038] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0178.038] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.038] GetProcessHeap () returned 0x4e0000 [0178.038] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0178.038] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40) returned 1 [0178.038] CryptDestroyKey (hKey=0x522f58) returned 1 [0178.038] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4e8*=0x40, lpOverlapped=0x0) returned 1 [0178.038] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0178.038] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0178.038] WriteFile (in: hFile=0x110, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0178.038] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0178.038] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0178.038] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0178.038] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.039] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.039] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x8ad4d, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0x8ad4d, lpOverlapped=0x0) returned 1 [0178.045] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x8ad50, dwBufLen=0x8ad50 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x8ad50) returned 1 [0178.052] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.052] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x8ad50, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0x8ad50, lpOverlapped=0x0) returned 1 [0178.054] CryptDestroyKey (hKey=0x522f58) returned 1 [0178.054] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x8ae24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.054] SetEndOfFile (hFile=0x110) returned 1 [0178.057] GetProcessHeap () returned 0x4e0000 [0178.057] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0178.057] GetProcessHeap () returned 0x4e0000 [0178.057] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0178.057] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\composite.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\composite.thmx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0178.059] CloseHandle (hObject=0x110) returned 1 [0178.059] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8607600, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a279a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8607600, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1240d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Concourse.thmx", cAlternateFileName="CONCOU~1.THM")) returned 1 [0178.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\concourse.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0178.061] GetProcessHeap () returned 0x4e0000 [0178.061] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0178.061] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0178.061] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0178.061] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0x3, lpOverlapped=0x0) returned 1 [0178.063] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0178.063] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.063] GetProcessHeap () returned 0x4e0000 [0178.063] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0178.063] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40) returned 1 [0178.063] CryptDestroyKey (hKey=0x522f58) returned 1 [0178.063] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4e8*=0x40, lpOverlapped=0x0) returned 1 [0178.063] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0178.063] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0178.063] WriteFile (in: hFile=0x110, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0178.064] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0178.064] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0178.064] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0178.064] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.064] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.064] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1240d, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0x1240d, lpOverlapped=0x0) returned 1 [0178.065] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x12410, dwBufLen=0x12410 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x12410) returned 1 [0178.066] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.066] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x12410, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0x12410, lpOverlapped=0x0) returned 1 [0178.067] CryptDestroyKey (hKey=0x522f58) returned 1 [0178.067] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x124e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.067] SetEndOfFile (hFile=0x110) returned 1 [0178.069] GetProcessHeap () returned 0x4e0000 [0178.070] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0178.070] GetProcessHeap () returned 0x4e0000 [0178.070] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0178.070] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\concourse.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\concourse.thmx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0178.071] CloseHandle (hObject=0x110) returned 1 [0178.071] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee59400, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a99dc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6ee59400, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1e92c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Couture.thmx", cAlternateFileName="COUTUR~1.THM")) returned 1 [0178.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\couture.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0178.075] GetFileSizeEx (in: hFile=0x110, lpFileSize=0x24df4f0 | out: lpFileSize=0x24df4f0*=2003652) returned 1 [0178.075] GetProcessHeap () returned 0x4e0000 [0178.075] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0178.075] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0178.075] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.075] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4dc*=0xc, lpOverlapped=0x0) returned 1 [0178.077] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0178.077] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.077] GetProcessHeap () returned 0x4e0000 [0178.077] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0178.077] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c0*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c0*=0x40) returned 1 [0178.077] CryptDestroyKey (hKey=0x522f58) returned 1 [0178.077] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4dc*=0x40, lpOverlapped=0x0) returned 1 [0178.077] WriteFile (in: hFile=0x110, lpBuffer=0x24df4e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4e4*, lpNumberOfBytesWritten=0x24df4dc*=0x4, lpOverlapped=0x0) returned 1 [0178.077] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4dc*=0x10, lpOverlapped=0x0) returned 1 [0178.077] WriteFile (in: hFile=0x110, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df4dc*=0x80, lpOverlapped=0x0) returned 1 [0178.077] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df508 | out: lpNewFilePointer=0x0) returned 1 [0178.077] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4dc, lpOverlapped=0x0 | out: lpBuffer=0x24df4f8*, lpNumberOfBytesWritten=0x24df4dc*=0x8, lpOverlapped=0x0) returned 1 [0178.077] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4e0 | out: phKey=0x24df4e0*=0x522f58) returned 1 [0178.077] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.077] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0178.077] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0178.080] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0178.084] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.084] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0178.085] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x1e93a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.085] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0178.085] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xa30ec, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0178.085] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0178.090] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0178.092] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xa30ec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.092] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0178.092] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x1e93a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.093] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0178.093] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x1a92d0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4b0 | out: lpNewFilePointer=0x0) returned 1 [0178.093] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a4*=0x40000, lpOverlapped=0x0) returned 1 [0178.096] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df4ac*=0x40000) returned 1 [0178.098] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x1a92d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.098] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a8*=0x40000, lpOverlapped=0x0) returned 1 [0178.099] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x1e93a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.099] WriteFile (in: hFile=0x110, lpBuffer=0x24df4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4a8, lpOverlapped=0x0 | out: lpBuffer=0x24df4b0*, lpNumberOfBytesWritten=0x24df4a8*=0x8, lpOverlapped=0x0) returned 1 [0178.099] CryptDestroyKey (hKey=0x522f58) returned 1 [0178.099] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x1e93a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.099] SetEndOfFile (hFile=0x110) returned 1 [0178.102] GetProcessHeap () returned 0x4e0000 [0178.102] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0178.102] GetProcessHeap () returned 0x4e0000 [0178.102] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0178.102] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\couture.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\couture.thmx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0178.104] CloseHandle (hObject=0x110) returned 1 [0178.104] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73aa4800, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a99dc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x73aa4800, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x555df, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Elemental.thmx", cAlternateFileName="ELEMEN~1.THM")) returned 1 [0178.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\elemental.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0178.106] GetProcessHeap () returned 0x4e0000 [0178.106] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0178.106] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0178.106] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0178.106] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0x1, lpOverlapped=0x0) returned 1 [0178.108] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0178.108] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.108] GetProcessHeap () returned 0x4e0000 [0178.108] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0178.108] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40) returned 1 [0178.108] CryptDestroyKey (hKey=0x522f58) returned 1 [0178.108] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4e8*=0x40, lpOverlapped=0x0) returned 1 [0178.108] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0178.108] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0178.108] WriteFile (in: hFile=0x110, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0178.108] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0178.108] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0178.108] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0178.108] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.108] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.109] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x555df, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0x555df, lpOverlapped=0x0) returned 1 [0178.113] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x555e0, dwBufLen=0x555e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x555e0) returned 1 [0178.116] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.116] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x555e0, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0x555e0, lpOverlapped=0x0) returned 1 [0178.117] CryptDestroyKey (hKey=0x522f58) returned 1 [0178.117] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x556b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.117] SetEndOfFile (hFile=0x110) returned 1 [0178.120] GetProcessHeap () returned 0x4e0000 [0178.120] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0178.120] GetProcessHeap () returned 0x4e0000 [0178.120] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0178.120] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\elemental.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\elemental.thmx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0178.122] CloseHandle (hObject=0x110) returned 1 [0178.122] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2d000, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5abff20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xac2d000, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x10f61, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Equity.thmx", cAlternateFileName="EQUITY~1.THM")) returned 1 [0178.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\equity.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0178.124] GetProcessHeap () returned 0x4e0000 [0178.124] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0178.124] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0178.124] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0178.124] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0xf, lpOverlapped=0x0) returned 1 [0178.125] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0178.125] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.126] GetProcessHeap () returned 0x4e0000 [0178.126] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0178.126] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40) returned 1 [0178.126] CryptDestroyKey (hKey=0x522f58) returned 1 [0178.126] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4e8*=0x40, lpOverlapped=0x0) returned 1 [0178.126] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0178.126] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0178.126] WriteFile (in: hFile=0x110, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0178.126] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0178.126] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0178.126] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0178.126] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.126] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.126] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x10f61, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0x10f61, lpOverlapped=0x0) returned 1 [0178.128] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x10f70, dwBufLen=0x10f70 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x10f70) returned 1 [0178.128] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.128] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x10f70, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0x10f70, lpOverlapped=0x0) returned 1 [0178.129] CryptDestroyKey (hKey=0x522f58) returned 1 [0178.129] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x11044, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.129] SetEndOfFile (hFile=0x110) returned 1 [0178.131] GetProcessHeap () returned 0x4e0000 [0178.131] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0178.131] GetProcessHeap () returned 0x4e0000 [0178.131] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0178.131] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\equity.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\equity.thmx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0178.133] CloseHandle (hObject=0x110) returned 1 [0178.133] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x478ec700, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5abff20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x478ec700, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xc278, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Essential.thmx", cAlternateFileName="ESSENT~1.THM")) returned 1 [0178.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Essential.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\essential.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0178.135] GetProcessHeap () returned 0x4e0000 [0178.135] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0178.135] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0178.135] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0178.135] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0178.137] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0178.137] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.137] GetProcessHeap () returned 0x4e0000 [0178.137] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0178.137] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40) returned 1 [0178.137] CryptDestroyKey (hKey=0x522f58) returned 1 [0178.137] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4e8*=0x40, lpOverlapped=0x0) returned 1 [0178.137] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0178.137] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0178.137] WriteFile (in: hFile=0x110, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0178.137] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0178.138] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0178.138] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0178.138] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.138] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.138] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xc278, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0xc278, lpOverlapped=0x0) returned 1 [0178.141] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0xc280, dwBufLen=0xc280 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0xc280) returned 1 [0178.141] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.141] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc280, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0xc280, lpOverlapped=0x0) returned 1 [0178.141] CryptDestroyKey (hKey=0x522f58) returned 1 [0178.141] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xc354, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.141] SetEndOfFile (hFile=0x110) returned 1 [0178.144] GetProcessHeap () returned 0x4e0000 [0178.144] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0178.144] GetProcessHeap () returned 0x4e0000 [0178.144] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0178.144] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Essential.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\essential.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Essential.thmx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\essential.thmx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0178.146] CloseHandle (hObject=0x110) returned 1 [0178.146] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x773dcf00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5ae6080, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x773dcf00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xd748, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Executive.thmx", cAlternateFileName="EXECUT~1.THM")) returned 1 [0178.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Executive.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\executive.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0178.147] GetProcessHeap () returned 0x4e0000 [0178.147] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0178.147] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0178.148] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0178.148] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0178.150] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0178.150] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.150] GetProcessHeap () returned 0x4e0000 [0178.150] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0178.150] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40) returned 1 [0178.150] CryptDestroyKey (hKey=0x522f58) returned 1 [0178.150] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4e8*=0x40, lpOverlapped=0x0) returned 1 [0178.150] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0178.150] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0178.150] WriteFile (in: hFile=0x110, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0178.150] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0178.150] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0178.150] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0178.150] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.150] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.150] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xd748, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0xd748, lpOverlapped=0x0) returned 1 [0178.152] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0xd750, dwBufLen=0xd750 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0xd750) returned 1 [0178.152] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.152] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xd750, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0xd750, lpOverlapped=0x0) returned 1 [0178.152] CryptDestroyKey (hKey=0x522f58) returned 1 [0178.152] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xd824, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.153] SetEndOfFile (hFile=0x110) returned 1 [0178.155] GetProcessHeap () returned 0x4e0000 [0178.155] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0178.155] GetProcessHeap () returned 0x4e0000 [0178.155] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0178.155] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Executive.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\executive.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Executive.thmx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\executive.thmx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0178.157] CloseHandle (hObject=0x110) returned 1 [0178.157] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11e9de00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5ae6080, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x11e9de00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x100a8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Flow.thmx", cAlternateFileName="FLOW~1.THM")) returned 1 [0178.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Flow.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\flow.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0178.158] GetProcessHeap () returned 0x4e0000 [0178.158] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0178.158] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0178.159] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0178.159] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0178.160] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0178.160] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.160] GetProcessHeap () returned 0x4e0000 [0178.160] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0178.160] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df4c8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df4c8*=0x30) returned 1 [0178.160] CryptDestroyKey (hKey=0x522f58) returned 1 [0178.160] WriteFile (in: hFile=0x110, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df4e8*=0x30, lpOverlapped=0x0) returned 1 [0178.161] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0178.161] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0178.161] WriteFile (in: hFile=0x110, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0178.161] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0178.161] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0178.161] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0178.161] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.161] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.161] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x100a8, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0x100a8, lpOverlapped=0x0) returned 1 [0178.163] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x100b0, dwBufLen=0x100b0 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x100b0) returned 1 [0178.163] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.163] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x100b0, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0x100b0, lpOverlapped=0x0) returned 1 [0178.164] CryptDestroyKey (hKey=0x522f58) returned 1 [0178.164] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x10174, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.164] SetEndOfFile (hFile=0x110) returned 1 [0178.166] GetProcessHeap () returned 0x4e0000 [0178.166] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0178.166] GetProcessHeap () returned 0x4e0000 [0178.166] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0178.166] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Flow.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\flow.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Flow.thmx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\flow.thmx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0178.168] CloseHandle (hObject=0x110) returned 1 [0178.168] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe565700, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b0c1e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe565700, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xf814, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Foundry.thmx", cAlternateFileName="FOUNDR~1.THM")) returned 1 [0178.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Foundry.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\foundry.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0178.170] GetProcessHeap () returned 0x4e0000 [0178.170] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0178.170] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0178.170] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0178.170] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0xc, lpOverlapped=0x0) returned 1 [0178.172] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0178.172] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.172] GetProcessHeap () returned 0x4e0000 [0178.172] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0178.172] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40) returned 1 [0178.172] CryptDestroyKey (hKey=0x522f58) returned 1 [0178.172] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4e8*=0x40, lpOverlapped=0x0) returned 1 [0178.172] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0178.172] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0178.172] WriteFile (in: hFile=0x110, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0178.172] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0178.172] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0178.173] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0178.173] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.173] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.173] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xf814, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0xf814, lpOverlapped=0x0) returned 1 [0178.174] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0xf820, dwBufLen=0xf820 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0xf820) returned 1 [0178.174] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.174] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xf820, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0xf820, lpOverlapped=0x0) returned 1 [0178.175] CryptDestroyKey (hKey=0x522f58) returned 1 [0178.175] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xf8f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.175] SetEndOfFile (hFile=0x110) returned 1 [0178.177] GetProcessHeap () returned 0x4e0000 [0178.177] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0178.177] GetProcessHeap () returned 0x4e0000 [0178.177] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0178.177] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Foundry.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\foundry.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Foundry.thmx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\foundry.thmx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0178.179] CloseHandle (hObject=0x110) returned 1 [0178.179] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b224e00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b0c1e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4b224e00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xd2e0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Grid.thmx", cAlternateFileName="GRID~1.THM")) returned 1 [0178.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Grid.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\grid.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0178.181] GetProcessHeap () returned 0x4e0000 [0178.181] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0178.181] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0178.181] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0178.181] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0178.181] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.181] GetProcessHeap () returned 0x4e0000 [0178.181] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0178.181] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df4c8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df4c8*=0x30) returned 1 [0178.181] CryptDestroyKey (hKey=0x522f58) returned 1 [0178.181] WriteFile (in: hFile=0x110, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df4e8*=0x30, lpOverlapped=0x0) returned 1 [0178.183] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0178.184] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0178.184] WriteFile (in: hFile=0x110, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0178.184] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0178.184] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0178.185] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0178.185] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.185] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.185] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xd2e0, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0xd2e0, lpOverlapped=0x0) returned 1 [0178.186] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0xd2e0, dwBufLen=0xd2e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0xd2e0) returned 1 [0178.186] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.186] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xd2e0, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0xd2e0, lpOverlapped=0x0) returned 1 [0178.186] CryptDestroyKey (hKey=0x522f58) returned 1 [0178.186] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xd3a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.186] SetEndOfFile (hFile=0x110) returned 1 [0178.189] GetProcessHeap () returned 0x4e0000 [0178.189] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0178.189] GetProcessHeap () returned 0x4e0000 [0178.189] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0178.189] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Grid.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\grid.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Grid.thmx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\grid.thmx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0178.190] CloseHandle (hObject=0x110) returned 1 [0178.191] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d84a800, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b32340, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4d84a800, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x60041, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Hardcover.thmx", cAlternateFileName="HARDCO~1.THM")) returned 1 [0178.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Hardcover.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\hardcover.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0178.192] GetProcessHeap () returned 0x4e0000 [0178.192] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0178.192] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0178.193] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0178.193] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0xf, lpOverlapped=0x0) returned 1 [0178.194] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0178.194] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.194] GetProcessHeap () returned 0x4e0000 [0178.194] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0178.194] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40) returned 1 [0178.194] CryptDestroyKey (hKey=0x522f58) returned 1 [0178.194] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4e8*=0x40, lpOverlapped=0x0) returned 1 [0178.194] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0178.194] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0178.195] WriteFile (in: hFile=0x110, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0178.195] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0178.195] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0178.195] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0178.195] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.195] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.195] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x60041, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0x60041, lpOverlapped=0x0) returned 1 [0178.199] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x60050, dwBufLen=0x60050 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x60050) returned 1 [0178.202] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.202] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x60050, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0x60050, lpOverlapped=0x0) returned 1 [0178.203] CryptDestroyKey (hKey=0x522f58) returned 1 [0178.203] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x60124, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.204] SetEndOfFile (hFile=0x110) returned 1 [0178.206] GetProcessHeap () returned 0x4e0000 [0178.206] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0178.206] GetProcessHeap () returned 0x4e0000 [0178.206] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0178.206] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Hardcover.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\hardcover.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Hardcover.thmx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\hardcover.thmx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0178.208] CloseHandle (hObject=0x110) returned 1 [0178.208] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ad15600, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b584a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7ad15600, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x3becb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Horizon.thmx", cAlternateFileName="HORIZO~1.THM")) returned 1 [0178.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Horizon.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\horizon.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0178.211] GetProcessHeap () returned 0x4e0000 [0178.211] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0178.211] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0178.211] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0178.211] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0x5, lpOverlapped=0x0) returned 1 [0178.213] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0178.213] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.213] GetProcessHeap () returned 0x4e0000 [0178.213] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0178.213] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40) returned 1 [0178.213] CryptDestroyKey (hKey=0x522f58) returned 1 [0178.213] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4e8*=0x40, lpOverlapped=0x0) returned 1 [0178.213] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0178.213] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0178.213] WriteFile (in: hFile=0x110, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0178.213] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0178.213] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0178.213] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0178.213] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.213] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.213] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3becb, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0x3becb, lpOverlapped=0x0) returned 1 [0178.216] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x3bed0, dwBufLen=0x3bed0 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x3bed0) returned 1 [0178.218] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.218] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3bed0, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0x3bed0, lpOverlapped=0x0) returned 1 [0178.219] CryptDestroyKey (hKey=0x522f58) returned 1 [0178.219] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x3bfa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.219] SetEndOfFile (hFile=0x110) returned 1 [0178.222] GetProcessHeap () returned 0x4e0000 [0178.222] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0178.222] GetProcessHeap () returned 0x4e0000 [0178.222] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0178.222] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Horizon.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\horizon.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Horizon.thmx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\horizon.thmx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0178.224] CloseHandle (hObject=0x110) returned 1 [0178.224] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x157d6500, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b584a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x157d6500, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x146a7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Median.thmx", cAlternateFileName="MEDIAN~1.THM")) returned 1 [0178.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Median.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\median.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0178.231] GetProcessHeap () returned 0x4e0000 [0178.231] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0178.231] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0178.231] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0178.231] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0x9, lpOverlapped=0x0) returned 1 [0178.233] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0178.233] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.233] GetProcessHeap () returned 0x4e0000 [0178.233] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0178.233] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40) returned 1 [0178.233] CryptDestroyKey (hKey=0x522f58) returned 1 [0178.233] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4e8*=0x40, lpOverlapped=0x0) returned 1 [0178.233] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0178.233] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0178.233] WriteFile (in: hFile=0x110, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0178.233] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0178.233] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0178.233] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0178.233] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.233] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.233] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x146a7, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0x146a7, lpOverlapped=0x0) returned 1 [0178.235] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x146b0, dwBufLen=0x146b0 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x146b0) returned 1 [0178.235] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.235] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x146b0, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0x146b0, lpOverlapped=0x0) returned 1 [0178.236] CryptDestroyKey (hKey=0x522f58) returned 1 [0178.236] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x14784, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.236] SetEndOfFile (hFile=0x110) returned 1 [0178.239] GetProcessHeap () returned 0x4e0000 [0178.239] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0178.239] GetProcessHeap () returned 0x4e0000 [0178.239] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0178.239] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Median.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\median.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Median.thmx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\median.thmx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0178.240] CloseHandle (hObject=0x110) returned 1 [0178.240] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1910ec00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b7e600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1910ec00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x13af1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Metro.thmx", cAlternateFileName="METRO~1.THM")) returned 1 [0178.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Metro.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\metro.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0178.242] GetProcessHeap () returned 0x4e0000 [0178.242] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0178.242] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0178.242] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0178.242] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0xf, lpOverlapped=0x0) returned 1 [0178.244] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0178.244] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.244] GetProcessHeap () returned 0x4e0000 [0178.244] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0178.244] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df4c8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df4c8*=0x30) returned 1 [0178.244] CryptDestroyKey (hKey=0x522f58) returned 1 [0178.244] WriteFile (in: hFile=0x110, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df4e8*=0x30, lpOverlapped=0x0) returned 1 [0178.244] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0178.244] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0178.244] WriteFile (in: hFile=0x110, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0178.245] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0178.245] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0178.245] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0178.245] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.245] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.245] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x13af1, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0x13af1, lpOverlapped=0x0) returned 1 [0178.246] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x13b00, dwBufLen=0x13b00 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x13b00) returned 1 [0178.247] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.247] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x13b00, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0x13b00, lpOverlapped=0x0) returned 1 [0178.247] CryptDestroyKey (hKey=0x522f58) returned 1 [0178.247] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x13bc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.247] SetEndOfFile (hFile=0x110) returned 1 [0178.250] GetProcessHeap () returned 0x4e0000 [0178.250] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0178.250] GetProcessHeap () returned 0x4e0000 [0178.250] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0178.250] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Metro.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\metro.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Metro.thmx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\metro.thmx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0178.251] CloseHandle (hObject=0x110) returned 1 [0178.251] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b734600, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b7e600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1b734600, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1583a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Module.thmx", cAlternateFileName="MODULE~1.THM")) returned 1 [0178.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Module.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\module.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0178.253] GetProcessHeap () returned 0x4e0000 [0178.253] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0178.253] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0178.253] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0178.253] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0x6, lpOverlapped=0x0) returned 1 [0178.272] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0178.272] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.272] GetProcessHeap () returned 0x4e0000 [0178.272] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0178.272] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40) returned 1 [0178.272] CryptDestroyKey (hKey=0x522f58) returned 1 [0178.272] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4e8*=0x40, lpOverlapped=0x0) returned 1 [0178.272] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0178.273] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0178.273] WriteFile (in: hFile=0x110, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0178.273] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0178.273] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0178.273] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0178.273] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.273] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.273] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1583a, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0x1583a, lpOverlapped=0x0) returned 1 [0178.274] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x15840, dwBufLen=0x15840 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x15840) returned 1 [0178.275] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.275] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x15840, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0x15840, lpOverlapped=0x0) returned 1 [0178.275] CryptDestroyKey (hKey=0x522f58) returned 1 [0178.275] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x15914, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.275] SetEndOfFile (hFile=0x110) returned 1 [0178.278] GetProcessHeap () returned 0x4e0000 [0178.278] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0178.278] GetProcessHeap () returned 0x4e0000 [0178.278] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0178.278] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Module.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\module.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Module.thmx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\module.thmx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0178.282] CloseHandle (hObject=0x110) returned 1 [0178.282] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e64dd00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5ba4760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7e64dd00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x96ac7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Newsprint.thmx", cAlternateFileName="NEWSPR~1.THM")) returned 1 [0178.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Newsprint.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\newsprint.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0178.284] GetProcessHeap () returned 0x4e0000 [0178.284] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0178.284] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0178.284] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0178.284] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0x9, lpOverlapped=0x0) returned 1 [0178.286] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0178.286] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.286] GetProcessHeap () returned 0x4e0000 [0178.286] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0178.286] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40) returned 1 [0178.286] CryptDestroyKey (hKey=0x522f58) returned 1 [0178.286] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4e8*=0x40, lpOverlapped=0x0) returned 1 [0178.286] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0178.286] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0178.286] WriteFile (in: hFile=0x110, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0178.286] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0178.286] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0178.286] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0178.287] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.287] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.287] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x96ac7, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0x96ac7, lpOverlapped=0x0) returned 1 [0178.293] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x96ad0, dwBufLen=0x96ad0 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x96ad0) returned 1 [0178.298] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.298] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x96ad0, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0x96ad0, lpOverlapped=0x0) returned 1 [0178.300] CryptDestroyKey (hKey=0x522f58) returned 1 [0178.300] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x96ba4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.300] SetEndOfFile (hFile=0x110) returned 1 [0178.303] GetProcessHeap () returned 0x4e0000 [0178.303] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0178.303] GetProcessHeap () returned 0x4e0000 [0178.303] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0178.303] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Newsprint.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\newsprint.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Newsprint.thmx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\newsprint.thmx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0178.304] CloseHandle (hObject=0x110) returned 1 [0178.304] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f06cd00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5ba4760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1f06cd00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x132b9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Opulent.thmx", cAlternateFileName="OPULEN~1.THM")) returned 1 [0178.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Opulent.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\opulent.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0178.306] GetProcessHeap () returned 0x4e0000 [0178.306] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0178.306] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0178.306] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0178.306] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0x7, lpOverlapped=0x0) returned 1 [0178.308] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0178.308] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.308] GetProcessHeap () returned 0x4e0000 [0178.308] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0178.308] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40) returned 1 [0178.308] CryptDestroyKey (hKey=0x522f58) returned 1 [0178.308] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4e8*=0x40, lpOverlapped=0x0) returned 1 [0178.308] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0178.309] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0178.309] WriteFile (in: hFile=0x110, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0178.309] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0178.309] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0178.309] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0178.309] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.309] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.309] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x132b9, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0x132b9, lpOverlapped=0x0) returned 1 [0178.311] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x132c0, dwBufLen=0x132c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x132c0) returned 1 [0178.312] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.312] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x132c0, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0x132c0, lpOverlapped=0x0) returned 1 [0178.312] CryptDestroyKey (hKey=0x522f58) returned 1 [0178.312] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x13394, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.312] SetEndOfFile (hFile=0x110) returned 1 [0178.315] GetProcessHeap () returned 0x4e0000 [0178.315] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0178.315] GetProcessHeap () returned 0x4e0000 [0178.315] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0178.315] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Opulent.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\opulent.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Opulent.thmx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\opulent.thmx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0178.317] CloseHandle (hObject=0x110) returned 1 [0178.318] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x229a5400, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5bca8c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x229a5400, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x16ef4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Oriel.thmx", cAlternateFileName="ORIEL~1.THM")) returned 1 [0178.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Oriel.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\oriel.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0178.320] GetProcessHeap () returned 0x4e0000 [0178.320] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0178.320] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0178.320] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0178.320] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0xc, lpOverlapped=0x0) returned 1 [0178.322] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0178.322] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.322] GetProcessHeap () returned 0x4e0000 [0178.322] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0178.322] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df4c8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df4c8*=0x30) returned 1 [0178.322] CryptDestroyKey (hKey=0x522f58) returned 1 [0178.322] WriteFile (in: hFile=0x110, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df4e8*=0x30, lpOverlapped=0x0) returned 1 [0178.322] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0178.322] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0178.322] WriteFile (in: hFile=0x110, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0178.323] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0178.323] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0178.323] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0178.323] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.323] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.323] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x16ef4, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0x16ef4, lpOverlapped=0x0) returned 1 [0178.324] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x16f00, dwBufLen=0x16f00 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x16f00) returned 1 [0178.325] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.325] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x16f00, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0x16f00, lpOverlapped=0x0) returned 1 [0178.325] CryptDestroyKey (hKey=0x522f58) returned 1 [0178.325] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x16fc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.325] SetEndOfFile (hFile=0x110) returned 1 [0178.328] GetProcessHeap () returned 0x4e0000 [0178.328] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0178.328] GetProcessHeap () returned 0x4e0000 [0178.328] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0178.328] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Oriel.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\oriel.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Oriel.thmx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\oriel.thmx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0178.329] CloseHandle (hObject=0x110) returned 1 [0178.330] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x262ddb00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5bca8c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x262ddb00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1540b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Origin.thmx", cAlternateFileName="ORIGIN~1.THM")) returned 1 [0178.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Origin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\origin.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0178.331] GetProcessHeap () returned 0x4e0000 [0178.331] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0178.331] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0178.332] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0178.332] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0x5, lpOverlapped=0x0) returned 1 [0178.333] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0178.333] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.333] GetProcessHeap () returned 0x4e0000 [0178.333] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0178.333] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40) returned 1 [0178.333] CryptDestroyKey (hKey=0x522f58) returned 1 [0178.333] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4e8*=0x40, lpOverlapped=0x0) returned 1 [0178.334] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0178.334] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0178.334] WriteFile (in: hFile=0x110, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0178.334] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0178.334] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0178.334] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0178.334] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.334] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.334] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1540b, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0x1540b, lpOverlapped=0x0) returned 1 [0178.335] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x15410, dwBufLen=0x15410 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x15410) returned 1 [0178.336] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.336] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x15410, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0x15410, lpOverlapped=0x0) returned 1 [0178.336] CryptDestroyKey (hKey=0x522f58) returned 1 [0178.336] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x154e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.337] SetEndOfFile (hFile=0x110) returned 1 [0178.339] GetProcessHeap () returned 0x4e0000 [0178.339] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0178.340] GetProcessHeap () returned 0x4e0000 [0178.340] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0178.340] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Origin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\origin.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Origin.thmx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\origin.thmx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0178.341] CloseHandle (hObject=0x110) returned 1 [0178.341] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29c16200, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c16b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x29c16200, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x421e6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Paper.thmx", cAlternateFileName="PAPER~1.THM")) returned 1 [0178.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Paper.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\paper.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0178.342] GetProcessHeap () returned 0x4e0000 [0178.342] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0178.342] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0178.342] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0178.342] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0xa, lpOverlapped=0x0) returned 1 [0178.344] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0178.344] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.344] GetProcessHeap () returned 0x4e0000 [0178.344] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0178.344] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df4c8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df4c8*=0x30) returned 1 [0178.344] CryptDestroyKey (hKey=0x522f58) returned 1 [0178.344] WriteFile (in: hFile=0x110, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df4e8*=0x30, lpOverlapped=0x0) returned 1 [0178.344] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0178.344] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0178.344] WriteFile (in: hFile=0x110, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0178.344] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0178.345] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0178.345] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0178.345] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.345] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.345] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x421e6, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0x421e6, lpOverlapped=0x0) returned 1 [0178.347] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x421f0, dwBufLen=0x421f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x421f0) returned 1 [0178.350] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.350] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x421f0, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0x421f0, lpOverlapped=0x0) returned 1 [0178.350] CryptDestroyKey (hKey=0x522f58) returned 1 [0178.350] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x422b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.350] SetEndOfFile (hFile=0x110) returned 1 [0178.352] GetProcessHeap () returned 0x4e0000 [0178.353] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0178.353] GetProcessHeap () returned 0x4e0000 [0178.353] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0178.353] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Paper.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\paper.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Paper.thmx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\paper.thmx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0178.354] CloseHandle (hObject=0x110) returned 1 [0178.354] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51182f00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c16b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x51182f00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xd15a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Perspective.thmx", cAlternateFileName="PERSPE~1.THM")) returned 1 [0178.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Perspective.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\perspective.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0178.355] GetProcessHeap () returned 0x4e0000 [0178.355] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0178.355] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0178.355] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0178.355] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0x6, lpOverlapped=0x0) returned 1 [0178.357] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0178.357] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.357] GetProcessHeap () returned 0x4e0000 [0178.357] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0178.357] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40) returned 1 [0178.357] CryptDestroyKey (hKey=0x522f58) returned 1 [0178.357] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4e8*=0x40, lpOverlapped=0x0) returned 1 [0178.357] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0178.357] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0178.357] WriteFile (in: hFile=0x110, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0178.358] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0178.358] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0178.358] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0178.358] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.358] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.358] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xd15a, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0xd15a, lpOverlapped=0x0) returned 1 [0178.359] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0xd160, dwBufLen=0xd160 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0xd160) returned 1 [0178.359] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.359] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xd160, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0xd160, lpOverlapped=0x0) returned 1 [0178.359] CryptDestroyKey (hKey=0x522f58) returned 1 [0178.360] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xd234, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.360] SetEndOfFile (hFile=0x110) returned 1 [0178.362] GetProcessHeap () returned 0x4e0000 [0178.362] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0178.362] GetProcessHeap () returned 0x4e0000 [0178.362] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0178.362] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Perspective.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\perspective.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Perspective.thmx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\perspective.thmx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0178.363] CloseHandle (hObject=0x110) returned 1 [0178.363] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54abb600, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c3cce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x54abb600, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xc97ce, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Pushpin.thmx", cAlternateFileName="PUSHPI~1.THM")) returned 1 [0178.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Pushpin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\pushpin.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0178.365] GetProcessHeap () returned 0x4e0000 [0178.365] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0178.365] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0178.365] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0178.365] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0x2, lpOverlapped=0x0) returned 1 [0178.367] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0178.367] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.367] GetProcessHeap () returned 0x4e0000 [0178.367] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0178.367] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40) returned 1 [0178.367] CryptDestroyKey (hKey=0x522f58) returned 1 [0178.367] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4e8*=0x40, lpOverlapped=0x0) returned 1 [0178.367] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0178.367] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0178.367] WriteFile (in: hFile=0x110, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0178.367] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0178.367] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0178.367] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0178.367] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.367] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.367] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xc97ce, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0xc97ce, lpOverlapped=0x0) returned 1 [0178.376] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0xc97d0, dwBufLen=0xc97d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0xc97d0) returned 1 [0178.382] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.382] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc97d0, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0xc97d0, lpOverlapped=0x0) returned 1 [0178.385] CryptDestroyKey (hKey=0x522f58) returned 1 [0178.385] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xc98a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.385] SetEndOfFile (hFile=0x110) returned 1 [0178.387] GetProcessHeap () returned 0x4e0000 [0178.387] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0178.387] GetProcessHeap () returned 0x4e0000 [0178.387] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0178.387] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Pushpin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\pushpin.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Pushpin.thmx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\pushpin.thmx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0178.389] CloseHandle (hObject=0x110) returned 1 [0178.389] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81f86400, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c62e40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x81f86400, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x106e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Slipstream.thmx", cAlternateFileName="SLIPST~1.THM")) returned 1 [0178.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\slipstream.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0178.391] GetProcessHeap () returned 0x4e0000 [0178.391] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0178.391] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0178.391] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0178.391] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0178.392] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0178.392] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.393] GetProcessHeap () returned 0x4e0000 [0178.393] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0178.393] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40) returned 1 [0178.393] CryptDestroyKey (hKey=0x522f58) returned 1 [0178.393] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4e8*=0x40, lpOverlapped=0x0) returned 1 [0178.393] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0178.393] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0178.393] WriteFile (in: hFile=0x110, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0178.393] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0178.393] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0178.393] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0178.393] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.393] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.393] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x106e8, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0x106e8, lpOverlapped=0x0) returned 1 [0178.395] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x106f0, dwBufLen=0x106f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x106f0) returned 1 [0178.395] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.395] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x106f0, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0x106f0, lpOverlapped=0x0) returned 1 [0178.395] CryptDestroyKey (hKey=0x522f58) returned 1 [0178.395] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x107c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.396] SetEndOfFile (hFile=0x110) returned 1 [0178.398] GetProcessHeap () returned 0x4e0000 [0178.398] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0178.398] GetProcessHeap () returned 0x4e0000 [0178.398] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0178.398] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\slipstream.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\slipstream.thmx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0178.400] CloseHandle (hObject=0x110) returned 1 [0178.400] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c23bc00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c62e40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2c23bc00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x124a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Solstice.thmx", cAlternateFileName="SOLSTI~1.THM")) returned 1 [0178.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\solstice.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0178.402] GetProcessHeap () returned 0x4e0000 [0178.402] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0178.402] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0178.402] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0178.402] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0178.402] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.402] GetProcessHeap () returned 0x4e0000 [0178.402] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0178.402] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40) returned 1 [0178.402] CryptDestroyKey (hKey=0x522f58) returned 1 [0178.402] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4e8*=0x40, lpOverlapped=0x0) returned 1 [0178.404] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0178.404] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0178.404] WriteFile (in: hFile=0x110, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0178.404] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0178.404] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0178.404] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0178.404] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.405] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.405] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x124a0, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0x124a0, lpOverlapped=0x0) returned 1 [0178.406] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x124a0, dwBufLen=0x124a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x124a0) returned 1 [0178.407] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.407] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x124a0, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0x124a0, lpOverlapped=0x0) returned 1 [0178.407] CryptDestroyKey (hKey=0x522f58) returned 1 [0178.407] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x12574, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.407] SetEndOfFile (hFile=0x110) returned 1 [0178.409] GetProcessHeap () returned 0x4e0000 [0178.409] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0178.409] GetProcessHeap () returned 0x4e0000 [0178.410] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0178.410] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\solstice.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\solstice.thmx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0178.411] CloseHandle (hObject=0x110) returned 1 [0178.411] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2fb74300, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c88fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2fb74300, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x10d83, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Technic.thmx", cAlternateFileName="TECHNI~1.THM")) returned 1 [0178.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\technic.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0178.413] GetProcessHeap () returned 0x4e0000 [0178.413] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0178.413] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0178.413] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0178.413] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0xd, lpOverlapped=0x0) returned 1 [0178.415] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0178.415] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.415] GetProcessHeap () returned 0x4e0000 [0178.415] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0178.415] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40) returned 1 [0178.415] CryptDestroyKey (hKey=0x522f58) returned 1 [0178.415] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4e8*=0x40, lpOverlapped=0x0) returned 1 [0178.415] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0178.415] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0178.415] WriteFile (in: hFile=0x110, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0178.415] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0178.415] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0178.415] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0178.416] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.416] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.416] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x10d83, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0x10d83, lpOverlapped=0x0) returned 1 [0178.417] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x10d90, dwBufLen=0x10d90 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x10d90) returned 1 [0178.418] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.418] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x10d90, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0x10d90, lpOverlapped=0x0) returned 1 [0178.418] CryptDestroyKey (hKey=0x522f58) returned 1 [0178.418] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x10e64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.418] SetEndOfFile (hFile=0x110) returned 1 [0178.421] GetProcessHeap () returned 0x4e0000 [0178.421] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0178.421] GetProcessHeap () returned 0x4e0000 [0178.421] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0178.421] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\technic.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\technic.thmx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0178.423] CloseHandle (hObject=0x110) returned 1 [0178.423] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59706a00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c88fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x59706a00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x15d75, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Thatch.thmx", cAlternateFileName="THATCH~1.THM")) returned 1 [0178.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\thatch.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0178.425] GetProcessHeap () returned 0x4e0000 [0178.425] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0178.425] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0178.425] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0178.425] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0xb, lpOverlapped=0x0) returned 1 [0178.426] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0178.426] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.426] GetProcessHeap () returned 0x4e0000 [0178.427] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0178.427] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40) returned 1 [0178.427] CryptDestroyKey (hKey=0x522f58) returned 1 [0178.427] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4e8*=0x40, lpOverlapped=0x0) returned 1 [0178.427] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0178.427] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0178.427] WriteFile (in: hFile=0x110, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0178.427] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0178.427] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0178.427] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0178.427] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.427] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.427] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x15d75, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0x15d75, lpOverlapped=0x0) returned 1 [0178.429] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x15d80, dwBufLen=0x15d80 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x15d80) returned 1 [0178.429] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.429] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x15d80, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0x15d80, lpOverlapped=0x0) returned 1 [0178.430] CryptDestroyKey (hKey=0x522f58) returned 1 [0178.430] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x15e54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.430] SetEndOfFile (hFile=0x110) returned 1 [0178.432] GetProcessHeap () returned 0x4e0000 [0178.432] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0178.432] GetProcessHeap () returned 0x4e0000 [0178.432] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0178.432] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\thatch.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\thatch.thmx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0178.434] CloseHandle (hObject=0x110) returned 1 [0178.434] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c9cf70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x603f4990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Theme Colors", cAlternateFileName="THEMEC~1")) returned 1 [0178.434] GetProcessHeap () returned 0x4e0000 [0178.434] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x94) returned 0x4fa058 [0178.434] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c9cf70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x603f4990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName=".", cAlternateFileName="")) returned 0x522f58 [0178.436] GetProcessHeap () returned 0x4e0000 [0178.436] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0178.436] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c9cf70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x603f4990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="..", cAlternateFileName="")) returned 1 [0178.437] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccc5300, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xccc5300, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3a0, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Adjacency.xml", cAlternateFileName="ADJACE~1.XML")) returned 1 [0178.437] GetProcessHeap () returned 0x4e0000 [0178.437] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x296) returned 0x541088 [0178.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\adjacency.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0178.438] GetProcessHeap () returned 0x4e0000 [0178.438] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0178.438] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0178.438] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0178.439] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.439] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.439] GetProcessHeap () returned 0x4e0000 [0178.439] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0178.439] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0178.439] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.439] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0178.440] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0178.440] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0178.441] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0178.441] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0178.441] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0178.441] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.441] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.441] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.441] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3a0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3a0, lpOverlapped=0x0) returned 1 [0178.441] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3a0, dwBufLen=0x3a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3a0) returned 1 [0178.441] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.441] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3a0, lpOverlapped=0x0) returned 1 [0178.441] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.441] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.441] SetEndOfFile (hFile=0xdc) returned 1 [0178.443] GetProcessHeap () returned 0x4e0000 [0178.443] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0178.443] GetProcessHeap () returned 0x4e0000 [0178.443] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0178.443] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\adjacency.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\adjacency.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0178.445] CloseHandle (hObject=0xdc) returned 1 [0178.445] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfd8000, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdfd8000, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x39d, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Angles.xml", cAlternateFileName="")) returned 1 [0178.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\angles.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0178.446] GetProcessHeap () returned 0x4e0000 [0178.446] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0178.446] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0178.446] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0178.446] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x3, lpOverlapped=0x0) returned 1 [0178.448] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.448] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.448] GetProcessHeap () returned 0x4e0000 [0178.448] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0178.448] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0178.448] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.448] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0178.448] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0178.448] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0178.448] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0178.448] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0178.448] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0178.448] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.448] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.448] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.449] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x39d, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x39d, lpOverlapped=0x0) returned 1 [0178.449] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3a0, dwBufLen=0x3a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3a0) returned 1 [0178.449] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.449] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3a0, lpOverlapped=0x0) returned 1 [0178.449] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.449] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.449] SetEndOfFile (hFile=0xdc) returned 1 [0178.451] GetProcessHeap () returned 0x4e0000 [0178.451] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0178.451] GetProcessHeap () returned 0x4e0000 [0178.451] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0178.451] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\angles.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\angles.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0178.452] CloseHandle (hObject=0xdc) returned 1 [0178.453] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb6b6700, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb6b6700, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3bf, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Apex.xml", cAlternateFileName="")) returned 1 [0178.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apex.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0178.454] GetProcessHeap () returned 0x4e0000 [0178.454] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0178.454] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0178.454] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0178.454] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x1, lpOverlapped=0x0) returned 1 [0178.458] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.458] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.458] GetProcessHeap () returned 0x4e0000 [0178.458] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0178.458] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0178.458] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.458] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0178.458] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0178.458] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0178.458] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0178.458] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0178.458] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0178.458] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.458] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.458] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.458] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3bf, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3bf, lpOverlapped=0x0) returned 1 [0178.458] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3c0, dwBufLen=0x3c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3c0) returned 1 [0178.458] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.458] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3c0, lpOverlapped=0x0) returned 1 [0178.459] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.459] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x484, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.459] SetEndOfFile (hFile=0xdc) returned 1 [0178.461] GetProcessHeap () returned 0x4e0000 [0178.461] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0178.461] GetProcessHeap () returned 0x4e0000 [0178.461] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0178.461] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apex.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apex.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0178.462] CloseHandle (hObject=0xdc) returned 1 [0178.462] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe09100, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe09100, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c5, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Apothecary.xml", cAlternateFileName="APOTHE~1.XML")) returned 1 [0178.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apothecary.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0178.464] GetProcessHeap () returned 0x4e0000 [0178.464] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0178.464] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0178.464] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0178.465] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xb, lpOverlapped=0x0) returned 1 [0178.466] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.466] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.466] GetProcessHeap () returned 0x4e0000 [0178.466] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0178.466] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0178.466] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.466] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0178.466] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0178.467] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0178.467] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0178.467] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0178.467] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0178.467] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.467] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.467] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.467] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3c5, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3c5, lpOverlapped=0x0) returned 1 [0178.467] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3d0) returned 1 [0178.467] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.467] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3d0, lpOverlapped=0x0) returned 1 [0178.467] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.467] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.467] SetEndOfFile (hFile=0xdc) returned 1 [0178.470] GetProcessHeap () returned 0x4e0000 [0178.470] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0178.470] GetProcessHeap () returned 0x4e0000 [0178.470] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0178.470] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apothecary.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apothecary.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0178.472] CloseHandle (hObject=0xdc) returned 1 [0178.472] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec9c9400, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xec9c9400, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Aspect.xml", cAlternateFileName="")) returned 1 [0178.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\aspect.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0178.473] GetProcessHeap () returned 0x4e0000 [0178.473] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0178.473] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0178.473] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0178.473] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xf, lpOverlapped=0x0) returned 1 [0178.475] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.475] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.475] GetProcessHeap () returned 0x4e0000 [0178.475] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0178.475] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0178.475] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.475] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0178.475] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0178.475] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0178.475] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0178.475] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0178.475] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0178.475] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.475] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.475] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.475] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3c1, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3c1, lpOverlapped=0x0) returned 1 [0178.475] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3d0) returned 1 [0178.475] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.475] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3d0, lpOverlapped=0x0) returned 1 [0178.476] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.476] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.476] SetEndOfFile (hFile=0xdc) returned 1 [0178.478] GetProcessHeap () returned 0x4e0000 [0178.478] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0178.478] GetProcessHeap () returned 0x4e0000 [0178.478] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0178.478] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\aspect.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\aspect.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0178.479] CloseHandle (hObject=0xdc) returned 1 [0178.479] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x211be00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x211be00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Austin.xml", cAlternateFileName="")) returned 1 [0178.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\austin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0178.490] GetProcessHeap () returned 0x4e0000 [0178.491] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0178.491] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0178.491] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0178.491] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xf, lpOverlapped=0x0) returned 1 [0178.616] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.616] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.616] GetProcessHeap () returned 0x4e0000 [0178.616] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0178.616] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0178.616] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.616] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0178.617] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0178.617] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0178.617] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0178.617] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0178.617] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0178.617] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.617] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.617] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.617] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3c1, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3c1, lpOverlapped=0x0) returned 1 [0178.617] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3d0) returned 1 [0178.617] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.617] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3d0, lpOverlapped=0x0) returned 1 [0178.618] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.618] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.618] SetEndOfFile (hFile=0xdc) returned 1 [0178.621] GetProcessHeap () returned 0x4e0000 [0178.621] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0178.621] GetProcessHeap () returned 0x4e0000 [0178.621] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0178.621] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\austin.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\austin.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0178.623] CloseHandle (hObject=0xdc) returned 1 [0178.623] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2ead00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2ead00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x39f, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Black Tie.xml", cAlternateFileName="BLACKT~1.XML")) returned 1 [0178.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\black tie.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0178.624] GetProcessHeap () returned 0x4e0000 [0178.624] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0178.624] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0178.624] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0178.625] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x1, lpOverlapped=0x0) returned 1 [0178.627] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.627] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.628] GetProcessHeap () returned 0x4e0000 [0178.628] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0178.628] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0178.628] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.628] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0178.628] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0178.628] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0178.628] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0178.628] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0178.628] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0178.628] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.628] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.628] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.629] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x39f, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x39f, lpOverlapped=0x0) returned 1 [0178.629] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3a0, dwBufLen=0x3a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3a0) returned 1 [0178.629] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.629] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3a0, lpOverlapped=0x0) returned 1 [0178.629] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.629] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.629] SetEndOfFile (hFile=0xdc) returned 1 [0178.631] GetProcessHeap () returned 0x4e0000 [0178.632] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0178.632] GetProcessHeap () returned 0x4e0000 [0178.632] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0178.632] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\black tie.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\black tie.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0178.633] CloseHandle (hObject=0xdc) returned 1 [0178.634] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedcdc100, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xedcdc100, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Civic.xml", cAlternateFileName="")) returned 1 [0178.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\civic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0178.635] GetProcessHeap () returned 0x4e0000 [0178.635] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0178.635] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0178.635] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0178.635] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.635] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.635] GetProcessHeap () returned 0x4e0000 [0178.635] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0178.635] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0178.635] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.635] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0178.638] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0178.638] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0178.638] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0178.638] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0178.638] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0178.639] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.639] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.639] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.639] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3c0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3c0, lpOverlapped=0x0) returned 1 [0178.639] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3c0, dwBufLen=0x3c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3c0) returned 1 [0178.639] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.639] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3c0, lpOverlapped=0x0) returned 1 [0178.639] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.639] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x484, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.639] SetEndOfFile (hFile=0xdc) returned 1 [0178.642] GetProcessHeap () returned 0x4e0000 [0178.642] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0178.642] GetProcessHeap () returned 0x4e0000 [0178.642] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0178.642] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\civic.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\civic.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0178.643] CloseHandle (hObject=0xdc) returned 1 [0178.644] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x342eb00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x342eb00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x39e, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Clarity.xml", cAlternateFileName="")) returned 1 [0178.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\clarity.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0178.645] GetProcessHeap () returned 0x4e0000 [0178.645] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0178.645] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0178.645] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0178.645] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0178.647] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.647] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.647] GetProcessHeap () returned 0x4e0000 [0178.647] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0178.647] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0178.647] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.647] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0178.648] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0178.648] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0178.648] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0178.648] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0178.648] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0178.648] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.648] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.648] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.648] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x39e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x39e, lpOverlapped=0x0) returned 1 [0178.648] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3a0, dwBufLen=0x3a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3a0) returned 1 [0178.648] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.648] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3a0, lpOverlapped=0x0) returned 1 [0178.649] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.649] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.649] SetEndOfFile (hFile=0xdc) returned 1 [0178.651] GetProcessHeap () returned 0x4e0000 [0178.651] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0178.651] GetProcessHeap () returned 0x4e0000 [0178.652] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0178.652] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\clarity.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\clarity.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0178.653] CloseHandle (hObject=0xdc) returned 1 [0178.653] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11910700, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11910700, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c4, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Composite.xml", cAlternateFileName="COMPOS~1.XML")) returned 1 [0178.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\composite.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0178.656] GetProcessHeap () returned 0x4e0000 [0178.656] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0178.656] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0178.656] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0178.656] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0178.658] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.658] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.658] GetProcessHeap () returned 0x4e0000 [0178.658] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0178.658] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0178.658] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.658] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0178.658] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0178.658] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0178.659] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0178.659] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0178.659] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0178.659] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.659] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.659] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.659] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3c4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3c4, lpOverlapped=0x0) returned 1 [0178.659] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3d0) returned 1 [0178.659] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.659] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3d0, lpOverlapped=0x0) returned 1 [0178.659] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.659] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.659] SetEndOfFile (hFile=0xdc) returned 1 [0178.662] GetProcessHeap () returned 0x4e0000 [0178.662] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0178.662] GetProcessHeap () returned 0x4e0000 [0178.662] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0178.662] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\composite.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\composite.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0178.664] CloseHandle (hObject=0xdc) returned 1 [0178.664] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeefeee00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeefeee00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c4, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Concourse.xml", cAlternateFileName="CONCOU~1.XML")) returned 1 [0178.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\concourse.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0178.665] GetProcessHeap () returned 0x4e0000 [0178.665] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0178.665] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0178.665] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0178.666] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0178.668] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.668] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.668] GetProcessHeap () returned 0x4e0000 [0178.668] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0178.668] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0178.668] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.668] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0178.668] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0178.668] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0178.668] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0178.668] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0178.668] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0178.668] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.669] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.669] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.669] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3c4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3c4, lpOverlapped=0x0) returned 1 [0178.669] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3d0) returned 1 [0178.669] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.669] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3d0, lpOverlapped=0x0) returned 1 [0178.669] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.669] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.669] SetEndOfFile (hFile=0xdc) returned 1 [0178.672] GetProcessHeap () returned 0x4e0000 [0178.672] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0178.672] GetProcessHeap () returned 0x4e0000 [0178.672] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0178.672] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\concourse.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\concourse.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0178.674] CloseHandle (hObject=0xdc) returned 1 [0178.674] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12c23400, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x12c23400, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c2, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Couture.xml", cAlternateFileName="")) returned 1 [0178.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\couture.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0178.676] GetProcessHeap () returned 0x4e0000 [0178.676] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0178.676] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0178.676] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0178.676] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0178.678] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.678] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.678] GetProcessHeap () returned 0x4e0000 [0178.678] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0178.678] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0178.678] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.678] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0178.678] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0178.678] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0178.679] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0178.679] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0178.679] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0178.679] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.679] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.679] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.679] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3c2, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3c2, lpOverlapped=0x0) returned 1 [0178.679] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3d0) returned 1 [0178.679] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.679] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3d0, lpOverlapped=0x0) returned 1 [0178.679] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.680] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.680] SetEndOfFile (hFile=0xdc) returned 1 [0178.682] GetProcessHeap () returned 0x4e0000 [0178.683] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0178.683] GetProcessHeap () returned 0x4e0000 [0178.683] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0178.683] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\couture.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\couture.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0178.684] CloseHandle (hObject=0xdc) returned 1 [0178.685] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15248e00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15248e00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c4, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Elemental.xml", cAlternateFileName="ELEMEN~1.XML")) returned 1 [0178.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\elemental.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0178.686] GetProcessHeap () returned 0x4e0000 [0178.686] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0178.686] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0178.686] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0178.686] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0178.688] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.688] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.688] GetProcessHeap () returned 0x4e0000 [0178.688] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0178.688] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0178.688] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.688] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0178.688] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0178.689] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0178.689] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0178.689] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0178.689] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0178.689] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.689] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.689] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.689] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3c4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3c4, lpOverlapped=0x0) returned 1 [0178.689] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3d0) returned 1 [0178.689] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.689] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3d0, lpOverlapped=0x0) returned 1 [0178.689] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.689] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.689] SetEndOfFile (hFile=0xdc) returned 1 [0178.692] GetProcessHeap () returned 0x4e0000 [0178.692] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0178.692] GetProcessHeap () returned 0x4e0000 [0178.692] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0178.692] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\elemental.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\elemental.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0178.694] CloseHandle (hObject=0xdc) returned 1 [0178.694] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0301b00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf0301b00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Equity.xml", cAlternateFileName="")) returned 1 [0178.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\equity.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0178.695] GetProcessHeap () returned 0x4e0000 [0178.695] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0178.695] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0178.695] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0178.695] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xf, lpOverlapped=0x0) returned 1 [0178.698] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.698] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.698] GetProcessHeap () returned 0x4e0000 [0178.698] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0178.698] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0178.698] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.698] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0178.699] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0178.699] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0178.699] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0178.699] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0178.699] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0178.699] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.699] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.699] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.700] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3c1, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3c1, lpOverlapped=0x0) returned 1 [0178.700] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3d0) returned 1 [0178.700] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.700] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3d0, lpOverlapped=0x0) returned 1 [0178.701] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.701] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.701] SetEndOfFile (hFile=0xdc) returned 1 [0178.703] GetProcessHeap () returned 0x4e0000 [0178.703] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0178.703] GetProcessHeap () returned 0x4e0000 [0178.703] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0178.703] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\equity.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\equity.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0178.707] CloseHandle (hObject=0xdc) returned 1 [0178.708] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4741800, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4741800, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3a0, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Essential.xml", cAlternateFileName="ESSENT~1.XML")) returned 1 [0178.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\essential.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0178.709] GetProcessHeap () returned 0x4e0000 [0178.709] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0178.709] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0178.709] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0178.709] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.709] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.709] GetProcessHeap () returned 0x4e0000 [0178.709] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0178.709] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0178.709] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.709] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0178.711] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0178.711] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0178.711] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0178.712] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0178.712] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0178.712] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.712] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.712] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.712] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3a0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3a0, lpOverlapped=0x0) returned 1 [0178.712] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3a0, dwBufLen=0x3a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3a0) returned 1 [0178.712] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.712] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3a0, lpOverlapped=0x0) returned 1 [0178.712] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.712] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.712] SetEndOfFile (hFile=0xdc) returned 1 [0178.715] GetProcessHeap () returned 0x4e0000 [0178.715] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0178.715] GetProcessHeap () returned 0x4e0000 [0178.715] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0178.715] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\essential.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\essential.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0178.717] CloseHandle (hObject=0xdc) returned 1 [0178.717] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1655bb00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1655bb00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c4, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Executive.xml", cAlternateFileName="EXECUT~1.XML")) returned 1 [0178.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\executive.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0178.718] GetProcessHeap () returned 0x4e0000 [0178.718] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0178.718] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0178.718] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0178.718] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0178.720] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.720] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.720] GetProcessHeap () returned 0x4e0000 [0178.720] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0178.720] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0178.721] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.721] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0178.721] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0178.721] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0178.721] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0178.721] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0178.721] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0178.721] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.721] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.721] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.721] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3c4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3c4, lpOverlapped=0x0) returned 1 [0178.721] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3d0) returned 1 [0178.721] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.721] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3d0, lpOverlapped=0x0) returned 1 [0178.722] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.722] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.722] SetEndOfFile (hFile=0xdc) returned 1 [0178.724] GetProcessHeap () returned 0x4e0000 [0178.724] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0178.724] GetProcessHeap () returned 0x4e0000 [0178.724] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0178.724] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\executive.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\executive.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0178.727] CloseHandle (hObject=0xdc) returned 1 [0178.727] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2927500, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2927500, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3bf, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Flow.xml", cAlternateFileName="")) returned 1 [0178.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\flow.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0178.728] GetProcessHeap () returned 0x4e0000 [0178.728] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0178.728] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0178.728] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0178.728] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x1, lpOverlapped=0x0) returned 1 [0178.815] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.815] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.815] GetProcessHeap () returned 0x4e0000 [0178.815] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0178.815] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0178.815] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.815] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0178.815] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0178.815] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0178.815] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0178.816] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0178.816] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0178.816] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.816] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.816] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.816] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3bf, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3bf, lpOverlapped=0x0) returned 1 [0178.816] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3c0, dwBufLen=0x3c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3c0) returned 1 [0178.816] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.816] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3c0, lpOverlapped=0x0) returned 1 [0178.816] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.816] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x484, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.816] SetEndOfFile (hFile=0xdc) returned 1 [0178.818] GetProcessHeap () returned 0x4e0000 [0178.818] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0178.818] GetProcessHeap () returned 0x4e0000 [0178.818] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0178.818] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\flow.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\flow.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0178.820] CloseHandle (hObject=0xdc) returned 1 [0178.820] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1614800, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf1614800, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c2, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Foundry.xml", cAlternateFileName="")) returned 1 [0178.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\foundry.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0178.821] GetProcessHeap () returned 0x4e0000 [0178.821] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0178.821] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0178.822] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0178.822] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0178.823] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.823] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.823] GetProcessHeap () returned 0x4e0000 [0178.824] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0178.824] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0178.824] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.824] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0178.824] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0178.824] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0178.824] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0178.824] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0178.824] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0178.824] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.824] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.824] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.824] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3c2, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3c2, lpOverlapped=0x0) returned 1 [0178.824] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3d0) returned 1 [0178.824] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.824] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3d0, lpOverlapped=0x0) returned 1 [0178.824] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.824] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.824] SetEndOfFile (hFile=0xdc) returned 1 [0178.827] GetProcessHeap () returned 0x4e0000 [0178.827] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0178.827] GetProcessHeap () returned 0x4e0000 [0178.827] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0178.827] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\foundry.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\foundry.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0178.828] CloseHandle (hObject=0xdc) returned 1 [0178.828] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99314000, ftCreationTime.dwHighDateTime=0x1c6ba8b, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99314000, ftLastWriteTime.dwHighDateTime=0x1c6ba8b, nFileSizeHigh=0x0, nFileSizeLow=0x3a0, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Grayscale.xml", cAlternateFileName="GRAYSC~1.XML")) returned 1 [0178.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grayscale.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0178.830] GetProcessHeap () returned 0x4e0000 [0178.830] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0178.830] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0178.830] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0178.830] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.830] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.830] GetProcessHeap () returned 0x4e0000 [0178.830] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0178.830] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0178.830] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.830] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0178.832] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0178.832] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0178.832] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0178.832] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0178.832] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0178.832] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.832] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.832] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.832] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3a0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3a0, lpOverlapped=0x0) returned 1 [0178.832] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3a0, dwBufLen=0x3a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3a0) returned 1 [0178.832] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.832] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3a0, lpOverlapped=0x0) returned 1 [0178.832] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.832] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.832] SetEndOfFile (hFile=0xdc) returned 1 [0178.834] GetProcessHeap () returned 0x4e0000 [0178.834] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0178.834] GetProcessHeap () returned 0x4e0000 [0178.835] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0178.835] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grayscale.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grayscale.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0178.836] CloseHandle (hObject=0xdc) returned 1 [0178.836] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a54500, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a54500, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3bf, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Grid.xml", cAlternateFileName="")) returned 1 [0178.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grid.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0178.837] GetProcessHeap () returned 0x4e0000 [0178.837] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0178.837] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0178.837] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0178.837] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x1, lpOverlapped=0x0) returned 1 [0178.839] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.839] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.839] GetProcessHeap () returned 0x4e0000 [0178.839] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0178.839] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0178.839] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.839] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0178.839] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0178.839] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0178.839] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0178.839] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0178.839] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0178.839] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.839] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.840] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.840] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3bf, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3bf, lpOverlapped=0x0) returned 1 [0178.840] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3c0, dwBufLen=0x3c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3c0) returned 1 [0178.840] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.840] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3c0, lpOverlapped=0x0) returned 1 [0178.840] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.840] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x484, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.840] SetEndOfFile (hFile=0xdc) returned 1 [0178.842] GetProcessHeap () returned 0x4e0000 [0178.842] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0178.842] GetProcessHeap () returned 0x4e0000 [0178.842] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0178.842] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grid.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grid.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0178.843] CloseHandle (hObject=0xdc) returned 1 [0178.843] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d67200, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d67200, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c4, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Hardcover.xml", cAlternateFileName="HARDCO~1.XML")) returned 1 [0178.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\hardcover.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0178.844] GetProcessHeap () returned 0x4e0000 [0178.844] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0178.844] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0178.844] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0178.844] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0178.846] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.846] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.846] GetProcessHeap () returned 0x4e0000 [0178.846] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0178.846] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0178.846] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.846] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0178.846] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0178.846] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0178.846] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0178.846] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0178.846] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0178.846] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.846] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.846] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.846] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3c4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3c4, lpOverlapped=0x0) returned 1 [0178.846] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3d0) returned 1 [0178.846] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.846] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3d0, lpOverlapped=0x0) returned 1 [0178.847] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.847] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.847] SetEndOfFile (hFile=0xdc) returned 1 [0178.849] GetProcessHeap () returned 0x4e0000 [0178.849] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0178.849] GetProcessHeap () returned 0x4e0000 [0178.849] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0178.849] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\hardcover.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\hardcover.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0178.850] CloseHandle (hObject=0xdc) returned 1 [0178.850] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1786e800, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1786e800, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x39e, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Horizon.xml", cAlternateFileName="")) returned 1 [0178.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\horizon.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0178.851] GetProcessHeap () returned 0x4e0000 [0178.851] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0178.851] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0178.851] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0178.851] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0178.853] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.853] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.853] GetProcessHeap () returned 0x4e0000 [0178.853] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0178.853] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0178.853] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.854] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0178.854] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0178.854] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0178.854] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0178.854] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0178.854] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0178.854] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.854] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.854] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.854] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x39e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x39e, lpOverlapped=0x0) returned 1 [0178.854] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3a0, dwBufLen=0x3a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3a0) returned 1 [0178.854] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.854] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3a0, lpOverlapped=0x0) returned 1 [0178.854] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.854] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.854] SetEndOfFile (hFile=0xdc) returned 1 [0178.856] GetProcessHeap () returned 0x4e0000 [0178.857] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0178.857] GetProcessHeap () returned 0x4e0000 [0178.857] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0178.857] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\horizon.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\horizon.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0178.858] CloseHandle (hObject=0xdc) returned 1 [0178.858] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3c3a200, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3c3a200, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Median.xml", cAlternateFileName="")) returned 1 [0178.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Median.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\median.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0178.859] GetProcessHeap () returned 0x4e0000 [0178.859] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0178.859] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0178.859] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0178.859] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xf, lpOverlapped=0x0) returned 1 [0178.861] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.861] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.861] GetProcessHeap () returned 0x4e0000 [0178.861] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0178.861] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0178.861] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.861] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0178.861] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0178.861] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0178.861] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0178.862] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0178.862] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0178.862] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.862] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.862] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.862] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3c1, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3c1, lpOverlapped=0x0) returned 1 [0178.862] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3d0) returned 1 [0178.862] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.862] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3d0, lpOverlapped=0x0) returned 1 [0178.862] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.862] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.862] SetEndOfFile (hFile=0xdc) returned 1 [0178.864] GetProcessHeap () returned 0x4e0000 [0178.865] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0178.865] GetProcessHeap () returned 0x4e0000 [0178.865] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0178.865] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Median.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\median.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Median.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\median.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0178.866] CloseHandle (hObject=0xdc) returned 1 [0178.866] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4f4cf00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4f4cf00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Metro.xml", cAlternateFileName="")) returned 1 [0178.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\metro.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0178.867] GetProcessHeap () returned 0x4e0000 [0178.867] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0178.867] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0178.867] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0178.867] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.867] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.867] GetProcessHeap () returned 0x4e0000 [0178.867] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0178.867] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0178.867] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.867] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0178.869] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0178.869] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0178.869] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0178.870] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0178.870] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0178.870] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.870] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.870] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.870] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3c0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3c0, lpOverlapped=0x0) returned 1 [0178.870] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3c0, dwBufLen=0x3c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3c0) returned 1 [0178.870] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.870] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3c0, lpOverlapped=0x0) returned 1 [0178.870] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.870] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x484, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.870] SetEndOfFile (hFile=0xdc) returned 1 [0178.872] GetProcessHeap () returned 0x4e0000 [0178.872] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0178.872] GetProcessHeap () returned 0x4e0000 [0178.872] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0178.872] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\metro.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\metro.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0178.874] CloseHandle (hObject=0xdc) returned 1 [0178.874] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf625fc00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf625fc00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Module.xml", cAlternateFileName="")) returned 1 [0178.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\module.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0178.875] GetProcessHeap () returned 0x4e0000 [0178.875] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0178.875] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0178.875] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0178.876] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xf, lpOverlapped=0x0) returned 1 [0178.877] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.877] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.877] GetProcessHeap () returned 0x4e0000 [0178.877] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0178.877] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0178.877] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.877] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0178.878] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0178.878] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0178.878] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0178.878] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0178.878] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0178.878] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.878] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.878] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.878] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3c1, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3c1, lpOverlapped=0x0) returned 1 [0178.878] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3d0) returned 1 [0178.878] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.878] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3d0, lpOverlapped=0x0) returned 1 [0178.878] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.878] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.878] SetEndOfFile (hFile=0xdc) returned 1 [0178.880] GetProcessHeap () returned 0x4e0000 [0178.880] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0178.880] GetProcessHeap () returned 0x4e0000 [0178.880] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0178.880] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\module.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\module.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0178.884] CloseHandle (hObject=0xdc) returned 1 [0178.884] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18b81500, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18b81500, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c4, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Newsprint.xml", cAlternateFileName="NEWSPR~1.XML")) returned 1 [0178.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\newsprint.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0178.885] GetProcessHeap () returned 0x4e0000 [0178.885] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0178.885] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0178.885] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0178.885] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0178.887] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.887] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.887] GetProcessHeap () returned 0x4e0000 [0178.887] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0178.887] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0178.887] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.887] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0178.887] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0178.887] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0178.887] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0178.887] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0178.887] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0178.887] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.887] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.887] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.887] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3c4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3c4, lpOverlapped=0x0) returned 1 [0178.887] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3d0) returned 1 [0178.888] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.888] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3d0, lpOverlapped=0x0) returned 1 [0178.888] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.888] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.888] SetEndOfFile (hFile=0xdc) returned 1 [0178.890] GetProcessHeap () returned 0x4e0000 [0178.890] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0178.890] GetProcessHeap () returned 0x4e0000 [0178.890] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0178.890] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\newsprint.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\newsprint.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0178.892] CloseHandle (hObject=0xdc) returned 1 [0178.892] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7572900, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7572900, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c2, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Opulent.xml", cAlternateFileName="")) returned 1 [0178.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\opulent.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0178.893] GetProcessHeap () returned 0x4e0000 [0178.893] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0178.893] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0178.893] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0178.893] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0178.895] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.895] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.895] GetProcessHeap () returned 0x4e0000 [0178.895] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0178.895] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0178.895] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.895] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0178.895] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0178.895] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0178.895] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0178.895] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0178.895] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0178.895] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.895] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.895] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.895] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3c2, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3c2, lpOverlapped=0x0) returned 1 [0178.895] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3d0) returned 1 [0178.895] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.895] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3d0, lpOverlapped=0x0) returned 1 [0178.896] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.896] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.896] SetEndOfFile (hFile=0xdc) returned 1 [0178.898] GetProcessHeap () returned 0x4e0000 [0178.898] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0178.898] GetProcessHeap () returned 0x4e0000 [0178.898] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0178.898] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\opulent.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\opulent.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0178.900] CloseHandle (hObject=0xdc) returned 1 [0178.900] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8885600, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf8885600, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Oriel.xml", cAlternateFileName="")) returned 1 [0178.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\oriel.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0178.901] GetProcessHeap () returned 0x4e0000 [0178.901] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0178.901] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0178.901] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0178.901] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.901] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.901] GetProcessHeap () returned 0x4e0000 [0178.901] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0178.901] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0178.901] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.901] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0178.903] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0178.903] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0178.903] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0178.904] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0178.904] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0178.904] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.904] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.904] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.904] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3c0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3c0, lpOverlapped=0x0) returned 1 [0178.904] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3c0, dwBufLen=0x3c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3c0) returned 1 [0178.904] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.904] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3c0, lpOverlapped=0x0) returned 1 [0178.904] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.904] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x484, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.904] SetEndOfFile (hFile=0xdc) returned 1 [0178.906] GetProcessHeap () returned 0x4e0000 [0178.906] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0178.906] GetProcessHeap () returned 0x4e0000 [0178.906] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0178.906] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\oriel.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\oriel.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0178.908] CloseHandle (hObject=0xdc) returned 1 [0178.908] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8885600, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf8885600, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Origin.xml", cAlternateFileName="")) returned 1 [0178.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\origin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0178.909] GetProcessHeap () returned 0x4e0000 [0178.909] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0178.909] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0178.909] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0178.910] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xf, lpOverlapped=0x0) returned 1 [0178.911] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.911] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.911] GetProcessHeap () returned 0x4e0000 [0178.911] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0178.911] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0178.911] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.911] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0178.911] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0178.911] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0178.912] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0178.912] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0178.912] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0178.912] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.912] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.912] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.912] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3c1, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3c1, lpOverlapped=0x0) returned 1 [0178.912] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3d0) returned 1 [0178.912] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.912] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3d0, lpOverlapped=0x0) returned 1 [0178.912] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.912] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.912] SetEndOfFile (hFile=0xdc) returned 1 [0178.914] GetProcessHeap () returned 0x4e0000 [0178.914] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0178.914] GetProcessHeap () returned 0x4e0000 [0178.914] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0178.914] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\origin.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\origin.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0178.916] CloseHandle (hObject=0xdc) returned 1 [0178.916] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9b98300, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9b98300, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Paper.xml", cAlternateFileName="")) returned 1 [0178.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\paper.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0178.916] GetProcessHeap () returned 0x4e0000 [0178.917] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0178.917] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0178.917] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0178.917] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.917] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.917] GetProcessHeap () returned 0x4e0000 [0178.917] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0178.917] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0178.917] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.917] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0178.919] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0178.919] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0178.919] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0178.919] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0178.919] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0178.919] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.919] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.919] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.919] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3c0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3c0, lpOverlapped=0x0) returned 1 [0178.919] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3c0, dwBufLen=0x3c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3c0) returned 1 [0178.919] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.919] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3c0, lpOverlapped=0x0) returned 1 [0178.919] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.919] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x484, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.919] SetEndOfFile (hFile=0xdc) returned 1 [0178.921] GetProcessHeap () returned 0x4e0000 [0178.921] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0178.921] GetProcessHeap () returned 0x4e0000 [0178.921] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0178.922] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\paper.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\paper.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0178.923] CloseHandle (hObject=0xdc) returned 1 [0178.923] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8079f00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8079f00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c6, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Perspective.xml", cAlternateFileName="PERSPE~1.XML")) returned 1 [0178.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\perspective.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0178.923] GetProcessHeap () returned 0x4e0000 [0178.923] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0178.923] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0178.923] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0178.924] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0178.926] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.926] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.926] GetProcessHeap () returned 0x4e0000 [0178.926] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0178.926] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0178.926] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.926] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0178.926] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0178.926] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0178.926] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0178.926] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0178.926] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0178.926] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.926] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.926] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.926] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3c6, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3c6, lpOverlapped=0x0) returned 1 [0178.926] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3d0) returned 1 [0178.926] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.926] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3d0, lpOverlapped=0x0) returned 1 [0178.927] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.927] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.927] SetEndOfFile (hFile=0xdc) returned 1 [0178.929] GetProcessHeap () returned 0x4e0000 [0178.929] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0178.929] GetProcessHeap () returned 0x4e0000 [0178.929] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0178.929] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\perspective.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\perspective.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0178.930] CloseHandle (hObject=0xdc) returned 1 [0178.930] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x938cc00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x938cc00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c2, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Pushpin.xml", cAlternateFileName="")) returned 1 [0178.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\pushpin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0178.931] GetProcessHeap () returned 0x4e0000 [0178.931] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0178.931] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0178.931] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0178.931] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0178.934] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.934] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.934] GetProcessHeap () returned 0x4e0000 [0178.934] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0178.934] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0178.934] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.934] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0178.934] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0178.934] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0178.934] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0178.934] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0178.934] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0178.934] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.934] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.935] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.935] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3c2, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3c2, lpOverlapped=0x0) returned 1 [0178.935] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3d0) returned 1 [0178.935] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.935] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3d0, lpOverlapped=0x0) returned 1 [0178.935] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.935] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.935] SetEndOfFile (hFile=0xdc) returned 1 [0178.937] GetProcessHeap () returned 0x4e0000 [0178.937] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0178.937] GetProcessHeap () returned 0x4e0000 [0178.937] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0178.937] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\pushpin.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\pushpin.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0178.938] CloseHandle (hObject=0xdc) returned 1 [0178.938] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19e94200, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19e94200, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c5, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Slipstream.xml", cAlternateFileName="SLIPST~1.XML")) returned 1 [0178.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\slipstream.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0178.939] GetProcessHeap () returned 0x4e0000 [0178.939] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0178.939] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0178.939] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0178.939] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xb, lpOverlapped=0x0) returned 1 [0178.941] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.941] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.941] GetProcessHeap () returned 0x4e0000 [0178.941] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0178.942] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0178.942] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.942] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0178.942] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0178.942] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0178.942] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0178.942] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0178.942] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0178.942] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.942] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.942] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.942] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3c5, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3c5, lpOverlapped=0x0) returned 1 [0178.942] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3d0) returned 1 [0178.942] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.942] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3d0, lpOverlapped=0x0) returned 1 [0178.942] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.942] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.942] SetEndOfFile (hFile=0xdc) returned 1 [0178.944] GetProcessHeap () returned 0x4e0000 [0178.944] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0178.945] GetProcessHeap () returned 0x4e0000 [0178.945] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0178.945] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\slipstream.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\slipstream.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0178.946] CloseHandle (hObject=0xdc) returned 1 [0178.946] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaeab000, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfaeab000, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c3, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Solstice.xml", cAlternateFileName="")) returned 1 [0178.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\solstice.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0178.947] GetProcessHeap () returned 0x4e0000 [0178.947] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0178.947] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0178.947] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0178.947] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xd, lpOverlapped=0x0) returned 1 [0178.949] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.949] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.949] GetProcessHeap () returned 0x4e0000 [0178.949] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0178.949] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0178.949] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.949] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0178.949] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0178.949] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0178.949] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0178.949] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0178.949] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0178.949] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.949] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.949] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.949] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3c3, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3c3, lpOverlapped=0x0) returned 1 [0178.950] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3d0) returned 1 [0178.950] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.950] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3d0, lpOverlapped=0x0) returned 1 [0178.950] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.950] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.950] SetEndOfFile (hFile=0xdc) returned 1 [0178.952] GetProcessHeap () returned 0x4e0000 [0178.952] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0178.952] GetProcessHeap () returned 0x4e0000 [0178.952] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0178.952] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\solstice.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\solstice.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0178.953] CloseHandle (hObject=0xdc) returned 1 [0178.953] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc1bdd00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc1bdd00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c2, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Technic.xml", cAlternateFileName="")) returned 1 [0178.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Technic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\technic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0178.955] GetProcessHeap () returned 0x4e0000 [0178.955] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0178.955] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0178.955] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0178.955] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0178.956] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.957] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.957] GetProcessHeap () returned 0x4e0000 [0178.957] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0178.957] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0178.957] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.957] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0178.957] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0178.957] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0178.957] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0178.957] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0178.957] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0178.957] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.957] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.957] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.957] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3c2, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3c2, lpOverlapped=0x0) returned 1 [0178.957] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3d0) returned 1 [0178.957] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.957] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3d0, lpOverlapped=0x0) returned 1 [0178.957] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.957] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.958] SetEndOfFile (hFile=0xdc) returned 1 [0178.960] GetProcessHeap () returned 0x4e0000 [0178.960] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0178.960] GetProcessHeap () returned 0x4e0000 [0178.960] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0178.960] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Technic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\technic.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Technic.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\technic.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0178.961] CloseHandle (hObject=0xdc) returned 1 [0178.961] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa69f900, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa69f900, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Thatch.xml", cAlternateFileName="")) returned 1 [0178.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Thatch.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\thatch.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0178.962] GetProcessHeap () returned 0x4e0000 [0178.962] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0178.962] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0178.962] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0178.962] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xf, lpOverlapped=0x0) returned 1 [0178.964] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.964] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.964] GetProcessHeap () returned 0x4e0000 [0178.964] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0178.964] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0178.964] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.964] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0178.964] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0178.964] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0178.964] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0178.964] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0178.964] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0178.964] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.964] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.964] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.964] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3c1, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3c1, lpOverlapped=0x0) returned 1 [0178.964] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3d0) returned 1 [0178.964] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.964] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3d0, lpOverlapped=0x0) returned 1 [0178.965] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.965] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.965] SetEndOfFile (hFile=0xdc) returned 1 [0178.967] GetProcessHeap () returned 0x4e0000 [0178.967] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0178.967] GetProcessHeap () returned 0x4e0000 [0178.967] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0178.967] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Thatch.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\thatch.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Thatch.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\thatch.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0178.968] CloseHandle (hObject=0xdc) returned 1 [0178.968] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd4d0a00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd4d0a00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3bf, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Trek.xml", cAlternateFileName="")) returned 1 [0178.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Trek.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\trek.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0178.969] GetProcessHeap () returned 0x4e0000 [0178.969] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0178.969] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0178.969] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0178.969] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x1, lpOverlapped=0x0) returned 1 [0178.971] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.971] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.971] GetProcessHeap () returned 0x4e0000 [0178.971] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0178.971] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0178.971] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.971] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0178.971] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0178.971] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0178.971] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0178.971] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0178.971] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0178.971] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.971] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.971] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.972] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3bf, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3bf, lpOverlapped=0x0) returned 1 [0178.972] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3c0, dwBufLen=0x3c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3c0) returned 1 [0178.972] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.972] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3c0, lpOverlapped=0x0) returned 1 [0178.972] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.972] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x484, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.972] SetEndOfFile (hFile=0xdc) returned 1 [0178.974] GetProcessHeap () returned 0x4e0000 [0178.974] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0178.974] GetProcessHeap () returned 0x4e0000 [0178.974] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0178.974] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Trek.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\trek.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Trek.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\trek.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0178.979] CloseHandle (hObject=0xdc) returned 1 [0178.979] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe7e3700, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe7e3700, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Urban.xml", cAlternateFileName="")) returned 1 [0178.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Urban.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\urban.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0178.980] GetProcessHeap () returned 0x4e0000 [0178.980] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0178.980] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0178.980] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0178.980] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.980] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.980] GetProcessHeap () returned 0x4e0000 [0178.980] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0178.980] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0178.980] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.980] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0178.982] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0178.982] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0178.982] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0178.982] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0178.982] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0178.983] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.983] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.983] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.983] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3c0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3c0, lpOverlapped=0x0) returned 1 [0178.983] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3c0, dwBufLen=0x3c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3c0) returned 1 [0178.983] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.983] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3c0, lpOverlapped=0x0) returned 1 [0178.983] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.983] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x484, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.983] SetEndOfFile (hFile=0xdc) returned 1 [0178.985] GetProcessHeap () returned 0x4e0000 [0178.985] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0178.985] GetProcessHeap () returned 0x4e0000 [0178.985] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0178.985] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Urban.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\urban.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Urban.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\urban.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0178.986] CloseHandle (hObject=0xdc) returned 1 [0178.986] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffaf6400, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xffaf6400, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Verve.xml", cAlternateFileName="")) returned 1 [0178.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Verve.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\verve.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0178.988] GetProcessHeap () returned 0x4e0000 [0178.988] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0178.988] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0178.988] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0178.988] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.988] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.988] GetProcessHeap () returned 0x4e0000 [0178.988] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0178.988] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0178.988] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.988] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0178.990] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0178.990] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0178.990] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0178.990] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0178.990] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0178.990] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.990] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.990] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.991] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3c0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3c0, lpOverlapped=0x0) returned 1 [0178.991] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3c0, dwBufLen=0x3c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3c0) returned 1 [0178.991] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.991] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3c0, lpOverlapped=0x0) returned 1 [0178.991] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.991] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x484, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.991] SetEndOfFile (hFile=0xdc) returned 1 [0178.993] GetProcessHeap () returned 0x4e0000 [0178.993] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0178.993] GetProcessHeap () returned 0x4e0000 [0178.993] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0178.993] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Verve.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\verve.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Verve.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\verve.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0178.994] CloseHandle (hObject=0xdc) returned 1 [0178.994] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9b2600, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9b2600, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c3, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Waveform.xml", cAlternateFileName="")) returned 1 [0178.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Waveform.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\waveform.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0178.995] GetProcessHeap () returned 0x4e0000 [0178.995] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0178.995] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0178.995] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0178.995] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xd, lpOverlapped=0x0) returned 1 [0178.997] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.997] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.997] GetProcessHeap () returned 0x4e0000 [0178.997] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0178.997] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0178.997] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.997] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0178.997] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0178.997] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0178.997] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0178.998] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0178.998] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0178.998] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0178.998] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0178.998] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.998] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3c3, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3c3, lpOverlapped=0x0) returned 1 [0178.998] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3d0) returned 1 [0178.998] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.998] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3d0, lpOverlapped=0x0) returned 1 [0178.998] CryptDestroyKey (hKey=0x522f98) returned 1 [0178.998] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.998] SetEndOfFile (hFile=0xdc) returned 1 [0179.000] GetProcessHeap () returned 0x4e0000 [0179.000] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0179.000] GetProcessHeap () returned 0x4e0000 [0179.000] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0179.001] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Waveform.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\waveform.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Waveform.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\waveform.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0179.002] CloseHandle (hObject=0xdc) returned 1 [0179.002] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9b2600, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9b2600, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c3, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Waveform.xml", cAlternateFileName="")) returned 0 [0179.002] GetProcessHeap () returned 0x4e0000 [0179.002] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0179.002] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df248, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f98) returned 1 [0179.002] CryptDecrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df2b0 | out: pbData=0x4f53d8, pdwDataLen=0x24df2b0) returned 1 [0179.002] CryptDestroyKey (hKey=0x522f98) returned 1 [0179.002] GetProcessHeap () returned 0x4e0000 [0179.002] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0179.002] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df248, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f98) returned 1 [0179.002] CryptDecrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df2b0 | out: pbData=0x4f5420, pdwDataLen=0x24df2b0) returned 1 [0179.002] CryptDestroyKey (hKey=0x522f98) returned 1 [0179.003] GetProcessHeap () returned 0x4e0000 [0179.003] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x522768 [0179.003] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df248, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f98) returned 1 [0179.003] CryptDecrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x522768, pdwDataLen=0x24df2b0 | out: pbData=0x522768, pdwDataLen=0x24df2b0) returned 1 [0179.003] CryptDestroyKey (hKey=0x522f98) returned 1 [0179.003] wsprintfW (in: param_1=0x24de28c, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\readme-warning.txt") returned 84 [0179.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\readme-warning.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0179.004] WriteFile (in: hFile=0xdc, lpBuffer=0x522768*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24de288, lpOverlapped=0x0 | out: lpBuffer=0x522768*, lpNumberOfBytesWritten=0x24de288*=0x6c3, lpOverlapped=0x0) returned 1 [0179.005] CloseHandle (hObject=0xdc) returned 1 [0179.015] GetProcessHeap () returned 0x4e0000 [0179.015] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x522768 | out: hHeap=0x4e0000) returned 1 [0179.015] GetProcessHeap () returned 0x4e0000 [0179.015] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0179.015] GetProcessHeap () returned 0x4e0000 [0179.015] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0179.015] FindClose (in: hFindFile=0x522f58 | out: hFindFile=0x522f58) returned 1 [0179.015] GetProcessHeap () returned 0x4e0000 [0179.015] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x541088 | out: hHeap=0x4e0000) returned 1 [0179.015] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5caf100, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Theme Effects", cAlternateFileName="THEMEE~1")) returned 1 [0179.015] GetProcessHeap () returned 0x4e0000 [0179.015] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x96) returned 0x4fa058 [0179.015] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5caf100, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName=".", cAlternateFileName="")) returned 0x522f58 [0179.017] GetProcessHeap () returned 0x4e0000 [0179.017] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0179.017] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5caf100, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="..", cAlternateFileName="")) returned 1 [0179.019] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61c8a500, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe591d000, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x61c8a500, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x5261, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Adjacency.eftx", cAlternateFileName="ADJACE~1.EFT")) returned 1 [0179.019] GetProcessHeap () returned 0x4e0000 [0179.020] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x298) returned 0x541088 [0179.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0179.022] GetProcessHeap () returned 0x4e0000 [0179.022] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0179.022] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0179.022] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0179.022] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xf, lpOverlapped=0x0) returned 1 [0179.024] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0179.024] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0179.024] GetProcessHeap () returned 0x4e0000 [0179.024] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0179.024] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0179.024] CryptDestroyKey (hKey=0x522f98) returned 1 [0179.024] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0179.024] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0179.025] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0179.025] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0179.025] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0179.025] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0179.025] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0179.025] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0179.025] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.025] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5261, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x5261, lpOverlapped=0x0) returned 1 [0179.026] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5270, dwBufLen=0x5270 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5270) returned 1 [0179.026] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.026] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5270, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5270, lpOverlapped=0x0) returned 1 [0179.027] CryptDestroyKey (hKey=0x522f98) returned 1 [0179.027] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5344, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.027] SetEndOfFile (hFile=0xdc) returned 1 [0179.029] GetProcessHeap () returned 0x4e0000 [0179.029] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0179.029] GetProcessHeap () returned 0x4e0000 [0179.029] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0179.029] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0179.031] CloseHandle (hObject=0xdc) returned 1 [0179.031] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x655c2c00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5943160, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x655c2c00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x6ae5, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Angles.eftx", cAlternateFileName="ANGLES~1.EFT")) returned 1 [0179.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0179.032] GetProcessHeap () returned 0x4e0000 [0179.032] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0179.032] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0179.032] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0179.032] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xb, lpOverlapped=0x0) returned 1 [0179.034] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0179.034] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0179.034] GetProcessHeap () returned 0x4e0000 [0179.035] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0179.035] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0179.035] CryptDestroyKey (hKey=0x522f98) returned 1 [0179.035] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0179.035] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0179.035] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0179.035] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0179.035] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0179.035] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0179.035] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0179.035] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0179.035] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.035] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x6ae5, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x6ae5, lpOverlapped=0x0) returned 1 [0179.038] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6af0, dwBufLen=0x6af0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6af0) returned 1 [0179.038] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.038] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6af0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x6af0, lpOverlapped=0x0) returned 1 [0179.038] CryptDestroyKey (hKey=0x522f98) returned 1 [0179.039] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6bc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.039] SetEndOfFile (hFile=0xdc) returned 1 [0179.041] GetProcessHeap () returned 0x4e0000 [0179.041] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0179.041] GetProcessHeap () returned 0x4e0000 [0179.041] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0179.041] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0179.042] CloseHandle (hObject=0xdc) returned 1 [0179.043] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83b00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5943160, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x83b00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x354c6, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Apex.eftx", cAlternateFileName="APEX~1.EFT")) returned 1 [0179.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0179.044] GetProcessHeap () returned 0x4e0000 [0179.044] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0179.044] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0179.044] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0179.044] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0179.050] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0179.050] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0179.050] GetProcessHeap () returned 0x4e0000 [0179.050] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0179.050] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0179.050] CryptDestroyKey (hKey=0x522f98) returned 1 [0179.050] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0179.051] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0179.051] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0179.051] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0179.051] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0179.051] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0179.051] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0179.051] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0179.051] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.051] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x354c6, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x354c6, lpOverlapped=0x0) returned 1 [0179.164] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x354d0, dwBufLen=0x354d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x354d0) returned 1 [0179.166] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.166] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x354d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x354d0, lpOverlapped=0x0) returned 1 [0179.167] CryptDestroyKey (hKey=0x522f98) returned 1 [0179.167] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x35594, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.167] SetEndOfFile (hFile=0xdc) returned 1 [0179.171] GetProcessHeap () returned 0x4e0000 [0179.171] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0179.171] GetProcessHeap () returned 0x4e0000 [0179.171] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0179.171] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0179.173] CloseHandle (hObject=0xdc) returned 1 [0179.173] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f368c00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59692c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3f368c00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xbf81, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Apothecary.eftx", cAlternateFileName="APOTHE~1.EFT")) returned 1 [0179.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0179.175] GetProcessHeap () returned 0x4e0000 [0179.175] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0179.175] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0179.175] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0179.175] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xf, lpOverlapped=0x0) returned 1 [0179.179] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0179.179] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0179.179] GetProcessHeap () returned 0x4e0000 [0179.179] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0179.179] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0179.179] CryptDestroyKey (hKey=0x522f98) returned 1 [0179.179] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0179.179] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0179.179] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0179.179] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0179.180] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0179.180] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0179.180] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0179.180] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0179.180] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.180] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xbf81, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xbf81, lpOverlapped=0x0) returned 1 [0179.184] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xbf90, dwBufLen=0xbf90 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xbf90) returned 1 [0179.185] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.185] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xbf90, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xbf90, lpOverlapped=0x0) returned 1 [0179.185] CryptDestroyKey (hKey=0x522f98) returned 1 [0179.185] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xc064, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.185] SetEndOfFile (hFile=0xdc) returned 1 [0179.188] GetProcessHeap () returned 0x4e0000 [0179.188] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0179.188] GetProcessHeap () returned 0x4e0000 [0179.188] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0179.188] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0179.190] CloseHandle (hObject=0xdc) returned 1 [0179.190] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39bc200, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59692c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x39bc200, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x581a, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Aspect.eftx", cAlternateFileName="ASPECT~1.EFT")) returned 1 [0179.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0179.191] GetProcessHeap () returned 0x4e0000 [0179.191] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0179.191] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0179.191] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0179.191] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0179.212] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0179.212] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0179.212] GetProcessHeap () returned 0x4e0000 [0179.213] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0179.213] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0179.213] CryptDestroyKey (hKey=0x522f98) returned 1 [0179.213] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0179.213] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0179.213] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0179.213] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0179.213] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0179.213] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0179.214] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0179.214] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0179.214] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.214] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x581a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x581a, lpOverlapped=0x0) returned 1 [0179.409] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5820, dwBufLen=0x5820 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5820) returned 1 [0179.409] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.409] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5820, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5820, lpOverlapped=0x0) returned 1 [0179.410] CryptDestroyKey (hKey=0x522f98) returned 1 [0179.410] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x58f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.410] SetEndOfFile (hFile=0xdc) returned 1 [0179.412] GetProcessHeap () returned 0x4e0000 [0179.412] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0179.412] GetProcessHeap () returned 0x4e0000 [0179.412] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0179.412] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0179.414] CloseHandle (hObject=0xdc) returned 1 [0179.414] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42ca1300, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe598f420, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x42ca1300, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x696d, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Austin.eftx", cAlternateFileName="AUSTIN~1.EFT")) returned 1 [0179.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0179.416] GetProcessHeap () returned 0x4e0000 [0179.416] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0179.416] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0179.416] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0179.416] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x3, lpOverlapped=0x0) returned 1 [0179.453] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0179.453] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0179.453] GetProcessHeap () returned 0x4e0000 [0179.453] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0179.453] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0179.453] CryptDestroyKey (hKey=0x522f98) returned 1 [0179.453] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0179.453] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0179.454] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0179.454] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0179.454] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0179.454] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0179.454] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0179.454] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0179.454] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.454] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x696d, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x696d, lpOverlapped=0x0) returned 1 [0179.558] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6970, dwBufLen=0x6970 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6970) returned 1 [0179.559] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.559] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6970, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x6970, lpOverlapped=0x0) returned 1 [0179.559] CryptDestroyKey (hKey=0x522f98) returned 1 [0179.559] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6a44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.559] SetEndOfFile (hFile=0xdc) returned 1 [0179.561] GetProcessHeap () returned 0x4e0000 [0179.561] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0179.561] GetProcessHeap () returned 0x4e0000 [0179.561] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0179.561] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0179.563] CloseHandle (hObject=0xdc) returned 1 [0179.563] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68efb300, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe598f420, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x68efb300, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x96e87, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Black Tie.eftx", cAlternateFileName="BLACKT~1.EFT")) returned 1 [0179.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0179.564] GetProcessHeap () returned 0x4e0000 [0179.564] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0179.564] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0179.565] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0179.565] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x9, lpOverlapped=0x0) returned 1 [0179.585] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0179.585] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0179.585] GetProcessHeap () returned 0x4e0000 [0179.585] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0179.585] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0179.585] CryptDestroyKey (hKey=0x522f98) returned 1 [0179.585] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0179.585] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0179.585] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0179.585] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0179.586] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0179.586] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0179.586] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0179.586] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0179.586] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.586] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x96e87, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x96e87, lpOverlapped=0x0) returned 1 [0179.888] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x96e90, dwBufLen=0x96e90 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x96e90) returned 1 [0179.893] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.893] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x96e90, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x96e90, lpOverlapped=0x0) returned 1 [0179.895] CryptDestroyKey (hKey=0x522f98) returned 1 [0179.895] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x96f64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.895] SetEndOfFile (hFile=0xdc) returned 1 [0179.898] GetProcessHeap () returned 0x4e0000 [0179.898] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0179.898] GetProcessHeap () returned 0x4e0000 [0179.898] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0179.898] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0179.900] CloseHandle (hObject=0xdc) returned 1 [0179.900] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72f4900, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59b5580, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x72f4900, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xa7a5, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Civic.eftx", cAlternateFileName="CIVIC~1.EFT")) returned 1 [0179.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0179.901] GetProcessHeap () returned 0x4e0000 [0179.901] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0179.901] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0179.901] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0179.901] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xb, lpOverlapped=0x0) returned 1 [0179.907] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0179.907] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0179.907] GetProcessHeap () returned 0x4e0000 [0179.907] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0179.907] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0179.907] CryptDestroyKey (hKey=0x522f98) returned 1 [0179.907] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0179.907] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0179.907] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0179.907] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0179.907] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0179.907] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0179.907] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0179.908] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0179.908] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.908] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xa7a5, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xa7a5, lpOverlapped=0x0) returned 1 [0179.914] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa7b0, dwBufLen=0xa7b0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa7b0) returned 1 [0179.914] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.915] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xa7b0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xa7b0, lpOverlapped=0x0) returned 1 [0179.915] CryptDestroyKey (hKey=0x522f98) returned 1 [0179.915] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xa874, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.915] SetEndOfFile (hFile=0xdc) returned 1 [0179.918] GetProcessHeap () returned 0x4e0000 [0179.918] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0179.919] GetProcessHeap () returned 0x4e0000 [0179.919] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0179.919] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0179.921] CloseHandle (hObject=0xdc) returned 1 [0179.921] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x465d9a00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59db6e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x465d9a00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x8032, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Clarity.eftx", cAlternateFileName="CLARIT~1.EFT")) returned 1 [0179.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0179.922] GetProcessHeap () returned 0x4e0000 [0179.922] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0179.922] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0179.922] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0179.922] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0179.934] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0179.934] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0179.934] GetProcessHeap () returned 0x4e0000 [0179.934] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0179.934] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0179.934] CryptDestroyKey (hKey=0x522f98) returned 1 [0179.934] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0179.934] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0179.934] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0179.934] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0179.934] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0179.934] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0179.934] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0179.935] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0179.935] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.935] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x8032, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x8032, lpOverlapped=0x0) returned 1 [0179.970] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8040, dwBufLen=0x8040 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8040) returned 1 [0179.970] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.970] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x8040, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x8040, lpOverlapped=0x0) returned 1 [0179.971] CryptDestroyKey (hKey=0x522f98) returned 1 [0179.971] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x8114, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.971] SetEndOfFile (hFile=0xdc) returned 1 [0179.974] GetProcessHeap () returned 0x4e0000 [0179.974] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0179.974] GetProcessHeap () returned 0x4e0000 [0179.974] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0179.974] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0179.976] CloseHandle (hObject=0xdc) returned 1 [0179.976] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6db46700, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a01840, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6db46700, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x825e4, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Composite.eftx", cAlternateFileName="COMPOS~1.EFT")) returned 1 [0179.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0179.978] GetProcessHeap () returned 0x4e0000 [0179.978] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0179.978] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0179.978] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0179.978] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0179.991] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0179.991] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0179.991] GetProcessHeap () returned 0x4e0000 [0179.991] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0179.991] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0179.991] CryptDestroyKey (hKey=0x522f98) returned 1 [0179.991] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0179.991] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0179.991] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0179.991] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0179.991] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0179.992] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0179.992] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0179.992] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0179.992] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.992] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x825e4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x825e4, lpOverlapped=0x0) returned 1 [0180.200] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x825f0, dwBufLen=0x825f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x825f0) returned 1 [0180.207] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.207] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x825f0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x825f0, lpOverlapped=0x0) returned 1 [0180.209] CryptDestroyKey (hKey=0x522f98) returned 1 [0180.209] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x826c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.209] SetEndOfFile (hFile=0xdc) returned 1 [0180.212] GetProcessHeap () returned 0x4e0000 [0180.212] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0180.212] GetProcessHeap () returned 0x4e0000 [0180.212] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0180.212] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0180.214] CloseHandle (hObject=0xdc) returned 1 [0180.214] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2d000, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a279a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xac2d000, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x5791, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Concourse.eftx", cAlternateFileName="CONCOU~1.EFT")) returned 1 [0180.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0180.215] GetProcessHeap () returned 0x4e0000 [0180.215] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0180.215] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0180.216] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0180.216] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xf, lpOverlapped=0x0) returned 1 [0180.218] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0180.218] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0180.218] GetProcessHeap () returned 0x4e0000 [0180.218] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0180.218] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0180.218] CryptDestroyKey (hKey=0x522f98) returned 1 [0180.218] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0180.218] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0180.218] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0180.218] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0180.218] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0180.219] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0180.219] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0180.219] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0180.219] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.219] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5791, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x5791, lpOverlapped=0x0) returned 1 [0180.331] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x57a0, dwBufLen=0x57a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x57a0) returned 1 [0180.331] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.331] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x57a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x57a0, lpOverlapped=0x0) returned 1 [0180.332] CryptDestroyKey (hKey=0x522f98) returned 1 [0180.332] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5874, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.332] SetEndOfFile (hFile=0xdc) returned 1 [0180.334] GetProcessHeap () returned 0x4e0000 [0180.334] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0180.334] GetProcessHeap () returned 0x4e0000 [0180.334] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0180.335] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0180.338] CloseHandle (hObject=0xdc) returned 1 [0180.338] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72791b00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a4db00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x72791b00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1e0721, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Couture.eftx", cAlternateFileName="COUTUR~1.EFT")) returned 1 [0180.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0180.340] GetFileSizeEx (in: hFile=0xdc, lpFileSize=0x24df260 | out: lpFileSize=0x24df260*=1967905) returned 1 [0180.340] GetProcessHeap () returned 0x4e0000 [0180.340] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0180.340] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0180.340] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.340] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24df24c, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df24c*=0xf, lpOverlapped=0x0) returned 1 [0180.344] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df250 | out: phKey=0x24df250*=0x522f98) returned 1 [0180.344] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0180.344] GetProcessHeap () returned 0x4e0000 [0180.344] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0180.344] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df230*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df230*=0x40) returned 1 [0180.344] CryptDestroyKey (hKey=0x522f98) returned 1 [0180.344] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df24c, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df24c*=0x40, lpOverlapped=0x0) returned 1 [0180.344] WriteFile (in: hFile=0xdc, lpBuffer=0x24df254*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df24c, lpOverlapped=0x0 | out: lpBuffer=0x24df254*, lpNumberOfBytesWritten=0x24df24c*=0x4, lpOverlapped=0x0) returned 1 [0180.344] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df24c, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df24c*=0x10, lpOverlapped=0x0) returned 1 [0180.344] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df24c, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df24c*=0x80, lpOverlapped=0x0) returned 1 [0180.344] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df278 | out: lpNewFilePointer=0x0) returned 1 [0180.344] WriteFile (in: hFile=0xdc, lpBuffer=0x24df268*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df24c, lpOverlapped=0x0 | out: lpBuffer=0x24df268*, lpNumberOfBytesWritten=0x24df24c*=0x8, lpOverlapped=0x0) returned 1 [0180.344] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df250 | out: phKey=0x24df250*=0x522f98) returned 1 [0180.344] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0180.345] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df220 | out: lpNewFilePointer=0x0) returned 1 [0180.345] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df214*=0x40000, lpOverlapped=0x0) returned 1 [0180.359] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df21c*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df21c*=0x40000) returned 1 [0180.362] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.362] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df218, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df218*=0x40000, lpOverlapped=0x0) returned 1 [0180.363] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1e0804, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.363] WriteFile (in: hFile=0xdc, lpBuffer=0x24df220*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df218, lpOverlapped=0x0 | out: lpBuffer=0x24df220*, lpNumberOfBytesWritten=0x24df218*=0x8, lpOverlapped=0x0) returned 1 [0180.363] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xa0260, lpNewFilePointer=0x0, dwMoveMethod=0x24df220 | out: lpNewFilePointer=0x0) returned 1 [0180.363] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df214*=0x40000, lpOverlapped=0x0) returned 1 [0180.376] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df21c*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df21c*=0x40000) returned 1 [0180.379] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xa0260, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.379] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df218, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df218*=0x40000, lpOverlapped=0x0) returned 1 [0180.380] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1e0804, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.380] WriteFile (in: hFile=0xdc, lpBuffer=0x24df220*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df218, lpOverlapped=0x0 | out: lpBuffer=0x24df220*, lpNumberOfBytesWritten=0x24df218*=0x8, lpOverlapped=0x0) returned 1 [0180.381] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1a0730, lpNewFilePointer=0x0, dwMoveMethod=0x24df220 | out: lpNewFilePointer=0x0) returned 1 [0180.381] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df214*=0x40000, lpOverlapped=0x0) returned 1 [0180.412] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df21c*=0x40000, dwBufLen=0x40000 | out: pbData=0x22d0020*, pdwDataLen=0x24df21c*=0x40000) returned 1 [0180.416] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1a0730, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.416] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x24df218, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df218*=0x40000, lpOverlapped=0x0) returned 1 [0180.417] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1e0804, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.417] WriteFile (in: hFile=0xdc, lpBuffer=0x24df220*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df218, lpOverlapped=0x0 | out: lpBuffer=0x24df220*, lpNumberOfBytesWritten=0x24df218*=0x8, lpOverlapped=0x0) returned 1 [0180.417] CryptDestroyKey (hKey=0x522f98) returned 1 [0180.417] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1e0804, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.417] SetEndOfFile (hFile=0xdc) returned 1 [0180.422] GetProcessHeap () returned 0x4e0000 [0180.422] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0180.422] GetProcessHeap () returned 0x4e0000 [0180.422] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0180.422] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0180.425] CloseHandle (hObject=0xdc) returned 1 [0180.425] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x760ca200, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a99dc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x760ca200, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x4caa1, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Elemental.eftx", cAlternateFileName="ELEMEN~1.EFT")) returned 1 [0180.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0180.427] GetProcessHeap () returned 0x4e0000 [0180.427] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0180.427] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0180.427] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0180.427] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xf, lpOverlapped=0x0) returned 1 [0180.567] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0180.567] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0180.567] GetProcessHeap () returned 0x4e0000 [0180.567] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0180.567] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0180.567] CryptDestroyKey (hKey=0x522f98) returned 1 [0180.567] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0180.567] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0180.568] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0180.568] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0180.568] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0180.568] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0180.568] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0180.568] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0180.568] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.568] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4caa1, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4caa1, lpOverlapped=0x0) returned 1 [0180.602] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4cab0, dwBufLen=0x4cab0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4cab0) returned 1 [0180.606] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.606] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4cab0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4cab0, lpOverlapped=0x0) returned 1 [0180.607] CryptDestroyKey (hKey=0x522f98) returned 1 [0180.607] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4cb84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.607] SetEndOfFile (hFile=0xdc) returned 1 [0180.610] GetProcessHeap () returned 0x4e0000 [0180.610] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0180.610] GetProcessHeap () returned 0x4e0000 [0180.611] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0180.611] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0180.613] CloseHandle (hObject=0xdc) returned 1 [0180.613] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd252a00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5abff20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd252a00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x6023, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Equity.eftx", cAlternateFileName="EQUITY~1.EFT")) returned 1 [0180.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0180.614] GetProcessHeap () returned 0x4e0000 [0180.614] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0180.614] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0180.614] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0180.615] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xd, lpOverlapped=0x0) returned 1 [0180.618] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0180.618] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0180.618] GetProcessHeap () returned 0x4e0000 [0180.618] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0180.619] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0180.619] CryptDestroyKey (hKey=0x522f98) returned 1 [0180.619] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0180.619] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0180.619] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0180.619] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0180.619] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0180.619] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0180.619] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0180.619] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0180.619] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.619] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x6023, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x6023, lpOverlapped=0x0) returned 1 [0180.622] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6030, dwBufLen=0x6030 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6030) returned 1 [0180.623] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.623] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6030, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x6030, lpOverlapped=0x0) returned 1 [0180.623] CryptDestroyKey (hKey=0x522f98) returned 1 [0180.623] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6104, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.623] SetEndOfFile (hFile=0xdc) returned 1 [0180.626] GetProcessHeap () returned 0x4e0000 [0180.626] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0180.626] GetProcessHeap () returned 0x4e0000 [0180.626] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0180.627] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0180.629] CloseHandle (hObject=0xdc) returned 1 [0180.629] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49f12100, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5abff20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x49f12100, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x3fde, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Essential.eftx", cAlternateFileName="ESSENT~1.EFT")) returned 1 [0180.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0180.631] GetProcessHeap () returned 0x4e0000 [0180.631] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0180.631] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0180.631] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0180.631] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0180.634] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0180.634] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0180.634] GetProcessHeap () returned 0x4e0000 [0180.634] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0180.634] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0180.634] CryptDestroyKey (hKey=0x522f98) returned 1 [0180.634] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0180.634] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0180.634] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0180.635] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0180.635] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0180.635] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0180.635] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0180.635] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0180.635] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.635] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3fde, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3fde, lpOverlapped=0x0) returned 1 [0180.640] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3fe0, dwBufLen=0x3fe0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3fe0) returned 1 [0180.640] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.640] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3fe0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3fe0, lpOverlapped=0x0) returned 1 [0180.641] CryptDestroyKey (hKey=0x522f98) returned 1 [0180.641] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x40b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.641] SetEndOfFile (hFile=0xdc) returned 1 [0180.643] GetProcessHeap () returned 0x4e0000 [0180.643] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0180.643] GetProcessHeap () returned 0x4e0000 [0180.643] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0180.644] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0180.646] CloseHandle (hObject=0xdc) returned 1 [0180.646] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a02900, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5abff20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x79a02900, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x52a4, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Executive.eftx", cAlternateFileName="EXECUT~1.EFT")) returned 1 [0180.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0180.648] GetProcessHeap () returned 0x4e0000 [0180.648] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0180.648] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0180.648] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0180.648] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0181.030] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0181.030] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0181.030] GetProcessHeap () returned 0x4e0000 [0181.030] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0181.030] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0181.030] CryptDestroyKey (hKey=0x522f98) returned 1 [0181.030] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0181.030] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0181.030] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0181.030] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0181.030] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0181.031] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0181.031] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0181.031] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0181.031] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.031] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x52a4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x52a4, lpOverlapped=0x0) returned 1 [0181.057] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x52b0, dwBufLen=0x52b0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x52b0) returned 1 [0181.057] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.057] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x52b0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x52b0, lpOverlapped=0x0) returned 1 [0181.058] CryptDestroyKey (hKey=0x522f98) returned 1 [0181.058] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5384, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.058] SetEndOfFile (hFile=0xdc) returned 1 [0181.060] GetProcessHeap () returned 0x4e0000 [0181.060] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0181.060] GetProcessHeap () returned 0x4e0000 [0181.060] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0181.060] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0181.062] CloseHandle (hObject=0xdc) returned 1 [0181.062] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x144c3800, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5ae6080, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x144c3800, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x6818, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Flow.eftx", cAlternateFileName="FLOW~1.EFT")) returned 1 [0181.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0181.064] GetProcessHeap () returned 0x4e0000 [0181.064] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0181.064] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0181.064] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0181.064] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0181.065] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0181.065] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0181.065] GetProcessHeap () returned 0x4e0000 [0181.065] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0181.065] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0181.065] CryptDestroyKey (hKey=0x522f98) returned 1 [0181.065] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0181.066] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0181.066] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0181.066] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0181.066] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0181.066] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0181.066] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0181.066] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0181.066] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.066] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x6818, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x6818, lpOverlapped=0x0) returned 1 [0181.068] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6820, dwBufLen=0x6820 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6820) returned 1 [0181.069] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.069] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6820, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x6820, lpOverlapped=0x0) returned 1 [0181.069] CryptDestroyKey (hKey=0x522f98) returned 1 [0181.069] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x68e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.069] SetEndOfFile (hFile=0xdc) returned 1 [0181.071] GetProcessHeap () returned 0x4e0000 [0181.071] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0181.071] GetProcessHeap () returned 0x4e0000 [0181.071] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0181.071] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0181.073] CloseHandle (hObject=0xdc) returned 1 [0181.073] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10b8b100, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b0c1e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x10b8b100, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x4732, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Foundry.eftx", cAlternateFileName="FOUNDR~1.EFT")) returned 1 [0181.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0181.074] GetProcessHeap () returned 0x4e0000 [0181.074] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0181.074] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0181.074] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0181.074] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0181.107] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0181.107] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0181.107] GetProcessHeap () returned 0x4e0000 [0181.107] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0181.107] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0181.107] CryptDestroyKey (hKey=0x522f98) returned 1 [0181.107] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0181.107] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0181.107] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0181.107] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0181.107] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0181.107] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0181.107] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0181.107] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0181.107] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.107] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4732, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4732, lpOverlapped=0x0) returned 1 [0181.284] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4740, dwBufLen=0x4740 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4740) returned 1 [0181.284] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.285] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4740, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4740, lpOverlapped=0x0) returned 1 [0181.285] CryptDestroyKey (hKey=0x522f98) returned 1 [0181.285] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.285] SetEndOfFile (hFile=0xdc) returned 1 [0181.287] GetProcessHeap () returned 0x4e0000 [0181.287] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0181.287] GetProcessHeap () returned 0x4e0000 [0181.287] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0181.287] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0181.289] CloseHandle (hObject=0xdc) returned 1 [0181.289] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d84a800, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b0c1e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4d84a800, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x48cf, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Grid.eftx", cAlternateFileName="GRID~1.EFT")) returned 1 [0181.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0181.290] GetProcessHeap () returned 0x4e0000 [0181.290] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0181.290] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0181.290] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0181.290] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x1, lpOverlapped=0x0) returned 1 [0181.343] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0181.343] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0181.343] GetProcessHeap () returned 0x4e0000 [0181.343] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0181.343] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0181.343] CryptDestroyKey (hKey=0x522f98) returned 1 [0181.343] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0181.343] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0181.343] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0181.344] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0181.344] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0181.344] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0181.344] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0181.344] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0181.344] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.344] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x48cf, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x48cf, lpOverlapped=0x0) returned 1 [0181.361] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x48d0, dwBufLen=0x48d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x48d0) returned 1 [0181.362] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.362] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x48d0, lpOverlapped=0x0) returned 1 [0181.362] CryptDestroyKey (hKey=0x522f98) returned 1 [0181.362] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.362] SetEndOfFile (hFile=0xdc) returned 1 [0181.364] GetProcessHeap () returned 0x4e0000 [0181.364] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0181.364] GetProcessHeap () returned 0x4e0000 [0181.364] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0181.364] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0181.366] CloseHandle (hObject=0xdc) returned 1 [0181.367] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51182f00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b32340, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x51182f00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x559e1, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Hardcover.eftx", cAlternateFileName="HARDCO~1.EFT")) returned 1 [0181.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0181.368] GetProcessHeap () returned 0x4e0000 [0181.368] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0181.368] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0181.368] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0181.368] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xf, lpOverlapped=0x0) returned 1 [0181.558] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0181.558] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0181.558] GetProcessHeap () returned 0x4e0000 [0181.558] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0181.558] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0181.558] CryptDestroyKey (hKey=0x522f98) returned 1 [0181.558] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0181.558] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0181.558] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0181.558] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0181.559] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0181.559] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0181.559] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0181.559] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0181.559] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.559] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x559e1, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x559e1, lpOverlapped=0x0) returned 1 [0181.588] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x559f0, dwBufLen=0x559f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x559f0) returned 1 [0181.592] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.592] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x559f0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x559f0, lpOverlapped=0x0) returned 1 [0181.593] CryptDestroyKey (hKey=0x522f98) returned 1 [0181.593] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x55ac4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.593] SetEndOfFile (hFile=0xdc) returned 1 [0181.597] GetProcessHeap () returned 0x4e0000 [0181.597] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0181.597] GetProcessHeap () returned 0x4e0000 [0181.597] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0181.597] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0181.599] CloseHandle (hObject=0xdc) returned 1 [0181.599] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d33b000, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b32340, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7d33b000, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x33892, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Horizon.eftx", cAlternateFileName="HORIZO~1.EFT")) returned 1 [0181.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0181.602] GetProcessHeap () returned 0x4e0000 [0181.602] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0181.602] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0181.602] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0181.602] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0181.634] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0181.634] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0181.634] GetProcessHeap () returned 0x4e0000 [0181.634] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0181.634] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0181.634] CryptDestroyKey (hKey=0x522f98) returned 1 [0181.634] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0181.635] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0181.635] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0181.635] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0181.635] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0181.635] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0181.635] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0181.635] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0181.635] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.635] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x33892, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x33892, lpOverlapped=0x0) returned 1 [0181.699] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x338a0, dwBufLen=0x338a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x338a0) returned 1 [0181.701] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.701] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x338a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x338a0, lpOverlapped=0x0) returned 1 [0181.702] CryptDestroyKey (hKey=0x522f98) returned 1 [0181.702] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x33974, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.702] SetEndOfFile (hFile=0xdc) returned 1 [0181.709] GetProcessHeap () returned 0x4e0000 [0181.709] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0181.709] GetProcessHeap () returned 0x4e0000 [0181.709] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0181.709] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0181.711] CloseHandle (hObject=0xdc) returned 1 [0181.711] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17dfbf00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b584a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x17dfbf00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x9a7a, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Median.eftx", cAlternateFileName="MEDIAN~1.EFT")) returned 1 [0181.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0181.713] GetProcessHeap () returned 0x4e0000 [0181.713] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0181.713] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0181.713] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0181.713] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0181.740] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0181.740] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0181.740] GetProcessHeap () returned 0x4e0000 [0181.740] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0181.740] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0181.741] CryptDestroyKey (hKey=0x522f98) returned 1 [0181.741] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0181.741] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0181.741] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0181.741] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0181.741] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0181.741] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0181.741] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0181.741] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0181.741] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.741] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x9a7a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x9a7a, lpOverlapped=0x0) returned 1 [0181.863] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9a80, dwBufLen=0x9a80 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9a80) returned 1 [0181.864] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.864] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x9a80, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x9a80, lpOverlapped=0x0) returned 1 [0181.864] CryptDestroyKey (hKey=0x522f98) returned 1 [0181.864] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x9b54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.864] SetEndOfFile (hFile=0xdc) returned 1 [0181.867] GetProcessHeap () returned 0x4e0000 [0181.867] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0181.867] GetProcessHeap () returned 0x4e0000 [0181.867] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0181.867] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0181.868] CloseHandle (hObject=0xdc) returned 1 [0181.868] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b734600, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b584a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1b734600, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x5e35, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Metro.eftx", cAlternateFileName="METRO~1.EFT")) returned 1 [0181.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0181.870] GetProcessHeap () returned 0x4e0000 [0181.870] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0181.870] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0181.870] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0181.870] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xb, lpOverlapped=0x0) returned 1 [0182.045] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0182.045] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0182.045] GetProcessHeap () returned 0x4e0000 [0182.045] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0182.045] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0182.045] CryptDestroyKey (hKey=0x522f98) returned 1 [0182.045] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0182.045] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0182.045] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0182.046] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0182.046] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0182.046] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0182.046] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0182.046] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0182.046] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.046] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5e35, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x5e35, lpOverlapped=0x0) returned 1 [0182.071] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5e40, dwBufLen=0x5e40 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5e40) returned 1 [0182.072] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.072] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5e40, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5e40, lpOverlapped=0x0) returned 1 [0182.072] CryptDestroyKey (hKey=0x522f98) returned 1 [0182.072] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5f04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.072] SetEndOfFile (hFile=0xdc) returned 1 [0182.075] GetProcessHeap () returned 0x4e0000 [0182.075] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0182.075] GetProcessHeap () returned 0x4e0000 [0182.075] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0182.075] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0182.077] CloseHandle (hObject=0xdc) returned 1 [0182.077] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dd5a000, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b7e600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1dd5a000, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xa95d, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Module.eftx", cAlternateFileName="MODULE~1.EFT")) returned 1 [0182.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0182.079] GetProcessHeap () returned 0x4e0000 [0182.079] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0182.079] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0182.079] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0182.079] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x3, lpOverlapped=0x0) returned 1 [0182.112] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0182.112] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0182.113] GetProcessHeap () returned 0x4e0000 [0182.113] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0182.113] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0182.113] CryptDestroyKey (hKey=0x522f98) returned 1 [0182.113] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0182.113] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0182.113] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0182.113] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0182.113] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0182.113] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0182.113] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0182.113] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0182.113] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.114] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xa95d, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xa95d, lpOverlapped=0x0) returned 1 [0182.150] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa960, dwBufLen=0xa960 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa960) returned 1 [0182.150] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.150] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xa960, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xa960, lpOverlapped=0x0) returned 1 [0182.151] CryptDestroyKey (hKey=0x522f98) returned 1 [0182.151] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xaa34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.151] SetEndOfFile (hFile=0xdc) returned 1 [0182.153] GetProcessHeap () returned 0x4e0000 [0182.153] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0182.153] GetProcessHeap () returned 0x4e0000 [0182.153] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0182.153] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0182.155] CloseHandle (hObject=0xdc) returned 1 [0182.155] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c73700, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b7e600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x80c73700, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x8e301, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Newsprint.eftx", cAlternateFileName="NEWSPR~1.EFT")) returned 1 [0182.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0182.156] GetProcessHeap () returned 0x4e0000 [0182.156] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0182.156] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0182.156] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0182.156] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xf, lpOverlapped=0x0) returned 1 [0182.172] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0182.172] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0182.172] GetProcessHeap () returned 0x4e0000 [0182.172] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0182.172] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0182.172] CryptDestroyKey (hKey=0x522f98) returned 1 [0182.172] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0182.173] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0182.173] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0182.173] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0182.173] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0182.173] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0182.173] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0182.173] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0182.173] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.173] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x8e301, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x8e301, lpOverlapped=0x0) returned 1 [0182.211] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8e310, dwBufLen=0x8e310 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8e310) returned 1 [0182.216] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.216] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x8e310, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x8e310, lpOverlapped=0x0) returned 1 [0182.218] CryptDestroyKey (hKey=0x522f98) returned 1 [0182.218] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x8e3e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.218] SetEndOfFile (hFile=0xdc) returned 1 [0182.220] GetProcessHeap () returned 0x4e0000 [0182.220] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0182.220] GetProcessHeap () returned 0x4e0000 [0182.220] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0182.220] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0182.224] CloseHandle (hObject=0xdc) returned 1 [0182.224] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21692700, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5ba4760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x21692700, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x8059, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Opulent.eftx", cAlternateFileName="OPULEN~1.EFT")) returned 1 [0182.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0182.225] GetProcessHeap () returned 0x4e0000 [0182.225] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0182.225] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0182.225] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0182.225] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x7, lpOverlapped=0x0) returned 1 [0182.247] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0182.247] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0182.247] GetProcessHeap () returned 0x4e0000 [0182.247] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0182.247] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0182.247] CryptDestroyKey (hKey=0x522f98) returned 1 [0182.247] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0182.247] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0182.247] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0182.247] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0182.247] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0182.247] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0182.248] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0182.248] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0182.248] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.248] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x8059, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x8059, lpOverlapped=0x0) returned 1 [0182.287] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8060, dwBufLen=0x8060 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8060) returned 1 [0182.289] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.289] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x8060, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x8060, lpOverlapped=0x0) returned 1 [0182.289] CryptDestroyKey (hKey=0x522f98) returned 1 [0182.289] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x8134, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.289] SetEndOfFile (hFile=0xdc) returned 1 [0182.294] GetProcessHeap () returned 0x4e0000 [0182.294] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0182.294] GetProcessHeap () returned 0x4e0000 [0182.294] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0182.294] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0182.296] CloseHandle (hObject=0xdc) returned 1 [0182.296] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24fcae00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5bca8c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x24fcae00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xa8b9, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Oriel.eftx", cAlternateFileName="ORIEL~1.EFT")) returned 1 [0182.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0182.298] GetProcessHeap () returned 0x4e0000 [0182.298] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0182.298] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0182.298] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0182.298] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x7, lpOverlapped=0x0) returned 1 [0182.638] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0182.638] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0182.638] GetProcessHeap () returned 0x4e0000 [0182.638] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0182.638] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0182.638] CryptDestroyKey (hKey=0x522f98) returned 1 [0182.638] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0182.638] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0182.639] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0182.639] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0182.639] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0182.639] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0182.639] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0182.639] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0182.639] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.639] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xa8b9, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xa8b9, lpOverlapped=0x0) returned 1 [0182.651] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa8c0, dwBufLen=0xa8c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa8c0) returned 1 [0182.652] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.652] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xa8c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xa8c0, lpOverlapped=0x0) returned 1 [0182.652] CryptDestroyKey (hKey=0x522f98) returned 1 [0182.652] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xa984, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.653] SetEndOfFile (hFile=0xdc) returned 1 [0182.655] GetProcessHeap () returned 0x4e0000 [0182.655] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0182.656] GetProcessHeap () returned 0x4e0000 [0182.656] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0182.656] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0182.660] CloseHandle (hObject=0xdc) returned 1 [0182.660] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28903500, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5bca8c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x28903500, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x9fed, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Origin.eftx", cAlternateFileName="ORIGIN~1.EFT")) returned 1 [0182.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0182.662] GetProcessHeap () returned 0x4e0000 [0182.662] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0182.662] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0182.662] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0182.662] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x3, lpOverlapped=0x0) returned 1 [0182.670] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0182.670] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0182.670] GetProcessHeap () returned 0x4e0000 [0182.670] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0182.670] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0182.670] CryptDestroyKey (hKey=0x522f98) returned 1 [0182.670] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0182.671] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0182.671] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0182.671] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0182.671] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0182.671] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0182.671] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0182.671] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0182.685] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.685] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x9fed, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x9fed, lpOverlapped=0x0) returned 1 [0182.721] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9ff0, dwBufLen=0x9ff0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9ff0) returned 1 [0182.722] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.722] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x9ff0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x9ff0, lpOverlapped=0x0) returned 1 [0182.722] CryptDestroyKey (hKey=0x522f98) returned 1 [0182.722] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xa0c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.722] SetEndOfFile (hFile=0xdc) returned 1 [0182.725] GetProcessHeap () returned 0x4e0000 [0182.725] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0182.725] GetProcessHeap () returned 0x4e0000 [0182.725] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0182.725] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0182.727] CloseHandle (hObject=0xdc) returned 1 [0182.728] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c23bc00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5bf0a20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2c23bc00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x37d8a, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Paper.eftx", cAlternateFileName="PAPER~1.EFT")) returned 1 [0182.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0182.735] GetProcessHeap () returned 0x4e0000 [0182.735] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0182.735] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0182.735] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0182.735] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0182.773] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0182.773] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0182.773] GetProcessHeap () returned 0x4e0000 [0182.773] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0182.773] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0182.773] CryptDestroyKey (hKey=0x522f98) returned 1 [0182.773] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0182.773] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0182.773] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0182.773] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0182.774] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0182.774] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0182.774] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0182.774] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0182.774] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.774] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x37d8a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x37d8a, lpOverlapped=0x0) returned 1 [0182.814] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x37d90, dwBufLen=0x37d90 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x37d90) returned 1 [0182.817] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.817] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x37d90, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x37d90, lpOverlapped=0x0) returned 1 [0182.818] CryptDestroyKey (hKey=0x522f98) returned 1 [0182.818] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x37e54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.818] SetEndOfFile (hFile=0xdc) returned 1 [0182.822] GetProcessHeap () returned 0x4e0000 [0182.822] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0182.822] GetProcessHeap () returned 0x4e0000 [0182.822] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0182.822] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0182.824] CloseHandle (hObject=0xdc) returned 1 [0182.824] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x537a8900, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c16b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x537a8900, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x53af, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Perspective.eftx", cAlternateFileName="PERSPE~1.EFT")) returned 1 [0182.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0182.826] GetProcessHeap () returned 0x4e0000 [0182.826] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0182.826] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0182.826] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0182.826] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x1, lpOverlapped=0x0) returned 1 [0182.833] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0182.833] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0182.833] GetProcessHeap () returned 0x4e0000 [0182.833] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0182.833] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0182.833] CryptDestroyKey (hKey=0x522f98) returned 1 [0182.833] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0182.833] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0182.833] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0182.833] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0182.834] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0182.834] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0182.834] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0182.834] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0182.834] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.834] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x53af, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x53af, lpOverlapped=0x0) returned 1 [0182.838] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x53b0, dwBufLen=0x53b0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x53b0) returned 1 [0182.838] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.838] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x53b0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x53b0, lpOverlapped=0x0) returned 1 [0182.838] CryptDestroyKey (hKey=0x522f98) returned 1 [0182.838] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5484, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.838] SetEndOfFile (hFile=0xdc) returned 1 [0182.841] GetProcessHeap () returned 0x4e0000 [0182.841] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0182.841] GetProcessHeap () returned 0x4e0000 [0182.841] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0182.841] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0182.844] CloseHandle (hObject=0xdc) returned 1 [0182.844] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x583f3d00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c3cce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x583f3d00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xbef29, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Pushpin.eftx", cAlternateFileName="PUSHPI~1.EFT")) returned 1 [0182.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0182.846] GetProcessHeap () returned 0x4e0000 [0182.846] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0182.846] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0182.846] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0182.846] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x7, lpOverlapped=0x0) returned 1 [0182.873] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0182.873] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0182.873] GetProcessHeap () returned 0x4e0000 [0182.873] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0182.873] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0182.873] CryptDestroyKey (hKey=0x522f98) returned 1 [0182.873] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0182.873] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0182.873] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0182.873] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0182.873] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0182.873] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0182.874] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0182.874] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0182.874] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.874] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xbef29, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xbef29, lpOverlapped=0x0) returned 1 [0183.029] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xbef30, dwBufLen=0xbef30 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xbef30) returned 1 [0183.039] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.039] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xbef30, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xbef30, lpOverlapped=0x0) returned 1 [0183.042] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.042] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xbf004, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.042] SetEndOfFile (hFile=0xdc) returned 1 [0183.046] GetProcessHeap () returned 0x4e0000 [0183.046] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0183.046] GetProcessHeap () returned 0x4e0000 [0183.046] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0183.046] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0183.048] CloseHandle (hObject=0xdc) returned 1 [0183.048] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x845abe00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c62e40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x845abe00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x6c8d, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Slipstream.eftx", cAlternateFileName="SLIPST~1.EFT")) returned 1 [0183.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0183.050] GetProcessHeap () returned 0x4e0000 [0183.050] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0183.050] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0183.050] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0183.050] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x3, lpOverlapped=0x0) returned 1 [0183.054] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.054] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.054] GetProcessHeap () returned 0x4e0000 [0183.054] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0183.055] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0183.055] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.055] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0183.055] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0183.055] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0183.055] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0183.055] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0183.055] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0183.055] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.055] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.055] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.055] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x6c8d, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x6c8d, lpOverlapped=0x0) returned 1 [0183.056] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6c90, dwBufLen=0x6c90 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6c90) returned 1 [0183.057] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.057] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6c90, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x6c90, lpOverlapped=0x0) returned 1 [0183.057] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.057] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6d64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.057] SetEndOfFile (hFile=0xdc) returned 1 [0183.060] GetProcessHeap () returned 0x4e0000 [0183.060] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0183.060] GetProcessHeap () returned 0x4e0000 [0183.060] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0183.060] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0183.062] CloseHandle (hObject=0xdc) returned 1 [0183.062] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e861600, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c62e40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2e861600, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x6c85, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Solstice.eftx", cAlternateFileName="SOLSTI~1.EFT")) returned 1 [0183.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0183.064] GetProcessHeap () returned 0x4e0000 [0183.064] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0183.064] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0183.064] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0183.064] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xb, lpOverlapped=0x0) returned 1 [0183.066] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.066] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.066] GetProcessHeap () returned 0x4e0000 [0183.066] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0183.066] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0183.066] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.066] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0183.066] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0183.067] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0183.067] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0183.067] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0183.067] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0183.067] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.067] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.067] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.067] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x6c85, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x6c85, lpOverlapped=0x0) returned 1 [0183.068] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6c90, dwBufLen=0x6c90 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6c90) returned 1 [0183.069] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.069] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6c90, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x6c90, lpOverlapped=0x0) returned 1 [0183.069] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.069] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6d64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.069] SetEndOfFile (hFile=0xdc) returned 1 [0183.072] GetProcessHeap () returned 0x4e0000 [0183.072] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0183.072] GetProcessHeap () returned 0x4e0000 [0183.072] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0183.072] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0183.074] CloseHandle (hObject=0xdc) returned 1 [0183.074] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32199d00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c62e40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x32199d00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x5c8c, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Technic.eftx", cAlternateFileName="TECHNI~1.EFT")) returned 1 [0183.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0183.075] GetProcessHeap () returned 0x4e0000 [0183.075] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0183.075] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0183.076] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0183.076] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0183.078] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.078] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.078] GetProcessHeap () returned 0x4e0000 [0183.078] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0183.078] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0183.078] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.078] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0183.078] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0183.078] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0183.078] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0183.079] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0183.079] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0183.079] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.079] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.079] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.079] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5c8c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x5c8c, lpOverlapped=0x0) returned 1 [0183.081] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5c90, dwBufLen=0x5c90 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5c90) returned 1 [0183.081] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.081] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5c90, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5c90, lpOverlapped=0x0) returned 1 [0183.081] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.081] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5d64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.081] SetEndOfFile (hFile=0xdc) returned 1 [0183.084] GetProcessHeap () returned 0x4e0000 [0183.084] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0183.084] GetProcessHeap () returned 0x4e0000 [0183.084] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0183.084] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0183.086] CloseHandle (hObject=0xdc) returned 1 [0183.086] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5bd2c400, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c88fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5bd2c400, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xa14f, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Thatch.eftx", cAlternateFileName="THATCH~1.EFT")) returned 1 [0183.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0183.088] GetProcessHeap () returned 0x4e0000 [0183.088] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0183.088] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0183.088] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0183.088] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x1, lpOverlapped=0x0) returned 1 [0183.090] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.090] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.090] GetProcessHeap () returned 0x4e0000 [0183.090] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0183.090] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0183.090] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.090] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0183.090] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0183.090] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0183.090] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0183.090] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0183.091] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0183.091] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.091] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.091] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.091] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xa14f, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xa14f, lpOverlapped=0x0) returned 1 [0183.092] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa150, dwBufLen=0xa150 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa150) returned 1 [0183.093] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.093] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xa150, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xa150, lpOverlapped=0x0) returned 1 [0183.093] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.093] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xa224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.093] SetEndOfFile (hFile=0xdc) returned 1 [0183.096] GetProcessHeap () returned 0x4e0000 [0183.096] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0183.096] GetProcessHeap () returned 0x4e0000 [0183.096] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0183.096] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0183.098] CloseHandle (hObject=0xdc) returned 1 [0183.098] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35ad2400, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c88fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x35ad2400, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1fb84, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Trek.eftx", cAlternateFileName="TREK~1.EFT")) returned 1 [0183.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0183.100] GetProcessHeap () returned 0x4e0000 [0183.100] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0183.100] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0183.100] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0183.100] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0183.102] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.102] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.102] GetProcessHeap () returned 0x4e0000 [0183.102] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0183.102] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0183.102] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.102] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0183.102] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0183.102] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0183.102] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0183.103] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0183.103] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0183.103] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.103] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.103] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.103] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1fb84, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1fb84, lpOverlapped=0x0) returned 1 [0183.105] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1fb90, dwBufLen=0x1fb90 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1fb90) returned 1 [0183.107] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.107] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1fb90, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1fb90, lpOverlapped=0x0) returned 1 [0183.107] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.107] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1fc54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.107] SetEndOfFile (hFile=0xdc) returned 1 [0183.111] GetProcessHeap () returned 0x4e0000 [0183.111] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0183.111] GetProcessHeap () returned 0x4e0000 [0183.111] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0183.111] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0183.113] CloseHandle (hObject=0xdc) returned 1 [0183.113] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3940ab00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3940ab00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x4c9b, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Urban.eftx", cAlternateFileName="URBAN~1.EFT")) returned 1 [0183.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0183.115] GetProcessHeap () returned 0x4e0000 [0183.115] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0183.115] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0183.116] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0183.116] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x5, lpOverlapped=0x0) returned 1 [0183.118] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.118] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.118] GetProcessHeap () returned 0x4e0000 [0183.118] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0183.118] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0183.118] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.118] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0183.118] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0183.118] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0183.118] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0183.118] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0183.118] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0183.119] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.119] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.119] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.119] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4c9b, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4c9b, lpOverlapped=0x0) returned 1 [0183.120] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4ca0, dwBufLen=0x4ca0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4ca0) returned 1 [0183.120] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.120] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4ca0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4ca0, lpOverlapped=0x0) returned 1 [0183.120] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.120] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4d64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.120] SetEndOfFile (hFile=0xdc) returned 1 [0183.123] GetProcessHeap () returned 0x4e0000 [0183.123] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0183.123] GetProcessHeap () returned 0x4e0000 [0183.123] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0183.123] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0183.125] CloseHandle (hObject=0xdc) returned 1 [0183.125] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cd43200, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3cd43200, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x79f8, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Verve.eftx", cAlternateFileName="VERVE~1.EFT")) returned 1 [0183.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0183.128] GetProcessHeap () returned 0x4e0000 [0183.128] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0183.128] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0183.128] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0183.128] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0183.130] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.130] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.131] GetProcessHeap () returned 0x4e0000 [0183.131] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0183.131] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0183.131] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.131] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0183.131] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0183.131] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0183.131] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0183.131] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0183.131] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0183.131] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.131] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.131] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.131] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x79f8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x79f8, lpOverlapped=0x0) returned 1 [0183.133] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7a00, dwBufLen=0x7a00 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7a00) returned 1 [0183.133] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.133] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7a00, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7a00, lpOverlapped=0x0) returned 1 [0183.133] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.133] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7ac4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.133] SetEndOfFile (hFile=0xdc) returned 1 [0183.136] GetProcessHeap () returned 0x4e0000 [0183.136] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0183.136] GetProcessHeap () returned 0x4e0000 [0183.136] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0183.136] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0183.138] CloseHandle (hObject=0xdc) returned 1 [0183.138] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f664b00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5f664b00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1b778, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Waveform.eftx", cAlternateFileName="WAVEFO~1.EFT")) returned 1 [0183.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0183.140] GetProcessHeap () returned 0x4e0000 [0183.140] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0183.140] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0183.140] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0183.140] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0183.143] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.143] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.143] GetProcessHeap () returned 0x4e0000 [0183.143] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0183.143] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0183.143] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.143] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0183.143] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0183.143] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0183.143] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0183.143] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0183.143] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0183.144] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.144] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.144] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.144] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1b778, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1b778, lpOverlapped=0x0) returned 1 [0183.146] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1b780, dwBufLen=0x1b780 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1b780) returned 1 [0183.147] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.147] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1b780, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1b780, lpOverlapped=0x0) returned 1 [0183.148] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.148] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1b854, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.148] SetEndOfFile (hFile=0xdc) returned 1 [0183.151] GetProcessHeap () returned 0x4e0000 [0183.151] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0183.151] GetProcessHeap () returned 0x4e0000 [0183.151] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0183.151] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0183.153] CloseHandle (hObject=0xdc) returned 1 [0183.153] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f664b00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5f664b00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1b778, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Waveform.eftx", cAlternateFileName="WAVEFO~1.EFT")) returned 0 [0183.153] GetProcessHeap () returned 0x4e0000 [0183.153] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0183.154] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df248, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f98) returned 1 [0183.154] CryptDecrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df2b0 | out: pbData=0x4f53d8, pdwDataLen=0x24df2b0) returned 1 [0183.154] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.154] GetProcessHeap () returned 0x4e0000 [0183.154] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0183.154] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df248, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f98) returned 1 [0183.154] CryptDecrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df2b0 | out: pbData=0x4f5420, pdwDataLen=0x24df2b0) returned 1 [0183.154] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.154] GetProcessHeap () returned 0x4e0000 [0183.154] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x522768 [0183.154] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df248, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f98) returned 1 [0183.154] CryptDecrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x522768, pdwDataLen=0x24df2b0 | out: pbData=0x522768, pdwDataLen=0x24df2b0) returned 1 [0183.154] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.154] wsprintfW (in: param_1=0x24de28c, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\readme-warning.txt") returned 85 [0183.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\readme-warning.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0183.159] WriteFile (in: hFile=0xdc, lpBuffer=0x522768*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24de288, lpOverlapped=0x0 | out: lpBuffer=0x522768*, lpNumberOfBytesWritten=0x24de288*=0x6c3, lpOverlapped=0x0) returned 1 [0183.160] CloseHandle (hObject=0xdc) returned 1 [0183.161] GetProcessHeap () returned 0x4e0000 [0183.161] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x522768 | out: hHeap=0x4e0000) returned 1 [0183.161] GetProcessHeap () returned 0x4e0000 [0183.161] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0183.161] GetProcessHeap () returned 0x4e0000 [0183.161] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0183.161] FindClose (in: hFindFile=0x522f58 | out: hFindFile=0x522f58) returned 1 [0183.161] GetProcessHeap () returned 0x4e0000 [0183.161] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x541088 | out: hHeap=0x4e0000) returned 1 [0183.161] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528a9ed0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6187c750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6187c750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Theme Fonts", cAlternateFileName="THEMEF~1")) returned 1 [0183.161] GetProcessHeap () returned 0x4e0000 [0183.161] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x92) returned 0x4fa058 [0183.161] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528a9ed0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6187c750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6187c750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName=".", cAlternateFileName="")) returned 0x522f58 [0183.163] GetProcessHeap () returned 0x4e0000 [0183.163] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0183.163] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528a9ed0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6187c750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6187c750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="..", cAlternateFileName="")) returned 1 [0183.164] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccc5300, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x61830490, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xccc5300, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe19, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Adjacency.xml", cAlternateFileName="ADJACE~1.XML")) returned 1 [0183.164] GetProcessHeap () returned 0x4e0000 [0183.164] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x294) returned 0x541088 [0183.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Adjacency.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\adjacency.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0183.167] GetProcessHeap () returned 0x4e0000 [0183.167] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0183.167] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0183.167] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0183.167] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x7, lpOverlapped=0x0) returned 1 [0183.169] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.169] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.169] GetProcessHeap () returned 0x4e0000 [0183.169] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0183.169] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0183.169] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.169] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0183.169] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0183.169] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0183.169] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0183.170] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0183.170] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0183.170] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.170] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.170] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.170] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xe19, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xe19, lpOverlapped=0x0) returned 1 [0183.170] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe20, dwBufLen=0xe20 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe20) returned 1 [0183.170] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.170] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xe20, lpOverlapped=0x0) returned 1 [0183.170] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.170] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.170] SetEndOfFile (hFile=0xdc) returned 1 [0183.173] GetProcessHeap () returned 0x4e0000 [0183.173] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0183.173] GetProcessHeap () returned 0x4e0000 [0183.173] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0183.173] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Adjacency.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\adjacency.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Adjacency.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\adjacency.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0183.175] CloseHandle (hObject=0xdc) returned 1 [0183.175] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfd8000, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdfd8000, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe2a, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Angles.xml", cAlternateFileName="")) returned 1 [0183.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Angles.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\angles.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0183.177] GetProcessHeap () returned 0x4e0000 [0183.177] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0183.177] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0183.177] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0183.177] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0183.179] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.179] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.179] GetProcessHeap () returned 0x4e0000 [0183.179] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0183.179] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0183.179] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.179] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0183.179] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0183.179] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0183.179] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0183.180] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0183.180] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0183.180] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.180] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.180] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.180] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xe2a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xe2a, lpOverlapped=0x0) returned 1 [0183.180] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe30, dwBufLen=0xe30 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe30) returned 1 [0183.180] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.180] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xe30, lpOverlapped=0x0) returned 1 [0183.180] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.180] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.180] SetEndOfFile (hFile=0xdc) returned 1 [0183.183] GetProcessHeap () returned 0x4e0000 [0183.183] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0183.183] GetProcessHeap () returned 0x4e0000 [0183.183] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0183.183] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Angles.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\angles.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Angles.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\angles.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0183.185] CloseHandle (hObject=0xdc) returned 1 [0183.185] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb6b6700, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x61830490, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb6b6700, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xeee, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Apex.xml", cAlternateFileName="")) returned 1 [0183.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apex.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apex.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0183.186] GetProcessHeap () returned 0x4e0000 [0183.186] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0183.186] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0183.186] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0183.186] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0183.188] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.188] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.188] GetProcessHeap () returned 0x4e0000 [0183.188] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0183.188] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0183.188] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.188] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0183.188] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0183.189] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0183.189] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0183.189] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0183.189] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0183.189] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.189] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.189] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.189] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xeee, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xeee, lpOverlapped=0x0) returned 1 [0183.189] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xef0, dwBufLen=0xef0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xef0) returned 1 [0183.189] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.189] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xef0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xef0, lpOverlapped=0x0) returned 1 [0183.189] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.189] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xfb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.190] SetEndOfFile (hFile=0xdc) returned 1 [0183.192] GetProcessHeap () returned 0x4e0000 [0183.192] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0183.192] GetProcessHeap () returned 0x4e0000 [0183.192] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0183.192] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apex.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apex.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apex.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apex.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0183.194] CloseHandle (hObject=0xdc) returned 1 [0183.194] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe09100, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe09100, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe1f, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Apothecary.xml", cAlternateFileName="APOTHE~1.XML")) returned 1 [0183.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apothecary.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apothecary.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0183.195] GetProcessHeap () returned 0x4e0000 [0183.195] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0183.195] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0183.195] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0183.195] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x1, lpOverlapped=0x0) returned 1 [0183.197] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.197] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.197] GetProcessHeap () returned 0x4e0000 [0183.197] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0183.197] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0183.197] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.197] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0183.197] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0183.197] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0183.197] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0183.197] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0183.197] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0183.198] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.198] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.198] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.198] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xe1f, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xe1f, lpOverlapped=0x0) returned 1 [0183.198] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe20, dwBufLen=0xe20 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe20) returned 1 [0183.198] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.198] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xe20, lpOverlapped=0x0) returned 1 [0183.198] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.198] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.198] SetEndOfFile (hFile=0xdc) returned 1 [0183.201] GetProcessHeap () returned 0x4e0000 [0183.201] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0183.201] GetProcessHeap () returned 0x4e0000 [0183.201] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0183.201] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apothecary.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apothecary.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apothecary.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apothecary.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0183.202] CloseHandle (hObject=0xdc) returned 1 [0183.202] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedcdc100, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x61830490, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xedcdc100, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe0b, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Aspect.xml", cAlternateFileName="")) returned 1 [0183.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Aspect.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\aspect.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0183.203] GetProcessHeap () returned 0x4e0000 [0183.203] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0183.203] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0183.203] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0183.204] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x5, lpOverlapped=0x0) returned 1 [0183.206] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.206] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.206] GetProcessHeap () returned 0x4e0000 [0183.206] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0183.206] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0183.206] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.206] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0183.206] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0183.206] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0183.206] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0183.206] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0183.207] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0183.207] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.207] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.207] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.207] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xe0b, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xe0b, lpOverlapped=0x0) returned 1 [0183.207] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe10, dwBufLen=0xe10 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe10) returned 1 [0183.207] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.207] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xe10, lpOverlapped=0x0) returned 1 [0183.207] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.207] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.207] SetEndOfFile (hFile=0xdc) returned 1 [0183.210] GetProcessHeap () returned 0x4e0000 [0183.210] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0183.210] GetProcessHeap () returned 0x4e0000 [0183.210] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0183.210] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Aspect.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\aspect.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Aspect.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\aspect.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0183.211] CloseHandle (hObject=0xdc) returned 1 [0183.211] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x211be00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x211be00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe16, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Austin.xml", cAlternateFileName="")) returned 1 [0183.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Austin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\austin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0183.213] GetProcessHeap () returned 0x4e0000 [0183.213] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0183.213] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0183.213] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0183.214] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0183.216] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.216] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.216] GetProcessHeap () returned 0x4e0000 [0183.216] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0183.216] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0183.216] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.216] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0183.216] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0183.216] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0183.216] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0183.217] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0183.217] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0183.217] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.217] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.217] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.217] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xe16, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xe16, lpOverlapped=0x0) returned 1 [0183.217] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe20, dwBufLen=0xe20 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe20) returned 1 [0183.217] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.217] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xe20, lpOverlapped=0x0) returned 1 [0183.217] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.217] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xee4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.217] SetEndOfFile (hFile=0xdc) returned 1 [0183.220] GetProcessHeap () returned 0x4e0000 [0183.220] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0183.220] GetProcessHeap () returned 0x4e0000 [0183.220] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0183.220] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Austin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\austin.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Austin.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\austin.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0183.223] CloseHandle (hObject=0xdc) returned 1 [0183.223] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2ead00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2ead00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xefb, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Black Tie.xml", cAlternateFileName="BLACKT~1.XML")) returned 1 [0183.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Black Tie.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\black tie.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0183.224] GetProcessHeap () returned 0x4e0000 [0183.224] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0183.224] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0183.224] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0183.224] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x5, lpOverlapped=0x0) returned 1 [0183.226] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.226] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.226] GetProcessHeap () returned 0x4e0000 [0183.226] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0183.226] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0183.226] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.226] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0183.227] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0183.227] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0183.227] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0183.227] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0183.227] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0183.227] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.227] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.227] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.227] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xefb, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xefb, lpOverlapped=0x0) returned 1 [0183.227] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xf00, dwBufLen=0xf00 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xf00) returned 1 [0183.227] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.227] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xf00, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xf00, lpOverlapped=0x0) returned 1 [0183.228] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.228] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xfd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.228] SetEndOfFile (hFile=0xdc) returned 1 [0183.230] GetProcessHeap () returned 0x4e0000 [0183.230] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0183.230] GetProcessHeap () returned 0x4e0000 [0183.230] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0183.230] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Black Tie.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\black tie.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Black Tie.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\black tie.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0183.231] CloseHandle (hObject=0xdc) returned 1 [0183.231] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedcdc100, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xedcdc100, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe1f, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Civic.xml", cAlternateFileName="")) returned 1 [0183.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Civic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\civic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0183.233] GetProcessHeap () returned 0x4e0000 [0183.233] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0183.233] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0183.233] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0183.233] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x1, lpOverlapped=0x0) returned 1 [0183.235] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.235] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.235] GetProcessHeap () returned 0x4e0000 [0183.235] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0183.235] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0183.235] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.235] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0183.235] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0183.236] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0183.236] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0183.236] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0183.236] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0183.236] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.236] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.236] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.236] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xe1f, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xe1f, lpOverlapped=0x0) returned 1 [0183.236] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe20, dwBufLen=0xe20 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe20) returned 1 [0183.236] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.236] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xe20, lpOverlapped=0x0) returned 1 [0183.236] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.236] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xee4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.236] SetEndOfFile (hFile=0xdc) returned 1 [0183.239] GetProcessHeap () returned 0x4e0000 [0183.239] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0183.239] GetProcessHeap () returned 0x4e0000 [0183.239] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0183.239] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Civic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\civic.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Civic.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\civic.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0183.241] CloseHandle (hObject=0xdc) returned 1 [0183.241] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x342eb00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x342eb00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe0f, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Clarity.xml", cAlternateFileName="")) returned 1 [0183.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Clarity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\clarity.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0183.242] GetProcessHeap () returned 0x4e0000 [0183.242] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0183.242] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0183.242] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0183.242] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x1, lpOverlapped=0x0) returned 1 [0183.244] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.244] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.244] GetProcessHeap () returned 0x4e0000 [0183.244] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0183.244] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0183.244] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.244] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0183.244] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0183.244] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0183.244] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0183.244] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0183.244] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0183.244] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.245] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.245] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.245] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xe0f, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xe0f, lpOverlapped=0x0) returned 1 [0183.245] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe10, dwBufLen=0xe10 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe10) returned 1 [0183.245] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.245] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xe10, lpOverlapped=0x0) returned 1 [0183.245] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.245] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xee4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.245] SetEndOfFile (hFile=0xdc) returned 1 [0183.248] GetProcessHeap () returned 0x4e0000 [0183.248] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0183.248] GetProcessHeap () returned 0x4e0000 [0183.248] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0183.248] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Clarity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\clarity.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Clarity.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\clarity.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0183.249] CloseHandle (hObject=0xdc) returned 1 [0183.249] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11910700, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11910700, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe0e, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Composite.xml", cAlternateFileName="COMPOS~1.XML")) returned 1 [0183.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Composite.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\composite.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0183.251] GetProcessHeap () returned 0x4e0000 [0183.251] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0183.251] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0183.251] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0183.251] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0183.253] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.253] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.253] GetProcessHeap () returned 0x4e0000 [0183.253] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0183.253] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0183.253] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.253] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0183.254] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0183.254] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0183.254] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0183.254] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0183.254] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0183.254] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.254] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.254] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.254] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xe0e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xe0e, lpOverlapped=0x0) returned 1 [0183.254] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe10, dwBufLen=0xe10 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe10) returned 1 [0183.254] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.254] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xe10, lpOverlapped=0x0) returned 1 [0183.255] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.255] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xee4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.255] SetEndOfFile (hFile=0xdc) returned 1 [0183.257] GetProcessHeap () returned 0x4e0000 [0183.257] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0183.257] GetProcessHeap () returned 0x4e0000 [0183.257] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0183.257] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Composite.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\composite.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Composite.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\composite.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0183.259] CloseHandle (hObject=0xdc) returned 1 [0183.259] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeefeee00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeefeee00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xdc6, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Concourse.xml", cAlternateFileName="CONCOU~1.XML")) returned 1 [0183.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Concourse.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\concourse.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0183.261] GetProcessHeap () returned 0x4e0000 [0183.261] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0183.261] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0183.261] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0183.261] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0183.275] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.276] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.276] GetProcessHeap () returned 0x4e0000 [0183.276] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0183.276] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0183.276] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.276] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0183.276] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0183.276] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0183.276] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0183.276] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0183.276] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0183.276] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.276] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.276] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.277] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xdc6, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xdc6, lpOverlapped=0x0) returned 1 [0183.277] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xdd0, dwBufLen=0xdd0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xdd0) returned 1 [0183.277] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.277] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xdd0, lpOverlapped=0x0) returned 1 [0183.277] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.277] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xea4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.277] SetEndOfFile (hFile=0xdc) returned 1 [0183.280] GetProcessHeap () returned 0x4e0000 [0183.280] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0183.280] GetProcessHeap () returned 0x4e0000 [0183.280] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0183.280] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Concourse.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\concourse.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Concourse.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\concourse.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0183.282] CloseHandle (hObject=0xdc) returned 1 [0183.282] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13f36100, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x13f36100, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xefc, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Couture.xml", cAlternateFileName="")) returned 1 [0183.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Couture.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\couture.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0183.284] GetProcessHeap () returned 0x4e0000 [0183.284] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0183.284] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0183.284] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0183.284] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0183.286] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.286] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.286] GetProcessHeap () returned 0x4e0000 [0183.286] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0183.287] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0183.287] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.287] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0183.287] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0183.287] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0183.287] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0183.287] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0183.287] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0183.287] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.287] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.287] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.287] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xefc, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xefc, lpOverlapped=0x0) returned 1 [0183.287] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xf00, dwBufLen=0xf00 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xf00) returned 1 [0183.288] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.288] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xf00, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xf00, lpOverlapped=0x0) returned 1 [0183.288] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.288] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xfd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.288] SetEndOfFile (hFile=0xdc) returned 1 [0183.290] GetProcessHeap () returned 0x4e0000 [0183.290] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0183.291] GetProcessHeap () returned 0x4e0000 [0183.291] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0183.291] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Couture.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\couture.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Couture.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\couture.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0183.292] CloseHandle (hObject=0xdc) returned 1 [0183.293] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15248e00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15248e00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe48, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Elemental.xml", cAlternateFileName="ELEMEN~1.XML")) returned 1 [0183.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Elemental.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\elemental.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0183.294] GetProcessHeap () returned 0x4e0000 [0183.294] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0183.294] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0183.294] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0183.294] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0183.296] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.296] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.296] GetProcessHeap () returned 0x4e0000 [0183.296] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0183.296] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0183.296] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.296] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0183.297] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0183.297] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0183.297] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0183.297] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0183.297] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0183.297] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.297] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.297] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.297] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xe48, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xe48, lpOverlapped=0x0) returned 1 [0183.297] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe50, dwBufLen=0xe50 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe50) returned 1 [0183.297] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.297] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe50, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xe50, lpOverlapped=0x0) returned 1 [0183.298] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.298] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xf24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.298] SetEndOfFile (hFile=0xdc) returned 1 [0183.301] GetProcessHeap () returned 0x4e0000 [0183.301] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0183.301] GetProcessHeap () returned 0x4e0000 [0183.301] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0183.301] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Elemental.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\elemental.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Elemental.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\elemental.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0183.303] CloseHandle (hObject=0xdc) returned 1 [0183.303] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0301b00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf0301b00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xef5, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Equity.xml", cAlternateFileName="")) returned 1 [0183.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Equity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\equity.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0183.304] GetProcessHeap () returned 0x4e0000 [0183.304] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0183.304] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0183.304] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0183.304] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xb, lpOverlapped=0x0) returned 1 [0183.350] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.350] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.350] GetProcessHeap () returned 0x4e0000 [0183.350] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0183.350] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0183.350] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.350] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0183.350] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0183.350] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0183.350] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0183.350] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0183.351] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0183.351] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.351] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.351] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.351] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xef5, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xef5, lpOverlapped=0x0) returned 1 [0183.351] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xf00, dwBufLen=0xf00 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xf00) returned 1 [0183.351] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.351] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xf00, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xf00, lpOverlapped=0x0) returned 1 [0183.351] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.351] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xfc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.351] SetEndOfFile (hFile=0xdc) returned 1 [0183.354] GetProcessHeap () returned 0x4e0000 [0183.354] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0183.354] GetProcessHeap () returned 0x4e0000 [0183.354] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0183.354] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Equity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\equity.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Equity.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\equity.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0183.356] CloseHandle (hObject=0xdc) returned 1 [0183.356] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4741800, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4741800, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe16, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Essential.xml", cAlternateFileName="ESSENT~1.XML")) returned 1 [0183.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Essential.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\essential.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0183.358] GetProcessHeap () returned 0x4e0000 [0183.358] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0183.358] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0183.358] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0183.358] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0183.360] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.360] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.360] GetProcessHeap () returned 0x4e0000 [0183.360] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0183.360] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0183.360] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.360] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0183.360] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0183.361] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0183.361] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0183.361] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0183.361] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0183.361] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.361] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.361] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.361] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xe16, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xe16, lpOverlapped=0x0) returned 1 [0183.361] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe20, dwBufLen=0xe20 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe20) returned 1 [0183.361] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.361] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xe20, lpOverlapped=0x0) returned 1 [0183.361] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.361] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.362] SetEndOfFile (hFile=0xdc) returned 1 [0183.365] GetProcessHeap () returned 0x4e0000 [0183.365] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0183.365] GetProcessHeap () returned 0x4e0000 [0183.365] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0183.365] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Essential.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\essential.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Essential.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\essential.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0183.369] CloseHandle (hObject=0xdc) returned 1 [0183.369] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1655bb00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1655bb00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe2f, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Executive.xml", cAlternateFileName="EXECUT~1.XML")) returned 1 [0183.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Executive.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\executive.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0183.370] GetProcessHeap () returned 0x4e0000 [0183.370] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0183.370] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0183.370] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0183.370] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x1, lpOverlapped=0x0) returned 1 [0183.372] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.372] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.372] GetProcessHeap () returned 0x4e0000 [0183.373] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0183.373] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0183.373] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.373] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0183.373] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0183.373] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0183.373] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0183.373] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0183.373] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0183.373] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.373] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.373] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.373] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xe2f, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xe2f, lpOverlapped=0x0) returned 1 [0183.373] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe30, dwBufLen=0xe30 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe30) returned 1 [0183.374] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.374] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xe30, lpOverlapped=0x0) returned 1 [0183.374] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.374] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xf04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.374] SetEndOfFile (hFile=0xdc) returned 1 [0183.376] GetProcessHeap () returned 0x4e0000 [0183.376] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0183.377] GetProcessHeap () returned 0x4e0000 [0183.377] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0183.377] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Executive.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\executive.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Executive.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\executive.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0183.378] CloseHandle (hObject=0xdc) returned 1 [0183.378] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2927500, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2927500, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xdb5, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Flow.xml", cAlternateFileName="")) returned 1 [0183.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Flow.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\flow.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0183.380] GetProcessHeap () returned 0x4e0000 [0183.380] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0183.380] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0183.380] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0183.380] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xb, lpOverlapped=0x0) returned 1 [0183.382] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.382] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.382] GetProcessHeap () returned 0x4e0000 [0183.382] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0183.382] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0183.382] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.382] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0183.382] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0183.382] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0183.382] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0183.382] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0183.382] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0183.383] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.383] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.383] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.383] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xdb5, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xdb5, lpOverlapped=0x0) returned 1 [0183.383] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xdc0, dwBufLen=0xdc0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xdc0) returned 1 [0183.383] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.383] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xdc0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xdc0, lpOverlapped=0x0) returned 1 [0183.383] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.383] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xe84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.383] SetEndOfFile (hFile=0xdc) returned 1 [0183.386] GetProcessHeap () returned 0x4e0000 [0183.386] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0183.386] GetProcessHeap () returned 0x4e0000 [0183.386] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0183.386] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Flow.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\flow.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Flow.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\flow.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0183.387] CloseHandle (hObject=0xdc) returned 1 [0183.387] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1614800, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf1614800, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xed4, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Foundry.xml", cAlternateFileName="")) returned 1 [0183.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Foundry.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\foundry.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0183.389] GetProcessHeap () returned 0x4e0000 [0183.389] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0183.389] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0183.389] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0183.389] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0183.448] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.448] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.448] GetProcessHeap () returned 0x4e0000 [0183.448] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0183.448] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0183.448] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.448] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0183.448] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0183.448] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0183.449] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0183.449] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0183.449] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0183.449] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.449] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.449] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.449] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xed4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xed4, lpOverlapped=0x0) returned 1 [0183.449] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xee0, dwBufLen=0xee0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xee0) returned 1 [0183.449] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.449] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xee0, lpOverlapped=0x0) returned 1 [0183.449] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.449] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xfb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.449] SetEndOfFile (hFile=0xdc) returned 1 [0183.452] GetProcessHeap () returned 0x4e0000 [0183.452] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0183.452] GetProcessHeap () returned 0x4e0000 [0183.452] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0183.452] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Foundry.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\foundry.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Foundry.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\foundry.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0183.454] CloseHandle (hObject=0xdc) returned 1 [0183.454] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a54500, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a54500, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe59, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Grid.xml", cAlternateFileName="")) returned 1 [0183.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Grid.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\grid.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0183.462] GetProcessHeap () returned 0x4e0000 [0183.462] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0183.462] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0183.462] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0183.462] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x7, lpOverlapped=0x0) returned 1 [0183.485] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.485] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.485] GetProcessHeap () returned 0x4e0000 [0183.485] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0183.485] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0183.485] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.485] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0183.485] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0183.485] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0183.485] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0183.485] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0183.486] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0183.486] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.486] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.486] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.486] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xe59, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xe59, lpOverlapped=0x0) returned 1 [0183.486] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe60, dwBufLen=0xe60 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe60) returned 1 [0183.486] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.486] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe60, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xe60, lpOverlapped=0x0) returned 1 [0183.486] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.486] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xf24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.486] SetEndOfFile (hFile=0xdc) returned 1 [0183.501] GetProcessHeap () returned 0x4e0000 [0183.501] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0183.502] GetProcessHeap () returned 0x4e0000 [0183.502] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0183.502] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Grid.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\grid.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Grid.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\grid.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0183.504] CloseHandle (hObject=0xdc) returned 1 [0183.504] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d67200, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d67200, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xf09, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Hardcover.xml", cAlternateFileName="HARDCO~1.XML")) returned 1 [0183.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Hardcover.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\hardcover.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0183.506] GetProcessHeap () returned 0x4e0000 [0183.506] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0183.506] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0183.506] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0183.506] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x7, lpOverlapped=0x0) returned 1 [0183.508] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.508] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.508] GetProcessHeap () returned 0x4e0000 [0183.508] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0183.508] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0183.508] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.508] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0183.508] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0183.509] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0183.509] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0183.509] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0183.509] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0183.509] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.509] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.509] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.509] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xf09, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xf09, lpOverlapped=0x0) returned 1 [0183.509] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xf10, dwBufLen=0xf10 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xf10) returned 1 [0183.509] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.509] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xf10, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xf10, lpOverlapped=0x0) returned 1 [0183.509] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.509] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xfe4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.509] SetEndOfFile (hFile=0xdc) returned 1 [0183.512] GetProcessHeap () returned 0x4e0000 [0183.512] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0183.512] GetProcessHeap () returned 0x4e0000 [0183.512] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0183.512] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Hardcover.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\hardcover.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Hardcover.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\hardcover.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0183.514] CloseHandle (hObject=0xdc) returned 1 [0183.514] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1786e800, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1786e800, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe2a, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Horizon.xml", cAlternateFileName="")) returned 1 [0183.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Horizon.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\horizon.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0183.515] GetProcessHeap () returned 0x4e0000 [0183.515] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0183.515] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0183.515] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0183.515] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0183.525] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.525] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.525] GetProcessHeap () returned 0x4e0000 [0183.525] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0183.525] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0183.525] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.525] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0183.526] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0183.526] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0183.526] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0183.526] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0183.527] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0183.527] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.527] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.527] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.527] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xe2a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xe2a, lpOverlapped=0x0) returned 1 [0183.527] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe30, dwBufLen=0xe30 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe30) returned 1 [0183.527] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.527] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xe30, lpOverlapped=0x0) returned 1 [0183.527] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.527] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xf04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.527] SetEndOfFile (hFile=0xdc) returned 1 [0183.530] GetProcessHeap () returned 0x4e0000 [0183.530] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0183.530] GetProcessHeap () returned 0x4e0000 [0183.530] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0183.530] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Horizon.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\horizon.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Horizon.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\horizon.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0183.532] CloseHandle (hObject=0xdc) returned 1 [0183.532] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3c3a200, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3c3a200, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xeed, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Median.xml", cAlternateFileName="")) returned 1 [0183.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Median.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\median.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0183.534] GetProcessHeap () returned 0x4e0000 [0183.534] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0183.534] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0183.534] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0183.534] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x3, lpOverlapped=0x0) returned 1 [0183.536] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.536] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.536] GetProcessHeap () returned 0x4e0000 [0183.536] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0183.536] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0183.537] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.537] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0183.537] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0183.537] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0183.537] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0183.537] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0183.537] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0183.537] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.537] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.537] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.537] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xeed, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xeed, lpOverlapped=0x0) returned 1 [0183.537] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xef0, dwBufLen=0xef0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xef0) returned 1 [0183.537] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.538] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xef0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xef0, lpOverlapped=0x0) returned 1 [0183.538] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.538] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xfb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.538] SetEndOfFile (hFile=0xdc) returned 1 [0183.540] GetProcessHeap () returned 0x4e0000 [0183.541] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0183.541] GetProcessHeap () returned 0x4e0000 [0183.541] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0183.541] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Median.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\median.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Median.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\median.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0183.542] CloseHandle (hObject=0xdc) returned 1 [0183.542] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4f4cf00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4f4cf00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe13, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Metro.xml", cAlternateFileName="")) returned 1 [0183.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Metro.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\metro.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0183.544] GetProcessHeap () returned 0x4e0000 [0183.544] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0183.544] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0183.544] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0183.544] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xd, lpOverlapped=0x0) returned 1 [0183.547] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.547] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.547] GetProcessHeap () returned 0x4e0000 [0183.548] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0183.548] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0183.548] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.548] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0183.548] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0183.548] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0183.548] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0183.548] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0183.548] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0183.548] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.548] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.548] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.548] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xe13, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xe13, lpOverlapped=0x0) returned 1 [0183.549] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe20, dwBufLen=0xe20 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe20) returned 1 [0183.549] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.549] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xe20, lpOverlapped=0x0) returned 1 [0183.549] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.549] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xee4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.549] SetEndOfFile (hFile=0xdc) returned 1 [0183.552] GetProcessHeap () returned 0x4e0000 [0183.552] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0183.552] GetProcessHeap () returned 0x4e0000 [0183.552] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0183.552] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Metro.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\metro.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Metro.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\metro.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0183.554] CloseHandle (hObject=0xdc) returned 1 [0183.554] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf625fc00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf625fc00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe05, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Module.xml", cAlternateFileName="")) returned 1 [0183.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Module.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\module.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0183.556] GetProcessHeap () returned 0x4e0000 [0183.556] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0183.556] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0183.556] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0183.556] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xb, lpOverlapped=0x0) returned 1 [0183.558] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.558] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.558] GetProcessHeap () returned 0x4e0000 [0183.558] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0183.558] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0183.558] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.558] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0183.558] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0183.558] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0183.558] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0183.558] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0183.558] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0183.559] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.559] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.559] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.559] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xe05, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xe05, lpOverlapped=0x0) returned 1 [0183.559] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe10, dwBufLen=0xe10 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe10) returned 1 [0183.559] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.559] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xe10, lpOverlapped=0x0) returned 1 [0183.559] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.559] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.559] SetEndOfFile (hFile=0xdc) returned 1 [0183.562] GetProcessHeap () returned 0x4e0000 [0183.562] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0183.562] GetProcessHeap () returned 0x4e0000 [0183.562] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0183.562] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Module.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\module.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Module.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\module.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0183.564] CloseHandle (hObject=0xdc) returned 1 [0183.564] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18b81500, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18b81500, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe39, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Newsprint.xml", cAlternateFileName="NEWSPR~1.XML")) returned 1 [0183.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Newsprint.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\newsprint.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0183.565] GetProcessHeap () returned 0x4e0000 [0183.565] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0183.565] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0183.565] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0183.565] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x7, lpOverlapped=0x0) returned 1 [0183.567] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.567] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.567] GetProcessHeap () returned 0x4e0000 [0183.567] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0183.567] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0183.567] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.567] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0183.568] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0183.568] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0183.568] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0183.568] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0183.568] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0183.568] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.568] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.568] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.568] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xe39, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xe39, lpOverlapped=0x0) returned 1 [0183.568] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe40, dwBufLen=0xe40 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe40) returned 1 [0183.569] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.569] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xe40, lpOverlapped=0x0) returned 1 [0183.569] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.569] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xf14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.569] SetEndOfFile (hFile=0xdc) returned 1 [0183.571] GetProcessHeap () returned 0x4e0000 [0183.572] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0183.572] GetProcessHeap () returned 0x4e0000 [0183.572] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0183.572] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Newsprint.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\newsprint.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Newsprint.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\newsprint.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0183.574] CloseHandle (hObject=0xdc) returned 1 [0183.574] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe70d00, ftCreationTime.dwHighDateTime=0x1c9b824, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xefe70d00, ftLastWriteTime.dwHighDateTime=0x1c9b824, nFileSizeHigh=0x0, nFileSizeLow=0xe15, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Office 2.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0183.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office 2.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office 2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0183.576] GetProcessHeap () returned 0x4e0000 [0183.576] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0183.576] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0183.576] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0183.576] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xb, lpOverlapped=0x0) returned 1 [0183.604] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.604] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.605] GetProcessHeap () returned 0x4e0000 [0183.605] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0183.605] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0183.605] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.605] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0183.605] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0183.605] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0183.605] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0183.605] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0183.605] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0183.606] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.606] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.606] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.606] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xe15, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xe15, lpOverlapped=0x0) returned 1 [0183.606] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe20, dwBufLen=0xe20 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe20) returned 1 [0183.606] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.606] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xe20, lpOverlapped=0x0) returned 1 [0183.606] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.606] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.606] SetEndOfFile (hFile=0xdc) returned 1 [0183.610] GetProcessHeap () returned 0x4e0000 [0183.610] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0183.610] GetProcessHeap () returned 0x4e0000 [0183.610] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0183.610] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office 2.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office 2.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office 2.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office 2.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0183.614] CloseHandle (hObject=0xdc) returned 1 [0183.614] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe70d00, ftCreationTime.dwHighDateTime=0x1c9b824, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xefe70d00, ftLastWriteTime.dwHighDateTime=0x1c9b824, nFileSizeHigh=0x0, nFileSizeLow=0xe01, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Office Classic 2.xml", cAlternateFileName="OFFICE~3.XML")) returned 1 [0183.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic 2.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic 2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0183.656] GetProcessHeap () returned 0x4e0000 [0183.656] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0183.656] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0183.657] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0183.657] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xf, lpOverlapped=0x0) returned 1 [0183.662] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.662] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.663] GetProcessHeap () returned 0x4e0000 [0183.663] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x50) returned 0x4fd470 [0183.663] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fd470*, pdwDataLen=0x24df238*=0x50, dwBufLen=0x50 | out: pbData=0x4fd470*, pdwDataLen=0x24df238*=0x50) returned 1 [0183.663] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.663] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd470*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd470*, lpNumberOfBytesWritten=0x24df258*=0x50, lpOverlapped=0x0) returned 1 [0183.663] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0183.663] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0183.663] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0183.663] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0183.663] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0183.664] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.664] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.664] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.664] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xe01, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xe01, lpOverlapped=0x0) returned 1 [0183.664] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe10, dwBufLen=0xe10 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe10) returned 1 [0183.664] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.664] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xe10, lpOverlapped=0x0) returned 1 [0183.664] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.664] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.664] SetEndOfFile (hFile=0xdc) returned 1 [0183.667] GetProcessHeap () returned 0x4e0000 [0183.667] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fd470 | out: hHeap=0x4e0000) returned 1 [0183.667] GetProcessHeap () returned 0x4e0000 [0183.667] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0183.668] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic 2.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic 2.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic 2.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic 2.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0183.670] CloseHandle (hObject=0xdc) returned 1 [0183.670] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe70d00, ftCreationTime.dwHighDateTime=0x1c9b824, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xefe70d00, ftLastWriteTime.dwHighDateTime=0x1c9b824, nFileSizeHigh=0x0, nFileSizeLow=0xe20, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Office Classic.xml", cAlternateFileName="OFFICE~2.XML")) returned 1 [0183.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0183.671] GetProcessHeap () returned 0x4e0000 [0183.671] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0183.672] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0183.672] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0183.672] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.672] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.672] GetProcessHeap () returned 0x4e0000 [0183.672] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0183.672] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0183.672] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.672] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0183.674] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0183.675] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0183.675] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0183.675] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0183.675] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0183.675] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.675] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.675] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.675] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xe20, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xe20, lpOverlapped=0x0) returned 1 [0183.675] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe20, dwBufLen=0xe20 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe20) returned 1 [0183.675] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.675] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xe20, lpOverlapped=0x0) returned 1 [0183.675] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.675] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.675] SetEndOfFile (hFile=0xdc) returned 1 [0183.677] GetProcessHeap () returned 0x4e0000 [0183.677] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0183.678] GetProcessHeap () returned 0x4e0000 [0183.678] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0183.678] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0183.680] CloseHandle (hObject=0xdc) returned 1 [0183.680] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7572900, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7572900, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe1d, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Opulent.xml", cAlternateFileName="")) returned 1 [0183.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Opulent.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\opulent.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0183.681] GetProcessHeap () returned 0x4e0000 [0183.681] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0183.681] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0183.681] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0183.681] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x3, lpOverlapped=0x0) returned 1 [0183.683] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.683] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.683] GetProcessHeap () returned 0x4e0000 [0183.683] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0183.683] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0183.683] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.683] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0183.683] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0183.683] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0183.683] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0183.684] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0183.684] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0183.684] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.684] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.684] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.684] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xe1d, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xe1d, lpOverlapped=0x0) returned 1 [0183.684] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe20, dwBufLen=0xe20 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe20) returned 1 [0183.684] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.684] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xe20, lpOverlapped=0x0) returned 1 [0183.684] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.684] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.684] SetEndOfFile (hFile=0xdc) returned 1 [0183.686] GetProcessHeap () returned 0x4e0000 [0183.686] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0183.686] GetProcessHeap () returned 0x4e0000 [0183.686] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0183.686] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Opulent.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\opulent.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Opulent.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\opulent.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0183.687] CloseHandle (hObject=0xdc) returned 1 [0183.688] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8885600, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf8885600, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe5a, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Oriel.xml", cAlternateFileName="")) returned 1 [0183.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\oriel.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0183.688] GetProcessHeap () returned 0x4e0000 [0183.688] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0183.689] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0183.689] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0183.689] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0183.691] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.691] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.691] GetProcessHeap () returned 0x4e0000 [0183.691] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0183.691] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0183.691] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.691] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0183.691] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0183.691] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0183.691] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0183.691] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0183.691] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0183.691] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.691] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.691] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.691] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xe5a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xe5a, lpOverlapped=0x0) returned 1 [0183.691] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe60, dwBufLen=0xe60 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe60) returned 1 [0183.691] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.691] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe60, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xe60, lpOverlapped=0x0) returned 1 [0183.692] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.692] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xf24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.692] SetEndOfFile (hFile=0xdc) returned 1 [0183.694] GetProcessHeap () returned 0x4e0000 [0183.694] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0183.694] GetProcessHeap () returned 0x4e0000 [0183.694] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0183.694] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\oriel.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\oriel.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0183.695] CloseHandle (hObject=0xdc) returned 1 [0183.695] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9b98300, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9b98300, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xeed, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Origin.xml", cAlternateFileName="")) returned 1 [0183.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Origin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\origin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0183.695] GetProcessHeap () returned 0x4e0000 [0183.696] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0183.696] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0183.696] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0183.696] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x3, lpOverlapped=0x0) returned 1 [0183.698] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.698] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.698] GetProcessHeap () returned 0x4e0000 [0183.698] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0183.698] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0183.698] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.698] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0183.698] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0183.698] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0183.698] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0183.698] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0183.698] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0183.698] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.699] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.699] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.699] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xeed, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xeed, lpOverlapped=0x0) returned 1 [0183.699] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xef0, dwBufLen=0xef0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xef0) returned 1 [0183.699] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.699] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xef0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xef0, lpOverlapped=0x0) returned 1 [0183.699] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.699] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xfb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.699] SetEndOfFile (hFile=0xdc) returned 1 [0183.701] GetProcessHeap () returned 0x4e0000 [0183.701] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0183.701] GetProcessHeap () returned 0x4e0000 [0183.701] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0183.701] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Origin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\origin.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Origin.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\origin.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0183.702] CloseHandle (hObject=0xdc) returned 1 [0183.702] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaeab000, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfaeab000, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe2c, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Paper.xml", cAlternateFileName="")) returned 1 [0183.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Paper.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\paper.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0183.703] GetProcessHeap () returned 0x4e0000 [0183.703] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0183.703] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0183.703] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0183.703] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0183.705] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.705] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.705] GetProcessHeap () returned 0x4e0000 [0183.705] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0183.705] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0183.705] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.705] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0183.705] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0183.705] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0183.705] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0183.706] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0183.706] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0183.706] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.706] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.706] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.706] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xe2c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xe2c, lpOverlapped=0x0) returned 1 [0183.706] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe30, dwBufLen=0xe30 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe30) returned 1 [0183.706] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.706] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xe30, lpOverlapped=0x0) returned 1 [0183.706] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.706] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.706] SetEndOfFile (hFile=0xdc) returned 1 [0183.709] GetProcessHeap () returned 0x4e0000 [0183.709] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0183.709] GetProcessHeap () returned 0x4e0000 [0183.709] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0183.709] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Paper.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\paper.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Paper.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\paper.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0183.710] CloseHandle (hObject=0xdc) returned 1 [0183.710] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8079f00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8079f00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe0f, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Perspective.xml", cAlternateFileName="PERSPE~1.XML")) returned 1 [0183.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Perspective.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\perspective.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0183.711] GetProcessHeap () returned 0x4e0000 [0183.711] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0183.711] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0183.711] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0183.711] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x1, lpOverlapped=0x0) returned 1 [0183.712] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.712] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.712] GetProcessHeap () returned 0x4e0000 [0183.713] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0183.713] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0183.713] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.713] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0183.713] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0183.713] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0183.713] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0183.713] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0183.713] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0183.713] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.713] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.713] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.713] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xe0f, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xe0f, lpOverlapped=0x0) returned 1 [0183.713] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe10, dwBufLen=0xe10 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe10) returned 1 [0183.713] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.713] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xe10, lpOverlapped=0x0) returned 1 [0183.713] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.713] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xee4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.714] SetEndOfFile (hFile=0xdc) returned 1 [0183.716] GetProcessHeap () returned 0x4e0000 [0183.716] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0183.716] GetProcessHeap () returned 0x4e0000 [0183.716] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0183.716] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Perspective.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\perspective.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Perspective.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\perspective.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0183.717] CloseHandle (hObject=0xdc) returned 1 [0183.717] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x938cc00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x938cc00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe7f, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Pushpin.xml", cAlternateFileName="")) returned 1 [0183.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Pushpin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\pushpin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0183.719] GetProcessHeap () returned 0x4e0000 [0183.719] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0183.719] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0183.719] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0183.719] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x1, lpOverlapped=0x0) returned 1 [0183.722] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.722] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.722] GetProcessHeap () returned 0x4e0000 [0183.722] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0183.722] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0183.722] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.722] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0183.722] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0183.722] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0183.722] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0183.722] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0183.722] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0183.722] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.722] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.722] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.723] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xe7f, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xe7f, lpOverlapped=0x0) returned 1 [0183.723] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe80, dwBufLen=0xe80 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe80) returned 1 [0183.723] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.723] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xe80, lpOverlapped=0x0) returned 1 [0183.723] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.723] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xf54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.723] SetEndOfFile (hFile=0xdc) returned 1 [0183.725] GetProcessHeap () returned 0x4e0000 [0183.725] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0183.725] GetProcessHeap () returned 0x4e0000 [0183.726] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0183.726] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Pushpin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\pushpin.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Pushpin.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\pushpin.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0183.727] CloseHandle (hObject=0xdc) returned 1 [0183.727] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b1a6f00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b1a6f00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe18, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Slipstream.xml", cAlternateFileName="SLIPST~1.XML")) returned 1 [0183.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Slipstream.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\slipstream.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0183.728] GetProcessHeap () returned 0x4e0000 [0183.728] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0183.728] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0183.728] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0183.729] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0183.731] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.731] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.731] GetProcessHeap () returned 0x4e0000 [0183.731] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0183.731] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0183.731] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.731] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0183.731] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0183.731] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0183.731] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0183.731] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0183.731] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0183.731] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.731] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.731] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.732] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xe18, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xe18, lpOverlapped=0x0) returned 1 [0183.732] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe20, dwBufLen=0xe20 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe20) returned 1 [0183.732] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.732] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xe20, lpOverlapped=0x0) returned 1 [0183.732] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.732] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.732] SetEndOfFile (hFile=0xdc) returned 1 [0183.735] GetProcessHeap () returned 0x4e0000 [0183.735] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0183.735] GetProcessHeap () returned 0x4e0000 [0183.735] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0183.735] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Slipstream.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\slipstream.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Slipstream.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\slipstream.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0183.736] CloseHandle (hObject=0xdc) returned 1 [0183.736] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc1bdd00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc1bdd00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xee9, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Solstice.xml", cAlternateFileName="")) returned 1 [0183.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Solstice.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\solstice.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0183.739] GetProcessHeap () returned 0x4e0000 [0183.739] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0183.739] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0183.739] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0183.740] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x7, lpOverlapped=0x0) returned 1 [0183.742] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.742] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.742] GetProcessHeap () returned 0x4e0000 [0183.742] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0183.742] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0183.742] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.742] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0183.742] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0183.742] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0183.742] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0183.742] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0183.742] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0183.743] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.743] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.743] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.743] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xee9, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xee9, lpOverlapped=0x0) returned 1 [0183.743] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xef0, dwBufLen=0xef0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xef0) returned 1 [0183.743] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.743] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xef0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xef0, lpOverlapped=0x0) returned 1 [0183.743] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.743] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xfc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.743] SetEndOfFile (hFile=0xdc) returned 1 [0183.746] GetProcessHeap () returned 0x4e0000 [0183.746] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0183.746] GetProcessHeap () returned 0x4e0000 [0183.746] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0183.746] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Solstice.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\solstice.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Solstice.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\solstice.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0183.748] CloseHandle (hObject=0xdc) returned 1 [0183.749] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd4d0a00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd4d0a00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe13, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Technic.xml", cAlternateFileName="")) returned 1 [0183.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Technic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\technic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0183.750] GetProcessHeap () returned 0x4e0000 [0183.750] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0183.750] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0183.750] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0183.750] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xd, lpOverlapped=0x0) returned 1 [0183.778] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.778] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.778] GetProcessHeap () returned 0x4e0000 [0183.778] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0183.778] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0183.778] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.778] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0183.778] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0183.778] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0183.778] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0183.778] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0183.779] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0183.779] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.779] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.779] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.779] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xe13, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xe13, lpOverlapped=0x0) returned 1 [0183.779] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe20, dwBufLen=0xe20 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe20) returned 1 [0183.779] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.779] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xe20, lpOverlapped=0x0) returned 1 [0183.779] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.779] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.779] SetEndOfFile (hFile=0xdc) returned 1 [0183.781] GetProcessHeap () returned 0x4e0000 [0183.781] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0183.781] GetProcessHeap () returned 0x4e0000 [0183.781] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0183.781] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Technic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\technic.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Technic.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\technic.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0183.783] CloseHandle (hObject=0xdc) returned 1 [0183.783] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa69f900, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x6187c750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa69f900, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xeff, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Thatch.xml", cAlternateFileName="")) returned 1 [0183.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Thatch.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\thatch.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0183.785] GetProcessHeap () returned 0x4e0000 [0183.785] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0183.785] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0183.785] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0183.785] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x1, lpOverlapped=0x0) returned 1 [0183.787] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.787] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.787] GetProcessHeap () returned 0x4e0000 [0183.787] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0183.787] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0183.787] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.787] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0183.787] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0183.787] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0183.787] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0183.787] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0183.788] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0183.788] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.788] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.788] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.788] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xeff, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xeff, lpOverlapped=0x0) returned 1 [0183.788] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xf00, dwBufLen=0xf00 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xf00) returned 1 [0183.788] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.788] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xf00, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xf00, lpOverlapped=0x0) returned 1 [0183.788] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.788] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xfc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.788] SetEndOfFile (hFile=0xdc) returned 1 [0183.790] GetProcessHeap () returned 0x4e0000 [0183.790] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0183.790] GetProcessHeap () returned 0x4e0000 [0183.790] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0183.790] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Thatch.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\thatch.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Thatch.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\thatch.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0183.792] CloseHandle (hObject=0xdc) returned 1 [0183.792] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd4d0a00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd4d0a00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe20, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Trek.xml", cAlternateFileName="")) returned 1 [0183.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Trek.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\trek.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0183.793] GetProcessHeap () returned 0x4e0000 [0183.794] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0183.794] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0183.794] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0183.794] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.794] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.794] GetProcessHeap () returned 0x4e0000 [0183.794] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0183.794] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0183.794] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.794] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0183.796] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0183.796] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0183.796] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0183.796] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0183.796] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0183.796] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.796] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.796] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.796] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xe20, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xe20, lpOverlapped=0x0) returned 1 [0183.796] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe20, dwBufLen=0xe20 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe20) returned 1 [0183.796] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.796] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xe20, lpOverlapped=0x0) returned 1 [0183.796] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.796] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xee4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.796] SetEndOfFile (hFile=0xdc) returned 1 [0183.798] GetProcessHeap () returned 0x4e0000 [0183.798] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0183.799] GetProcessHeap () returned 0x4e0000 [0183.799] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0183.799] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Trek.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\trek.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Trek.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\trek.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0183.800] CloseHandle (hObject=0xdc) returned 1 [0183.800] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe7e3700, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe7e3700, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe19, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Urban.xml", cAlternateFileName="")) returned 1 [0183.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Urban.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\urban.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0183.802] GetProcessHeap () returned 0x4e0000 [0183.802] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0183.802] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0183.802] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0183.802] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x7, lpOverlapped=0x0) returned 1 [0183.804] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.804] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.804] GetProcessHeap () returned 0x4e0000 [0183.804] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0183.804] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0183.804] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.804] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0183.804] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0183.804] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0183.804] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0183.804] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0183.804] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0183.804] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.804] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.804] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.804] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xe19, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xe19, lpOverlapped=0x0) returned 1 [0183.805] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe20, dwBufLen=0xe20 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe20) returned 1 [0183.805] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.805] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xe20, lpOverlapped=0x0) returned 1 [0183.805] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.805] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xee4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.805] SetEndOfFile (hFile=0xdc) returned 1 [0183.807] GetProcessHeap () returned 0x4e0000 [0183.807] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0183.807] GetProcessHeap () returned 0x4e0000 [0183.807] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0183.807] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Urban.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\urban.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Urban.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\urban.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0183.808] CloseHandle (hObject=0xdc) returned 1 [0183.808] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffaf6400, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xffaf6400, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe14, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Verve.xml", cAlternateFileName="")) returned 1 [0183.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Verve.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\verve.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0183.809] GetProcessHeap () returned 0x4e0000 [0183.809] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0183.809] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0183.810] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0183.810] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0183.812] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.812] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.812] GetProcessHeap () returned 0x4e0000 [0183.812] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0183.812] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df238*=0x30) returned 1 [0183.812] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.812] WriteFile (in: hFile=0xdc, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df258*=0x30, lpOverlapped=0x0) returned 1 [0183.812] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0183.812] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0183.812] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0183.812] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0183.812] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0183.812] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.812] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.812] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.812] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xe14, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xe14, lpOverlapped=0x0) returned 1 [0183.812] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe20, dwBufLen=0xe20 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe20) returned 1 [0183.813] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.813] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xe20, lpOverlapped=0x0) returned 1 [0183.813] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.813] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xee4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.813] SetEndOfFile (hFile=0xdc) returned 1 [0183.815] GetProcessHeap () returned 0x4e0000 [0183.815] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0183.815] GetProcessHeap () returned 0x4e0000 [0183.815] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0183.815] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Verve.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\verve.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Verve.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\verve.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0183.816] CloseHandle (hObject=0xdc) returned 1 [0183.816] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9b2600, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9b2600, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xdf9, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Waveform.xml", cAlternateFileName="")) returned 1 [0183.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Waveform.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\waveform.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0183.817] GetProcessHeap () returned 0x4e0000 [0183.817] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0183.817] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0183.817] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0183.817] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x7, lpOverlapped=0x0) returned 1 [0183.819] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.819] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.819] GetProcessHeap () returned 0x4e0000 [0183.819] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0183.819] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0183.819] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.819] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0183.819] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0183.819] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0183.819] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0183.820] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0183.820] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0183.820] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.820] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.820] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.820] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xdf9, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xdf9, lpOverlapped=0x0) returned 1 [0183.820] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe00, dwBufLen=0xe00 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xe00) returned 1 [0183.820] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.820] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xe00, lpOverlapped=0x0) returned 1 [0183.820] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.820] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.820] SetEndOfFile (hFile=0xdc) returned 1 [0183.822] GetProcessHeap () returned 0x4e0000 [0183.822] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0183.822] GetProcessHeap () returned 0x4e0000 [0183.822] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0183.822] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Waveform.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\waveform.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Waveform.xml.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\waveform.xml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0183.823] CloseHandle (hObject=0xdc) returned 1 [0183.824] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9b2600, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9b2600, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xdf9, dwReserved0=0x4fa050, dwReserved1=0x24df3f8, cFileName="Waveform.xml", cAlternateFileName="")) returned 0 [0183.824] GetProcessHeap () returned 0x4e0000 [0183.824] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0183.824] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df248, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f98) returned 1 [0183.824] CryptDecrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df2b0 | out: pbData=0x4f53d8, pdwDataLen=0x24df2b0) returned 1 [0183.824] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.824] GetProcessHeap () returned 0x4e0000 [0183.824] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0183.824] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df248, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f98) returned 1 [0183.824] CryptDecrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df2b0 | out: pbData=0x4f5420, pdwDataLen=0x24df2b0) returned 1 [0183.824] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.824] GetProcessHeap () returned 0x4e0000 [0183.824] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x522768 [0183.824] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df248, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f98) returned 1 [0183.824] CryptDecrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x522768, pdwDataLen=0x24df2b0 | out: pbData=0x522768, pdwDataLen=0x24df2b0) returned 1 [0183.824] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.824] wsprintfW (in: param_1=0x24de28c, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\readme-warning.txt") returned 83 [0183.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\readme-warning.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0183.825] WriteFile (in: hFile=0xdc, lpBuffer=0x522768*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24de288, lpOverlapped=0x0 | out: lpBuffer=0x522768*, lpNumberOfBytesWritten=0x24de288*=0x6c3, lpOverlapped=0x0) returned 1 [0183.826] CloseHandle (hObject=0xdc) returned 1 [0183.826] GetProcessHeap () returned 0x4e0000 [0183.826] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x522768 | out: hHeap=0x4e0000) returned 1 [0183.826] GetProcessHeap () returned 0x4e0000 [0183.826] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0183.826] GetProcessHeap () returned 0x4e0000 [0183.826] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0183.826] FindClose (in: hFindFile=0x522f58 | out: hFindFile=0x522f58) returned 1 [0183.826] GetProcessHeap () returned 0x4e0000 [0183.826] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x541088 | out: hHeap=0x4e0000) returned 1 [0183.827] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x334aca00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c88fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x334aca00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x2a23c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Trek.thmx", cAlternateFileName="TREK~1.THM")) returned 1 [0183.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Trek.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\trek.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0183.827] GetProcessHeap () returned 0x4e0000 [0183.827] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0183.827] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0183.828] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0183.828] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0183.831] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0183.831] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.831] GetProcessHeap () returned 0x4e0000 [0183.831] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0183.831] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df4c8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df4c8*=0x30) returned 1 [0183.831] CryptDestroyKey (hKey=0x522f58) returned 1 [0183.831] WriteFile (in: hFile=0x110, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df4e8*=0x30, lpOverlapped=0x0) returned 1 [0183.831] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0183.831] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0183.831] WriteFile (in: hFile=0x110, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0183.831] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0183.831] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0183.831] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0183.831] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.831] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.831] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2a23c, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0x2a23c, lpOverlapped=0x0) returned 1 [0183.833] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x2a240, dwBufLen=0x2a240 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x2a240) returned 1 [0183.835] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.835] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2a240, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0x2a240, lpOverlapped=0x0) returned 1 [0183.836] CryptDestroyKey (hKey=0x522f58) returned 1 [0183.836] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x2a304, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.836] SetEndOfFile (hFile=0x110) returned 1 [0183.839] GetProcessHeap () returned 0x4e0000 [0183.839] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0183.839] GetProcessHeap () returned 0x4e0000 [0183.839] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0183.839] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Trek.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\trek.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Trek.thmx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\trek.thmx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0183.840] CloseHandle (hObject=0x110) returned 1 [0183.840] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36de5100, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x36de5100, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xfc70, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Urban.thmx", cAlternateFileName="URBAN~1.THM")) returned 1 [0183.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Urban.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\urban.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0183.841] GetProcessHeap () returned 0x4e0000 [0183.842] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0183.842] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0183.842] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0183.842] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0183.842] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.842] GetProcessHeap () returned 0x4e0000 [0183.842] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0183.842] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df4c8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df4c8*=0x30) returned 1 [0183.842] CryptDestroyKey (hKey=0x522f58) returned 1 [0183.842] WriteFile (in: hFile=0x110, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df4e8*=0x30, lpOverlapped=0x0) returned 1 [0183.843] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0183.844] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0183.844] WriteFile (in: hFile=0x110, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0183.844] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0183.844] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0183.844] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0183.844] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.844] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.844] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xfc70, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0xfc70, lpOverlapped=0x0) returned 1 [0183.845] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0xfc70, dwBufLen=0xfc70 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0xfc70) returned 1 [0183.846] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.846] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xfc70, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0xfc70, lpOverlapped=0x0) returned 1 [0183.846] CryptDestroyKey (hKey=0x522f58) returned 1 [0183.846] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xfd34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.846] SetEndOfFile (hFile=0x110) returned 1 [0183.849] GetProcessHeap () returned 0x4e0000 [0183.849] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0183.849] GetProcessHeap () returned 0x4e0000 [0183.849] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0183.849] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Urban.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\urban.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Urban.thmx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\urban.thmx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0183.851] CloseHandle (hObject=0x110) returned 1 [0183.851] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a71d800, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3a71d800, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x12600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Verve.thmx", cAlternateFileName="VERVE~1.THM")) returned 1 [0183.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Verve.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\verve.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0183.852] GetProcessHeap () returned 0x4e0000 [0183.852] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0183.852] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0183.852] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0183.852] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0183.852] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.852] GetProcessHeap () returned 0x4e0000 [0183.852] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4fcd10 [0183.852] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4fcd10*, pdwDataLen=0x24df4c8*=0x30, dwBufLen=0x30 | out: pbData=0x4fcd10*, pdwDataLen=0x24df4c8*=0x30) returned 1 [0183.852] CryptDestroyKey (hKey=0x522f58) returned 1 [0183.852] WriteFile (in: hFile=0x110, lpBuffer=0x4fcd10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fcd10*, lpNumberOfBytesWritten=0x24df4e8*=0x30, lpOverlapped=0x0) returned 1 [0183.854] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0183.854] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0183.854] WriteFile (in: hFile=0x110, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0183.854] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0183.854] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0183.854] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0183.854] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.854] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.854] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x12600, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0x12600, lpOverlapped=0x0) returned 1 [0183.856] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x12600, dwBufLen=0x12600 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x12600) returned 1 [0183.856] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.856] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x12600, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0x12600, lpOverlapped=0x0) returned 1 [0183.857] CryptDestroyKey (hKey=0x522f58) returned 1 [0183.857] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x126c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.857] SetEndOfFile (hFile=0x110) returned 1 [0183.859] GetProcessHeap () returned 0x4e0000 [0183.859] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd10 | out: hHeap=0x4e0000) returned 1 [0183.859] GetProcessHeap () returned 0x4e0000 [0183.859] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0183.859] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Verve.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\verve.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Verve.thmx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\verve.thmx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0183.861] CloseHandle (hObject=0x110) returned 1 [0183.861] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d03f100, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5cd5260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5d03f100, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x2c681, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Waveform.thmx", cAlternateFileName="WAVEFO~1.THM")) returned 1 [0183.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Waveform.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\waveform.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0183.863] GetProcessHeap () returned 0x4e0000 [0183.863] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0183.863] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0183.863] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df500 | out: lpNewFilePointer=0x0) returned 1 [0183.863] WriteFile (in: hFile=0x110, lpBuffer=0x24df510*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df510*, lpNumberOfBytesWritten=0x24df4e8*=0xf, lpOverlapped=0x0) returned 1 [0183.873] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0183.873] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.873] GetProcessHeap () returned 0x4e0000 [0183.873] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0183.873] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df4c8*=0x40) returned 1 [0183.873] CryptDestroyKey (hKey=0x522f58) returned 1 [0183.873] WriteFile (in: hFile=0x110, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df4e8*=0x40, lpOverlapped=0x0) returned 1 [0183.874] WriteFile (in: hFile=0x110, lpBuffer=0x24df4f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df4f0*, lpNumberOfBytesWritten=0x24df4e8*=0x4, lpOverlapped=0x0) returned 1 [0183.874] WriteFile (in: hFile=0x110, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df4e8*=0x10, lpOverlapped=0x0) returned 1 [0183.874] WriteFile (in: hFile=0x110, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df4e8*=0x80, lpOverlapped=0x0) returned 1 [0183.874] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df4f8 | out: lpNewFilePointer=0x0) returned 1 [0183.874] WriteFile (in: hFile=0x110, lpBuffer=0x24df508*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df4e8, lpOverlapped=0x0 | out: lpBuffer=0x24df508*, lpNumberOfBytesWritten=0x24df4e8*=0x8, lpOverlapped=0x0) returned 1 [0183.874] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df4ec | out: phKey=0x24df4ec*=0x522f58) returned 1 [0183.874] CryptSetKeyParam (hKey=0x522f58, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.874] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.874] ReadFile (in: hFile=0x110, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2c681, lpNumberOfBytesRead=0x24df4a0, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df4a0*=0x2c681, lpOverlapped=0x0) returned 1 [0183.876] CryptEncrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x2c690, dwBufLen=0x2c690 | out: pbData=0x22d0020*, pdwDataLen=0x24df4a8*=0x2c690) returned 1 [0183.878] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.878] WriteFile (in: hFile=0x110, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2c690, lpNumberOfBytesWritten=0x24df4a4, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df4a4*=0x2c690, lpOverlapped=0x0) returned 1 [0183.878] CryptDestroyKey (hKey=0x522f58) returned 1 [0183.879] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x2c764, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.879] SetEndOfFile (hFile=0x110) returned 1 [0183.882] GetProcessHeap () returned 0x4e0000 [0183.882] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0183.882] GetProcessHeap () returned 0x4e0000 [0183.882] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0183.882] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Waveform.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\waveform.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Waveform.thmx.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\document themes 14\\waveform.thmx.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0183.886] CloseHandle (hObject=0x110) returned 1 [0183.886] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d03f100, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5cd5260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5d03f100, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x2c681, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Waveform.thmx", cAlternateFileName="WAVEFO~1.THM")) returned 0 [0183.886] GetProcessHeap () returned 0x4e0000 [0183.886] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0183.886] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df4d8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f58) returned 1 [0183.886] CryptDecrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df540 | out: pbData=0x4f53d8, pdwDataLen=0x24df540) returned 1 [0183.886] CryptDestroyKey (hKey=0x522f58) returned 1 [0183.886] GetProcessHeap () returned 0x4e0000 [0183.886] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0183.886] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df4d8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f58) returned 1 [0183.886] CryptDecrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df540 | out: pbData=0x4f5420, pdwDataLen=0x24df540) returned 1 [0183.886] CryptDestroyKey (hKey=0x522f58) returned 1 [0183.886] GetProcessHeap () returned 0x4e0000 [0183.886] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x53a550 [0183.886] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df4d8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f58) returned 1 [0183.886] CryptDecrypt (in: hKey=0x522f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x53a550, pdwDataLen=0x24df540 | out: pbData=0x53a550, pdwDataLen=0x24df540) returned 1 [0183.886] CryptDestroyKey (hKey=0x522f58) returned 1 [0183.886] wsprintfW (in: param_1=0x24de51c, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\readme-warning.txt") returned 71 [0183.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\readme-warning.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0183.888] WriteFile (in: hFile=0x110, lpBuffer=0x53a550*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24de518, lpOverlapped=0x0 | out: lpBuffer=0x53a550*, lpNumberOfBytesWritten=0x24de518*=0x6c3, lpOverlapped=0x0) returned 1 [0183.889] CloseHandle (hObject=0x110) returned 1 [0183.889] GetProcessHeap () returned 0x4e0000 [0183.889] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x53a550 | out: hHeap=0x4e0000) returned 1 [0183.889] GetProcessHeap () returned 0x4e0000 [0183.889] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0183.889] GetProcessHeap () returned 0x4e0000 [0183.889] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0183.889] FindClose (in: hFindFile=0x522ed8 | out: hFindFile=0x522ed8) returned 1 [0183.889] GetProcessHeap () returned 0x4e0000 [0183.889] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x53a2c8 | out: hHeap=0x4e0000) returned 1 [0183.889] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a3f4620, ftCreationTime.dwHighDateTime=0x1d57d17, ftLastAccessTime.dwLowDateTime=0xbc3d9000, ftLastAccessTime.dwHighDateTime=0x1d568b8, ftLastWriteTime.dwLowDateTime=0xbc3d9000, ftLastWriteTime.dwHighDateTime=0x1d568b8, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="italic.exe", cAlternateFileName="")) returned 1 [0183.889] FindNextFileW (in: hFindFile=0x522e98, lpFindFileData=0x24df800 | out: lpFindFileData=0x24df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MEDIA", cAlternateFileName="")) returned 1 [0183.889] GetProcessHeap () returned 0x4e0000 [0183.889] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x60) returned 0x528080 [0183.889] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\*.*", lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522ed8 [0183.890] GetProcessHeap () returned 0x4e0000 [0183.890] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x528080 | out: hHeap=0x4e0000) returned 1 [0183.890] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0183.891] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd6dc020, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CAGCAT10", cAlternateFileName="")) returned 1 [0183.891] GetProcessHeap () returned 0x4e0000 [0183.891] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x262) returned 0x53a2c8 [0183.891] GetProcessHeap () returned 0x4e0000 [0183.891] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x72) returned 0x4f1b18 [0183.891] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd6dc020, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f58 [0183.893] GetProcessHeap () returned 0x4e0000 [0183.893] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1b18 | out: hHeap=0x4e0000) returned 1 [0183.893] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd6dc020, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0183.894] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeec79e70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 1 [0183.894] GetProcessHeap () returned 0x4e0000 [0183.894] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x274) returned 0x522768 [0183.894] GetProcessHeap () returned 0x4e0000 [0183.894] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x7c) returned 0x4fa058 [0183.894] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeec79e70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0183.894] GetProcessHeap () returned 0x4e0000 [0183.894] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0183.894] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeec79e70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0183.894] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11d8d700, ftCreationTime.dwHighDateTime=0x1c07b1f, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x11d8d700, ftLastWriteTime.dwHighDateTime=0x1c07b1f, nFileSizeHigh=0x0, nFileSizeLow=0x4c450, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CAGCAT10.MML", cAlternateFileName="")) returned 1 [0183.894] GetProcessHeap () returned 0x4e0000 [0183.894] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x27e) returned 0x5229e8 [0183.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0183.896] GetProcessHeap () returned 0x4e0000 [0183.896] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0183.896] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0183.896] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0183.896] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0183.896] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.896] GetProcessHeap () returned 0x4e0000 [0183.896] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0183.896] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0183.896] CryptDestroyKey (hKey=0x522fd8) returned 1 [0183.896] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0183.898] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0183.898] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0183.898] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0183.898] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0183.898] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0183.898] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0183.898] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.898] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.899] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4c450, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x4c450, lpOverlapped=0x0) returned 1 [0183.903] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x4c450, dwBufLen=0x4c450 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x4c450) returned 1 [0183.906] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.906] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4c450, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x4c450, lpOverlapped=0x0) returned 1 [0183.907] CryptDestroyKey (hKey=0x522fd8) returned 1 [0183.907] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x4c524, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.907] SetEndOfFile (hFile=0x100) returned 1 [0183.909] GetProcessHeap () returned 0x4e0000 [0183.909] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0183.909] GetProcessHeap () returned 0x4e0000 [0183.909] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0183.909] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0183.911] CloseHandle (hObject=0x100) returned 1 [0183.911] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11d8d700, ftCreationTime.dwHighDateTime=0x1c07b1f, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x11d8d700, ftLastWriteTime.dwHighDateTime=0x1c07b1f, nFileSizeHigh=0x0, nFileSizeLow=0x4c450, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CAGCAT10.MML", cAlternateFileName="")) returned 0 [0183.912] GetProcessHeap () returned 0x4e0000 [0183.912] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0183.912] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0183.912] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df020 | out: pbData=0x4f53d8, pdwDataLen=0x24df020) returned 1 [0183.912] CryptDestroyKey (hKey=0x522fd8) returned 1 [0183.912] GetProcessHeap () returned 0x4e0000 [0183.912] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0183.912] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0183.912] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df020 | out: pbData=0x4f5420, pdwDataLen=0x24df020) returned 1 [0183.912] CryptDestroyKey (hKey=0x522fd8) returned 1 [0183.912] GetProcessHeap () returned 0x4e0000 [0183.912] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x53a538 [0183.912] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0183.912] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x53a538, pdwDataLen=0x24df020 | out: pbData=0x53a538, pdwDataLen=0x24df020) returned 1 [0183.912] CryptDestroyKey (hKey=0x522fd8) returned 1 [0183.912] wsprintfW (in: param_1=0x24ddffc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\readme-warning.txt") returned 72 [0183.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\readme-warning.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0183.914] WriteFile (in: hFile=0x100, lpBuffer=0x53a538*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddff8, lpOverlapped=0x0 | out: lpBuffer=0x53a538*, lpNumberOfBytesWritten=0x24ddff8*=0x6c3, lpOverlapped=0x0) returned 1 [0183.915] CloseHandle (hObject=0x100) returned 1 [0183.915] GetProcessHeap () returned 0x4e0000 [0183.915] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x53a538 | out: hHeap=0x4e0000) returned 1 [0183.915] GetProcessHeap () returned 0x4e0000 [0183.915] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0183.915] GetProcessHeap () returned 0x4e0000 [0183.915] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0183.915] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0183.915] GetProcessHeap () returned 0x4e0000 [0183.915] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5229e8 | out: hHeap=0x4e0000) returned 1 [0183.915] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2162900, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x51b925d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2162900, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x3da0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CAGCAT10.DLL", cAlternateFileName="")) returned 1 [0183.915] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x130a0400, ftCreationTime.dwHighDateTime=0x1c07b1f, ftLastAccessTime.dwLowDateTime=0x60120f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x130a0400, ftLastWriteTime.dwHighDateTime=0x1c07b1f, nFileSizeHigh=0x0, nFileSizeLow=0x603d8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CAGCAT10.MMW", cAlternateFileName="")) returned 1 [0183.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0183.916] GetProcessHeap () returned 0x4e0000 [0183.916] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0183.916] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0183.916] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0183.916] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0183.925] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.925] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.925] GetProcessHeap () returned 0x4e0000 [0183.925] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0183.925] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0183.925] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.925] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0183.925] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0183.926] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0183.926] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0183.926] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0183.926] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0183.926] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.926] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.926] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.926] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x603d8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x603d8, lpOverlapped=0x0) returned 1 [0183.931] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x603e0, dwBufLen=0x603e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x603e0) returned 1 [0183.936] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.936] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x603e0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x603e0, lpOverlapped=0x0) returned 1 [0183.937] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.937] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x604b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.937] SetEndOfFile (hFile=0xdc) returned 1 [0183.941] GetProcessHeap () returned 0x4e0000 [0183.941] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0183.941] GetProcessHeap () returned 0x4e0000 [0183.941] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0183.941] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0183.944] CloseHandle (hObject=0xdc) returned 1 [0183.944] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ec5600, ftCreationTime.dwHighDateTime=0x1bd4c14, ftLastAccessTime.dwLowDateTime=0xbd180ea0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x11ec5600, ftLastWriteTime.dwHighDateTime=0x1bd4c14, nFileSizeHigh=0x0, nFileSizeLow=0x585a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ELPHRG01.WAV", cAlternateFileName="")) returned 1 [0183.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\elphrg01.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0183.946] GetProcessHeap () returned 0x4e0000 [0183.946] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0183.946] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0183.946] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0183.946] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0183.948] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.948] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.948] GetProcessHeap () returned 0x4e0000 [0183.948] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0183.948] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0183.948] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.948] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0183.949] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0183.949] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0183.949] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0183.949] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0183.949] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0183.949] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.949] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.949] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.949] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x585a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x585a, lpOverlapped=0x0) returned 1 [0183.950] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5860, dwBufLen=0x5860 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5860) returned 1 [0183.951] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.951] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5860, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5860, lpOverlapped=0x0) returned 1 [0183.951] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.951] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5934, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.951] SetEndOfFile (hFile=0xdc) returned 1 [0183.954] GetProcessHeap () returned 0x4e0000 [0183.954] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0183.954] GetProcessHeap () returned 0x4e0000 [0183.954] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0183.954] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\elphrg01.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\elphrg01.wav.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0183.957] CloseHandle (hObject=0xdc) returned 1 [0183.957] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63c1b400, ftCreationTime.dwHighDateTime=0x1bd216e, ftLastAccessTime.dwLowDateTime=0xbd3e24a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x63c1b400, ftLastWriteTime.dwHighDateTime=0x1bd216e, nFileSizeHigh=0x0, nFileSizeLow=0x3602, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0088542.WMF", cAlternateFileName="")) returned 1 [0183.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0088542.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0183.958] GetProcessHeap () returned 0x4e0000 [0183.959] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0183.959] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0183.959] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0183.959] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0183.961] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.961] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.961] GetProcessHeap () returned 0x4e0000 [0183.961] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0183.961] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0183.961] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.961] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0183.961] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0183.961] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0183.962] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0183.962] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0183.962] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0183.962] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.962] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.962] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.962] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3602, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3602, lpOverlapped=0x0) returned 1 [0183.963] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3610, dwBufLen=0x3610 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3610) returned 1 [0183.963] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.963] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3610, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3610, lpOverlapped=0x0) returned 1 [0183.964] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.964] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x36e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.964] SetEndOfFile (hFile=0xdc) returned 1 [0183.966] GetProcessHeap () returned 0x4e0000 [0183.966] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0183.966] GetProcessHeap () returned 0x4e0000 [0183.967] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0183.967] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0088542.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0088542.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0183.969] CloseHandle (hObject=0xdc) returned 1 [0183.969] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68ad6a00, ftCreationTime.dwHighDateTime=0x1bcf887, ftLastAccessTime.dwLowDateTime=0xbd3e24a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x68ad6a00, ftLastWriteTime.dwHighDateTime=0x1bcf887, nFileSizeHigh=0x0, nFileSizeLow=0x8880, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0090070.WMF", cAlternateFileName="")) returned 1 [0183.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0090070.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0183.971] GetProcessHeap () returned 0x4e0000 [0183.971] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0183.971] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0183.971] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0183.971] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.971] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.971] GetProcessHeap () returned 0x4e0000 [0183.971] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0183.972] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0183.972] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.972] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0183.974] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0183.974] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0183.974] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0183.974] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0183.974] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0183.974] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.974] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.974] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.974] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x8880, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x8880, lpOverlapped=0x0) returned 1 [0183.979] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8880, dwBufLen=0x8880 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8880) returned 1 [0183.979] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.979] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x8880, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x8880, lpOverlapped=0x0) returned 1 [0183.980] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.980] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x8954, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.980] SetEndOfFile (hFile=0xdc) returned 1 [0183.983] GetProcessHeap () returned 0x4e0000 [0183.983] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0183.983] GetProcessHeap () returned 0x4e0000 [0183.983] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0183.983] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0090070.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0090070.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0183.985] CloseHandle (hObject=0xdc) returned 1 [0183.985] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59c88400, ftCreationTime.dwHighDateTime=0x1bd208e, ftLastAccessTime.dwLowDateTime=0xbd3e24a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x59c88400, ftLastWriteTime.dwHighDateTime=0x1bd208e, nFileSizeHigh=0x0, nFileSizeLow=0x830a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0090386.WMF", cAlternateFileName="")) returned 1 [0183.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0090386.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0183.990] GetProcessHeap () returned 0x4e0000 [0183.990] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0183.990] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0183.990] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0183.991] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0183.993] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.993] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.993] GetProcessHeap () returned 0x4e0000 [0183.993] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0183.993] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0183.993] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.993] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0183.993] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0183.993] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0183.993] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0183.993] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0183.994] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0183.994] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0183.994] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0183.994] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.994] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x830a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x830a, lpOverlapped=0x0) returned 1 [0183.995] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8310, dwBufLen=0x8310 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8310) returned 1 [0183.996] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.996] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x8310, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x8310, lpOverlapped=0x0) returned 1 [0183.996] CryptDestroyKey (hKey=0x522f98) returned 1 [0183.996] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x83e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.996] SetEndOfFile (hFile=0xdc) returned 1 [0183.999] GetProcessHeap () returned 0x4e0000 [0183.999] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0183.999] GetProcessHeap () returned 0x4e0000 [0183.999] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0183.999] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0090386.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0090386.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0184.001] CloseHandle (hObject=0xdc) returned 1 [0184.002] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e332700, ftCreationTime.dwHighDateTime=0x1bd3d86, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6e332700, ftLastWriteTime.dwHighDateTime=0x1bd3d86, nFileSizeHigh=0x0, nFileSizeLow=0x870a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0149407.WMF", cAlternateFileName="")) returned 1 [0184.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149407.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0184.004] GetProcessHeap () returned 0x4e0000 [0184.004] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0184.005] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0184.005] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0184.005] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0184.007] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.007] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.007] GetProcessHeap () returned 0x4e0000 [0184.007] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0184.007] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0184.007] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.007] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0184.007] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0184.007] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0184.007] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0184.008] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0184.008] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.008] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.008] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.008] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.008] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x870a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x870a, lpOverlapped=0x0) returned 1 [0184.009] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8710, dwBufLen=0x8710 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8710) returned 1 [0184.010] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.010] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x8710, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x8710, lpOverlapped=0x0) returned 1 [0184.010] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.010] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x87e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.010] SetEndOfFile (hFile=0xdc) returned 1 [0184.013] GetProcessHeap () returned 0x4e0000 [0184.013] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0184.013] GetProcessHeap () returned 0x4e0000 [0184.013] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0184.013] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149407.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149407.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0184.015] CloseHandle (hObject=0xdc) returned 1 [0184.015] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fd5900, ftCreationTime.dwHighDateTime=0x1bd4249, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4fd5900, ftLastWriteTime.dwHighDateTime=0x1bd4249, nFileSizeHigh=0x0, nFileSizeLow=0x5eda, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0149481.WMF", cAlternateFileName="")) returned 1 [0184.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149481.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0184.017] GetProcessHeap () returned 0x4e0000 [0184.017] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0184.017] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0184.017] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0184.017] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0184.030] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.030] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.030] GetProcessHeap () returned 0x4e0000 [0184.030] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0184.030] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0184.030] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.031] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0184.031] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0184.031] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0184.031] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0184.031] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0184.031] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.031] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.031] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.031] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.031] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5eda, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x5eda, lpOverlapped=0x0) returned 1 [0184.033] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5ee0, dwBufLen=0x5ee0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5ee0) returned 1 [0184.033] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.033] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5ee0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5ee0, lpOverlapped=0x0) returned 1 [0184.033] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.033] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5fb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.033] SetEndOfFile (hFile=0xdc) returned 1 [0184.036] GetProcessHeap () returned 0x4e0000 [0184.036] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0184.036] GetProcessHeap () returned 0x4e0000 [0184.036] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0184.036] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149481.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149481.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0184.039] CloseHandle (hObject=0xdc) returned 1 [0184.039] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fe3f700, ftCreationTime.dwHighDateTime=0x1bd5067, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3fe3f700, ftLastWriteTime.dwHighDateTime=0x1bd5067, nFileSizeHigh=0x0, nFileSizeLow=0xa80a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0149627.WMF", cAlternateFileName="")) returned 1 [0184.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149627.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0184.041] GetProcessHeap () returned 0x4e0000 [0184.041] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0184.041] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0184.041] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0184.041] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0184.044] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.044] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.044] GetProcessHeap () returned 0x4e0000 [0184.044] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0184.044] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0184.044] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.044] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0184.044] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0184.044] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0184.045] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0184.045] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0184.045] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.045] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.045] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.045] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.045] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xa80a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xa80a, lpOverlapped=0x0) returned 1 [0184.087] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa810, dwBufLen=0xa810 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa810) returned 1 [0184.087] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.087] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xa810, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xa810, lpOverlapped=0x0) returned 1 [0184.087] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.087] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xa8e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.087] SetEndOfFile (hFile=0xdc) returned 1 [0184.090] GetProcessHeap () returned 0x4e0000 [0184.090] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0184.090] GetProcessHeap () returned 0x4e0000 [0184.090] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0184.090] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149627.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149627.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0184.092] CloseHandle (hObject=0xdc) returned 1 [0184.092] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9dd2e700, ftCreationTime.dwHighDateTime=0x1bd6439, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9dd2e700, ftLastWriteTime.dwHighDateTime=0x1bd6439, nFileSizeHigh=0x0, nFileSizeLow=0x1ffa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0149887.WMF", cAlternateFileName="")) returned 1 [0184.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149887.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0184.095] GetProcessHeap () returned 0x4e0000 [0184.095] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0184.095] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0184.095] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0184.095] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0184.097] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.097] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.097] GetProcessHeap () returned 0x4e0000 [0184.097] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0184.097] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0184.097] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.097] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0184.097] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0184.098] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0184.098] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0184.098] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0184.098] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.098] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.098] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.098] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.098] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1ffa, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1ffa, lpOverlapped=0x0) returned 1 [0184.099] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2000, dwBufLen=0x2000 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2000) returned 1 [0184.099] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.099] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2000, lpOverlapped=0x0) returned 1 [0184.099] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.099] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x20d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.099] SetEndOfFile (hFile=0xdc) returned 1 [0184.101] GetProcessHeap () returned 0x4e0000 [0184.101] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0184.101] GetProcessHeap () returned 0x4e0000 [0184.101] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0184.102] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149887.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149887.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0184.103] CloseHandle (hObject=0xdc) returned 1 [0184.103] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fc87200, ftCreationTime.dwHighDateTime=0x1bd7ec5, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3fc87200, ftLastWriteTime.dwHighDateTime=0x1bd7ec5, nFileSizeHigh=0x0, nFileSizeLow=0x2068, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0157763.WMF", cAlternateFileName="")) returned 1 [0184.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157763.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0157763.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0184.105] GetProcessHeap () returned 0x4e0000 [0184.105] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0184.105] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0184.105] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0184.105] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.107] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.107] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.107] GetProcessHeap () returned 0x4e0000 [0184.107] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0184.107] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0184.107] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.107] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0184.107] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0184.107] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0184.107] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0184.108] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0184.108] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.108] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.108] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.108] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.108] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2068, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2068, lpOverlapped=0x0) returned 1 [0184.111] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2070, dwBufLen=0x2070 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2070) returned 1 [0184.111] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.111] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2070, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2070, lpOverlapped=0x0) returned 1 [0184.111] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.111] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2144, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.111] SetEndOfFile (hFile=0xdc) returned 1 [0184.113] GetProcessHeap () returned 0x4e0000 [0184.113] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0184.113] GetProcessHeap () returned 0x4e0000 [0184.113] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0184.113] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157763.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0157763.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157763.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0157763.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0184.115] CloseHandle (hObject=0xdc) returned 1 [0184.115] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaeffa900, ftCreationTime.dwHighDateTime=0x1bd94f9, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaeffa900, ftLastWriteTime.dwHighDateTime=0x1bd94f9, nFileSizeHigh=0x0, nFileSizeLow=0x1d94, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0157995.WMF", cAlternateFileName="")) returned 1 [0184.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157995.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0157995.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0184.116] GetProcessHeap () returned 0x4e0000 [0184.116] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0184.116] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0184.117] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0184.117] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0184.118] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.118] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.118] GetProcessHeap () returned 0x4e0000 [0184.118] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0184.118] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0184.118] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.118] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0184.119] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0184.119] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0184.119] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0184.119] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0184.119] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.119] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.119] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.119] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.119] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1d94, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1d94, lpOverlapped=0x0) returned 1 [0184.120] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1da0, dwBufLen=0x1da0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1da0) returned 1 [0184.120] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.120] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1da0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1da0, lpOverlapped=0x0) returned 1 [0184.120] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.120] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1e74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.120] SetEndOfFile (hFile=0xdc) returned 1 [0184.122] GetProcessHeap () returned 0x4e0000 [0184.122] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0184.122] GetProcessHeap () returned 0x4e0000 [0184.122] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0184.122] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157995.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0157995.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157995.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0157995.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0184.124] CloseHandle (hObject=0xdc) returned 1 [0184.124] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9ba3e00, ftCreationTime.dwHighDateTime=0x1bd94f9, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb9ba3e00, ftLastWriteTime.dwHighDateTime=0x1bd94f9, nFileSizeHigh=0x0, nFileSizeLow=0x1426, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0158007.WMF", cAlternateFileName="")) returned 1 [0184.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0158007.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0158007.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0184.125] GetProcessHeap () returned 0x4e0000 [0184.125] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0184.125] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0184.125] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0184.125] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0184.127] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.127] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.127] GetProcessHeap () returned 0x4e0000 [0184.127] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0184.127] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0184.127] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.127] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0184.127] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0184.128] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0184.128] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0184.128] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0184.128] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.128] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.128] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.128] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.128] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1426, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1426, lpOverlapped=0x0) returned 1 [0184.129] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1430, dwBufLen=0x1430 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1430) returned 1 [0184.129] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.129] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1430, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1430, lpOverlapped=0x0) returned 1 [0184.130] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.130] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1504, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.130] SetEndOfFile (hFile=0xdc) returned 1 [0184.132] GetProcessHeap () returned 0x4e0000 [0184.132] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0184.132] GetProcessHeap () returned 0x4e0000 [0184.132] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0184.132] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0158007.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0158007.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0158007.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0158007.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0184.135] CloseHandle (hObject=0xdc) returned 1 [0184.135] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf00c800, ftCreationTime.dwHighDateTime=0x1bdf6f6, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdf00c800, ftLastWriteTime.dwHighDateTime=0x1bdf6f6, nFileSizeHigh=0x0, nFileSizeLow=0x4d38, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0183168.WMF", cAlternateFileName="")) returned 1 [0184.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183168.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183168.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0184.137] GetProcessHeap () returned 0x4e0000 [0184.137] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0184.137] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0184.137] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0184.137] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.139] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.139] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.139] GetProcessHeap () returned 0x4e0000 [0184.139] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0184.139] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0184.139] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.139] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0184.139] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0184.139] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0184.139] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0184.139] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0184.139] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.139] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.139] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.139] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.139] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4d38, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4d38, lpOverlapped=0x0) returned 1 [0184.140] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4d40, dwBufLen=0x4d40 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4d40) returned 1 [0184.141] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.141] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4d40, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4d40, lpOverlapped=0x0) returned 1 [0184.141] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.141] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4e14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.141] SetEndOfFile (hFile=0xdc) returned 1 [0184.143] GetProcessHeap () returned 0x4e0000 [0184.143] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0184.143] GetProcessHeap () returned 0x4e0000 [0184.143] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0184.143] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183168.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183168.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183168.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183168.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0184.145] CloseHandle (hObject=0xdc) returned 1 [0184.145] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9d86900, ftCreationTime.dwHighDateTime=0x1bdf6f7, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc9d86900, ftLastWriteTime.dwHighDateTime=0x1bdf6f7, nFileSizeHigh=0x0, nFileSizeLow=0x7018, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0183290.WMF", cAlternateFileName="")) returned 1 [0184.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183290.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183290.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0184.146] GetProcessHeap () returned 0x4e0000 [0184.146] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0184.146] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0184.146] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0184.146] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.148] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.148] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.148] GetProcessHeap () returned 0x4e0000 [0184.148] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0184.148] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0184.148] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.148] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0184.148] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0184.148] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0184.149] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0184.149] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0184.149] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.149] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.149] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.149] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.149] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7018, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7018, lpOverlapped=0x0) returned 1 [0184.150] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7020, dwBufLen=0x7020 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7020) returned 1 [0184.150] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.150] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7020, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7020, lpOverlapped=0x0) returned 1 [0184.150] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.150] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x70f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.150] SetEndOfFile (hFile=0xdc) returned 1 [0184.153] GetProcessHeap () returned 0x4e0000 [0184.153] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0184.153] GetProcessHeap () returned 0x4e0000 [0184.153] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0184.153] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183290.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183290.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183290.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183290.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0184.154] CloseHandle (hObject=0xdc) returned 1 [0184.154] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8564400, ftCreationTime.dwHighDateTime=0x1bdf6f7, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf8564400, ftLastWriteTime.dwHighDateTime=0x1bdf6f7, nFileSizeHigh=0x0, nFileSizeLow=0x14fa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0183328.WMF", cAlternateFileName="")) returned 1 [0184.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183328.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183328.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0184.156] GetProcessHeap () returned 0x4e0000 [0184.156] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0184.156] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0184.156] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0184.156] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0184.157] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.158] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.158] GetProcessHeap () returned 0x4e0000 [0184.158] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0184.158] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0184.158] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.158] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0184.158] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0184.158] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0184.158] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0184.158] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0184.158] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.158] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.158] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.158] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.158] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x14fa, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x14fa, lpOverlapped=0x0) returned 1 [0184.159] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1500, dwBufLen=0x1500 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1500) returned 1 [0184.159] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.159] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1500, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1500, lpOverlapped=0x0) returned 1 [0184.159] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.159] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x15d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.159] SetEndOfFile (hFile=0xdc) returned 1 [0184.161] GetProcessHeap () returned 0x4e0000 [0184.161] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0184.161] GetProcessHeap () returned 0x4e0000 [0184.161] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0184.161] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183328.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183328.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183328.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183328.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0184.163] CloseHandle (hObject=0xdc) returned 1 [0184.163] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf396a700, ftCreationTime.dwHighDateTime=0x1be0d1a, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf396a700, ftLastWriteTime.dwHighDateTime=0x1be0d1a, nFileSizeHigh=0x0, nFileSizeLow=0x171c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0185604.WMF", cAlternateFileName="")) returned 1 [0184.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0185604.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0185604.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0184.164] GetProcessHeap () returned 0x4e0000 [0184.164] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0184.164] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0184.164] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0184.164] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0184.166] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.166] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.166] GetProcessHeap () returned 0x4e0000 [0184.166] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0184.166] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0184.166] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.166] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0184.166] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0184.166] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0184.167] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0184.167] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0184.167] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.167] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.167] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.167] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.167] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x171c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x171c, lpOverlapped=0x0) returned 1 [0184.168] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1720, dwBufLen=0x1720 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1720) returned 1 [0184.168] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.168] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1720, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1720, lpOverlapped=0x0) returned 1 [0184.168] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.168] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x17f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.168] SetEndOfFile (hFile=0xdc) returned 1 [0184.170] GetProcessHeap () returned 0x4e0000 [0184.170] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0184.170] GetProcessHeap () returned 0x4e0000 [0184.170] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0184.170] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0185604.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0185604.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0185604.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0185604.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0184.172] CloseHandle (hObject=0xdc) returned 1 [0184.175] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc0fec00, ftCreationTime.dwHighDateTime=0x1be0d23, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdc0fec00, ftLastWriteTime.dwHighDateTime=0x1be0d23, nFileSizeHigh=0x0, nFileSizeLow=0x2f64, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0186002.WMF", cAlternateFileName="")) returned 1 [0184.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186002.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0186002.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0184.177] GetProcessHeap () returned 0x4e0000 [0184.177] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0184.177] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0184.177] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0184.177] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0184.179] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.179] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.179] GetProcessHeap () returned 0x4e0000 [0184.179] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0184.179] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0184.179] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.179] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0184.179] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0184.179] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0184.179] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0184.180] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0184.180] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.180] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.180] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.180] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.180] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2f64, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2f64, lpOverlapped=0x0) returned 1 [0184.180] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2f70, dwBufLen=0x2f70 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2f70) returned 1 [0184.181] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.181] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2f70, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2f70, lpOverlapped=0x0) returned 1 [0184.181] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.181] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3044, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.181] SetEndOfFile (hFile=0xdc) returned 1 [0184.183] GetProcessHeap () returned 0x4e0000 [0184.183] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0184.183] GetProcessHeap () returned 0x4e0000 [0184.183] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0184.183] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186002.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0186002.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186002.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0186002.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0184.185] CloseHandle (hObject=0xdc) returned 1 [0184.185] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb426a00, ftCreationTime.dwHighDateTime=0x1be0d22, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xeb426a00, ftLastWriteTime.dwHighDateTime=0x1be0d22, nFileSizeHigh=0x0, nFileSizeLow=0x1b3a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0186348.WMF", cAlternateFileName="")) returned 1 [0184.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186348.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0186348.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0184.186] GetProcessHeap () returned 0x4e0000 [0184.186] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0184.186] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0184.186] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0184.186] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0184.224] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.224] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.224] GetProcessHeap () returned 0x4e0000 [0184.224] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0184.225] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0184.225] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.225] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0184.225] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0184.225] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0184.225] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0184.225] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0184.225] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.225] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.225] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.225] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.226] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1b3a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1b3a, lpOverlapped=0x0) returned 1 [0184.227] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1b40, dwBufLen=0x1b40 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1b40) returned 1 [0184.227] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.227] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1b40, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1b40, lpOverlapped=0x0) returned 1 [0184.227] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.227] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1c14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.227] SetEndOfFile (hFile=0xdc) returned 1 [0184.230] GetProcessHeap () returned 0x4e0000 [0184.230] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0184.230] GetProcessHeap () returned 0x4e0000 [0184.230] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0184.230] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186348.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0186348.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186348.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0186348.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0184.234] CloseHandle (hObject=0xdc) returned 1 [0184.234] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b608300, ftCreationTime.dwHighDateTime=0x1be10fe, ftLastAccessTime.dwLowDateTime=0xbd4a0b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1b608300, ftLastWriteTime.dwHighDateTime=0x1be10fe, nFileSizeHigh=0x0, nFileSizeLow=0x4746, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187423.WMF", cAlternateFileName="")) returned 1 [0184.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0187423.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0187423.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0184.236] GetProcessHeap () returned 0x4e0000 [0184.236] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0184.236] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0184.236] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0184.236] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0184.241] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.241] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.241] GetProcessHeap () returned 0x4e0000 [0184.241] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0184.241] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0184.241] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.242] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0184.242] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0184.242] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0184.242] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0184.242] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0184.242] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.242] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.242] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.242] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.242] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4746, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4746, lpOverlapped=0x0) returned 1 [0184.243] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4750, dwBufLen=0x4750 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4750) returned 1 [0184.244] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.244] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4750, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4750, lpOverlapped=0x0) returned 1 [0184.244] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.244] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4824, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.244] SetEndOfFile (hFile=0xdc) returned 1 [0184.247] GetProcessHeap () returned 0x4e0000 [0184.247] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0184.247] GetProcessHeap () returned 0x4e0000 [0184.247] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0184.247] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0187423.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0187423.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0187423.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0187423.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0184.249] CloseHandle (hObject=0xdc) returned 1 [0184.249] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc36d6a00, ftCreationTime.dwHighDateTime=0x1be2705, ftLastAccessTime.dwLowDateTime=0xbd4a0b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc36d6a00, ftLastWriteTime.dwHighDateTime=0x1be2705, nFileSizeHigh=0x0, nFileSizeLow=0x31da, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0195384.WMF", cAlternateFileName="")) returned 1 [0184.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195384.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195384.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0184.251] GetProcessHeap () returned 0x4e0000 [0184.251] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0184.251] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0184.251] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0184.251] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0184.266] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.266] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.266] GetProcessHeap () returned 0x4e0000 [0184.266] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0184.266] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0184.266] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.266] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0184.266] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0184.266] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0184.266] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0184.267] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0184.267] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.267] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.267] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.267] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.267] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x31da, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x31da, lpOverlapped=0x0) returned 1 [0184.268] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x31e0, dwBufLen=0x31e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x31e0) returned 1 [0184.268] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.268] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x31e0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x31e0, lpOverlapped=0x0) returned 1 [0184.268] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.269] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x32b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.269] SetEndOfFile (hFile=0xdc) returned 1 [0184.271] GetProcessHeap () returned 0x4e0000 [0184.271] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0184.271] GetProcessHeap () returned 0x4e0000 [0184.271] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0184.271] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195384.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195384.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195384.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195384.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0184.273] CloseHandle (hObject=0xdc) returned 1 [0184.273] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa438000, ftCreationTime.dwHighDateTime=0x1be2705, ftLastAccessTime.dwLowDateTime=0xbd4a0b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfa438000, ftLastWriteTime.dwHighDateTime=0x1be2705, nFileSizeHigh=0x0, nFileSizeLow=0x275c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0195534.WMF", cAlternateFileName="")) returned 1 [0184.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195534.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195534.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0184.276] GetProcessHeap () returned 0x4e0000 [0184.276] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0184.276] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0184.276] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0184.276] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0184.278] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.278] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.278] GetProcessHeap () returned 0x4e0000 [0184.278] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0184.278] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0184.278] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.278] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0184.278] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0184.278] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0184.278] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0184.279] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0184.279] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.279] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.279] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.279] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.279] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x275c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x275c, lpOverlapped=0x0) returned 1 [0184.280] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2760, dwBufLen=0x2760 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2760) returned 1 [0184.280] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.280] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2760, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2760, lpOverlapped=0x0) returned 1 [0184.280] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.280] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.280] SetEndOfFile (hFile=0xdc) returned 1 [0184.283] GetProcessHeap () returned 0x4e0000 [0184.283] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0184.283] GetProcessHeap () returned 0x4e0000 [0184.283] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0184.283] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195534.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195534.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195534.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195534.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0184.285] CloseHandle (hObject=0xdc) returned 1 [0184.285] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x455d9300, ftCreationTime.dwHighDateTime=0x1be2706, ftLastAccessTime.dwLowDateTime=0xbd4a0b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x455d9300, ftLastWriteTime.dwHighDateTime=0x1be2706, nFileSizeHigh=0x0, nFileSizeLow=0xfca, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0195812.WMF", cAlternateFileName="")) returned 1 [0184.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195812.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195812.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0184.287] GetProcessHeap () returned 0x4e0000 [0184.287] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0184.287] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0184.287] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0184.287] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0184.289] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.289] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.289] GetProcessHeap () returned 0x4e0000 [0184.289] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0184.289] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0184.289] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.289] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0184.289] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0184.290] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0184.290] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0184.290] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0184.290] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.290] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.290] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.290] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.290] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xfca, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xfca, lpOverlapped=0x0) returned 1 [0184.290] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xfd0, dwBufLen=0xfd0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xfd0) returned 1 [0184.290] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.290] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xfd0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xfd0, lpOverlapped=0x0) returned 1 [0184.290] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.290] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x10a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.291] SetEndOfFile (hFile=0xdc) returned 1 [0184.293] GetProcessHeap () returned 0x4e0000 [0184.293] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0184.293] GetProcessHeap () returned 0x4e0000 [0184.293] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0184.293] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195812.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195812.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195812.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195812.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0184.295] CloseHandle (hObject=0xdc) returned 1 [0184.295] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ec5c200, ftCreationTime.dwHighDateTime=0x1be2706, ftLastAccessTime.dwLowDateTime=0xbd4a0b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9ec5c200, ftLastWriteTime.dwHighDateTime=0x1be2706, nFileSizeHigh=0x0, nFileSizeLow=0x7b2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0196164.WMF", cAlternateFileName="")) returned 1 [0184.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196164.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196164.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0184.296] GetProcessHeap () returned 0x4e0000 [0184.296] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0184.296] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0184.296] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0184.296] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0184.299] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.299] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.299] GetProcessHeap () returned 0x4e0000 [0184.299] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0184.299] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0184.299] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.299] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0184.299] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0184.299] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0184.299] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0184.299] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0184.299] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.299] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.299] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.300] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.300] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7b2, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7b2, lpOverlapped=0x0) returned 1 [0184.300] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7c0, dwBufLen=0x7c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7c0) returned 1 [0184.300] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.300] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7c0, lpOverlapped=0x0) returned 1 [0184.300] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.300] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x894, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.300] SetEndOfFile (hFile=0xdc) returned 1 [0184.303] GetProcessHeap () returned 0x4e0000 [0184.303] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0184.303] GetProcessHeap () returned 0x4e0000 [0184.303] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0184.303] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196164.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196164.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196164.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196164.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0184.304] CloseHandle (hObject=0xdc) returned 1 [0184.304] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81ec6b00, ftCreationTime.dwHighDateTime=0x1be390f, ftLastAccessTime.dwLowDateTime=0xbd4a0b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x81ec6b00, ftLastWriteTime.dwHighDateTime=0x1be390f, nFileSizeHigh=0x0, nFileSizeLow=0x1216, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0196374.WMF", cAlternateFileName="")) returned 1 [0184.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196374.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196374.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0184.305] GetProcessHeap () returned 0x4e0000 [0184.305] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0184.305] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0184.305] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0184.305] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0184.307] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.307] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.307] GetProcessHeap () returned 0x4e0000 [0184.308] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0184.308] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0184.308] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.308] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0184.308] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0184.308] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0184.308] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0184.308] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0184.308] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.308] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.308] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.308] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.308] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1216, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1216, lpOverlapped=0x0) returned 1 [0184.309] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1220, dwBufLen=0x1220 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1220) returned 1 [0184.309] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.309] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1220, lpOverlapped=0x0) returned 1 [0184.310] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.310] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x12f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.310] SetEndOfFile (hFile=0xdc) returned 1 [0184.312] GetProcessHeap () returned 0x4e0000 [0184.312] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0184.312] GetProcessHeap () returned 0x4e0000 [0184.312] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0184.313] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196374.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196374.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196374.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196374.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0184.314] CloseHandle (hObject=0xdc) returned 1 [0184.314] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x929ce100, ftCreationTime.dwHighDateTime=0x1be390f, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x929ce100, ftLastWriteTime.dwHighDateTime=0x1be390f, nFileSizeHigh=0x0, nFileSizeLow=0x8cbe, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0196400.WMF", cAlternateFileName="")) returned 1 [0184.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196400.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196400.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0184.316] GetProcessHeap () returned 0x4e0000 [0184.316] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0184.316] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0184.316] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0184.316] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0184.318] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.318] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.318] GetProcessHeap () returned 0x4e0000 [0184.318] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0184.318] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0184.318] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.318] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0184.318] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0184.319] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0184.319] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0184.319] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0184.319] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.319] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.319] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.319] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.319] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x8cbe, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x8cbe, lpOverlapped=0x0) returned 1 [0184.320] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8cc0, dwBufLen=0x8cc0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8cc0) returned 1 [0184.321] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.321] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x8cc0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x8cc0, lpOverlapped=0x0) returned 1 [0184.321] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.321] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x8d94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.321] SetEndOfFile (hFile=0xdc) returned 1 [0184.324] GetProcessHeap () returned 0x4e0000 [0184.324] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0184.324] GetProcessHeap () returned 0x4e0000 [0184.324] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0184.324] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196400.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196400.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196400.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196400.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0184.326] CloseHandle (hObject=0xdc) returned 1 [0184.326] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91fc00, ftCreationTime.dwHighDateTime=0x1bdf0c6, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x91fc00, ftLastWriteTime.dwHighDateTime=0x1bdf0c6, nFileSizeHigh=0x0, nFileSizeLow=0x2518, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0199036.WMF", cAlternateFileName="")) returned 1 [0184.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199036.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199036.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0184.327] GetProcessHeap () returned 0x4e0000 [0184.327] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0184.327] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0184.327] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0184.327] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.329] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.329] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.329] GetProcessHeap () returned 0x4e0000 [0184.329] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0184.329] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0184.329] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.330] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0184.330] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0184.330] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0184.330] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0184.330] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0184.330] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.330] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.330] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.330] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.330] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2518, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2518, lpOverlapped=0x0) returned 1 [0184.332] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2520, dwBufLen=0x2520 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2520) returned 1 [0184.332] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.332] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2520, lpOverlapped=0x0) returned 1 [0184.332] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.332] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x25f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.332] SetEndOfFile (hFile=0xdc) returned 1 [0184.335] GetProcessHeap () returned 0x4e0000 [0184.335] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0184.335] GetProcessHeap () returned 0x4e0000 [0184.335] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0184.335] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199036.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199036.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199036.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199036.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0184.337] CloseHandle (hObject=0xdc) returned 1 [0184.337] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xebd55500, ftCreationTime.dwHighDateTime=0x1be05ec, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xebd55500, ftLastWriteTime.dwHighDateTime=0x1be05ec, nFileSizeHigh=0x0, nFileSizeLow=0x8ec4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0199283.WMF", cAlternateFileName="")) returned 1 [0184.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199283.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199283.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0184.338] GetProcessHeap () returned 0x4e0000 [0184.338] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0184.338] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0184.338] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0184.338] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0184.341] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.341] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.341] GetProcessHeap () returned 0x4e0000 [0184.341] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0184.341] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0184.341] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.341] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0184.341] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0184.341] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0184.341] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0184.341] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0184.341] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.341] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.341] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.341] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.342] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x8ec4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x8ec4, lpOverlapped=0x0) returned 1 [0184.343] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8ed0, dwBufLen=0x8ed0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8ed0) returned 1 [0184.343] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.343] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x8ed0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x8ed0, lpOverlapped=0x0) returned 1 [0184.343] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.344] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x8fa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.344] SetEndOfFile (hFile=0xdc) returned 1 [0184.347] GetProcessHeap () returned 0x4e0000 [0184.347] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0184.347] GetProcessHeap () returned 0x4e0000 [0184.347] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0184.347] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199283.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199283.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199283.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199283.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0184.348] CloseHandle (hObject=0xdc) returned 1 [0184.349] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54b53500, ftCreationTime.dwHighDateTime=0x1be3e9a, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x54b53500, ftLastWriteTime.dwHighDateTime=0x1be3e9a, nFileSizeHigh=0x0, nFileSizeLow=0xf5e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0199549.WMF", cAlternateFileName="")) returned 1 [0184.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199549.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199549.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0184.350] GetProcessHeap () returned 0x4e0000 [0184.350] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0184.350] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0184.350] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0184.350] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0184.365] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.365] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.365] GetProcessHeap () returned 0x4e0000 [0184.365] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0184.365] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0184.365] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.365] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0184.365] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0184.365] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0184.365] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0184.366] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0184.366] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.366] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.366] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.366] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.366] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xf5e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xf5e, lpOverlapped=0x0) returned 1 [0184.366] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xf60, dwBufLen=0xf60 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xf60) returned 1 [0184.366] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.366] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xf60, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xf60, lpOverlapped=0x0) returned 1 [0184.366] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.366] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.366] SetEndOfFile (hFile=0xdc) returned 1 [0184.369] GetProcessHeap () returned 0x4e0000 [0184.369] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0184.369] GetProcessHeap () returned 0x4e0000 [0184.369] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0184.369] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199549.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199549.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199549.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199549.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0184.371] CloseHandle (hObject=0xdc) returned 1 [0184.371] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b8b4b00, ftCreationTime.dwHighDateTime=0x1be3e9a, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8b8b4b00, ftLastWriteTime.dwHighDateTime=0x1be3e9a, nFileSizeHigh=0x0, nFileSizeLow=0x341e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0199661.WMF", cAlternateFileName="")) returned 1 [0184.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199661.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199661.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0184.373] GetProcessHeap () returned 0x4e0000 [0184.373] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0184.373] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0184.373] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0184.374] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0184.376] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.376] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.376] GetProcessHeap () returned 0x4e0000 [0184.376] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0184.376] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0184.376] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.376] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0184.376] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0184.376] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0184.377] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0184.377] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0184.377] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.377] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.377] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.377] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.377] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x341e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x341e, lpOverlapped=0x0) returned 1 [0184.378] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3420, dwBufLen=0x3420 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3420) returned 1 [0184.378] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.378] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3420, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3420, lpOverlapped=0x0) returned 1 [0184.379] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.379] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x34f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.379] SetEndOfFile (hFile=0xdc) returned 1 [0184.381] GetProcessHeap () returned 0x4e0000 [0184.381] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0184.381] GetProcessHeap () returned 0x4e0000 [0184.382] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0184.382] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199661.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199661.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199661.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199661.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0184.383] CloseHandle (hObject=0xdc) returned 1 [0184.383] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1b0eb00, ftCreationTime.dwHighDateTime=0x1be3e9a, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb1b0eb00, ftLastWriteTime.dwHighDateTime=0x1be3e9a, nFileSizeHigh=0x0, nFileSizeLow=0x900, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0199727.WMF", cAlternateFileName="")) returned 1 [0184.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199727.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199727.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0184.385] GetProcessHeap () returned 0x4e0000 [0184.385] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0184.385] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0184.385] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0184.385] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.385] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.385] GetProcessHeap () returned 0x4e0000 [0184.385] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0184.385] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0184.385] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.385] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0184.386] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0184.386] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0184.387] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0184.387] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0184.387] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.387] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.387] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.387] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.387] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x900, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x900, lpOverlapped=0x0) returned 1 [0184.387] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x900, dwBufLen=0x900 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x900) returned 1 [0184.387] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.387] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x900, lpOverlapped=0x0) returned 1 [0184.387] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.387] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x9d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.387] SetEndOfFile (hFile=0xdc) returned 1 [0184.389] GetProcessHeap () returned 0x4e0000 [0184.389] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0184.389] GetProcessHeap () returned 0x4e0000 [0184.389] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0184.389] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199727.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199727.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199727.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199727.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0184.390] CloseHandle (hObject=0xdc) returned 1 [0184.390] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc6b8000, ftCreationTime.dwHighDateTime=0x1be3e9a, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbc6b8000, ftLastWriteTime.dwHighDateTime=0x1be3e9a, nFileSizeHigh=0x0, nFileSizeLow=0xaf0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0199755.WMF", cAlternateFileName="")) returned 1 [0184.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199755.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199755.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0184.391] GetProcessHeap () returned 0x4e0000 [0184.391] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0184.391] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0184.391] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0184.391] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.391] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.391] GetProcessHeap () returned 0x4e0000 [0184.391] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0184.391] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0184.391] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.391] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0184.393] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0184.393] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0184.394] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0184.394] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0184.394] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.394] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.394] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.394] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.394] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xaf0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xaf0, lpOverlapped=0x0) returned 1 [0184.394] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xaf0, dwBufLen=0xaf0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xaf0) returned 1 [0184.394] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.394] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xaf0, lpOverlapped=0x0) returned 1 [0184.394] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.394] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xbc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.394] SetEndOfFile (hFile=0xdc) returned 1 [0184.396] GetProcessHeap () returned 0x4e0000 [0184.396] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0184.396] GetProcessHeap () returned 0x4e0000 [0184.396] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0184.396] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199755.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199755.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199755.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199755.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0184.399] CloseHandle (hObject=0xdc) returned 1 [0184.399] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd311d700, ftCreationTime.dwHighDateTime=0x1be3e9a, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd311d700, ftLastWriteTime.dwHighDateTime=0x1be3e9a, nFileSizeHigh=0x0, nFileSizeLow=0x948, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0199805.WMF", cAlternateFileName="")) returned 1 [0184.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199805.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199805.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0184.401] GetProcessHeap () returned 0x4e0000 [0184.401] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0184.401] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0184.401] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0184.401] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.403] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.403] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.403] GetProcessHeap () returned 0x4e0000 [0184.403] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0184.403] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0184.403] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.403] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0184.403] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0184.403] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0184.403] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0184.403] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0184.403] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.403] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.403] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.403] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.403] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x948, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x948, lpOverlapped=0x0) returned 1 [0184.403] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x950, dwBufLen=0x950 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x950) returned 1 [0184.403] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.403] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x950, lpOverlapped=0x0) returned 1 [0184.403] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.404] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xa24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.404] SetEndOfFile (hFile=0xdc) returned 1 [0184.406] GetProcessHeap () returned 0x4e0000 [0184.406] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0184.406] GetProcessHeap () returned 0x4e0000 [0184.406] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0184.406] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199805.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199805.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199805.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199805.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0184.408] CloseHandle (hObject=0xdc) returned 1 [0184.408] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85ccab00, ftCreationTime.dwHighDateTime=0x1be4d5e, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x85ccab00, ftLastWriteTime.dwHighDateTime=0x1be4d5e, nFileSizeHigh=0x0, nFileSizeLow=0x2398, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0205462.WMF", cAlternateFileName="")) returned 1 [0184.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205462.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205462.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0184.410] GetProcessHeap () returned 0x4e0000 [0184.410] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0184.410] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0184.410] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0184.410] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.412] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.412] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.412] GetProcessHeap () returned 0x4e0000 [0184.412] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0184.412] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0184.412] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.412] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0184.412] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0184.412] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0184.412] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0184.412] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0184.412] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.412] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.412] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.412] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.412] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2398, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2398, lpOverlapped=0x0) returned 1 [0184.413] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x23a0, dwBufLen=0x23a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x23a0) returned 1 [0184.413] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.413] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x23a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x23a0, lpOverlapped=0x0) returned 1 [0184.413] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.413] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.413] SetEndOfFile (hFile=0xdc) returned 1 [0184.415] GetProcessHeap () returned 0x4e0000 [0184.415] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0184.415] GetProcessHeap () returned 0x4e0000 [0184.416] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0184.416] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205462.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205462.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205462.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205462.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0184.417] CloseHandle (hObject=0xdc) returned 1 [0184.417] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89603200, ftCreationTime.dwHighDateTime=0x1be4d5e, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x89603200, ftLastWriteTime.dwHighDateTime=0x1be4d5e, nFileSizeHigh=0x0, nFileSizeLow=0x11e2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0205466.WMF", cAlternateFileName="")) returned 1 [0184.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205466.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205466.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0184.418] GetProcessHeap () returned 0x4e0000 [0184.418] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0184.418] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0184.418] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0184.418] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0184.420] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.420] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.420] GetProcessHeap () returned 0x4e0000 [0184.420] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0184.420] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0184.420] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.420] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0184.420] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0184.420] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0184.420] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0184.420] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0184.420] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.420] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.420] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.420] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.420] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x11e2, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x11e2, lpOverlapped=0x0) returned 1 [0184.421] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x11f0, dwBufLen=0x11f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x11f0) returned 1 [0184.421] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.421] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x11f0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x11f0, lpOverlapped=0x0) returned 1 [0184.421] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.422] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x12c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.422] SetEndOfFile (hFile=0xdc) returned 1 [0184.424] GetProcessHeap () returned 0x4e0000 [0184.424] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0184.424] GetProcessHeap () returned 0x4e0000 [0184.424] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0184.424] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205466.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205466.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205466.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205466.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0184.425] CloseHandle (hObject=0xdc) returned 1 [0184.425] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14d9c300, ftCreationTime.dwHighDateTime=0x1be4d5f, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x14d9c300, ftLastWriteTime.dwHighDateTime=0x1be4d5f, nFileSizeHigh=0x0, nFileSizeLow=0x17f2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0205582.WMF", cAlternateFileName="")) returned 1 [0184.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205582.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205582.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0184.426] GetProcessHeap () returned 0x4e0000 [0184.426] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0184.426] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0184.426] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0184.426] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0184.428] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.428] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.428] GetProcessHeap () returned 0x4e0000 [0184.428] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0184.428] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0184.428] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.428] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0184.428] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0184.428] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0184.428] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0184.428] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0184.428] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.428] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.429] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.429] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.429] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x17f2, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x17f2, lpOverlapped=0x0) returned 1 [0184.429] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1800, dwBufLen=0x1800 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1800) returned 1 [0184.429] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.429] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1800, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1800, lpOverlapped=0x0) returned 1 [0184.430] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.430] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x18d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.430] SetEndOfFile (hFile=0xdc) returned 1 [0184.432] GetProcessHeap () returned 0x4e0000 [0184.432] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0184.432] GetProcessHeap () returned 0x4e0000 [0184.432] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0184.432] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205582.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205582.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205582.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205582.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0184.433] CloseHandle (hObject=0xdc) returned 1 [0184.433] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e240a00, ftCreationTime.dwHighDateTime=0x1be560f, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3e240a00, ftLastWriteTime.dwHighDateTime=0x1be560f, nFileSizeHigh=0x0, nFileSizeLow=0xb34e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0211949.WMF", cAlternateFileName="")) returned 1 [0184.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0211949.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0211949.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0184.433] GetProcessHeap () returned 0x4e0000 [0184.433] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0184.433] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0184.434] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0184.434] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0184.436] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.436] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.436] GetProcessHeap () returned 0x4e0000 [0184.436] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0184.436] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0184.436] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.436] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0184.436] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0184.436] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0184.436] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0184.436] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0184.437] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.437] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.437] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.437] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.437] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb34e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xb34e, lpOverlapped=0x0) returned 1 [0184.438] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xb350, dwBufLen=0xb350 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xb350) returned 1 [0184.438] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.438] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xb350, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xb350, lpOverlapped=0x0) returned 1 [0184.438] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.438] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xb424, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.439] SetEndOfFile (hFile=0xdc) returned 1 [0184.441] GetProcessHeap () returned 0x4e0000 [0184.441] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0184.441] GetProcessHeap () returned 0x4e0000 [0184.441] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0184.441] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0211949.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0211949.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0211949.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0211949.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0184.442] CloseHandle (hObject=0xdc) returned 1 [0184.443] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50527800, ftCreationTime.dwHighDateTime=0x1be5610, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x50527800, ftLastWriteTime.dwHighDateTime=0x1be5610, nFileSizeHigh=0x0, nFileSizeLow=0x11be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0212219.WMF", cAlternateFileName="")) returned 1 [0184.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212219.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212219.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0184.444] GetProcessHeap () returned 0x4e0000 [0184.444] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0184.444] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0184.444] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0184.444] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0184.446] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.446] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.446] GetProcessHeap () returned 0x4e0000 [0184.446] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0184.446] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0184.446] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.446] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0184.446] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0184.446] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0184.446] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0184.446] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0184.446] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.446] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.446] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.446] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.447] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x11be, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x11be, lpOverlapped=0x0) returned 1 [0184.572] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x11c0, dwBufLen=0x11c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x11c0) returned 1 [0184.573] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.573] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x11c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x11c0, lpOverlapped=0x0) returned 1 [0184.573] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.573] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1294, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.573] SetEndOfFile (hFile=0xdc) returned 1 [0184.576] GetProcessHeap () returned 0x4e0000 [0184.576] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0184.576] GetProcessHeap () returned 0x4e0000 [0184.576] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0184.576] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212219.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212219.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212219.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212219.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0184.578] CloseHandle (hObject=0xdc) returned 1 [0184.578] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56952400, ftCreationTime.dwHighDateTime=0x1be5611, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x56952400, ftLastWriteTime.dwHighDateTime=0x1be5611, nFileSizeHigh=0x0, nFileSizeLow=0x248e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0212661.WMF", cAlternateFileName="")) returned 1 [0184.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212661.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212661.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0184.581] GetProcessHeap () returned 0x4e0000 [0184.581] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0184.581] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0184.581] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0184.581] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0184.584] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.584] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.584] GetProcessHeap () returned 0x4e0000 [0184.584] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0184.584] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0184.584] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.584] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0184.584] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0184.584] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0184.584] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0184.585] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0184.585] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.585] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.585] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.585] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.585] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x248e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x248e, lpOverlapped=0x0) returned 1 [0184.586] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2490, dwBufLen=0x2490 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2490) returned 1 [0184.586] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.586] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2490, lpOverlapped=0x0) returned 1 [0184.586] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.586] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2564, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.586] SetEndOfFile (hFile=0xdc) returned 1 [0184.589] GetProcessHeap () returned 0x4e0000 [0184.589] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0184.589] GetProcessHeap () returned 0x4e0000 [0184.589] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0184.589] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212661.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212661.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212661.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212661.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0184.591] CloseHandle (hObject=0xdc) returned 1 [0184.591] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e6ca800, ftCreationTime.dwHighDateTime=0x1be5611, ftLastAccessTime.dwLowDateTime=0xbd512fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6e6ca800, ftLastWriteTime.dwHighDateTime=0x1be5611, nFileSizeHigh=0x0, nFileSizeLow=0xb7a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0212701.WMF", cAlternateFileName="")) returned 1 [0184.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212701.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212701.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0184.592] GetProcessHeap () returned 0x4e0000 [0184.592] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0184.592] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0184.592] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0184.593] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0184.595] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.595] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.595] GetProcessHeap () returned 0x4e0000 [0184.595] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0184.595] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0184.595] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.595] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0184.595] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0184.595] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0184.595] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0184.595] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0184.595] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.596] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.596] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.596] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.596] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb7a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xb7a, lpOverlapped=0x0) returned 1 [0184.596] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xb80, dwBufLen=0xb80 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xb80) returned 1 [0184.596] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.596] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xb80, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xb80, lpOverlapped=0x0) returned 1 [0184.596] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.596] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xc54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.596] SetEndOfFile (hFile=0xdc) returned 1 [0184.599] GetProcessHeap () returned 0x4e0000 [0184.599] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0184.599] GetProcessHeap () returned 0x4e0000 [0184.599] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0184.599] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212701.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212701.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212701.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212701.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0184.601] CloseHandle (hObject=0xdc) returned 1 [0184.601] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdae7a700, ftCreationTime.dwHighDateTime=0x1be5611, ftLastAccessTime.dwLowDateTime=0xbd512fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdae7a700, ftLastWriteTime.dwHighDateTime=0x1be5611, nFileSizeHigh=0x0, nFileSizeLow=0x2424, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0212957.WMF", cAlternateFileName="")) returned 1 [0184.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212957.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212957.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0184.602] GetProcessHeap () returned 0x4e0000 [0184.602] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0184.602] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0184.602] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0184.602] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0184.604] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.604] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.605] GetProcessHeap () returned 0x4e0000 [0184.605] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0184.605] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0184.605] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.605] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0184.605] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0184.605] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0184.605] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0184.605] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0184.605] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.605] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.605] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.605] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.605] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2424, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2424, lpOverlapped=0x0) returned 1 [0184.606] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2430, dwBufLen=0x2430 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2430) returned 1 [0184.606] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.607] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2430, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2430, lpOverlapped=0x0) returned 1 [0184.607] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.607] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2504, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.607] SetEndOfFile (hFile=0xdc) returned 1 [0184.609] GetProcessHeap () returned 0x4e0000 [0184.609] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0184.609] GetProcessHeap () returned 0x4e0000 [0184.609] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0184.610] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212957.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212957.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212957.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212957.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0184.612] CloseHandle (hObject=0xdc) returned 1 [0184.612] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8726e600, ftCreationTime.dwHighDateTime=0x1be59a2, ftLastAccessTime.dwLowDateTime=0xbd512fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8726e600, ftLastWriteTime.dwHighDateTime=0x1be59a2, nFileSizeHigh=0x0, nFileSizeLow=0x68ba, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0214098.WAV", cAlternateFileName="")) returned 1 [0184.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0214098.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0184.614] GetProcessHeap () returned 0x4e0000 [0184.614] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0184.614] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0184.614] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0184.614] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0184.616] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.616] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.616] GetProcessHeap () returned 0x4e0000 [0184.616] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0184.616] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0184.616] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.616] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0184.616] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0184.616] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0184.616] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0184.617] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0184.617] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.617] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.617] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.617] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.617] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x68ba, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x68ba, lpOverlapped=0x0) returned 1 [0184.618] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x68c0, dwBufLen=0x68c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x68c0) returned 1 [0184.618] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.618] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x68c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x68c0, lpOverlapped=0x0) returned 1 [0184.619] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.619] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.619] SetEndOfFile (hFile=0xdc) returned 1 [0184.621] GetProcessHeap () returned 0x4e0000 [0184.621] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0184.621] GetProcessHeap () returned 0x4e0000 [0184.621] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0184.622] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0214098.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0214098.wav.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0184.623] CloseHandle (hObject=0xdc) returned 1 [0184.623] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32ba5a00, ftCreationTime.dwHighDateTime=0x1be1b5b, ftLastAccessTime.dwLowDateTime=0xbd512fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x32ba5a00, ftLastWriteTime.dwHighDateTime=0x1be1b5b, nFileSizeHigh=0x0, nFileSizeLow=0x1d3a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0215086.WMF", cAlternateFileName="")) returned 1 [0184.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0215086.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0184.625] GetProcessHeap () returned 0x4e0000 [0184.625] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0184.625] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0184.625] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0184.625] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0184.627] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.627] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.627] GetProcessHeap () returned 0x4e0000 [0184.627] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0184.627] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0184.627] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.627] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0184.627] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0184.627] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0184.627] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0184.627] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0184.627] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.628] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.628] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.628] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.628] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1d3a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1d3a, lpOverlapped=0x0) returned 1 [0184.631] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1d40, dwBufLen=0x1d40 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1d40) returned 1 [0184.631] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.631] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1d40, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1d40, lpOverlapped=0x0) returned 1 [0184.631] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.631] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1e14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.631] SetEndOfFile (hFile=0xdc) returned 1 [0184.634] GetProcessHeap () returned 0x4e0000 [0184.634] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0184.634] GetProcessHeap () returned 0x4e0000 [0184.634] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0184.634] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0215086.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0215086.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0184.636] CloseHandle (hObject=0xdc) returned 1 [0184.636] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35c4ec00, ftCreationTime.dwHighDateTime=0x1be6c1a, ftLastAccessTime.dwLowDateTime=0xbd512fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x35c4ec00, ftLastWriteTime.dwHighDateTime=0x1be6c1a, nFileSizeHigh=0x0, nFileSizeLow=0x3138, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0216516.WMF", cAlternateFileName="")) returned 1 [0184.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216516.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0184.637] GetProcessHeap () returned 0x4e0000 [0184.637] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0184.637] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0184.637] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0184.637] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.639] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.639] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.639] GetProcessHeap () returned 0x4e0000 [0184.639] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0184.639] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0184.639] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.639] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0184.639] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0184.639] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0184.640] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0184.640] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0184.640] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.640] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.640] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.640] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.640] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3138, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3138, lpOverlapped=0x0) returned 1 [0184.641] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3140, dwBufLen=0x3140 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3140) returned 1 [0184.641] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.641] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3140, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3140, lpOverlapped=0x0) returned 1 [0184.641] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.642] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.642] SetEndOfFile (hFile=0xdc) returned 1 [0184.644] GetProcessHeap () returned 0x4e0000 [0184.644] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0184.644] GetProcessHeap () returned 0x4e0000 [0184.644] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0184.645] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216516.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216516.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0184.646] CloseHandle (hObject=0xdc) returned 1 [0184.646] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e7ca500, ftCreationTime.dwHighDateTime=0x1be6c1a, ftLastAccessTime.dwLowDateTime=0xbd512fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7e7ca500, ftLastWriteTime.dwHighDateTime=0x1be6c1a, nFileSizeHigh=0x0, nFileSizeLow=0x1c06, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0216588.WMF", cAlternateFileName="")) returned 1 [0184.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216588.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0184.647] GetProcessHeap () returned 0x4e0000 [0184.647] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0184.648] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0184.648] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0184.648] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0184.650] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.650] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.650] GetProcessHeap () returned 0x4e0000 [0184.650] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0184.650] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0184.650] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.650] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0184.650] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0184.650] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0184.650] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0184.650] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0184.650] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.651] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.651] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.651] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.651] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1c06, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1c06, lpOverlapped=0x0) returned 1 [0184.652] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1c10, dwBufLen=0x1c10 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1c10) returned 1 [0184.652] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.652] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1c10, lpOverlapped=0x0) returned 1 [0184.652] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.652] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1ce4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.652] SetEndOfFile (hFile=0xdc) returned 1 [0184.655] GetProcessHeap () returned 0x4e0000 [0184.655] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0184.655] GetProcessHeap () returned 0x4e0000 [0184.655] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0184.655] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216588.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216588.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0184.656] CloseHandle (hObject=0xdc) returned 1 [0184.657] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff3ba100, ftCreationTime.dwHighDateTime=0x1be6c1a, ftLastAccessTime.dwLowDateTime=0xbd512fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xff3ba100, ftLastWriteTime.dwHighDateTime=0x1be6c1a, nFileSizeHigh=0x0, nFileSizeLow=0x5d78, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0216724.WMF", cAlternateFileName="")) returned 1 [0184.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216724.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0184.658] GetProcessHeap () returned 0x4e0000 [0184.658] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0184.659] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0184.659] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0184.659] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.661] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.661] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.661] GetProcessHeap () returned 0x4e0000 [0184.661] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0184.661] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0184.661] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.661] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0184.661] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0184.661] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0184.661] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0184.661] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0184.661] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.661] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.661] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.661] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.661] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5d78, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x5d78, lpOverlapped=0x0) returned 1 [0184.662] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5d80, dwBufLen=0x5d80 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5d80) returned 1 [0184.662] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.662] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5d80, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5d80, lpOverlapped=0x0) returned 1 [0184.662] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.662] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5e54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.662] SetEndOfFile (hFile=0xdc) returned 1 [0184.665] GetProcessHeap () returned 0x4e0000 [0184.665] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0184.665] GetProcessHeap () returned 0x4e0000 [0184.665] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0184.665] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216724.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216724.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0184.666] CloseHandle (hObject=0xdc) returned 1 [0184.666] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x825cf700, ftCreationTime.dwHighDateTime=0x1be6c1b, ftLastAccessTime.dwLowDateTime=0xbd539100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x825cf700, ftLastWriteTime.dwHighDateTime=0x1be6c1b, nFileSizeHigh=0x0, nFileSizeLow=0x2dc4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0216858.WMF", cAlternateFileName="")) returned 1 [0184.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216858.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0184.667] GetProcessHeap () returned 0x4e0000 [0184.667] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0184.667] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0184.668] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0184.668] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0184.670] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.670] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.670] GetProcessHeap () returned 0x4e0000 [0184.670] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0184.670] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0184.670] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.670] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0184.670] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0184.670] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0184.670] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0184.670] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0184.670] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.670] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.670] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.670] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.670] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2dc4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2dc4, lpOverlapped=0x0) returned 1 [0184.671] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2dd0, dwBufLen=0x2dd0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2dd0) returned 1 [0184.671] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.671] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2dd0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2dd0, lpOverlapped=0x0) returned 1 [0184.671] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.671] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2ea4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.671] SetEndOfFile (hFile=0xdc) returned 1 [0184.674] GetProcessHeap () returned 0x4e0000 [0184.674] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0184.674] GetProcessHeap () returned 0x4e0000 [0184.674] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0184.674] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216858.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216858.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0184.676] CloseHandle (hObject=0xdc) returned 1 [0184.676] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8cb3500, ftCreationTime.dwHighDateTime=0x1be6c1d, ftLastAccessTime.dwLowDateTime=0xbd539100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd8cb3500, ftLastWriteTime.dwHighDateTime=0x1be6c1d, nFileSizeHigh=0x0, nFileSizeLow=0x1aea, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0217698.WMF", cAlternateFileName="")) returned 1 [0184.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0217698.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0184.677] GetProcessHeap () returned 0x4e0000 [0184.677] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0184.677] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0184.677] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0184.677] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0184.679] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.679] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.679] GetProcessHeap () returned 0x4e0000 [0184.679] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0184.679] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0184.679] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.679] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0184.679] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0184.679] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0184.679] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0184.679] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0184.679] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.679] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.680] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.680] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.680] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1aea, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1aea, lpOverlapped=0x0) returned 1 [0184.680] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1af0, dwBufLen=0x1af0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1af0) returned 1 [0184.680] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.680] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1af0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1af0, lpOverlapped=0x0) returned 1 [0184.681] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.681] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1bc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.681] SetEndOfFile (hFile=0xdc) returned 1 [0184.683] GetProcessHeap () returned 0x4e0000 [0184.683] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0184.683] GetProcessHeap () returned 0x4e0000 [0184.683] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0184.683] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0217698.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0217698.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0184.684] CloseHandle (hObject=0xdc) returned 1 [0184.684] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bfdb600, ftCreationTime.dwHighDateTime=0x1be7a36, ftLastAccessTime.dwLowDateTime=0xbd539100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7bfdb600, ftLastWriteTime.dwHighDateTime=0x1be7a36, nFileSizeHigh=0x0, nFileSizeLow=0x3838, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0221903.WMF", cAlternateFileName="")) returned 1 [0184.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0221903.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0184.684] GetProcessHeap () returned 0x4e0000 [0184.684] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0184.684] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0184.684] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0184.685] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.686] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.686] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.686] GetProcessHeap () returned 0x4e0000 [0184.686] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0184.686] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0184.686] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.686] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0184.686] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0184.687] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0184.687] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0184.687] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0184.687] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.687] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.687] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.687] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.687] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3838, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3838, lpOverlapped=0x0) returned 1 [0184.688] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3840, dwBufLen=0x3840 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3840) returned 1 [0184.688] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.688] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3840, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3840, lpOverlapped=0x0) returned 1 [0184.688] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.688] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3914, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.688] SetEndOfFile (hFile=0xdc) returned 1 [0184.690] GetProcessHeap () returned 0x4e0000 [0184.690] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0184.690] GetProcessHeap () returned 0x4e0000 [0184.690] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0184.690] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0221903.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0221903.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0184.691] CloseHandle (hObject=0xdc) returned 1 [0184.692] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7bae00, ftCreationTime.dwHighDateTime=0x1be7a37, ftLastAccessTime.dwLowDateTime=0xbd539100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7d7bae00, ftLastWriteTime.dwHighDateTime=0x1be7a37, nFileSizeHigh=0x0, nFileSizeLow=0x78a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0222015.WMF", cAlternateFileName="")) returned 1 [0184.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222015.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222015.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0184.696] GetProcessHeap () returned 0x4e0000 [0184.696] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0184.696] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0184.696] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0184.696] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0184.698] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.698] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.698] GetProcessHeap () returned 0x4e0000 [0184.698] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0184.698] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0184.698] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.698] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0184.698] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0184.698] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0184.698] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0184.699] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0184.699] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.699] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.699] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.699] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.699] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x78a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x78a, lpOverlapped=0x0) returned 1 [0184.699] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x790, dwBufLen=0x790 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x790) returned 1 [0184.699] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.699] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x790, lpOverlapped=0x0) returned 1 [0184.699] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.699] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x864, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.699] SetEndOfFile (hFile=0xdc) returned 1 [0184.701] GetProcessHeap () returned 0x4e0000 [0184.701] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0184.701] GetProcessHeap () returned 0x4e0000 [0184.701] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0184.701] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222015.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222015.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222015.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222015.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0184.702] CloseHandle (hObject=0xdc) returned 1 [0184.702] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fde0800, ftCreationTime.dwHighDateTime=0x1be7a37, ftLastAccessTime.dwLowDateTime=0xbd539100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7fde0800, ftLastWriteTime.dwHighDateTime=0x1be7a37, nFileSizeHigh=0x0, nFileSizeLow=0x632, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0222017.WMF", cAlternateFileName="")) returned 1 [0184.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222017.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222017.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0184.703] GetProcessHeap () returned 0x4e0000 [0184.703] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0184.703] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0184.703] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0184.703] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0184.705] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.705] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.705] GetProcessHeap () returned 0x4e0000 [0184.705] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0184.705] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0184.705] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.706] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0184.706] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0184.706] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0184.706] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0184.706] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0184.706] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.706] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.706] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.706] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.706] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x632, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x632, lpOverlapped=0x0) returned 1 [0184.706] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x640, dwBufLen=0x640 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x640) returned 1 [0184.706] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.706] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x640, lpOverlapped=0x0) returned 1 [0184.706] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.706] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.706] SetEndOfFile (hFile=0xdc) returned 1 [0184.708] GetProcessHeap () returned 0x4e0000 [0184.708] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0184.708] GetProcessHeap () returned 0x4e0000 [0184.708] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0184.708] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222017.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222017.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222017.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222017.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0184.710] CloseHandle (hObject=0xdc) returned 1 [0184.710] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82406200, ftCreationTime.dwHighDateTime=0x1be7a37, ftLastAccessTime.dwLowDateTime=0xbd539100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x82406200, ftLastWriteTime.dwHighDateTime=0x1be7a37, nFileSizeHigh=0x0, nFileSizeLow=0x58e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0222019.WMF", cAlternateFileName="")) returned 1 [0184.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222019.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222019.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0184.711] GetProcessHeap () returned 0x4e0000 [0184.711] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0184.711] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0184.711] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0184.711] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0184.712] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.712] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.713] GetProcessHeap () returned 0x4e0000 [0184.713] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0184.713] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0184.713] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.713] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0184.713] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0184.713] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0184.713] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0184.713] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0184.713] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.713] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.713] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.713] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.713] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x58e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x58e, lpOverlapped=0x0) returned 1 [0184.713] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x590, dwBufLen=0x590 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x590) returned 1 [0184.713] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.713] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x590, lpOverlapped=0x0) returned 1 [0184.713] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.713] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x664, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.714] SetEndOfFile (hFile=0xdc) returned 1 [0184.715] GetProcessHeap () returned 0x4e0000 [0184.716] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0184.716] GetProcessHeap () returned 0x4e0000 [0184.716] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0184.716] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222019.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222019.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222019.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222019.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0184.718] CloseHandle (hObject=0xdc) returned 1 [0184.718] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85d3e900, ftCreationTime.dwHighDateTime=0x1be7a37, ftLastAccessTime.dwLowDateTime=0xbd539100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x85d3e900, ftLastWriteTime.dwHighDateTime=0x1be7a37, nFileSizeHigh=0x0, nFileSizeLow=0x7c6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0222021.WMF", cAlternateFileName="")) returned 1 [0184.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222021.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222021.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0184.718] GetProcessHeap () returned 0x4e0000 [0184.718] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0184.718] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0184.718] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0184.719] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0184.720] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.720] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.720] GetProcessHeap () returned 0x4e0000 [0184.720] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0184.720] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0184.720] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.720] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0184.720] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0184.721] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0184.721] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0184.721] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0184.721] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.721] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.721] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.721] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.721] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7c6, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7c6, lpOverlapped=0x0) returned 1 [0184.721] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7d0, dwBufLen=0x7d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7d0) returned 1 [0184.721] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.721] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7d0, lpOverlapped=0x0) returned 1 [0184.721] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.721] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x8a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.721] SetEndOfFile (hFile=0xdc) returned 1 [0184.723] GetProcessHeap () returned 0x4e0000 [0184.723] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0184.723] GetProcessHeap () returned 0x4e0000 [0184.723] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0184.723] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222021.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222021.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222021.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222021.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0184.724] CloseHandle (hObject=0xdc) returned 1 [0184.724] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b0a7e00, ftCreationTime.dwHighDateTime=0x1be860b, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7b0a7e00, ftLastWriteTime.dwHighDateTime=0x1be860b, nFileSizeHigh=0x0, nFileSizeLow=0xf5c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0229385.WMF", cAlternateFileName="")) returned 1 [0184.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229385.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0229385.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0184.726] GetProcessHeap () returned 0x4e0000 [0184.726] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0184.726] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0184.726] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0184.726] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0184.728] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.728] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.728] GetProcessHeap () returned 0x4e0000 [0184.728] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0184.728] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0184.728] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.728] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0184.728] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0184.728] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0184.728] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0184.728] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0184.728] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.728] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.728] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.728] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.729] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xf5c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xf5c, lpOverlapped=0x0) returned 1 [0184.729] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xf60, dwBufLen=0xf60 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xf60) returned 1 [0184.729] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.729] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xf60, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xf60, lpOverlapped=0x0) returned 1 [0184.729] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.729] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.729] SetEndOfFile (hFile=0xdc) returned 1 [0184.731] GetProcessHeap () returned 0x4e0000 [0184.731] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0184.731] GetProcessHeap () returned 0x4e0000 [0184.731] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0184.731] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229385.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0229385.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229385.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0229385.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0184.732] CloseHandle (hObject=0xdc) returned 1 [0184.732] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c3bab00, ftCreationTime.dwHighDateTime=0x1be860b, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7c3bab00, ftLastWriteTime.dwHighDateTime=0x1be860b, nFileSizeHigh=0x0, nFileSizeLow=0xee0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0229389.WMF", cAlternateFileName="")) returned 1 [0184.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229389.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0229389.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0184.733] GetProcessHeap () returned 0x4e0000 [0184.733] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0184.733] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0184.733] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0184.733] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.733] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.733] GetProcessHeap () returned 0x4e0000 [0184.733] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0184.733] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0184.733] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.733] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0184.735] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0184.735] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0184.735] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0184.735] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0184.735] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.735] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.735] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.735] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.735] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xee0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xee0, lpOverlapped=0x0) returned 1 [0184.735] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xee0, dwBufLen=0xee0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xee0) returned 1 [0184.735] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.736] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xee0, lpOverlapped=0x0) returned 1 [0184.736] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.736] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xfb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.736] SetEndOfFile (hFile=0xdc) returned 1 [0184.738] GetProcessHeap () returned 0x4e0000 [0184.738] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0184.738] GetProcessHeap () returned 0x4e0000 [0184.738] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0184.738] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229389.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0229389.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229389.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0229389.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0184.739] CloseHandle (hObject=0xdc) returned 1 [0184.739] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd64900, ftCreationTime.dwHighDateTime=0x1bc82e4, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6fd64900, ftLastWriteTime.dwHighDateTime=0x1bc82e4, nFileSizeHigh=0x0, nFileSizeLow=0x30da, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0230876.WMF", cAlternateFileName="")) returned 1 [0184.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0230876.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0230876.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0184.740] GetProcessHeap () returned 0x4e0000 [0184.740] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0184.740] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0184.740] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0184.740] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0184.742] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.742] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.742] GetProcessHeap () returned 0x4e0000 [0184.742] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0184.742] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0184.742] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.742] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0184.742] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0184.742] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0184.742] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0184.742] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0184.742] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.742] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.742] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.742] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.742] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x30da, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x30da, lpOverlapped=0x0) returned 1 [0184.743] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x30e0, dwBufLen=0x30e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x30e0) returned 1 [0184.743] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.744] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x30e0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x30e0, lpOverlapped=0x0) returned 1 [0184.744] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.744] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x31b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.744] SetEndOfFile (hFile=0xdc) returned 1 [0184.746] GetProcessHeap () returned 0x4e0000 [0184.746] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0184.746] GetProcessHeap () returned 0x4e0000 [0184.746] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0184.746] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0230876.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0230876.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0230876.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0230876.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0184.747] CloseHandle (hObject=0xdc) returned 1 [0184.747] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabe1b900, ftCreationTime.dwHighDateTime=0x1be516b, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xabe1b900, ftLastWriteTime.dwHighDateTime=0x1be516b, nFileSizeHigh=0x0, nFileSizeLow=0x77f0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0233018.WMF", cAlternateFileName="")) returned 1 [0184.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233018.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233018.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0184.748] GetProcessHeap () returned 0x4e0000 [0184.748] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0184.748] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0184.748] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0184.748] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.748] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.748] GetProcessHeap () returned 0x4e0000 [0184.748] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0184.748] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0184.748] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.748] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0184.750] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0184.750] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0184.750] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0184.750] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0184.750] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.750] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.750] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.751] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.751] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x77f0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x77f0, lpOverlapped=0x0) returned 1 [0184.752] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x77f0, dwBufLen=0x77f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x77f0) returned 1 [0184.752] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.752] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x77f0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x77f0, lpOverlapped=0x0) returned 1 [0184.752] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.752] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x78c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.752] SetEndOfFile (hFile=0xdc) returned 1 [0184.754] GetProcessHeap () returned 0x4e0000 [0184.754] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0184.754] GetProcessHeap () returned 0x4e0000 [0184.754] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0184.755] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233018.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233018.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233018.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233018.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0184.756] CloseHandle (hObject=0xdc) returned 1 [0184.756] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c43c200, ftCreationTime.dwHighDateTime=0x1be1b5b, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3c43c200, ftLastWriteTime.dwHighDateTime=0x1be1b5b, nFileSizeHigh=0x0, nFileSizeLow=0x1522, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0233070.WMF", cAlternateFileName="")) returned 1 [0184.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233070.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233070.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0184.757] GetProcessHeap () returned 0x4e0000 [0184.757] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0184.757] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0184.757] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0184.757] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0184.761] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.761] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.761] GetProcessHeap () returned 0x4e0000 [0184.761] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0184.761] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0184.761] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.761] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0184.761] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0184.761] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0184.761] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0184.761] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0184.761] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.761] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.761] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.761] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.761] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1522, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1522, lpOverlapped=0x0) returned 1 [0184.762] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1530, dwBufLen=0x1530 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1530) returned 1 [0184.762] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.762] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1530, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1530, lpOverlapped=0x0) returned 1 [0184.762] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.762] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1604, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.762] SetEndOfFile (hFile=0xdc) returned 1 [0184.764] GetProcessHeap () returned 0x4e0000 [0184.764] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0184.764] GetProcessHeap () returned 0x4e0000 [0184.764] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0184.764] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233070.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233070.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233070.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233070.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0184.766] CloseHandle (hObject=0xdc) returned 1 [0184.766] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36d32e00, ftCreationTime.dwHighDateTime=0x1be56ed, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x36d32e00, ftLastWriteTime.dwHighDateTime=0x1be56ed, nFileSizeHigh=0x0, nFileSizeLow=0x80f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0233312.WMF", cAlternateFileName="")) returned 1 [0184.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233312.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233312.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0184.767] GetProcessHeap () returned 0x4e0000 [0184.767] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0184.767] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0184.767] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0184.767] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.852] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.852] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.852] GetProcessHeap () returned 0x4e0000 [0184.852] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0184.852] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0184.852] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.852] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0184.853] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0184.853] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0184.853] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0184.853] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0184.853] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.853] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.853] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.853] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.853] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x80f8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x80f8, lpOverlapped=0x0) returned 1 [0184.854] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8100, dwBufLen=0x8100 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x8100) returned 1 [0184.854] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.854] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x8100, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x8100, lpOverlapped=0x0) returned 1 [0184.855] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.855] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x81d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.855] SetEndOfFile (hFile=0xdc) returned 1 [0184.857] GetProcessHeap () returned 0x4e0000 [0184.857] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0184.857] GetProcessHeap () returned 0x4e0000 [0184.857] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0184.857] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233312.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233312.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233312.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233312.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0184.859] CloseHandle (hObject=0xdc) returned 1 [0184.859] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23f92c00, ftCreationTime.dwHighDateTime=0x1be8094, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x23f92c00, ftLastWriteTime.dwHighDateTime=0x1be8094, nFileSizeHigh=0x0, nFileSizeLow=0x6632, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0234131.WMF", cAlternateFileName="")) returned 1 [0184.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234131.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234131.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0184.860] GetProcessHeap () returned 0x4e0000 [0184.860] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0184.860] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0184.860] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0184.861] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0184.862] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.862] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.863] GetProcessHeap () returned 0x4e0000 [0184.863] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0184.863] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0184.863] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.863] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0184.863] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0184.863] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0184.863] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0184.863] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0184.863] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.863] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.863] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.863] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.863] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x6632, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x6632, lpOverlapped=0x0) returned 1 [0184.865] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6640, dwBufLen=0x6640 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6640) returned 1 [0184.865] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.865] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6640, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x6640, lpOverlapped=0x0) returned 1 [0184.865] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.865] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.865] SetEndOfFile (hFile=0xdc) returned 1 [0184.868] GetProcessHeap () returned 0x4e0000 [0184.868] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0184.868] GetProcessHeap () returned 0x4e0000 [0184.868] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0184.868] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234131.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234131.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234131.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234131.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0184.870] CloseHandle (hObject=0xdc) returned 1 [0184.870] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a15c200, ftCreationTime.dwHighDateTime=0x1be7fe9, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4a15c200, ftLastWriteTime.dwHighDateTime=0x1be7fe9, nFileSizeHigh=0x0, nFileSizeLow=0xa87e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0234266.WMF", cAlternateFileName="")) returned 1 [0184.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234266.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234266.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0184.872] GetProcessHeap () returned 0x4e0000 [0184.872] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0184.872] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0184.872] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0184.872] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0184.874] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.874] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.874] GetProcessHeap () returned 0x4e0000 [0184.874] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0184.874] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0184.874] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.874] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0184.874] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0184.874] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0184.874] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0184.874] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0184.874] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.875] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.875] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.875] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.875] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xa87e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xa87e, lpOverlapped=0x0) returned 1 [0184.876] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa880, dwBufLen=0xa880 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa880) returned 1 [0184.876] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.876] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xa880, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xa880, lpOverlapped=0x0) returned 1 [0184.877] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.877] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xa954, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.877] SetEndOfFile (hFile=0xdc) returned 1 [0184.880] GetProcessHeap () returned 0x4e0000 [0184.880] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0184.880] GetProcessHeap () returned 0x4e0000 [0184.880] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0184.880] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234266.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234266.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234266.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234266.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0184.882] CloseHandle (hObject=0xdc) returned 1 [0184.882] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1034e00, ftCreationTime.dwHighDateTime=0x1be75a5, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1034e00, ftLastWriteTime.dwHighDateTime=0x1be75a5, nFileSizeHigh=0x0, nFileSizeLow=0x27ee, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0234657.WMF", cAlternateFileName="")) returned 1 [0184.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234657.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234657.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0184.884] GetProcessHeap () returned 0x4e0000 [0184.884] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0184.884] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0184.884] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0184.884] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0184.886] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.886] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.886] GetProcessHeap () returned 0x4e0000 [0184.886] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0184.886] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0184.886] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.886] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0184.886] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0184.886] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0184.887] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0184.887] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0184.887] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.887] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.887] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.887] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.887] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x27ee, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x27ee, lpOverlapped=0x0) returned 1 [0184.890] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x27f0, dwBufLen=0x27f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x27f0) returned 1 [0184.891] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.891] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x27f0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x27f0, lpOverlapped=0x0) returned 1 [0184.891] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.891] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x28c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.891] SetEndOfFile (hFile=0xdc) returned 1 [0184.894] GetProcessHeap () returned 0x4e0000 [0184.894] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0184.894] GetProcessHeap () returned 0x4e0000 [0184.894] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0184.894] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234657.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234657.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234657.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234657.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0184.896] CloseHandle (hObject=0xdc) returned 1 [0184.896] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9eeb500, ftCreationTime.dwHighDateTime=0x1bf2be6, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc9eeb500, ftLastWriteTime.dwHighDateTime=0x1bf2be6, nFileSizeHigh=0x0, nFileSizeLow=0xd4f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0234687.GIF", cAlternateFileName="")) returned 1 [0184.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234687.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0184.897] GetProcessHeap () returned 0x4e0000 [0184.897] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0184.897] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0184.897] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0184.898] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x1, lpOverlapped=0x0) returned 1 [0184.899] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.900] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.900] GetProcessHeap () returned 0x4e0000 [0184.900] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0184.900] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0184.900] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.900] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0184.900] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0184.900] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0184.900] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0184.900] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0184.900] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.900] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.900] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.900] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.900] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xd4f, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xd4f, lpOverlapped=0x0) returned 1 [0184.901] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xd50, dwBufLen=0xd50 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xd50) returned 1 [0184.901] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.901] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xd50, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xd50, lpOverlapped=0x0) returned 1 [0184.901] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.901] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xe24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.901] SetEndOfFile (hFile=0xdc) returned 1 [0184.903] GetProcessHeap () returned 0x4e0000 [0184.904] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0184.904] GetProcessHeap () returned 0x4e0000 [0184.904] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0184.904] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234687.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234687.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0184.908] CloseHandle (hObject=0xdc) returned 1 [0184.908] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85566d00, ftCreationTime.dwHighDateTime=0x1be911f, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x85566d00, ftLastWriteTime.dwHighDateTime=0x1be911f, nFileSizeHigh=0x0, nFileSizeLow=0x1820, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0235241.WMF", cAlternateFileName="")) returned 1 [0184.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0235241.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0184.909] GetProcessHeap () returned 0x4e0000 [0184.909] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0184.909] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0184.910] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0184.910] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.910] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.910] GetProcessHeap () returned 0x4e0000 [0184.910] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0184.910] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0184.910] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.910] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0184.916] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0184.916] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0184.916] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0184.916] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0184.916] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.916] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.916] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.916] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.916] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1820, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1820, lpOverlapped=0x0) returned 1 [0184.917] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1820, dwBufLen=0x1820 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1820) returned 1 [0184.918] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.918] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1820, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1820, lpOverlapped=0x0) returned 1 [0184.918] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.918] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x18f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.918] SetEndOfFile (hFile=0xdc) returned 1 [0184.920] GetProcessHeap () returned 0x4e0000 [0184.921] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0184.921] GetProcessHeap () returned 0x4e0000 [0184.921] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0184.921] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0235241.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0235241.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0184.923] CloseHandle (hObject=0xdc) returned 1 [0184.923] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c56b00, ftCreationTime.dwHighDateTime=0x1c0371d, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4c56b00, ftLastWriteTime.dwHighDateTime=0x1c0371d, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0235319.WMF", cAlternateFileName="")) returned 1 [0184.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0235319.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0184.924] GetProcessHeap () returned 0x4e0000 [0184.924] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0184.924] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0184.924] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0184.924] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0184.926] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.926] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.926] GetProcessHeap () returned 0x4e0000 [0184.926] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0184.926] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0184.926] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.926] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0184.926] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0184.926] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0184.927] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0184.927] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0184.927] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.927] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.927] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.927] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.927] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xa24, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xa24, lpOverlapped=0x0) returned 1 [0184.927] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa30, dwBufLen=0xa30 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa30) returned 1 [0184.927] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.927] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xa30, lpOverlapped=0x0) returned 1 [0184.927] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.927] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xb04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.927] SetEndOfFile (hFile=0xdc) returned 1 [0184.930] GetProcessHeap () returned 0x4e0000 [0184.930] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0184.930] GetProcessHeap () returned 0x4e0000 [0184.930] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0184.930] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0235319.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0235319.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0184.932] CloseHandle (hObject=0xdc) returned 1 [0184.932] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0bd8800, ftCreationTime.dwHighDateTime=0x1be9cd9, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb0bd8800, ftLastWriteTime.dwHighDateTime=0x1be9cd9, nFileSizeHigh=0x0, nFileSizeLow=0x13d6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0240695.WMF", cAlternateFileName="")) returned 1 [0184.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0240695.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0184.934] GetProcessHeap () returned 0x4e0000 [0184.934] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0184.934] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0184.934] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0184.934] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0184.936] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.936] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.936] GetProcessHeap () returned 0x4e0000 [0184.936] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0184.937] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0184.937] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.937] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0184.937] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0184.937] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0184.937] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0184.937] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0184.937] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.937] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.937] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.937] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.937] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x13d6, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x13d6, lpOverlapped=0x0) returned 1 [0184.938] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x13e0, dwBufLen=0x13e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x13e0) returned 1 [0184.938] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.939] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x13e0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x13e0, lpOverlapped=0x0) returned 1 [0184.939] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.939] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x14b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.939] SetEndOfFile (hFile=0xdc) returned 1 [0184.941] GetProcessHeap () returned 0x4e0000 [0184.941] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0184.942] GetProcessHeap () returned 0x4e0000 [0184.942] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0184.942] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0240695.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0240695.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0184.944] CloseHandle (hObject=0xdc) returned 1 [0184.944] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc16dfe00, ftCreationTime.dwHighDateTime=0x1be9cd9, ftLastAccessTime.dwLowDateTime=0xbd5ab520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc16dfe00, ftLastWriteTime.dwHighDateTime=0x1be9cd9, nFileSizeHigh=0x0, nFileSizeLow=0x1aa2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0240719.WMF", cAlternateFileName="")) returned 1 [0184.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0240719.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0184.947] GetProcessHeap () returned 0x4e0000 [0184.947] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0184.947] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0184.947] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0184.947] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0184.949] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.949] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.949] GetProcessHeap () returned 0x4e0000 [0184.949] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0184.949] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0184.950] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.950] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0184.950] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0184.950] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0184.950] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0184.950] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0184.950] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.950] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.950] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.950] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.950] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1aa2, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1aa2, lpOverlapped=0x0) returned 1 [0184.951] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1ab0, dwBufLen=0x1ab0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1ab0) returned 1 [0184.951] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.951] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1ab0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1ab0, lpOverlapped=0x0) returned 1 [0184.952] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.952] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1b84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.952] SetEndOfFile (hFile=0xdc) returned 1 [0184.954] GetProcessHeap () returned 0x4e0000 [0184.954] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0184.954] GetProcessHeap () returned 0x4e0000 [0184.954] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0184.954] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0240719.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0240719.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0184.956] CloseHandle (hObject=0xdc) returned 1 [0184.957] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d89700, ftCreationTime.dwHighDateTime=0x1beb2f4, ftLastAccessTime.dwLowDateTime=0xbd5ab520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x28d89700, ftLastWriteTime.dwHighDateTime=0x1beb2f4, nFileSizeHigh=0x0, nFileSizeLow=0x1498, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0251301.WMF", cAlternateFileName="")) returned 1 [0184.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251301.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0184.958] GetProcessHeap () returned 0x4e0000 [0184.958] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0184.958] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0184.958] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0184.958] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.960] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.960] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.960] GetProcessHeap () returned 0x4e0000 [0184.960] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0184.960] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0184.960] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.960] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0184.960] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0184.960] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0184.961] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0184.961] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0184.961] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.961] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.961] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.961] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.961] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1498, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1498, lpOverlapped=0x0) returned 1 [0184.962] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x14a0, dwBufLen=0x14a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x14a0) returned 1 [0184.962] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.962] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x14a0, lpOverlapped=0x0) returned 1 [0184.962] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.962] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1574, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.962] SetEndOfFile (hFile=0xdc) returned 1 [0184.965] GetProcessHeap () returned 0x4e0000 [0184.965] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0184.965] GetProcessHeap () returned 0x4e0000 [0184.965] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0184.965] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251301.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251301.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0184.967] CloseHandle (hObject=0xdc) returned 1 [0184.967] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf384f00, ftCreationTime.dwHighDateTime=0x1beb2f6, ftLastAccessTime.dwLowDateTime=0xbd5ab520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf384f00, ftLastWriteTime.dwHighDateTime=0x1beb2f6, nFileSizeHigh=0x0, nFileSizeLow=0x1232, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0251871.WMF", cAlternateFileName="")) returned 1 [0184.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251871.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0184.968] GetProcessHeap () returned 0x4e0000 [0184.969] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0184.969] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0184.969] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0184.969] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0184.971] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.971] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.971] GetProcessHeap () returned 0x4e0000 [0184.971] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0184.971] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0184.971] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.971] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0184.971] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0184.972] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0184.972] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0184.972] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0184.972] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0184.972] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0184.972] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0184.972] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.972] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1232, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1232, lpOverlapped=0x0) returned 1 [0184.973] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1240, dwBufLen=0x1240 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1240) returned 1 [0184.973] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.973] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1240, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1240, lpOverlapped=0x0) returned 1 [0184.973] CryptDestroyKey (hKey=0x522f98) returned 1 [0184.973] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.973] SetEndOfFile (hFile=0xdc) returned 1 [0184.976] GetProcessHeap () returned 0x4e0000 [0184.976] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0184.976] GetProcessHeap () returned 0x4e0000 [0184.976] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0184.976] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251871.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251871.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0184.978] CloseHandle (hObject=0xdc) returned 1 [0184.978] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db62a00, ftCreationTime.dwHighDateTime=0x1beb2f6, ftLastAccessTime.dwLowDateTime=0xbd5ab520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3db62a00, ftLastWriteTime.dwHighDateTime=0x1beb2f6, nFileSizeHigh=0x0, nFileSizeLow=0x11b6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0251925.WMF", cAlternateFileName="")) returned 1 [0184.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251925.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0184.980] GetProcessHeap () returned 0x4e0000 [0184.980] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0184.981] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0184.981] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0184.981] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0185.025] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.025] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.025] GetProcessHeap () returned 0x4e0000 [0185.025] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0185.025] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0185.025] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.025] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0185.026] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0185.026] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0185.026] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0185.026] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0185.026] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0185.026] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.026] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.026] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.026] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x11b6, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x11b6, lpOverlapped=0x0) returned 1 [0185.027] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x11c0, dwBufLen=0x11c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x11c0) returned 1 [0185.027] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.028] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x11c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x11c0, lpOverlapped=0x0) returned 1 [0185.028] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.028] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1294, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.028] SetEndOfFile (hFile=0xdc) returned 1 [0185.031] GetProcessHeap () returned 0x4e0000 [0185.031] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0185.031] GetProcessHeap () returned 0x4e0000 [0185.031] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0185.031] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251925.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251925.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0185.033] CloseHandle (hObject=0xdc) returned 1 [0185.033] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb8de800, ftCreationTime.dwHighDateTime=0x1beb2f7, ftLastAccessTime.dwLowDateTime=0xbd5ab520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfb8de800, ftLastWriteTime.dwHighDateTime=0x1beb2f7, nFileSizeHigh=0x0, nFileSizeLow=0x158c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0252349.WMF", cAlternateFileName="")) returned 1 [0185.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0252349.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0252349.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0185.035] GetProcessHeap () returned 0x4e0000 [0185.035] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0185.035] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0185.035] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0185.035] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0185.037] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.037] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.037] GetProcessHeap () returned 0x4e0000 [0185.037] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0185.037] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0185.037] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.037] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0185.037] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0185.037] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0185.037] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0185.038] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0185.038] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0185.038] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.038] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.038] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.038] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x158c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x158c, lpOverlapped=0x0) returned 1 [0185.039] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1590, dwBufLen=0x1590 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1590) returned 1 [0185.039] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.039] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1590, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1590, lpOverlapped=0x0) returned 1 [0185.039] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.039] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1664, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.039] SetEndOfFile (hFile=0xdc) returned 1 [0185.042] GetProcessHeap () returned 0x4e0000 [0185.042] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0185.042] GetProcessHeap () returned 0x4e0000 [0185.042] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0185.042] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0252349.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0252349.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0252349.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0252349.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0185.044] CloseHandle (hObject=0xdc) returned 1 [0185.044] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fdf2000, ftCreationTime.dwHighDateTime=0x1beccca, ftLastAccessTime.dwLowDateTime=0xbd5ab520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3fdf2000, ftLastWriteTime.dwHighDateTime=0x1beccca, nFileSizeHigh=0x0, nFileSizeLow=0xed0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0278882.WMF", cAlternateFileName="")) returned 1 [0185.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0278882.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0278882.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0185.046] GetProcessHeap () returned 0x4e0000 [0185.046] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0185.046] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0185.046] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0185.046] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.046] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.046] GetProcessHeap () returned 0x4e0000 [0185.046] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0185.046] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0185.046] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.046] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0185.049] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0185.049] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0185.049] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0185.049] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0185.049] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0185.049] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.049] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.049] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.049] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xed0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xed0, lpOverlapped=0x0) returned 1 [0185.049] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xed0, dwBufLen=0xed0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xed0) returned 1 [0185.049] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.050] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xed0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xed0, lpOverlapped=0x0) returned 1 [0185.050] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.050] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xfa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.050] SetEndOfFile (hFile=0xdc) returned 1 [0185.052] GetProcessHeap () returned 0x4e0000 [0185.053] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0185.053] GetProcessHeap () returned 0x4e0000 [0185.053] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0185.053] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0278882.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0278882.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0278882.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0278882.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0185.055] CloseHandle (hObject=0xdc) returned 1 [0185.055] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecd0c800, ftCreationTime.dwHighDateTime=0x1bee443, ftLastAccessTime.dwLowDateTime=0xbd5ab520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xecd0c800, ftLastWriteTime.dwHighDateTime=0x1bee443, nFileSizeHigh=0x0, nFileSizeLow=0x4ffa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0281904.WMF", cAlternateFileName="")) returned 1 [0185.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0281904.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0281904.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0185.056] GetProcessHeap () returned 0x4e0000 [0185.056] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0185.056] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0185.056] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0185.057] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0185.059] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.059] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.059] GetProcessHeap () returned 0x4e0000 [0185.059] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0185.059] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0185.059] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.059] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0185.059] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0185.059] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0185.060] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0185.060] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0185.060] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0185.060] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.060] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.060] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.060] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4ffa, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4ffa, lpOverlapped=0x0) returned 1 [0185.061] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5000, dwBufLen=0x5000 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5000) returned 1 [0185.061] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.061] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5000, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5000, lpOverlapped=0x0) returned 1 [0185.061] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.062] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x50d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.062] SetEndOfFile (hFile=0xdc) returned 1 [0185.064] GetProcessHeap () returned 0x4e0000 [0185.064] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0185.064] GetProcessHeap () returned 0x4e0000 [0185.064] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0185.064] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0281904.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0281904.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0281904.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0281904.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0185.066] CloseHandle (hObject=0xdc) returned 1 [0185.066] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1a4f200, ftCreationTime.dwHighDateTime=0x1bed3d9, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe1a4f200, ftLastWriteTime.dwHighDateTime=0x1bed3d9, nFileSizeHigh=0x0, nFileSizeLow=0x4dc6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0283209.GIF", cAlternateFileName="")) returned 1 [0185.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0283209.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0185.068] GetProcessHeap () returned 0x4e0000 [0185.068] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0185.068] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0185.068] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0185.068] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0185.070] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.070] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.070] GetProcessHeap () returned 0x4e0000 [0185.070] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0185.070] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0185.070] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.070] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0185.070] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0185.070] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0185.070] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0185.071] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0185.071] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0185.071] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.071] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.071] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.071] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4dc6, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4dc6, lpOverlapped=0x0) returned 1 [0185.072] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4dd0, dwBufLen=0x4dd0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4dd0) returned 1 [0185.072] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.072] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4dd0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4dd0, lpOverlapped=0x0) returned 1 [0185.072] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.072] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4ea4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.072] SetEndOfFile (hFile=0xdc) returned 1 [0185.074] GetProcessHeap () returned 0x4e0000 [0185.075] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0185.075] GetProcessHeap () returned 0x4e0000 [0185.075] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0185.075] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0283209.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0283209.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0185.077] CloseHandle (hObject=0xdc) returned 1 [0185.077] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7ae3400, ftCreationTime.dwHighDateTime=0x1bea1cc, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb7ae3400, ftLastWriteTime.dwHighDateTime=0x1bea1cc, nFileSizeHigh=0x0, nFileSizeLow=0x62e3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0284916.JPG", cAlternateFileName="")) returned 1 [0185.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0284916.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0185.078] GetProcessHeap () returned 0x4e0000 [0185.078] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0185.078] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0185.078] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0185.078] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xd, lpOverlapped=0x0) returned 1 [0185.080] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.080] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.080] GetProcessHeap () returned 0x4e0000 [0185.080] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0185.080] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0185.080] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.080] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0185.080] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0185.080] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0185.080] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0185.080] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0185.080] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0185.080] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.080] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.080] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.080] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x62e3, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x62e3, lpOverlapped=0x0) returned 1 [0185.081] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x62f0, dwBufLen=0x62f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x62f0) returned 1 [0185.082] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.082] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x62f0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x62f0, lpOverlapped=0x0) returned 1 [0185.082] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.082] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x63c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.082] SetEndOfFile (hFile=0xdc) returned 1 [0185.088] GetProcessHeap () returned 0x4e0000 [0185.088] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0185.088] GetProcessHeap () returned 0x4e0000 [0185.088] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0185.088] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0284916.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0284916.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0185.090] CloseHandle (hObject=0xdc) returned 1 [0185.090] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa68bc300, ftCreationTime.dwHighDateTime=0x1befd79, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa68bc300, ftLastWriteTime.dwHighDateTime=0x1befd79, nFileSizeHigh=0x0, nFileSizeLow=0x7876, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0285360.WMF", cAlternateFileName="")) returned 1 [0185.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285360.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0185.091] GetProcessHeap () returned 0x4e0000 [0185.091] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0185.092] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0185.092] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0185.092] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0185.113] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.113] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.113] GetProcessHeap () returned 0x4e0000 [0185.113] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0185.113] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0185.113] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.113] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0185.113] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0185.113] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0185.113] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0185.113] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0185.113] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0185.114] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.114] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.114] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.114] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7876, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7876, lpOverlapped=0x0) returned 1 [0185.115] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7880, dwBufLen=0x7880 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7880) returned 1 [0185.116] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.116] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7880, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7880, lpOverlapped=0x0) returned 1 [0185.116] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.116] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7954, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.116] SetEndOfFile (hFile=0xdc) returned 1 [0185.119] GetProcessHeap () returned 0x4e0000 [0185.119] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0185.119] GetProcessHeap () returned 0x4e0000 [0185.119] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0185.119] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285360.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285360.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0185.122] CloseHandle (hObject=0xdc) returned 1 [0185.123] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd63acb00, ftCreationTime.dwHighDateTime=0x1befd79, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd63acb00, ftLastWriteTime.dwHighDateTime=0x1befd79, nFileSizeHigh=0x0, nFileSizeLow=0x30e4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0285410.WMF", cAlternateFileName="")) returned 1 [0185.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285410.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0185.124] GetProcessHeap () returned 0x4e0000 [0185.124] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0185.124] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0185.124] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0185.124] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0185.127] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.127] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.127] GetProcessHeap () returned 0x4e0000 [0185.127] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0185.127] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0185.127] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.127] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0185.127] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0185.128] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0185.128] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0185.128] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0185.128] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0185.128] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.128] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.128] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.128] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x30e4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x30e4, lpOverlapped=0x0) returned 1 [0185.129] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x30f0, dwBufLen=0x30f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x30f0) returned 1 [0185.129] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.129] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x30f0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x30f0, lpOverlapped=0x0) returned 1 [0185.130] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.130] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x31c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.130] SetEndOfFile (hFile=0xdc) returned 1 [0185.132] GetProcessHeap () returned 0x4e0000 [0185.132] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0185.132] GetProcessHeap () returned 0x4e0000 [0185.132] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0185.132] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285410.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285410.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0185.134] CloseHandle (hObject=0xdc) returned 1 [0185.134] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97d5a00, ftCreationTime.dwHighDateTime=0x1befd7a, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x97d5a00, ftLastWriteTime.dwHighDateTime=0x1befd7a, nFileSizeHigh=0x0, nFileSizeLow=0x2448, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0285444.WMF", cAlternateFileName="")) returned 1 [0185.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285444.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0185.137] GetProcessHeap () returned 0x4e0000 [0185.137] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0185.137] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0185.137] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0185.137] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0185.139] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.139] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.139] GetProcessHeap () returned 0x4e0000 [0185.139] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0185.139] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0185.139] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.139] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0185.139] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0185.139] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0185.139] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0185.139] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0185.139] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0185.140] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.140] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.140] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.140] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2448, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2448, lpOverlapped=0x0) returned 1 [0185.140] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2450, dwBufLen=0x2450 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2450) returned 1 [0185.141] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.141] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2450, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2450, lpOverlapped=0x0) returned 1 [0185.142] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.142] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2524, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.142] SetEndOfFile (hFile=0xdc) returned 1 [0185.145] GetProcessHeap () returned 0x4e0000 [0185.145] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0185.145] GetProcessHeap () returned 0x4e0000 [0185.145] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0185.145] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285444.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285444.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0185.147] CloseHandle (hObject=0xdc) returned 1 [0185.147] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d3c7300, ftCreationTime.dwHighDateTime=0x1befd7b, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5d3c7300, ftLastWriteTime.dwHighDateTime=0x1befd7b, nFileSizeHigh=0x0, nFileSizeLow=0x2a12, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0285698.WMF", cAlternateFileName="")) returned 1 [0185.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285698.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0185.148] GetProcessHeap () returned 0x4e0000 [0185.148] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0185.148] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0185.148] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0185.149] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0185.152] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.152] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.152] GetProcessHeap () returned 0x4e0000 [0185.152] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0185.152] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0185.152] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.152] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0185.152] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0185.152] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0185.152] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0185.153] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0185.153] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0185.153] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.153] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.153] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.153] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2a12, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2a12, lpOverlapped=0x0) returned 1 [0185.154] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2a20, dwBufLen=0x2a20 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2a20) returned 1 [0185.154] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.154] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2a20, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2a20, lpOverlapped=0x0) returned 1 [0185.154] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.154] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2af4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.154] SetEndOfFile (hFile=0xdc) returned 1 [0185.156] GetProcessHeap () returned 0x4e0000 [0185.156] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0185.156] GetProcessHeap () returned 0x4e0000 [0185.156] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0185.157] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285698.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285698.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0185.158] CloseHandle (hObject=0xdc) returned 1 [0185.158] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ecd1e00, ftCreationTime.dwHighDateTime=0x1befd7b, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9ecd1e00, ftLastWriteTime.dwHighDateTime=0x1befd7b, nFileSizeHigh=0x0, nFileSizeLow=0x958c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0285750.WMF", cAlternateFileName="")) returned 1 [0185.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285750.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0185.159] GetProcessHeap () returned 0x4e0000 [0185.159] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0185.160] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0185.160] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0185.160] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0185.161] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.161] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.161] GetProcessHeap () returned 0x4e0000 [0185.161] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0185.161] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0185.161] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.162] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0185.162] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0185.162] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0185.162] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0185.162] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0185.162] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0185.162] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.162] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.162] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.162] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x958c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x958c, lpOverlapped=0x0) returned 1 [0185.164] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9590, dwBufLen=0x9590 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9590) returned 1 [0185.164] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.164] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x9590, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x9590, lpOverlapped=0x0) returned 1 [0185.164] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.164] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x9664, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.164] SetEndOfFile (hFile=0xdc) returned 1 [0185.166] GetProcessHeap () returned 0x4e0000 [0185.166] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0185.167] GetProcessHeap () returned 0x4e0000 [0185.167] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0185.167] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285750.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285750.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0185.168] CloseHandle (hObject=0xdc) returned 1 [0185.168] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95908100, ftCreationTime.dwHighDateTime=0x1befd7c, ftLastAccessTime.dwLowDateTime=0xbd5f77e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x95908100, ftLastWriteTime.dwHighDateTime=0x1befd7c, nFileSizeHigh=0x0, nFileSizeLow=0x3452, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0285926.WMF", cAlternateFileName="")) returned 1 [0185.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285926.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0185.169] GetProcessHeap () returned 0x4e0000 [0185.169] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0185.169] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0185.169] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0185.170] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0185.234] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.235] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.235] GetProcessHeap () returned 0x4e0000 [0185.235] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0185.235] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0185.235] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.235] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0185.235] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0185.235] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0185.235] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0185.235] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0185.235] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0185.235] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.235] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.235] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.235] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3452, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3452, lpOverlapped=0x0) returned 1 [0185.236] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3460, dwBufLen=0x3460 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3460) returned 1 [0185.236] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.236] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3460, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3460, lpOverlapped=0x0) returned 1 [0185.237] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.237] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3534, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.237] SetEndOfFile (hFile=0xdc) returned 1 [0185.239] GetProcessHeap () returned 0x4e0000 [0185.239] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0185.239] GetProcessHeap () returned 0x4e0000 [0185.239] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0185.239] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285926.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285926.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0185.241] CloseHandle (hObject=0xdc) returned 1 [0185.241] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf49a800, ftCreationTime.dwHighDateTime=0x1befd7c, ftLastAccessTime.dwLowDateTime=0xbd5f77e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbf49a800, ftLastWriteTime.dwHighDateTime=0x1befd7c, nFileSizeHigh=0x0, nFileSizeLow=0x9e0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0286034.WMF", cAlternateFileName="")) returned 1 [0185.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0286034.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0185.243] GetProcessHeap () returned 0x4e0000 [0185.243] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0185.243] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0185.243] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0185.243] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.243] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.243] GetProcessHeap () returned 0x4e0000 [0185.243] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0185.243] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0185.243] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.243] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0185.245] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0185.245] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0185.245] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0185.245] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0185.245] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0185.245] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.245] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.245] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.245] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x9e0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x9e0, lpOverlapped=0x0) returned 1 [0185.246] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9e0, dwBufLen=0x9e0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9e0) returned 1 [0185.246] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.246] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x9e0, lpOverlapped=0x0) returned 1 [0185.246] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.246] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xab4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.246] SetEndOfFile (hFile=0xdc) returned 1 [0185.248] GetProcessHeap () returned 0x4e0000 [0185.248] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0185.248] GetProcessHeap () returned 0x4e0000 [0185.248] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0185.248] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0286034.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0286034.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0185.250] CloseHandle (hObject=0xdc) returned 1 [0185.250] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5efff00, ftCreationTime.dwHighDateTime=0x1befd7c, ftLastAccessTime.dwLowDateTime=0xbd5f77e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd5efff00, ftLastWriteTime.dwHighDateTime=0x1befd7c, nFileSizeHigh=0x0, nFileSizeLow=0x9d0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0286068.WMF", cAlternateFileName="")) returned 1 [0185.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286068.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0286068.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0185.251] GetProcessHeap () returned 0x4e0000 [0185.251] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0185.251] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0185.251] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0185.251] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.251] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.251] GetProcessHeap () returned 0x4e0000 [0185.251] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0185.251] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0185.251] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.251] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0185.253] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0185.253] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0185.253] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0185.253] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0185.253] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0185.253] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.253] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.253] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.253] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x9d0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x9d0, lpOverlapped=0x0) returned 1 [0185.253] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9d0, dwBufLen=0x9d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9d0) returned 1 [0185.254] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.254] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x9d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x9d0, lpOverlapped=0x0) returned 1 [0185.254] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.254] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xaa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.254] SetEndOfFile (hFile=0xdc) returned 1 [0185.256] GetProcessHeap () returned 0x4e0000 [0185.256] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0185.256] GetProcessHeap () returned 0x4e0000 [0185.256] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0185.256] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286068.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0286068.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286068.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0286068.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0185.257] CloseHandle (hObject=0xdc) returned 1 [0185.257] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa019c00, ftCreationTime.dwHighDateTime=0x1bef57a, ftLastAccessTime.dwLowDateTime=0xbd5f77e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaa019c00, ftLastWriteTime.dwHighDateTime=0x1bef57a, nFileSizeHigh=0x0, nFileSizeLow=0xb21e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0287005.WMF", cAlternateFileName="")) returned 1 [0185.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0287005.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0287005.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0185.258] GetProcessHeap () returned 0x4e0000 [0185.258] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0185.258] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0185.258] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0185.258] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0185.260] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.260] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.260] GetProcessHeap () returned 0x4e0000 [0185.260] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0185.260] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0185.260] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.260] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0185.260] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0185.260] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0185.261] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0185.261] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0185.261] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0185.261] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.261] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.261] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.261] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb21e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xb21e, lpOverlapped=0x0) returned 1 [0185.262] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xb220, dwBufLen=0xb220 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xb220) returned 1 [0185.262] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.262] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xb220, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xb220, lpOverlapped=0x0) returned 1 [0185.263] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.263] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xb2f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.263] SetEndOfFile (hFile=0xdc) returned 1 [0185.265] GetProcessHeap () returned 0x4e0000 [0185.265] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0185.265] GetProcessHeap () returned 0x4e0000 [0185.265] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0185.265] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0287005.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0287005.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0287005.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0287005.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0185.267] CloseHandle (hObject=0xdc) returned 1 [0185.267] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x948c7400, ftCreationTime.dwHighDateTime=0x1bf1521, ftLastAccessTime.dwLowDateTime=0xbd5f77e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x948c7400, ftLastWriteTime.dwHighDateTime=0x1bf1521, nFileSizeHigh=0x0, nFileSizeLow=0x76ea, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0291984.WMF", cAlternateFileName="")) returned 1 [0185.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0291984.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0291984.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0185.268] GetProcessHeap () returned 0x4e0000 [0185.268] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0185.268] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0185.268] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0185.268] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0185.270] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.270] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.270] GetProcessHeap () returned 0x4e0000 [0185.270] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0185.270] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0185.270] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.270] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0185.270] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0185.270] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0185.270] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0185.270] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0185.270] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0185.270] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.270] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.270] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.270] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x76ea, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x76ea, lpOverlapped=0x0) returned 1 [0185.272] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x76f0, dwBufLen=0x76f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x76f0) returned 1 [0185.272] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.272] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x76f0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x76f0, lpOverlapped=0x0) returned 1 [0185.272] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.272] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x77c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.272] SetEndOfFile (hFile=0xdc) returned 1 [0185.275] GetProcessHeap () returned 0x4e0000 [0185.275] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0185.275] GetProcessHeap () returned 0x4e0000 [0185.275] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0185.275] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0291984.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0291984.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0291984.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0291984.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0185.277] CloseHandle (hObject=0xdc) returned 1 [0185.277] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9003000, ftCreationTime.dwHighDateTime=0x1bf1521, ftLastAccessTime.dwLowDateTime=0xbd5f77e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc9003000, ftLastWriteTime.dwHighDateTime=0x1bf1521, nFileSizeHigh=0x0, nFileSizeLow=0x7148, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0292020.WMF", cAlternateFileName="")) returned 1 [0185.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292020.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292020.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0185.279] GetProcessHeap () returned 0x4e0000 [0185.279] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0185.279] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0185.279] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0185.279] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0185.302] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.302] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.302] GetProcessHeap () returned 0x4e0000 [0185.302] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0185.302] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0185.302] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.302] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0185.303] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0185.303] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0185.303] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0185.303] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0185.303] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0185.303] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.303] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.303] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.303] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7148, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x7148, lpOverlapped=0x0) returned 1 [0185.305] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7150, dwBufLen=0x7150 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x7150) returned 1 [0185.305] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.305] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7150, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x7150, lpOverlapped=0x0) returned 1 [0185.305] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.305] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x7224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.305] SetEndOfFile (hFile=0xdc) returned 1 [0185.308] GetProcessHeap () returned 0x4e0000 [0185.308] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0185.308] GetProcessHeap () returned 0x4e0000 [0185.308] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0185.308] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292020.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292020.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292020.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292020.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0185.310] CloseHandle (hObject=0xdc) returned 1 [0185.311] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4af05900, ftCreationTime.dwHighDateTime=0x1bf1522, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4af05900, ftLastWriteTime.dwHighDateTime=0x1bf1522, nFileSizeHigh=0x0, nFileSizeLow=0x20ce, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0292152.WMF", cAlternateFileName="")) returned 1 [0185.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292152.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292152.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0185.312] GetProcessHeap () returned 0x4e0000 [0185.312] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0185.312] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0185.312] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0185.313] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0185.314] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.315] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.315] GetProcessHeap () returned 0x4e0000 [0185.315] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0185.315] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0185.315] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.315] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0185.315] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0185.315] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0185.315] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0185.315] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0185.315] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0185.315] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.315] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.315] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.315] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x20ce, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x20ce, lpOverlapped=0x0) returned 1 [0185.336] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x20d0, dwBufLen=0x20d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x20d0) returned 1 [0185.336] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.336] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x20d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x20d0, lpOverlapped=0x0) returned 1 [0185.336] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.336] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x21a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.336] SetEndOfFile (hFile=0xdc) returned 1 [0185.339] GetProcessHeap () returned 0x4e0000 [0185.339] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0185.339] GetProcessHeap () returned 0x4e0000 [0185.339] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0185.339] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292152.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292152.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292152.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292152.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0185.342] CloseHandle (hObject=0xdc) returned 1 [0185.342] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48b60800, ftCreationTime.dwHighDateTime=0x1bf16a4, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x48b60800, ftLastWriteTime.dwHighDateTime=0x1bf16a4, nFileSizeHigh=0x0, nFileSizeLow=0x998, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0292982.WMF", cAlternateFileName="")) returned 1 [0185.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292982.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292982.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0185.343] GetProcessHeap () returned 0x4e0000 [0185.343] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0185.343] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0185.343] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0185.343] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0185.347] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.347] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.347] GetProcessHeap () returned 0x4e0000 [0185.347] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0185.347] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0185.347] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.347] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0185.347] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0185.347] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0185.347] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0185.347] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0185.348] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0185.348] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.348] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.348] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.348] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x998, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x998, lpOverlapped=0x0) returned 1 [0185.348] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9a0, dwBufLen=0x9a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9a0) returned 1 [0185.348] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.348] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x9a0, lpOverlapped=0x0) returned 1 [0185.348] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.348] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xa74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.348] SetEndOfFile (hFile=0xdc) returned 1 [0185.351] GetProcessHeap () returned 0x4e0000 [0185.351] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0185.351] GetProcessHeap () returned 0x4e0000 [0185.351] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0185.351] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292982.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292982.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292982.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292982.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0185.353] CloseHandle (hObject=0xdc) returned 1 [0185.353] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9af72900, ftCreationTime.dwHighDateTime=0x1bf16a4, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9af72900, ftLastWriteTime.dwHighDateTime=0x1bf16a4, nFileSizeHigh=0x0, nFileSizeLow=0x5ba, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0293234.WMF", cAlternateFileName="")) returned 1 [0185.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293234.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293234.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0185.354] GetProcessHeap () returned 0x4e0000 [0185.354] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0185.354] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0185.354] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0185.354] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0185.392] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.392] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.392] GetProcessHeap () returned 0x4e0000 [0185.392] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0185.392] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0185.392] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.392] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0185.392] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0185.392] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0185.392] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0185.392] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0185.392] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0185.393] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.393] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.393] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.393] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5ba, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x5ba, lpOverlapped=0x0) returned 1 [0185.393] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5c0, dwBufLen=0x5c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5c0) returned 1 [0185.393] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.393] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5c0, lpOverlapped=0x0) returned 1 [0185.393] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.393] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.393] SetEndOfFile (hFile=0xdc) returned 1 [0185.396] GetProcessHeap () returned 0x4e0000 [0185.396] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0185.396] GetProcessHeap () returned 0x4e0000 [0185.396] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0185.396] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293234.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293234.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293234.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293234.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0185.398] CloseHandle (hObject=0xdc) returned 1 [0185.398] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9af72900, ftCreationTime.dwHighDateTime=0x1bf16a4, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9af72900, ftLastWriteTime.dwHighDateTime=0x1bf16a4, nFileSizeHigh=0x0, nFileSizeLow=0x766, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0293236.WMF", cAlternateFileName="")) returned 1 [0185.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293236.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293236.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0185.401] GetProcessHeap () returned 0x4e0000 [0185.401] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0185.401] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0185.401] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0185.401] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0185.403] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.403] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.403] GetProcessHeap () returned 0x4e0000 [0185.403] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0185.403] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0185.403] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.403] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0185.403] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0185.404] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0185.404] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0185.404] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0185.404] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0185.404] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.404] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.404] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.404] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x766, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x766, lpOverlapped=0x0) returned 1 [0185.404] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x770, dwBufLen=0x770 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x770) returned 1 [0185.404] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.404] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x770, lpOverlapped=0x0) returned 1 [0185.404] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.404] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x844, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.404] SetEndOfFile (hFile=0xdc) returned 1 [0185.407] GetProcessHeap () returned 0x4e0000 [0185.407] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0185.407] GetProcessHeap () returned 0x4e0000 [0185.407] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0185.407] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293236.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293236.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293236.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293236.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0185.409] CloseHandle (hObject=0xdc) returned 1 [0185.410] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9af72900, ftCreationTime.dwHighDateTime=0x1bf16a4, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9af72900, ftLastWriteTime.dwHighDateTime=0x1bf16a4, nFileSizeHigh=0x0, nFileSizeLow=0x78a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0293238.WMF", cAlternateFileName="")) returned 1 [0185.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293238.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293238.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0185.411] GetProcessHeap () returned 0x4e0000 [0185.411] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0185.411] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0185.411] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0185.411] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0185.414] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.414] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.414] GetProcessHeap () returned 0x4e0000 [0185.414] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0185.414] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0185.414] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.414] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0185.414] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0185.414] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0185.414] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0185.414] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0185.414] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0185.414] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.414] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.414] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.415] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x78a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x78a, lpOverlapped=0x0) returned 1 [0185.415] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x790, dwBufLen=0x790 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x790) returned 1 [0185.415] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.415] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x790, lpOverlapped=0x0) returned 1 [0185.415] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.415] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x864, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.415] SetEndOfFile (hFile=0xdc) returned 1 [0185.417] GetProcessHeap () returned 0x4e0000 [0185.418] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0185.418] GetProcessHeap () returned 0x4e0000 [0185.418] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0185.418] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293238.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293238.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293238.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293238.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0185.419] CloseHandle (hObject=0xdc) returned 1 [0185.419] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c285600, ftCreationTime.dwHighDateTime=0x1bf16a4, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9c285600, ftLastWriteTime.dwHighDateTime=0x1bf16a4, nFileSizeHigh=0x0, nFileSizeLow=0x88e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0293240.WMF", cAlternateFileName="")) returned 1 [0185.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293240.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293240.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0185.421] GetProcessHeap () returned 0x4e0000 [0185.421] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0185.421] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0185.421] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0185.421] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0185.423] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.423] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.423] GetProcessHeap () returned 0x4e0000 [0185.423] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0185.423] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0185.424] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.424] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0185.424] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0185.424] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0185.424] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0185.424] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0185.424] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0185.424] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.424] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.424] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.424] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x88e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x88e, lpOverlapped=0x0) returned 1 [0185.424] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x890, dwBufLen=0x890 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x890) returned 1 [0185.424] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.424] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x890, lpOverlapped=0x0) returned 1 [0185.425] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.425] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x964, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.425] SetEndOfFile (hFile=0xdc) returned 1 [0185.427] GetProcessHeap () returned 0x4e0000 [0185.427] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0185.427] GetProcessHeap () returned 0x4e0000 [0185.427] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0185.427] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293240.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293240.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293240.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293240.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0185.429] CloseHandle (hObject=0xdc) returned 1 [0185.429] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47a99d00, ftCreationTime.dwHighDateTime=0x1bf1523, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x47a99d00, ftLastWriteTime.dwHighDateTime=0x1bf1523, nFileSizeHigh=0x0, nFileSizeLow=0x92c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0293570.WMF", cAlternateFileName="")) returned 1 [0185.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293570.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293570.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0185.430] GetProcessHeap () returned 0x4e0000 [0185.430] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0185.430] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0185.430] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0185.430] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0185.432] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.432] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.432] GetProcessHeap () returned 0x4e0000 [0185.432] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0185.432] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0185.432] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.433] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0185.433] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0185.433] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0185.433] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0185.433] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0185.433] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0185.433] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.433] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.433] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.433] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x92c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x92c, lpOverlapped=0x0) returned 1 [0185.433] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x930, dwBufLen=0x930 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x930) returned 1 [0185.433] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.433] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x930, lpOverlapped=0x0) returned 1 [0185.434] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.434] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xa04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.434] SetEndOfFile (hFile=0xdc) returned 1 [0185.436] GetProcessHeap () returned 0x4e0000 [0185.436] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0185.436] GetProcessHeap () returned 0x4e0000 [0185.436] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0185.436] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293570.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293570.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293570.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293570.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0185.439] CloseHandle (hObject=0xdc) returned 1 [0185.439] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0911500, ftCreationTime.dwHighDateTime=0x1bf1523, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb0911500, ftLastWriteTime.dwHighDateTime=0x1bf1523, nFileSizeHigh=0x0, nFileSizeLow=0x15ea, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0293828.WMF", cAlternateFileName="")) returned 1 [0185.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293828.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293828.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0185.441] GetProcessHeap () returned 0x4e0000 [0185.441] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0185.441] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0185.441] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0185.441] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0185.443] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.443] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.443] GetProcessHeap () returned 0x4e0000 [0185.443] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0185.443] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0185.443] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.443] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0185.443] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0185.443] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0185.443] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0185.443] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0185.443] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0185.444] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.444] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.444] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.444] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x15ea, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x15ea, lpOverlapped=0x0) returned 1 [0185.445] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x15f0, dwBufLen=0x15f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x15f0) returned 1 [0185.445] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.445] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x15f0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x15f0, lpOverlapped=0x0) returned 1 [0185.445] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.445] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x16c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.445] SetEndOfFile (hFile=0xdc) returned 1 [0185.448] GetProcessHeap () returned 0x4e0000 [0185.448] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0185.448] GetProcessHeap () returned 0x4e0000 [0185.448] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0185.448] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293828.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293828.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293828.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293828.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0185.449] CloseHandle (hObject=0xdc) returned 1 [0185.449] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7b82300, ftCreationTime.dwHighDateTime=0x1bf1523, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb7b82300, ftLastWriteTime.dwHighDateTime=0x1bf1523, nFileSizeHigh=0x0, nFileSizeLow=0x812, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0293844.WMF", cAlternateFileName="")) returned 1 [0185.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293844.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293844.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0185.450] GetProcessHeap () returned 0x4e0000 [0185.450] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0185.450] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0185.450] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0185.450] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0185.452] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.452] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.453] GetProcessHeap () returned 0x4e0000 [0185.453] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0185.453] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0185.453] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.453] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0185.453] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0185.453] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0185.453] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0185.453] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0185.453] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0185.454] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.454] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.454] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.454] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x812, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x812, lpOverlapped=0x0) returned 1 [0185.454] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x820, dwBufLen=0x820 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x820) returned 1 [0185.454] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.454] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x820, lpOverlapped=0x0) returned 1 [0185.454] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.454] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x8f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.454] SetEndOfFile (hFile=0xdc) returned 1 [0185.457] GetProcessHeap () returned 0x4e0000 [0185.457] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0185.457] GetProcessHeap () returned 0x4e0000 [0185.457] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0185.457] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293844.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293844.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293844.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293844.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0185.458] CloseHandle (hObject=0xdc) returned 1 [0185.458] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72dc8d00, ftCreationTime.dwHighDateTime=0x1bf0891, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x72dc8d00, ftLastWriteTime.dwHighDateTime=0x1bf0891, nFileSizeHigh=0x0, nFileSizeLow=0x29e5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0295241.GIF", cAlternateFileName="")) returned 1 [0185.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0295241.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0185.459] GetProcessHeap () returned 0x4e0000 [0185.459] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0185.459] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0185.459] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0185.459] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xb, lpOverlapped=0x0) returned 1 [0185.461] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.461] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.461] GetProcessHeap () returned 0x4e0000 [0185.461] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0185.461] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0185.461] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.461] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0185.461] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0185.461] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0185.461] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0185.462] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0185.462] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0185.462] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.462] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.462] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.462] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x29e5, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x29e5, lpOverlapped=0x0) returned 1 [0185.463] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x29f0, dwBufLen=0x29f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x29f0) returned 1 [0185.463] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.463] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x29f0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x29f0, lpOverlapped=0x0) returned 1 [0185.463] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.463] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2ac4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.463] SetEndOfFile (hFile=0xdc) returned 1 [0185.466] GetProcessHeap () returned 0x4e0000 [0185.466] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0185.466] GetProcessHeap () returned 0x4e0000 [0185.466] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0185.466] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0295241.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0295241.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0185.467] CloseHandle (hObject=0xdc) returned 1 [0185.470] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b4c2400, ftCreationTime.dwHighDateTime=0x1bf2c95, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7b4c2400, ftLastWriteTime.dwHighDateTime=0x1bf2c95, nFileSizeHigh=0x0, nFileSizeLow=0xcd52, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0297185.WMF", cAlternateFileName="")) returned 1 [0185.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297185.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0185.471] GetProcessHeap () returned 0x4e0000 [0185.471] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0185.471] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0185.471] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0185.471] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0185.599] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.599] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.599] GetProcessHeap () returned 0x4e0000 [0185.599] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0185.599] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0185.599] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.599] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0185.599] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0185.599] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0185.600] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0185.600] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0185.600] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0185.600] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.600] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.600] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.600] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xcd52, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xcd52, lpOverlapped=0x0) returned 1 [0185.601] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xcd60, dwBufLen=0xcd60 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xcd60) returned 1 [0185.602] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.602] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xcd60, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xcd60, lpOverlapped=0x0) returned 1 [0185.602] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.603] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xce34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.603] SetEndOfFile (hFile=0xdc) returned 1 [0185.606] GetProcessHeap () returned 0x4e0000 [0185.606] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0185.606] GetProcessHeap () returned 0x4e0000 [0185.606] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0185.606] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297185.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297185.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0185.608] CloseHandle (hObject=0xdc) returned 1 [0185.608] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74beac00, ftCreationTime.dwHighDateTime=0x1bf2c97, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x74beac00, ftLastWriteTime.dwHighDateTime=0x1bf2c97, nFileSizeHigh=0x0, nFileSizeLow=0x6db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0297551.WMF", cAlternateFileName="")) returned 1 [0185.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297551.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0185.611] GetProcessHeap () returned 0x4e0000 [0185.611] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0185.611] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0185.611] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0185.611] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0185.613] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.613] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.613] GetProcessHeap () returned 0x4e0000 [0185.613] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0185.613] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0185.613] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.613] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0185.613] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0185.613] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0185.613] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0185.614] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0185.614] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0185.614] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.614] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.614] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.614] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x6db8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x6db8, lpOverlapped=0x0) returned 1 [0185.615] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6dc0, dwBufLen=0x6dc0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x6dc0) returned 1 [0185.615] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.615] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6dc0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x6dc0, lpOverlapped=0x0) returned 1 [0185.616] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.616] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x6e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.616] SetEndOfFile (hFile=0xdc) returned 1 [0185.619] GetProcessHeap () returned 0x4e0000 [0185.619] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0185.619] GetProcessHeap () returned 0x4e0000 [0185.619] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0185.619] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297551.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297551.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0185.621] CloseHandle (hObject=0xdc) returned 1 [0185.621] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50170400, ftCreationTime.dwHighDateTime=0x1bf2c98, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x50170400, ftLastWriteTime.dwHighDateTime=0x1bf2c98, nFileSizeHigh=0x0, nFileSizeLow=0xa7c2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0297707.WMF", cAlternateFileName="")) returned 1 [0185.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297707.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0185.622] GetProcessHeap () returned 0x4e0000 [0185.622] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0185.622] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0185.622] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0185.622] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0185.625] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.625] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.625] GetProcessHeap () returned 0x4e0000 [0185.625] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0185.625] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0185.625] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.625] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0185.625] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0185.625] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0185.625] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0185.625] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0185.625] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0185.626] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.626] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.626] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.626] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xa7c2, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xa7c2, lpOverlapped=0x0) returned 1 [0185.627] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa7d0, dwBufLen=0xa7d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xa7d0) returned 1 [0185.628] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.628] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xa7d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xa7d0, lpOverlapped=0x0) returned 1 [0185.628] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.628] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xa8a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.628] SetEndOfFile (hFile=0xdc) returned 1 [0185.631] GetProcessHeap () returned 0x4e0000 [0185.631] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0185.631] GetProcessHeap () returned 0x4e0000 [0185.631] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0185.631] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297707.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297707.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0185.633] CloseHandle (hObject=0xdc) returned 1 [0185.633] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x848ac000, ftCreationTime.dwHighDateTime=0x1bf2c98, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x848ac000, ftLastWriteTime.dwHighDateTime=0x1bf2c98, nFileSizeHigh=0x0, nFileSizeLow=0x27ba, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0297749.WMF", cAlternateFileName="")) returned 1 [0185.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297749.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0185.635] GetProcessHeap () returned 0x4e0000 [0185.635] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0185.635] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0185.635] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0185.635] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0185.637] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.637] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.637] GetProcessHeap () returned 0x4e0000 [0185.637] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0185.637] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0185.637] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.637] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0185.637] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0185.637] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0185.637] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0185.638] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0185.638] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0185.638] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.638] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.638] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.638] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x27ba, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x27ba, lpOverlapped=0x0) returned 1 [0185.639] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x27c0, dwBufLen=0x27c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x27c0) returned 1 [0185.639] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.639] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x27c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x27c0, lpOverlapped=0x0) returned 1 [0185.639] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.639] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2894, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.639] SetEndOfFile (hFile=0xdc) returned 1 [0185.642] GetProcessHeap () returned 0x4e0000 [0185.642] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0185.642] GetProcessHeap () returned 0x4e0000 [0185.642] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0185.642] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297749.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297749.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0185.644] CloseHandle (hObject=0xdc) returned 1 [0185.644] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3dea00, ftCreationTime.dwHighDateTime=0x1bf2c8c, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xae3dea00, ftLastWriteTime.dwHighDateTime=0x1bf2c8c, nFileSizeHigh=0x0, nFileSizeLow=0x197e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0298653.WMF", cAlternateFileName="")) returned 1 [0185.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0298653.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0185.645] GetProcessHeap () returned 0x4e0000 [0185.645] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0185.646] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0185.646] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0185.646] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0185.648] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.648] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.648] GetProcessHeap () returned 0x4e0000 [0185.648] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0185.648] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0185.648] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.648] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0185.648] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0185.648] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0185.648] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0185.648] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0185.649] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0185.649] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.649] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.649] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.649] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x197e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x197e, lpOverlapped=0x0) returned 1 [0185.650] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1980, dwBufLen=0x1980 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1980) returned 1 [0185.650] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.650] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1980, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1980, lpOverlapped=0x0) returned 1 [0185.650] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.650] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1a54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.650] SetEndOfFile (hFile=0xdc) returned 1 [0185.653] GetProcessHeap () returned 0x4e0000 [0185.653] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0185.653] GetProcessHeap () returned 0x4e0000 [0185.653] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0185.653] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0298653.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0298653.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0185.654] CloseHandle (hObject=0xdc) returned 1 [0185.655] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dcbb900, ftCreationTime.dwHighDateTime=0x1bf2c8d, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2dcbb900, ftLastWriteTime.dwHighDateTime=0x1bf2c8d, nFileSizeHigh=0x0, nFileSizeLow=0x19a6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0298897.WMF", cAlternateFileName="")) returned 1 [0185.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0298897.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0185.656] GetProcessHeap () returned 0x4e0000 [0185.656] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0185.656] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0185.656] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0185.656] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0185.658] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.659] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.659] GetProcessHeap () returned 0x4e0000 [0185.659] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0185.659] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0185.659] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.659] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0185.659] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0185.659] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0185.659] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0185.659] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0185.659] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0185.659] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.659] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.659] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.659] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x19a6, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x19a6, lpOverlapped=0x0) returned 1 [0185.660] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x19b0, dwBufLen=0x19b0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x19b0) returned 1 [0185.660] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.661] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x19b0, lpOverlapped=0x0) returned 1 [0185.661] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.661] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1a84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.661] SetEndOfFile (hFile=0xdc) returned 1 [0185.663] GetProcessHeap () returned 0x4e0000 [0185.664] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0185.664] GetProcessHeap () returned 0x4e0000 [0185.664] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0185.664] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0298897.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0298897.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0185.665] CloseHandle (hObject=0xdc) returned 1 [0185.665] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15fa3200, ftCreationTime.dwHighDateTime=0x1bf2c99, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x15fa3200, ftLastWriteTime.dwHighDateTime=0x1bf2c99, nFileSizeHigh=0x0, nFileSizeLow=0x163c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0299125.WMF", cAlternateFileName="")) returned 1 [0185.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299125.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0185.666] GetProcessHeap () returned 0x4e0000 [0185.666] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0185.666] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0185.667] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0185.667] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0185.673] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.673] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.673] GetProcessHeap () returned 0x4e0000 [0185.673] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0185.673] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0185.673] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.673] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0185.673] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0185.673] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0185.673] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0185.673] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0185.673] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0185.673] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.673] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.673] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.673] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x163c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x163c, lpOverlapped=0x0) returned 1 [0185.674] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1640, dwBufLen=0x1640 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1640) returned 1 [0185.674] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.674] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1640, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1640, lpOverlapped=0x0) returned 1 [0185.675] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.675] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x1714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.675] SetEndOfFile (hFile=0xdc) returned 1 [0185.677] GetProcessHeap () returned 0x4e0000 [0185.677] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0185.677] GetProcessHeap () returned 0x4e0000 [0185.677] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0185.677] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299125.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299125.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0185.678] CloseHandle (hObject=0xdc) returned 1 [0185.678] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x375b1e00, ftCreationTime.dwHighDateTime=0x1bf2c99, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x375b1e00, ftLastWriteTime.dwHighDateTime=0x1bf2c99, nFileSizeHigh=0x0, nFileSizeLow=0x23b6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0299171.WMF", cAlternateFileName="")) returned 1 [0185.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299171.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299171.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0185.679] GetProcessHeap () returned 0x4e0000 [0185.679] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0185.679] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0185.679] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0185.679] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xa, lpOverlapped=0x0) returned 1 [0185.681] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.681] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.681] GetProcessHeap () returned 0x4e0000 [0185.681] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0185.681] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0185.681] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.681] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0185.681] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0185.681] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0185.681] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0185.681] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0185.681] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0185.681] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.681] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.681] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.681] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x23b6, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x23b6, lpOverlapped=0x0) returned 1 [0185.682] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x23c0, dwBufLen=0x23c0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x23c0) returned 1 [0185.682] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.682] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x23c0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x23c0, lpOverlapped=0x0) returned 1 [0185.683] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.683] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.683] SetEndOfFile (hFile=0xdc) returned 1 [0185.685] GetProcessHeap () returned 0x4e0000 [0185.685] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0185.685] GetProcessHeap () returned 0x4e0000 [0185.685] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0185.685] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299171.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299171.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299171.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299171.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0185.686] CloseHandle (hObject=0xdc) returned 1 [0185.686] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa08f6100, ftCreationTime.dwHighDateTime=0x1bf2c9a, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa08f6100, ftLastWriteTime.dwHighDateTime=0x1bf2c9a, nFileSizeHigh=0x0, nFileSizeLow=0x62c8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0299587.WMF", cAlternateFileName="")) returned 1 [0185.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299587.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299587.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0185.687] GetProcessHeap () returned 0x4e0000 [0185.687] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0185.687] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0185.687] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0185.687] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0185.689] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.689] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.689] GetProcessHeap () returned 0x4e0000 [0185.689] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0185.689] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0185.689] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.689] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0185.689] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0185.689] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0185.689] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0185.689] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0185.690] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0185.690] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.690] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.690] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.690] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x62c8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x62c8, lpOverlapped=0x0) returned 1 [0185.691] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x62d0, dwBufLen=0x62d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x62d0) returned 1 [0185.691] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.691] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x62d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x62d0, lpOverlapped=0x0) returned 1 [0185.691] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.691] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x63a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.691] SetEndOfFile (hFile=0xdc) returned 1 [0185.693] GetProcessHeap () returned 0x4e0000 [0185.693] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0185.693] GetProcessHeap () returned 0x4e0000 [0185.693] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0185.693] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299587.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299587.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299587.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299587.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0185.695] CloseHandle (hObject=0xdc) returned 1 [0185.695] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd2b9900, ftCreationTime.dwHighDateTime=0x1bf2c9a, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd2b9900, ftLastWriteTime.dwHighDateTime=0x1bf2c9a, nFileSizeHigh=0x0, nFileSizeLow=0x1310, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0299611.WMF", cAlternateFileName="")) returned 1 [0185.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299611.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299611.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0185.696] GetProcessHeap () returned 0x4e0000 [0185.696] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0185.696] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0185.696] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0185.696] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.696] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.696] GetProcessHeap () returned 0x4e0000 [0185.696] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0185.696] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0185.697] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.697] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0185.698] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0185.698] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0185.698] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0185.699] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0185.699] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0185.699] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.699] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.699] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.699] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1310, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1310, lpOverlapped=0x0) returned 1 [0185.700] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1310, dwBufLen=0x1310 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1310) returned 1 [0185.700] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.700] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1310, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1310, lpOverlapped=0x0) returned 1 [0185.700] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.700] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x13e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.700] SetEndOfFile (hFile=0xdc) returned 1 [0185.702] GetProcessHeap () returned 0x4e0000 [0185.702] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0185.702] GetProcessHeap () returned 0x4e0000 [0185.702] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0185.702] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299611.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299611.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299611.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299611.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0185.703] CloseHandle (hObject=0xdc) returned 1 [0185.703] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e1a5400, ftCreationTime.dwHighDateTime=0x1bf2c9b, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5e1a5400, ftLastWriteTime.dwHighDateTime=0x1bf2c9b, nFileSizeHigh=0x0, nFileSizeLow=0x4322, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0299763.WMF", cAlternateFileName="")) returned 1 [0185.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299763.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299763.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0185.704] GetProcessHeap () returned 0x4e0000 [0185.704] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0185.704] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0185.704] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0185.704] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0185.706] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.706] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.706] GetProcessHeap () returned 0x4e0000 [0185.706] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0185.706] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0185.706] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.706] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0185.706] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0185.706] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0185.706] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0185.706] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0185.706] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0185.706] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.706] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.706] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.706] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4322, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4322, lpOverlapped=0x0) returned 1 [0185.707] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4330, dwBufLen=0x4330 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4330) returned 1 [0185.707] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.707] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4330, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4330, lpOverlapped=0x0) returned 1 [0185.708] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.708] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4404, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.708] SetEndOfFile (hFile=0xdc) returned 1 [0185.710] GetProcessHeap () returned 0x4e0000 [0185.710] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0185.710] GetProcessHeap () returned 0x4e0000 [0185.710] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0185.710] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299763.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299763.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299763.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299763.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0185.711] CloseHandle (hObject=0xdc) returned 1 [0185.711] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0508500, ftCreationTime.dwHighDateTime=0x1bf3a1b, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf0508500, ftLastWriteTime.dwHighDateTime=0x1bf3a1b, nFileSizeHigh=0x0, nFileSizeLow=0x3465, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0300520.GIF", cAlternateFileName="")) returned 1 [0185.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300520.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0185.712] GetProcessHeap () returned 0x4e0000 [0185.712] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0185.712] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0185.712] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0185.712] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xb, lpOverlapped=0x0) returned 1 [0185.714] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.714] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.714] GetProcessHeap () returned 0x4e0000 [0185.714] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0185.714] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0185.714] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.714] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0185.714] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0185.714] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0185.714] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0185.714] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0185.714] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0185.714] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.714] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.714] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.714] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3465, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3465, lpOverlapped=0x0) returned 1 [0185.715] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3470, dwBufLen=0x3470 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3470) returned 1 [0185.716] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.716] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3470, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3470, lpOverlapped=0x0) returned 1 [0185.716] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.716] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3544, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.716] SetEndOfFile (hFile=0xdc) returned 1 [0185.718] GetProcessHeap () returned 0x4e0000 [0185.718] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0185.718] GetProcessHeap () returned 0x4e0000 [0185.718] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0185.718] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300520.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300520.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0185.719] CloseHandle (hObject=0xdc) returned 1 [0185.719] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9b61300, ftCreationTime.dwHighDateTime=0x1bf452c, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf9b61300, ftLastWriteTime.dwHighDateTime=0x1bf452c, nFileSizeHigh=0x0, nFileSizeLow=0x239c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0300840.WMF", cAlternateFileName="")) returned 1 [0185.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300840.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0185.720] GetProcessHeap () returned 0x4e0000 [0185.720] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0185.720] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0185.720] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0185.720] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0185.722] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.722] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.722] GetProcessHeap () returned 0x4e0000 [0185.722] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0185.722] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0185.722] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.722] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0185.722] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0185.722] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0185.722] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0185.722] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0185.723] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0185.723] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.723] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.723] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.723] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x239c, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x239c, lpOverlapped=0x0) returned 1 [0185.723] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x23a0, dwBufLen=0x23a0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x23a0) returned 1 [0185.723] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.723] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x23a0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x23a0, lpOverlapped=0x0) returned 1 [0185.724] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.724] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.724] SetEndOfFile (hFile=0xdc) returned 1 [0185.726] GetProcessHeap () returned 0x4e0000 [0185.726] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0185.726] GetProcessHeap () returned 0x4e0000 [0185.726] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0185.726] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300840.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300840.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0185.727] CloseHandle (hObject=0xdc) returned 1 [0185.727] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x616c5e00, ftCreationTime.dwHighDateTime=0x1bf452d, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x616c5e00, ftLastWriteTime.dwHighDateTime=0x1bf452d, nFileSizeHigh=0x0, nFileSizeLow=0xdafc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0300912.WMF", cAlternateFileName="")) returned 1 [0185.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300912.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0185.729] GetProcessHeap () returned 0x4e0000 [0185.729] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0185.729] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0185.729] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0185.729] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0185.730] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.730] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.730] GetProcessHeap () returned 0x4e0000 [0185.730] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0185.731] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0185.731] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.731] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0185.731] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0185.731] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0185.731] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0185.731] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0185.731] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0185.731] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.731] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.731] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.731] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xdafc, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xdafc, lpOverlapped=0x0) returned 1 [0185.732] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xdb00, dwBufLen=0xdb00 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xdb00) returned 1 [0185.733] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.733] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xdb00, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xdb00, lpOverlapped=0x0) returned 1 [0185.733] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.733] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xdbd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.733] SetEndOfFile (hFile=0xdc) returned 1 [0185.735] GetProcessHeap () returned 0x4e0000 [0185.736] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0185.736] GetProcessHeap () returned 0x4e0000 [0185.736] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0185.736] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300912.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300912.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0185.737] CloseHandle (hObject=0xdc) returned 1 [0185.737] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb340b00, ftCreationTime.dwHighDateTime=0x1bf452d, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfb340b00, ftLastWriteTime.dwHighDateTime=0x1bf452d, nFileSizeHigh=0x0, nFileSizeLow=0x2fd8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0301050.WMF", cAlternateFileName="")) returned 1 [0185.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301050.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0185.738] GetProcessHeap () returned 0x4e0000 [0185.738] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0185.738] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0185.738] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0185.738] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0185.740] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.740] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.740] GetProcessHeap () returned 0x4e0000 [0185.740] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0185.740] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0185.740] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.740] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0185.740] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0185.740] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0185.740] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0185.740] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0185.740] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0185.741] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.741] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.741] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.741] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2fd8, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x2fd8, lpOverlapped=0x0) returned 1 [0185.741] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2fe0, dwBufLen=0x2fe0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2fe0) returned 1 [0185.742] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.742] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2fe0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2fe0, lpOverlapped=0x0) returned 1 [0185.742] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.742] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x30b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.742] SetEndOfFile (hFile=0xdc) returned 1 [0185.744] GetProcessHeap () returned 0x4e0000 [0185.744] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0185.744] GetProcessHeap () returned 0x4e0000 [0185.744] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0185.744] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301050.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301050.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0185.746] CloseHandle (hObject=0xdc) returned 1 [0185.746] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf780800, ftCreationTime.dwHighDateTime=0x1bf452e, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf780800, ftLastWriteTime.dwHighDateTime=0x1bf452e, nFileSizeHigh=0x0, nFileSizeLow=0x224e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0301076.WMF", cAlternateFileName="")) returned 1 [0185.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301076.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0185.746] GetProcessHeap () returned 0x4e0000 [0185.746] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0185.747] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0185.747] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0185.747] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x2, lpOverlapped=0x0) returned 1 [0185.748] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.748] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.748] GetProcessHeap () returned 0x4e0000 [0185.748] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0185.748] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0185.748] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.748] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0185.749] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0185.749] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0185.749] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0185.749] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0185.749] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0185.749] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.749] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.749] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.749] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x224e, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x224e, lpOverlapped=0x0) returned 1 [0185.750] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2250, dwBufLen=0x2250 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x2250) returned 1 [0185.750] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.750] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2250, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x2250, lpOverlapped=0x0) returned 1 [0185.750] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.750] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2324, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.750] SetEndOfFile (hFile=0xdc) returned 1 [0185.752] GetProcessHeap () returned 0x4e0000 [0185.752] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0185.752] GetProcessHeap () returned 0x4e0000 [0185.752] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0185.753] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301076.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301076.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0185.754] CloseHandle (hObject=0xdc) returned 1 [0185.754] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf91e7c00, ftCreationTime.dwHighDateTime=0x1bf452e, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf91e7c00, ftLastWriteTime.dwHighDateTime=0x1bf452e, nFileSizeHigh=0x0, nFileSizeLow=0x953a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0301252.WMF", cAlternateFileName="")) returned 1 [0185.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301252.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0185.754] GetProcessHeap () returned 0x4e0000 [0185.755] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0185.755] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0185.755] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0185.755] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0185.756] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.756] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.756] GetProcessHeap () returned 0x4e0000 [0185.756] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0185.756] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0185.756] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.756] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0185.757] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0185.757] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0185.757] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0185.757] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0185.757] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0185.757] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.757] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.757] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.757] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x953a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x953a, lpOverlapped=0x0) returned 1 [0185.758] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9540, dwBufLen=0x9540 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x9540) returned 1 [0185.758] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.758] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x9540, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x9540, lpOverlapped=0x0) returned 1 [0185.758] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.758] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x9614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.758] SetEndOfFile (hFile=0xdc) returned 1 [0185.761] GetProcessHeap () returned 0x4e0000 [0185.761] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0185.761] GetProcessHeap () returned 0x4e0000 [0185.761] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0185.761] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301252.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301252.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0185.762] CloseHandle (hObject=0xdc) returned 1 [0185.762] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5570900, ftCreationTime.dwHighDateTime=0x1bf4530, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5570900, ftLastWriteTime.dwHighDateTime=0x1bf4530, nFileSizeHigh=0x0, nFileSizeLow=0x1f40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0301480.WMF", cAlternateFileName="")) returned 1 [0185.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301480.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0185.763] GetProcessHeap () returned 0x4e0000 [0185.763] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0185.763] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0185.763] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0185.763] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.763] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.764] GetProcessHeap () returned 0x4e0000 [0185.764] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0185.764] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0185.764] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.764] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0185.835] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0185.835] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0185.835] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0185.835] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0185.835] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0185.835] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.835] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.835] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.835] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1f40, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1f40, lpOverlapped=0x0) returned 1 [0185.836] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1f40, dwBufLen=0x1f40 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1f40) returned 1 [0185.836] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.837] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1f40, lpOverlapped=0x0) returned 1 [0185.837] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.837] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.837] SetEndOfFile (hFile=0xdc) returned 1 [0185.839] GetProcessHeap () returned 0x4e0000 [0185.840] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0185.840] GetProcessHeap () returned 0x4e0000 [0185.840] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0185.840] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301480.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301480.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0185.842] CloseHandle (hObject=0xdc) returned 1 [0185.842] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xced53d00, ftCreationTime.dwHighDateTime=0x1bf4a9f, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xced53d00, ftLastWriteTime.dwHighDateTime=0x1bf4a9f, nFileSizeHigh=0x0, nFileSizeLow=0x5a2b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0302827.JPG", cAlternateFileName="")) returned 1 [0185.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302827.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0185.843] GetProcessHeap () returned 0x4e0000 [0185.843] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0185.843] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0185.843] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0185.844] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x5, lpOverlapped=0x0) returned 1 [0185.846] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.846] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.846] GetProcessHeap () returned 0x4e0000 [0185.846] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0185.846] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0185.846] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.846] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0185.846] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0185.846] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0185.846] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0185.846] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0185.846] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0185.846] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.847] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.847] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.847] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5a2b, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x5a2b, lpOverlapped=0x0) returned 1 [0185.848] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5a30, dwBufLen=0x5a30 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5a30) returned 1 [0185.848] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.848] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5a30, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5a30, lpOverlapped=0x0) returned 1 [0185.848] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.848] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5b04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.848] SetEndOfFile (hFile=0xdc) returned 1 [0185.851] GetProcessHeap () returned 0x4e0000 [0185.851] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0185.851] GetProcessHeap () returned 0x4e0000 [0185.851] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0185.851] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302827.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302827.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0185.853] CloseHandle (hObject=0xdc) returned 1 [0185.853] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33a69b00, ftCreationTime.dwHighDateTime=0x1bf4b65, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x33a69b00, ftLastWriteTime.dwHighDateTime=0x1bf4b65, nFileSizeHigh=0x0, nFileSizeLow=0x25c1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0302953.JPG", cAlternateFileName="")) returned 1 [0185.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302953.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0185.854] GetProcessHeap () returned 0x4e0000 [0185.854] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0185.854] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0185.855] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0185.855] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xf, lpOverlapped=0x0) returned 1 [0185.861] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.861] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.861] GetProcessHeap () returned 0x4e0000 [0185.861] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0185.861] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0185.861] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.861] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0185.862] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0185.862] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0185.862] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0185.862] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0185.862] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0185.862] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.862] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.862] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.862] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x25c1, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x25c1, lpOverlapped=0x0) returned 1 [0185.863] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x25d0, dwBufLen=0x25d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x25d0) returned 1 [0185.863] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.863] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x25d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x25d0, lpOverlapped=0x0) returned 1 [0185.864] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.864] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x26a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.864] SetEndOfFile (hFile=0xdc) returned 1 [0185.866] GetProcessHeap () returned 0x4e0000 [0185.866] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0185.866] GetProcessHeap () returned 0x4e0000 [0185.866] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0185.867] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302953.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302953.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0185.869] CloseHandle (hObject=0xdc) returned 1 [0185.869] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa04dd00, ftCreationTime.dwHighDateTime=0x1bf4531, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfa04dd00, ftLastWriteTime.dwHighDateTime=0x1bf4531, nFileSizeHigh=0x0, nFileSizeLow=0x4d84, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0304933.WMF", cAlternateFileName="")) returned 1 [0185.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0304933.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0185.870] GetProcessHeap () returned 0x4e0000 [0185.870] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0185.870] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0185.870] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0185.870] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0185.872] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.872] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.872] GetProcessHeap () returned 0x4e0000 [0185.873] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0185.873] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0185.873] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.873] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0185.873] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0185.873] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0185.873] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0185.873] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0185.873] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0185.873] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.873] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.873] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.873] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4d84, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x4d84, lpOverlapped=0x0) returned 1 [0185.875] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4d90, dwBufLen=0x4d90 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x4d90) returned 1 [0185.875] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.875] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4d90, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x4d90, lpOverlapped=0x0) returned 1 [0185.875] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.875] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x4e64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.875] SetEndOfFile (hFile=0xdc) returned 1 [0185.878] GetProcessHeap () returned 0x4e0000 [0185.878] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0185.878] GetProcessHeap () returned 0x4e0000 [0185.878] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0185.878] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0304933.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0304933.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0185.880] CloseHandle (hObject=0xdc) returned 1 [0185.880] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ab12600, ftCreationTime.dwHighDateTime=0x1bf4533, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3ab12600, ftLastWriteTime.dwHighDateTime=0x1bf4533, nFileSizeHigh=0x0, nFileSizeLow=0x5af0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0305257.WMF", cAlternateFileName="")) returned 1 [0185.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0305257.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0185.882] GetProcessHeap () returned 0x4e0000 [0185.882] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0185.882] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0185.882] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0185.882] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.882] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.882] GetProcessHeap () returned 0x4e0000 [0185.882] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0185.882] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0185.882] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.883] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0185.884] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0185.885] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0185.885] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0185.885] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0185.885] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0185.885] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.885] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.885] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.885] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5af0, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x5af0, lpOverlapped=0x0) returned 1 [0185.896] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5af0, dwBufLen=0x5af0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5af0) returned 1 [0185.897] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.897] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5af0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5af0, lpOverlapped=0x0) returned 1 [0185.897] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.897] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5bc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.897] SetEndOfFile (hFile=0xdc) returned 1 [0185.900] GetProcessHeap () returned 0x4e0000 [0185.900] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0185.900] GetProcessHeap () returned 0x4e0000 [0185.900] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0185.900] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0305257.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0305257.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0185.902] CloseHandle (hObject=0xdc) returned 1 [0185.902] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x494c0d00, ftCreationTime.dwHighDateTime=0x1bf4534, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x494c0d00, ftLastWriteTime.dwHighDateTime=0x1bf4534, nFileSizeHigh=0x0, nFileSizeLow=0x3372, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0305493.WMF", cAlternateFileName="")) returned 1 [0185.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0305493.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0185.904] GetProcessHeap () returned 0x4e0000 [0185.904] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0185.904] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0185.904] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0185.904] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0185.906] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.906] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.906] GetProcessHeap () returned 0x4e0000 [0185.906] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0185.906] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0185.906] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.907] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0185.907] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0185.907] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0185.907] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0185.907] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0185.907] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0185.907] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.907] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.907] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.907] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3372, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x3372, lpOverlapped=0x0) returned 1 [0185.908] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3380, dwBufLen=0x3380 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x3380) returned 1 [0185.909] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.909] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3380, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x3380, lpOverlapped=0x0) returned 1 [0185.909] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.909] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x3454, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.909] SetEndOfFile (hFile=0xdc) returned 1 [0185.911] GetProcessHeap () returned 0x4e0000 [0185.911] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0185.912] GetProcessHeap () returned 0x4e0000 [0185.912] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0185.912] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0305493.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0305493.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0185.913] CloseHandle (hObject=0xdc) returned 1 [0185.913] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8598100, ftCreationTime.dwHighDateTime=0x1bf71c6, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb8598100, ftLastWriteTime.dwHighDateTime=0x1bf71c6, nFileSizeHigh=0x0, nFileSizeLow=0x60e4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0315447.JPG", cAlternateFileName="")) returned 1 [0185.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0315447.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0185.915] GetProcessHeap () returned 0x4e0000 [0185.915] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0185.915] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0185.915] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0185.915] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0185.918] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.918] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.918] GetProcessHeap () returned 0x4e0000 [0185.918] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0185.918] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0185.918] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.918] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0185.918] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0185.918] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0185.918] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0185.918] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0185.918] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0185.918] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.919] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.919] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.919] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x60e4, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x60e4, lpOverlapped=0x0) returned 1 [0185.920] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x60f0, dwBufLen=0x60f0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x60f0) returned 1 [0185.920] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.920] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x60f0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x60f0, lpOverlapped=0x0) returned 1 [0185.920] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.920] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x61c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.920] SetEndOfFile (hFile=0xdc) returned 1 [0185.923] GetProcessHeap () returned 0x4e0000 [0185.923] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0185.923] GetProcessHeap () returned 0x4e0000 [0185.924] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0185.924] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0315447.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0315447.jpg.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0185.925] CloseHandle (hObject=0xdc) returned 1 [0185.926] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x653ad300, ftCreationTime.dwHighDateTime=0x1bfaf58, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x653ad300, ftLastWriteTime.dwHighDateTime=0x1bfaf58, nFileSizeHigh=0x0, nFileSizeLow=0x5168, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0332268.WMF", cAlternateFileName="")) returned 1 [0185.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0332268.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0185.927] GetProcessHeap () returned 0x4e0000 [0185.927] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0185.927] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0185.927] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0185.927] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0185.932] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.932] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.932] GetProcessHeap () returned 0x4e0000 [0185.932] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0185.932] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0185.932] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.932] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0185.932] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0185.932] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0185.932] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0185.933] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0185.933] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0185.933] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.933] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.933] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.933] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5168, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x5168, lpOverlapped=0x0) returned 1 [0185.938] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5170, dwBufLen=0x5170 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x5170) returned 1 [0185.938] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.938] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5170, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x5170, lpOverlapped=0x0) returned 1 [0185.938] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.939] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x5244, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.939] SetEndOfFile (hFile=0xdc) returned 1 [0185.941] GetProcessHeap () returned 0x4e0000 [0185.941] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0185.941] GetProcessHeap () returned 0x4e0000 [0185.941] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0185.941] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0332268.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0332268.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0185.943] CloseHandle (hObject=0xdc) returned 1 [0185.944] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x666c0000, ftCreationTime.dwHighDateTime=0x1bfaf58, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x666c0000, ftLastWriteTime.dwHighDateTime=0x1bfaf58, nFileSizeHigh=0x0, nFileSizeLow=0x47c2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0332364.WMF", cAlternateFileName="")) returned 1 [0185.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0332364.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0185.945] GetProcessHeap () returned 0x4e0000 [0185.945] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0185.945] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0185.945] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0185.945] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xe, lpOverlapped=0x0) returned 1 [0185.947] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.947] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.947] GetProcessHeap () returned 0x4e0000 [0185.947] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0185.947] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0185.947] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.948] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0185.948] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0185.948] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0185.948] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0185.948] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0185.948] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0185.948] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.948] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.948] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.948] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x47c2, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x47c2, lpOverlapped=0x0) returned 1 [0185.949] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x47d0, dwBufLen=0x47d0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x47d0) returned 1 [0185.950] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.950] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x47d0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x47d0, lpOverlapped=0x0) returned 1 [0185.950] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.950] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x48a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.950] SetEndOfFile (hFile=0xdc) returned 1 [0185.953] GetProcessHeap () returned 0x4e0000 [0185.953] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0185.953] GetProcessHeap () returned 0x4e0000 [0185.953] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0185.953] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0332364.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0332364.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0185.955] CloseHandle (hObject=0xdc) returned 1 [0185.955] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5ca1000, ftCreationTime.dwHighDateTime=0x1bfaf58, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc5ca1000, ftLastWriteTime.dwHighDateTime=0x1bfaf58, nFileSizeHigh=0x0, nFileSizeLow=0x1f64, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0335112.WMF", cAlternateFileName="")) returned 1 [0185.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0335112.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0185.957] GetProcessHeap () returned 0x4e0000 [0185.957] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0185.957] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0185.957] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0185.957] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0xc, lpOverlapped=0x0) returned 1 [0185.959] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.959] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.959] GetProcessHeap () returned 0x4e0000 [0185.959] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0185.959] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0185.959] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.959] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0185.959] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0185.959] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0185.959] WriteFile (in: hFile=0xdc, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0185.960] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0185.960] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0185.960] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.960] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.960] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.960] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1f64, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0x1f64, lpOverlapped=0x0) returned 1 [0185.961] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1f70, dwBufLen=0x1f70 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0x1f70) returned 1 [0185.961] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.961] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1f70, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0x1f70, lpOverlapped=0x0) returned 1 [0185.961] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.961] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x2044, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.961] SetEndOfFile (hFile=0xdc) returned 1 [0185.964] GetProcessHeap () returned 0x4e0000 [0185.964] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0185.964] GetProcessHeap () returned 0x4e0000 [0185.964] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0185.964] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0335112.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0335112.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0185.966] CloseHandle (hObject=0xdc) returned 1 [0185.966] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c046200, ftCreationTime.dwHighDateTime=0x1bfaf5c, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2c046200, ftLastWriteTime.dwHighDateTime=0x1bfaf5c, nFileSizeHigh=0x0, nFileSizeLow=0xce9a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0336075.WMF", cAlternateFileName="")) returned 1 [0185.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0336075.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0185.967] GetProcessHeap () returned 0x4e0000 [0185.967] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0185.967] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0185.967] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df270 | out: lpNewFilePointer=0x0) returned 1 [0185.968] WriteFile (in: hFile=0xdc, lpBuffer=0x24df280*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df280*, lpNumberOfBytesWritten=0x24df258*=0x6, lpOverlapped=0x0) returned 1 [0185.970] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.970] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.970] GetProcessHeap () returned 0x4e0000 [0185.970] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0185.970] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24df238*=0x40) returned 1 [0185.970] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.970] WriteFile (in: hFile=0xdc, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24df258*=0x40, lpOverlapped=0x0) returned 1 [0185.970] WriteFile (in: hFile=0xdc, lpBuffer=0x24df260*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df260*, lpNumberOfBytesWritten=0x24df258*=0x4, lpOverlapped=0x0) returned 1 [0185.970] WriteFile (in: hFile=0xdc, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24df258*=0x10, lpOverlapped=0x0) returned 1 [0185.970] WriteFile (in: hFile=0xdc, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24df258*=0x80, lpOverlapped=0x0) returned 1 [0185.970] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24df268 | out: lpNewFilePointer=0x0) returned 1 [0185.970] WriteFile (in: hFile=0xdc, lpBuffer=0x24df278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24df258, lpOverlapped=0x0 | out: lpBuffer=0x24df278*, lpNumberOfBytesWritten=0x24df258*=0x8, lpOverlapped=0x0) returned 1 [0185.970] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24df25c | out: phKey=0x24df25c*=0x522f98) returned 1 [0185.970] CryptSetKeyParam (hKey=0x522f98, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.970] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.971] ReadFile (in: hFile=0xdc, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xce9a, lpNumberOfBytesRead=0x24df210, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24df210*=0xce9a, lpOverlapped=0x0) returned 1 [0185.972] CryptEncrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24df218*=0xcea0, dwBufLen=0xcea0 | out: pbData=0x22d0020*, pdwDataLen=0x24df218*=0xcea0) returned 1 [0185.973] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.973] WriteFile (in: hFile=0xdc, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xcea0, lpNumberOfBytesWritten=0x24df214, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24df214*=0xcea0, lpOverlapped=0x0) returned 1 [0185.973] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.973] SetFilePointerEx (in: hFile=0xdc, liDistanceToMove=0xcf74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.973] SetEndOfFile (hFile=0xdc) returned 1 [0185.976] GetProcessHeap () returned 0x4e0000 [0185.976] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0185.976] GetProcessHeap () returned 0x4e0000 [0185.976] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0185.976] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0336075.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0336075.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0185.978] CloseHandle (hObject=0xdc) returned 1 [0185.978] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c046200, ftCreationTime.dwHighDateTime=0x1bfaf5c, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2c046200, ftLastWriteTime.dwHighDateTime=0x1bfaf5c, nFileSizeHigh=0x0, nFileSizeLow=0xce9a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0336075.WMF", cAlternateFileName="")) returned 0 [0185.978] GetProcessHeap () returned 0x4e0000 [0185.978] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0185.978] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df248, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f98) returned 1 [0185.978] CryptDecrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df2b0 | out: pbData=0x4f53d8, pdwDataLen=0x24df2b0) returned 1 [0185.978] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.978] GetProcessHeap () returned 0x4e0000 [0185.978] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0185.978] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df248, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f98) returned 1 [0185.978] CryptDecrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df2b0 | out: pbData=0x4f5420, pdwDataLen=0x24df2b0) returned 1 [0185.978] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.978] GetProcessHeap () returned 0x4e0000 [0185.979] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x53a538 [0185.979] CryptImportKey (in: hProv=0x4f0590, pbData=0x24df248, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522f98) returned 1 [0185.979] CryptDecrypt (in: hKey=0x522f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x53a538, pdwDataLen=0x24df2b0 | out: pbData=0x53a538, pdwDataLen=0x24df2b0) returned 1 [0185.979] CryptDestroyKey (hKey=0x522f98) returned 1 [0185.979] wsprintfW (in: param_1=0x24de28c, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\readme-warning.txt") returned 67 [0185.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\readme-warning.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0185.981] WriteFile (in: hFile=0xdc, lpBuffer=0x53a538*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24de288, lpOverlapped=0x0 | out: lpBuffer=0x53a538*, lpNumberOfBytesWritten=0x24de288*=0x6c3, lpOverlapped=0x0) returned 1 [0185.982] CloseHandle (hObject=0xdc) returned 1 [0185.982] GetProcessHeap () returned 0x4e0000 [0185.982] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x53a538 | out: hHeap=0x4e0000) returned 1 [0185.982] GetProcessHeap () returned 0x4e0000 [0185.982] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0185.982] GetProcessHeap () returned 0x4e0000 [0185.982] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0185.982] FindClose (in: hFindFile=0x522f58 | out: hFindFile=0x522f58) returned 1 [0185.982] GetProcessHeap () returned 0x4e0000 [0185.982] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x522768 | out: hHeap=0x4e0000) returned 1 [0185.982] FindNextFileW (in: hFindFile=0x522ed8, lpFindFileData=0x24df570 | out: lpFindFileData=0x24df570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x596c1850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OFFICE14", cAlternateFileName="")) returned 1 [0185.983] GetProcessHeap () returned 0x4e0000 [0185.983] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x72) returned 0x4f1b18 [0185.983] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\*.*", lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x596c1850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f58 [0185.983] GetProcessHeap () returned 0x4e0000 [0185.983] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1b18 | out: hHeap=0x4e0000) returned 1 [0185.983] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x596c1850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0185.983] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 1 [0185.983] GetProcessHeap () returned 0x4e0000 [0185.983] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x274) returned 0x522768 [0185.983] GetProcessHeap () returned 0x4e0000 [0185.984] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x7c) returned 0x4fa058 [0185.984] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0185.984] GetProcessHeap () returned 0x4e0000 [0185.984] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0185.984] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0185.984] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x130a0400, ftCreationTime.dwHighDateTime=0x1c07b1f, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x130a0400, ftLastWriteTime.dwHighDateTime=0x1c07b1f, nFileSizeHigh=0x0, nFileSizeLow=0x4c438, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OFFICE10.MML", cAlternateFileName="")) returned 1 [0185.984] GetProcessHeap () returned 0x4e0000 [0185.984] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x27e) returned 0x5229e8 [0185.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0185.985] GetProcessHeap () returned 0x4e0000 [0185.985] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0185.985] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0185.985] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0185.985] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0185.987] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0185.987] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.987] GetProcessHeap () returned 0x4e0000 [0185.987] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0185.988] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0185.988] CryptDestroyKey (hKey=0x522fd8) returned 1 [0185.988] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0185.988] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0185.988] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0185.988] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0185.988] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0185.988] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0185.988] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0185.988] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0185.988] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.988] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4c438, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x4c438, lpOverlapped=0x0) returned 1 [0185.993] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x4c440, dwBufLen=0x4c440 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x4c440) returned 1 [0185.995] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.995] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4c440, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x4c440, lpOverlapped=0x0) returned 1 [0185.996] CryptDestroyKey (hKey=0x522fd8) returned 1 [0185.996] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x4c514, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.996] SetEndOfFile (hFile=0x100) returned 1 [0185.999] GetProcessHeap () returned 0x4e0000 [0185.999] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0185.999] GetProcessHeap () returned 0x4e0000 [0185.999] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0185.999] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0186.001] CloseHandle (hObject=0x100) returned 1 [0186.001] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x130a0400, ftCreationTime.dwHighDateTime=0x1c07b1f, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x130a0400, ftLastWriteTime.dwHighDateTime=0x1c07b1f, nFileSizeHigh=0x0, nFileSizeLow=0x4c438, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OFFICE10.MML", cAlternateFileName="")) returned 0 [0186.001] GetProcessHeap () returned 0x4e0000 [0186.001] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0186.001] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0186.001] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df020 | out: pbData=0x4f53d8, pdwDataLen=0x24df020) returned 1 [0186.002] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.002] GetProcessHeap () returned 0x4e0000 [0186.002] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0186.002] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0186.002] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df020 | out: pbData=0x4f5420, pdwDataLen=0x24df020) returned 1 [0186.002] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.002] GetProcessHeap () returned 0x4e0000 [0186.002] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x53a538 [0186.002] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0186.002] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x53a538, pdwDataLen=0x24df020 | out: pbData=0x53a538, pdwDataLen=0x24df020) returned 1 [0186.002] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.002] wsprintfW (in: param_1=0x24ddffc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\readme-warning.txt") returned 72 [0186.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\readme-warning.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0186.003] WriteFile (in: hFile=0x100, lpBuffer=0x53a538*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddff8, lpOverlapped=0x0 | out: lpBuffer=0x53a538*, lpNumberOfBytesWritten=0x24ddff8*=0x6c3, lpOverlapped=0x0) returned 1 [0186.004] CloseHandle (hObject=0x100) returned 1 [0186.004] GetProcessHeap () returned 0x4e0000 [0186.004] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x53a538 | out: hHeap=0x4e0000) returned 1 [0186.004] GetProcessHeap () returned 0x4e0000 [0186.004] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0186.004] GetProcessHeap () returned 0x4e0000 [0186.004] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0186.004] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0186.006] GetProcessHeap () returned 0x4e0000 [0186.006] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5229e8 | out: hHeap=0x4e0000) returned 1 [0186.006] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbcce4400, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AUTOSHAP", cAlternateFileName="")) returned 1 [0186.007] GetProcessHeap () returned 0x4e0000 [0186.007] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x84) returned 0x4fa058 [0186.007] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbcce4400, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0186.009] GetProcessHeap () returned 0x4e0000 [0186.009] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0186.009] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbcce4400, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0186.010] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3475600, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3475600, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x3da0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AUTOSHAP.DLL", cAlternateFileName="")) returned 1 [0186.010] GetProcessHeap () returned 0x4e0000 [0186.010] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x286) returned 0x5229e8 [0186.010] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6154e300, ftCreationTime.dwHighDateTime=0x1bdcf23, ftLastAccessTime.dwLowDateTime=0xbcb414e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6154e300, ftLastWriteTime.dwHighDateTime=0x1bdcf23, nFileSizeHigh=0x0, nFileSizeLow=0x926, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18180_.WMF", cAlternateFileName="")) returned 1 [0186.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18180_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0186.012] GetProcessHeap () returned 0x4e0000 [0186.012] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0186.012] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0186.012] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0186.012] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xa, lpOverlapped=0x0) returned 1 [0186.013] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.013] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.013] GetProcessHeap () returned 0x4e0000 [0186.013] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0186.014] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0186.014] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.014] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0186.014] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0186.014] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0186.014] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0186.014] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0186.014] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0186.014] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.014] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.014] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.014] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x926, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x926, lpOverlapped=0x0) returned 1 [0186.014] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x930, dwBufLen=0x930 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x930) returned 1 [0186.014] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.014] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x930, lpOverlapped=0x0) returned 1 [0186.015] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.015] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xa04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.015] SetEndOfFile (hFile=0x100) returned 1 [0186.017] GetProcessHeap () returned 0x4e0000 [0186.017] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0186.017] GetProcessHeap () returned 0x4e0000 [0186.017] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0186.017] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18180_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18180_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0186.018] CloseHandle (hObject=0x100) returned 1 [0186.019] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe4e1600, ftCreationTime.dwHighDateTime=0x1bdfe4c, ftLastAccessTime.dwLowDateTime=0xbcb67640, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe4e1600, ftLastWriteTime.dwHighDateTime=0x1bdfe4c, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18181_.WMF", cAlternateFileName="")) returned 1 [0186.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18181_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0186.021] GetProcessHeap () returned 0x4e0000 [0186.021] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0186.021] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0186.021] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0186.021] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x2, lpOverlapped=0x0) returned 1 [0186.023] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.023] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.023] GetProcessHeap () returned 0x4e0000 [0186.023] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0186.023] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0186.023] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.023] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0186.023] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0186.023] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0186.023] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0186.023] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0186.023] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0186.023] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.023] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.023] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.024] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb2e, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xb2e, lpOverlapped=0x0) returned 1 [0186.024] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xb30, dwBufLen=0xb30 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xb30) returned 1 [0186.024] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.024] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xb30, lpOverlapped=0x0) returned 1 [0186.024] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.024] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xc04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.024] SetEndOfFile (hFile=0x100) returned 1 [0186.026] GetProcessHeap () returned 0x4e0000 [0186.026] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0186.026] GetProcessHeap () returned 0x4e0000 [0186.026] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0186.026] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18181_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18181_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0186.028] CloseHandle (hObject=0x100) returned 1 [0186.028] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0ce0000, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcb67640, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa0ce0000, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0xc5e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18182_.WMF", cAlternateFileName="")) returned 1 [0186.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18182_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0186.029] GetProcessHeap () returned 0x4e0000 [0186.029] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0186.029] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0186.029] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0186.029] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x2, lpOverlapped=0x0) returned 1 [0186.031] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.031] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.031] GetProcessHeap () returned 0x4e0000 [0186.031] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0186.031] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0186.031] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.031] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0186.031] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0186.031] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0186.031] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0186.031] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0186.031] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0186.031] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.032] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.032] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.032] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xc5e, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xc5e, lpOverlapped=0x0) returned 1 [0186.032] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc60, dwBufLen=0xc60 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc60) returned 1 [0186.032] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.032] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc60, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xc60, lpOverlapped=0x0) returned 1 [0186.032] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.032] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xd34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.032] SetEndOfFile (hFile=0x100) returned 1 [0186.034] GetProcessHeap () returned 0x4e0000 [0186.034] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0186.034] GetProcessHeap () returned 0x4e0000 [0186.034] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0186.034] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18182_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18182_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0186.036] CloseHandle (hObject=0x100) returned 1 [0186.036] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe12d7e00, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcb67640, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe12d7e00, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0xd22, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18184_.WMF", cAlternateFileName="")) returned 1 [0186.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0186.037] GetProcessHeap () returned 0x4e0000 [0186.037] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0186.037] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0186.037] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0186.037] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xe, lpOverlapped=0x0) returned 1 [0186.039] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.039] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.039] GetProcessHeap () returned 0x4e0000 [0186.039] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0186.039] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0186.039] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.039] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0186.039] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0186.039] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0186.039] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0186.039] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0186.039] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0186.039] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.039] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.039] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.040] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xd22, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xd22, lpOverlapped=0x0) returned 1 [0186.040] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xd30, dwBufLen=0xd30 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xd30) returned 1 [0186.040] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.040] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xd30, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xd30, lpOverlapped=0x0) returned 1 [0186.040] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.040] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xe04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.040] SetEndOfFile (hFile=0x100) returned 1 [0186.042] GetProcessHeap () returned 0x4e0000 [0186.042] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0186.042] GetProcessHeap () returned 0x4e0000 [0186.042] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0186.042] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18184_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18184_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0186.047] CloseHandle (hObject=0x100) returned 1 [0186.047] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8867900, ftCreationTime.dwHighDateTime=0x1bdcf1b, ftLastAccessTime.dwLowDateTime=0xbcb67640, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd8867900, ftLastWriteTime.dwHighDateTime=0x1bdcf1b, nFileSizeHigh=0x0, nFileSizeLow=0xd42, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18185_.WMF", cAlternateFileName="")) returned 1 [0186.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18185_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0186.048] GetProcessHeap () returned 0x4e0000 [0186.048] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0186.048] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0186.048] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0186.048] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xe, lpOverlapped=0x0) returned 1 [0186.050] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.050] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.050] GetProcessHeap () returned 0x4e0000 [0186.050] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0186.050] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0186.050] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.050] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0186.050] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0186.050] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0186.050] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0186.050] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0186.051] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0186.051] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.051] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.051] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.051] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xd42, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xd42, lpOverlapped=0x0) returned 1 [0186.051] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xd50, dwBufLen=0xd50 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xd50) returned 1 [0186.051] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.051] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xd50, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xd50, lpOverlapped=0x0) returned 1 [0186.051] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.051] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xe24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.051] SetEndOfFile (hFile=0x100) returned 1 [0186.053] GetProcessHeap () returned 0x4e0000 [0186.053] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0186.053] GetProcessHeap () returned 0x4e0000 [0186.053] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0186.053] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18185_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18185_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0186.055] CloseHandle (hObject=0x100) returned 1 [0186.055] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50bd100, ftCreationTime.dwHighDateTime=0x1bdcf1d, ftLastAccessTime.dwLowDateTime=0xbcb67640, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe50bd100, ftLastWriteTime.dwHighDateTime=0x1bdcf1d, nFileSizeHigh=0x0, nFileSizeLow=0x758, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18187_.WMF", cAlternateFileName="")) returned 1 [0186.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18187_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0186.057] GetProcessHeap () returned 0x4e0000 [0186.057] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0186.057] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0186.057] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0186.057] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0186.058] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.058] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.059] GetProcessHeap () returned 0x4e0000 [0186.059] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0186.059] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0186.059] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.059] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0186.059] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0186.059] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0186.059] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0186.059] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0186.059] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0186.059] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.059] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.059] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.059] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x758, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x758, lpOverlapped=0x0) returned 1 [0186.059] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x760, dwBufLen=0x760 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x760) returned 1 [0186.059] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.059] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x760, lpOverlapped=0x0) returned 1 [0186.059] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.059] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.059] SetEndOfFile (hFile=0x100) returned 1 [0186.062] GetProcessHeap () returned 0x4e0000 [0186.062] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0186.062] GetProcessHeap () returned 0x4e0000 [0186.062] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0186.062] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18187_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18187_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0186.063] CloseHandle (hObject=0x100) returned 1 [0186.063] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84c95f00, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbcb67640, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x84c95f00, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0x980, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18189_.WMF", cAlternateFileName="")) returned 1 [0186.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18189_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18189_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0186.064] GetProcessHeap () returned 0x4e0000 [0186.064] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0186.064] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0186.064] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0186.064] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.064] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.064] GetProcessHeap () returned 0x4e0000 [0186.064] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0186.064] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0186.065] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.065] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0186.066] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0186.066] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0186.066] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0186.066] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0186.066] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0186.066] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.066] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.066] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.067] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x980, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x980, lpOverlapped=0x0) returned 1 [0186.067] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x980, dwBufLen=0x980 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x980) returned 1 [0186.067] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.067] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x980, lpOverlapped=0x0) returned 1 [0186.067] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.067] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xa54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.067] SetEndOfFile (hFile=0x100) returned 1 [0186.069] GetProcessHeap () returned 0x4e0000 [0186.069] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0186.069] GetProcessHeap () returned 0x4e0000 [0186.069] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0186.069] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18189_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18189_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18189_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18189_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0186.070] CloseHandle (hObject=0x100) returned 1 [0186.070] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea699700, ftCreationTime.dwHighDateTime=0x1bdfe4c, ftLastAccessTime.dwLowDateTime=0xbcb8d7a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xea699700, ftLastWriteTime.dwHighDateTime=0x1bdfe4c, nFileSizeHigh=0x0, nFileSizeLow=0x994, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18190_.WMF", cAlternateFileName="")) returned 1 [0186.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18190_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18190_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0186.071] GetProcessHeap () returned 0x4e0000 [0186.071] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0186.071] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0186.071] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0186.071] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xc, lpOverlapped=0x0) returned 1 [0186.072] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.072] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.072] GetProcessHeap () returned 0x4e0000 [0186.072] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0186.073] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0186.073] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.073] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0186.073] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0186.073] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0186.073] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0186.073] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0186.073] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0186.073] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.073] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.073] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.073] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x994, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x994, lpOverlapped=0x0) returned 1 [0186.073] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x9a0, dwBufLen=0x9a0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x9a0) returned 1 [0186.073] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.073] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x9a0, lpOverlapped=0x0) returned 1 [0186.073] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.073] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xa74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.073] SetEndOfFile (hFile=0x100) returned 1 [0186.075] GetProcessHeap () returned 0x4e0000 [0186.075] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0186.075] GetProcessHeap () returned 0x4e0000 [0186.075] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0186.076] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18190_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18190_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18190_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18190_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0186.076] CloseHandle (hObject=0x100) returned 1 [0186.077] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x171d3300, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbcb8d7a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x171d3300, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0xc9e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18191_.WMF", cAlternateFileName="")) returned 1 [0186.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18191_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0186.078] GetProcessHeap () returned 0x4e0000 [0186.078] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0186.078] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0186.078] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0186.078] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x2, lpOverlapped=0x0) returned 1 [0186.080] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.080] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.080] GetProcessHeap () returned 0x4e0000 [0186.080] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0186.080] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0186.080] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.080] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0186.080] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0186.080] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0186.080] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0186.080] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0186.080] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0186.080] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.080] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.080] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.080] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xc9e, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xc9e, lpOverlapped=0x0) returned 1 [0186.081] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xca0, dwBufLen=0xca0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xca0) returned 1 [0186.081] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.081] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xca0, lpOverlapped=0x0) returned 1 [0186.081] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.081] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xd74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.081] SetEndOfFile (hFile=0x100) returned 1 [0186.083] GetProcessHeap () returned 0x4e0000 [0186.083] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0186.083] GetProcessHeap () returned 0x4e0000 [0186.083] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0186.083] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18191_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18191_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18191_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18191_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0186.084] CloseHandle (hObject=0x100) returned 1 [0186.085] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6432a00, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcb8d7a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb6432a00, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0x2068, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18192_.WMF", cAlternateFileName="")) returned 1 [0186.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18192_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18192_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0186.086] GetProcessHeap () returned 0x4e0000 [0186.086] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0186.086] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0186.086] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0186.086] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0186.088] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.088] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.088] GetProcessHeap () returned 0x4e0000 [0186.088] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0186.088] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0186.088] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.088] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0186.088] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0186.088] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0186.088] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0186.088] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0186.088] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0186.089] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.089] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.089] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.089] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2068, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x2068, lpOverlapped=0x0) returned 1 [0186.089] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x2070, dwBufLen=0x2070 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x2070) returned 1 [0186.089] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.089] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2070, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x2070, lpOverlapped=0x0) returned 1 [0186.090] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.090] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x2144, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.090] SetEndOfFile (hFile=0x100) returned 1 [0186.092] GetProcessHeap () returned 0x4e0000 [0186.092] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0186.092] GetProcessHeap () returned 0x4e0000 [0186.092] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0186.092] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18192_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18192_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18192_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18192_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0186.093] CloseHandle (hObject=0x100) returned 1 [0186.093] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd07d0800, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcb8d7a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd07d0800, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0x128e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18193_.WMF", cAlternateFileName="")) returned 1 [0186.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18193_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18193_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0186.095] GetProcessHeap () returned 0x4e0000 [0186.095] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0186.095] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0186.095] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0186.095] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x2, lpOverlapped=0x0) returned 1 [0186.134] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.134] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.134] GetProcessHeap () returned 0x4e0000 [0186.134] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0186.134] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0186.134] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.134] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0186.134] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0186.134] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0186.134] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0186.134] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0186.135] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0186.135] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.135] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.135] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.135] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x128e, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x128e, lpOverlapped=0x0) returned 1 [0186.136] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1290, dwBufLen=0x1290 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1290) returned 1 [0186.136] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.136] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1290, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x1290, lpOverlapped=0x0) returned 1 [0186.136] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.136] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1364, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.136] SetEndOfFile (hFile=0x100) returned 1 [0186.138] GetProcessHeap () returned 0x4e0000 [0186.138] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0186.138] GetProcessHeap () returned 0x4e0000 [0186.138] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0186.138] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18193_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18193_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18193_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18193_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0186.140] CloseHandle (hObject=0x100) returned 1 [0186.140] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29e33800, ftCreationTime.dwHighDateTime=0x1bdcf1d, ftLastAccessTime.dwLowDateTime=0xbcb8d7a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x29e33800, ftLastWriteTime.dwHighDateTime=0x1bdcf1d, nFileSizeHigh=0x0, nFileSizeLow=0xdde, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18194_.WMF", cAlternateFileName="")) returned 1 [0186.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18194_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0186.141] GetProcessHeap () returned 0x4e0000 [0186.141] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0186.142] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0186.142] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0186.142] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x2, lpOverlapped=0x0) returned 1 [0186.143] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.143] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.143] GetProcessHeap () returned 0x4e0000 [0186.143] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0186.143] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0186.143] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.143] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0186.143] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0186.143] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0186.143] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0186.144] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0186.144] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0186.144] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.144] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.144] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.144] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xdde, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xdde, lpOverlapped=0x0) returned 1 [0186.144] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xde0, dwBufLen=0xde0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xde0) returned 1 [0186.144] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.144] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xde0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xde0, lpOverlapped=0x0) returned 1 [0186.144] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.144] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xeb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.144] SetEndOfFile (hFile=0x100) returned 1 [0186.146] GetProcessHeap () returned 0x4e0000 [0186.146] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0186.146] GetProcessHeap () returned 0x4e0000 [0186.146] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0186.146] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18194_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18194_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18194_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18194_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0186.147] CloseHandle (hObject=0x100) returned 1 [0186.148] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4404e00, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcb8d7a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf4404e00, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0x5a4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18196_.WMF", cAlternateFileName="")) returned 1 [0186.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18196_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0186.148] GetProcessHeap () returned 0x4e0000 [0186.149] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0186.149] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0186.149] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0186.149] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xc, lpOverlapped=0x0) returned 1 [0186.150] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.150] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.150] GetProcessHeap () returned 0x4e0000 [0186.150] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0186.150] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0186.150] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.150] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0186.150] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0186.151] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0186.151] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0186.151] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0186.151] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0186.151] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.151] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.151] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.151] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5a4, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x5a4, lpOverlapped=0x0) returned 1 [0186.151] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x5b0) returned 1 [0186.151] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.151] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x5b0, lpOverlapped=0x0) returned 1 [0186.151] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.151] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.151] SetEndOfFile (hFile=0x100) returned 1 [0186.153] GetProcessHeap () returned 0x4e0000 [0186.153] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0186.153] GetProcessHeap () returned 0x4e0000 [0186.153] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0186.153] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18196_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18196_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18196_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18196_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0186.155] CloseHandle (hObject=0x100) returned 1 [0186.155] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6adbc800, ftCreationTime.dwHighDateTime=0x1bdfe4c, ftLastAccessTime.dwLowDateTime=0xbcb8d7a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6adbc800, ftLastWriteTime.dwHighDateTime=0x1bdfe4c, nFileSizeHigh=0x0, nFileSizeLow=0x5b4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18197_.WMF", cAlternateFileName="")) returned 1 [0186.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18197_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18197_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0186.156] GetProcessHeap () returned 0x4e0000 [0186.156] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0186.156] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0186.156] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0186.156] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xc, lpOverlapped=0x0) returned 1 [0186.167] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.167] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.167] GetProcessHeap () returned 0x4e0000 [0186.167] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0186.167] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0186.167] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.167] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0186.167] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0186.168] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0186.168] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0186.168] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0186.168] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0186.168] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.168] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.168] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.168] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5b4, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x5b4, lpOverlapped=0x0) returned 1 [0186.168] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x5c0, dwBufLen=0x5c0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x5c0) returned 1 [0186.168] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.168] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x5c0, lpOverlapped=0x0) returned 1 [0186.168] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.168] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.168] SetEndOfFile (hFile=0x100) returned 1 [0186.173] GetProcessHeap () returned 0x4e0000 [0186.173] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0186.173] GetProcessHeap () returned 0x4e0000 [0186.173] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0186.173] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18197_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18197_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18197_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18197_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0186.175] CloseHandle (hObject=0x100) returned 1 [0186.175] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6adbc800, ftCreationTime.dwHighDateTime=0x1bdfe4c, ftLastAccessTime.dwLowDateTime=0xbcbb3900, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6adbc800, ftLastWriteTime.dwHighDateTime=0x1bdfe4c, nFileSizeHigh=0x0, nFileSizeLow=0x5c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18198_.WMF", cAlternateFileName="")) returned 1 [0186.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18198_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18198_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0186.176] GetProcessHeap () returned 0x4e0000 [0186.176] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0186.176] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0186.176] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0186.176] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xc, lpOverlapped=0x0) returned 1 [0186.178] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.179] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.179] GetProcessHeap () returned 0x4e0000 [0186.179] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0186.179] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0186.179] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.179] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0186.179] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0186.179] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0186.179] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0186.179] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0186.179] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0186.179] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.179] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.179] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.179] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5c4, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x5c4, lpOverlapped=0x0) returned 1 [0186.180] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x5d0, dwBufLen=0x5d0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x5d0) returned 1 [0186.180] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.180] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5d0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x5d0, lpOverlapped=0x0) returned 1 [0186.180] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.180] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x6a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.180] SetEndOfFile (hFile=0x100) returned 1 [0186.183] GetProcessHeap () returned 0x4e0000 [0186.183] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0186.183] GetProcessHeap () returned 0x4e0000 [0186.183] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0186.183] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18198_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18198_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18198_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18198_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0186.184] CloseHandle (hObject=0x100) returned 1 [0186.184] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2fdb1800, ftCreationTime.dwHighDateTime=0x1bdcf21, ftLastAccessTime.dwLowDateTime=0xbcbb3900, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2fdb1800, ftLastWriteTime.dwHighDateTime=0x1bdcf21, nFileSizeHigh=0x0, nFileSizeLow=0xc3c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18199_.WMF", cAlternateFileName="")) returned 1 [0186.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18199_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18199_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0186.185] GetProcessHeap () returned 0x4e0000 [0186.185] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0186.185] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0186.186] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0186.186] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0186.188] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.188] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.188] GetProcessHeap () returned 0x4e0000 [0186.188] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0186.188] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0186.188] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.188] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0186.188] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0186.188] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0186.188] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0186.188] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0186.189] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0186.189] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.189] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.189] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.189] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xc3c, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xc3c, lpOverlapped=0x0) returned 1 [0186.189] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc40, dwBufLen=0xc40 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc40) returned 1 [0186.189] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.189] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xc40, lpOverlapped=0x0) returned 1 [0186.189] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.189] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xd14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.189] SetEndOfFile (hFile=0x100) returned 1 [0186.192] GetProcessHeap () returned 0x4e0000 [0186.192] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0186.192] GetProcessHeap () returned 0x4e0000 [0186.192] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0186.192] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18199_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18199_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18199_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18199_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0186.193] CloseHandle (hObject=0x100) returned 1 [0186.193] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd302000, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbcbb3900, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfd302000, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0x61c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18200_.WMF", cAlternateFileName="")) returned 1 [0186.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18200_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0186.194] GetProcessHeap () returned 0x4e0000 [0186.194] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0186.194] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0186.194] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0186.194] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0186.196] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.196] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.196] GetProcessHeap () returned 0x4e0000 [0186.196] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0186.196] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0186.196] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.197] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0186.197] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0186.197] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0186.197] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0186.197] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0186.197] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0186.197] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.197] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.197] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.197] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x61c, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x61c, lpOverlapped=0x0) returned 1 [0186.197] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x620, dwBufLen=0x620 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x620) returned 1 [0186.197] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.197] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x620, lpOverlapped=0x0) returned 1 [0186.198] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.198] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x6f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.198] SetEndOfFile (hFile=0x100) returned 1 [0186.200] GetProcessHeap () returned 0x4e0000 [0186.200] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0186.200] GetProcessHeap () returned 0x4e0000 [0186.200] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0186.200] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18200_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18200_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18200_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18200_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0186.202] CloseHandle (hObject=0x100) returned 1 [0186.202] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3c3c400, ftCreationTime.dwHighDateTime=0x1bdcf1f, ftLastAccessTime.dwLowDateTime=0xbcbb3900, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd3c3c400, ftLastWriteTime.dwHighDateTime=0x1bdcf1f, nFileSizeHigh=0x0, nFileSizeLow=0x6ec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18201_.WMF", cAlternateFileName="")) returned 1 [0186.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18201_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18201_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0186.204] GetProcessHeap () returned 0x4e0000 [0186.204] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0186.204] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0186.204] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0186.204] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0186.206] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.206] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.206] GetProcessHeap () returned 0x4e0000 [0186.206] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0186.206] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0186.206] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.206] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0186.206] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0186.206] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0186.206] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0186.206] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0186.206] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0186.207] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.207] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.207] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.207] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x6ec, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x6ec, lpOverlapped=0x0) returned 1 [0186.207] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x6f0, dwBufLen=0x6f0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x6f0) returned 1 [0186.207] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.207] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6f0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x6f0, lpOverlapped=0x0) returned 1 [0186.207] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.207] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x7c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.207] SetEndOfFile (hFile=0x100) returned 1 [0186.210] GetProcessHeap () returned 0x4e0000 [0186.210] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0186.210] GetProcessHeap () returned 0x4e0000 [0186.210] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0186.210] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18201_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18201_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18201_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18201_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0186.211] CloseHandle (hObject=0x100) returned 1 [0186.211] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6adbc800, ftCreationTime.dwHighDateTime=0x1bdfe4c, ftLastAccessTime.dwLowDateTime=0xbcbb3900, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6adbc800, ftLastWriteTime.dwHighDateTime=0x1bdfe4c, nFileSizeHigh=0x0, nFileSizeLow=0x56c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18202_.WMF", cAlternateFileName="")) returned 1 [0186.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18202_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18202_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0186.212] GetProcessHeap () returned 0x4e0000 [0186.212] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0186.212] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0186.212] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0186.212] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0186.281] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.281] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.281] GetProcessHeap () returned 0x4e0000 [0186.281] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0186.281] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0186.281] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.281] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0186.281] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0186.281] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0186.281] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0186.281] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0186.281] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0186.281] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.281] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.281] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.282] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x56c, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x56c, lpOverlapped=0x0) returned 1 [0186.282] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x570, dwBufLen=0x570 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x570) returned 1 [0186.282] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.282] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x570, lpOverlapped=0x0) returned 1 [0186.282] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.282] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x644, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.282] SetEndOfFile (hFile=0x100) returned 1 [0186.284] GetProcessHeap () returned 0x4e0000 [0186.284] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0186.284] GetProcessHeap () returned 0x4e0000 [0186.284] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0186.284] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18202_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18202_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18202_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18202_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0186.286] CloseHandle (hObject=0x100) returned 1 [0186.286] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f586200, ftCreationTime.dwHighDateTime=0x1bdcf1d, ftLastAccessTime.dwLowDateTime=0xbcbb3900, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3f586200, ftLastWriteTime.dwHighDateTime=0x1bdcf1d, nFileSizeHigh=0x0, nFileSizeLow=0x822, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18203_.WMF", cAlternateFileName="")) returned 1 [0186.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18203_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18203_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0186.287] GetProcessHeap () returned 0x4e0000 [0186.287] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0186.287] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0186.287] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0186.288] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xe, lpOverlapped=0x0) returned 1 [0186.325] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.325] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.325] GetProcessHeap () returned 0x4e0000 [0186.325] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0186.325] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0186.325] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.325] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0186.325] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0186.325] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0186.325] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0186.325] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0186.325] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0186.326] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.326] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.326] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.326] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x822, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x822, lpOverlapped=0x0) returned 1 [0186.326] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x830, dwBufLen=0x830 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x830) returned 1 [0186.326] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.326] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x830, lpOverlapped=0x0) returned 1 [0186.326] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.326] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x904, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.326] SetEndOfFile (hFile=0x100) returned 1 [0186.328] GetProcessHeap () returned 0x4e0000 [0186.328] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0186.328] GetProcessHeap () returned 0x4e0000 [0186.328] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0186.328] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18203_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18203_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18203_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18203_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0186.330] CloseHandle (hObject=0x100) returned 1 [0186.330] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7db3a00, ftCreationTime.dwHighDateTime=0x1bddcb2, ftLastAccessTime.dwLowDateTime=0xbcbb3900, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd7db3a00, ftLastWriteTime.dwHighDateTime=0x1bddcb2, nFileSizeHigh=0x0, nFileSizeLow=0x814, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18204_.WMF", cAlternateFileName="")) returned 1 [0186.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18204_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18204_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0186.332] GetProcessHeap () returned 0x4e0000 [0186.332] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0186.332] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0186.332] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0186.332] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xc, lpOverlapped=0x0) returned 1 [0186.334] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.334] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.334] GetProcessHeap () returned 0x4e0000 [0186.334] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0186.334] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0186.334] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.334] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0186.334] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0186.334] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0186.334] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0186.334] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0186.334] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0186.334] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.334] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.334] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.335] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x814, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x814, lpOverlapped=0x0) returned 1 [0186.335] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x820, dwBufLen=0x820 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x820) returned 1 [0186.335] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.335] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x820, lpOverlapped=0x0) returned 1 [0186.335] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.335] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x8f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.335] SetEndOfFile (hFile=0x100) returned 1 [0186.337] GetProcessHeap () returned 0x4e0000 [0186.337] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0186.337] GetProcessHeap () returned 0x4e0000 [0186.337] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0186.337] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18204_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18204_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18204_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18204_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0186.339] CloseHandle (hObject=0x100) returned 1 [0186.339] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58631200, ftCreationTime.dwHighDateTime=0x1bdcf21, ftLastAccessTime.dwLowDateTime=0xbcbd9a60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x58631200, ftLastWriteTime.dwHighDateTime=0x1bdcf21, nFileSizeHigh=0x0, nFileSizeLow=0x8da, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18205_.WMF", cAlternateFileName="")) returned 1 [0186.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18205_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18205_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0186.341] GetProcessHeap () returned 0x4e0000 [0186.341] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0186.341] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0186.341] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0186.341] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x6, lpOverlapped=0x0) returned 1 [0186.342] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.342] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.342] GetProcessHeap () returned 0x4e0000 [0186.342] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0186.342] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0186.342] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.342] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0186.343] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0186.343] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0186.343] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0186.343] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0186.343] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0186.343] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.343] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.343] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.343] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x8da, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x8da, lpOverlapped=0x0) returned 1 [0186.343] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x8e0, dwBufLen=0x8e0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x8e0) returned 1 [0186.343] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.343] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x8e0, lpOverlapped=0x0) returned 1 [0186.343] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.343] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x9b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.343] SetEndOfFile (hFile=0x100) returned 1 [0186.345] GetProcessHeap () returned 0x4e0000 [0186.345] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0186.345] GetProcessHeap () returned 0x4e0000 [0186.345] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0186.345] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18205_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18205_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18205_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18205_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0186.347] CloseHandle (hObject=0x100) returned 1 [0186.347] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4dd5a600, ftCreationTime.dwHighDateTime=0x1bddc9f, ftLastAccessTime.dwLowDateTime=0xbcbd9a60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4dd5a600, ftLastWriteTime.dwHighDateTime=0x1bddc9f, nFileSizeHigh=0x0, nFileSizeLow=0x8da, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18206_.WMF", cAlternateFileName="")) returned 1 [0186.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18206_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18206_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0186.348] GetProcessHeap () returned 0x4e0000 [0186.348] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0186.348] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0186.348] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0186.348] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x6, lpOverlapped=0x0) returned 1 [0186.350] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.350] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.350] GetProcessHeap () returned 0x4e0000 [0186.350] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0186.350] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0186.350] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.350] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0186.350] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0186.350] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0186.350] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0186.350] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0186.350] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0186.350] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.350] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.350] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.350] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x8da, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x8da, lpOverlapped=0x0) returned 1 [0186.351] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x8e0, dwBufLen=0x8e0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x8e0) returned 1 [0186.351] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.351] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x8e0, lpOverlapped=0x0) returned 1 [0186.351] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.351] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x9b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.351] SetEndOfFile (hFile=0x100) returned 1 [0186.353] GetProcessHeap () returned 0x4e0000 [0186.353] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0186.353] GetProcessHeap () returned 0x4e0000 [0186.353] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0186.353] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18206_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18206_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18206_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18206_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0186.354] CloseHandle (hObject=0x100) returned 1 [0186.354] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5e8e00, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcbd9a60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf5e8e00, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0xfbc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18207_.WMF", cAlternateFileName="")) returned 1 [0186.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18207_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18207_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0186.355] GetProcessHeap () returned 0x4e0000 [0186.355] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0186.355] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0186.355] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0186.355] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0186.357] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.357] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.357] GetProcessHeap () returned 0x4e0000 [0186.357] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0186.357] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0186.357] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.357] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0186.357] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0186.358] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0186.358] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0186.358] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0186.358] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0186.358] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.358] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.358] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.358] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xfbc, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xfbc, lpOverlapped=0x0) returned 1 [0186.358] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xfc0, dwBufLen=0xfc0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xfc0) returned 1 [0186.358] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.358] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xfc0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xfc0, lpOverlapped=0x0) returned 1 [0186.358] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.358] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1094, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.358] SetEndOfFile (hFile=0x100) returned 1 [0186.361] GetProcessHeap () returned 0x4e0000 [0186.361] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0186.361] GetProcessHeap () returned 0x4e0000 [0186.361] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0186.361] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18207_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18207_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18207_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18207_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0186.365] CloseHandle (hObject=0x100) returned 1 [0186.365] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f714100, ftCreationTime.dwHighDateTime=0x1bdcf1f, ftLastAccessTime.dwLowDateTime=0xbcbd9a60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4f714100, ftLastWriteTime.dwHighDateTime=0x1bdcf1f, nFileSizeHigh=0x0, nFileSizeLow=0x1b28, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18208_.WMF", cAlternateFileName="")) returned 1 [0186.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18208_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18208_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0186.366] GetProcessHeap () returned 0x4e0000 [0186.366] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0186.366] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0186.366] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0186.366] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0186.369] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.369] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.369] GetProcessHeap () returned 0x4e0000 [0186.369] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0186.369] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0186.369] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.369] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0186.369] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0186.369] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0186.369] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0186.369] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0186.369] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0186.370] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.370] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.370] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.370] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1b28, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x1b28, lpOverlapped=0x0) returned 1 [0186.371] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1b30, dwBufLen=0x1b30 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1b30) returned 1 [0186.371] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.371] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1b30, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x1b30, lpOverlapped=0x0) returned 1 [0186.371] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.371] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1c04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.371] SetEndOfFile (hFile=0x100) returned 1 [0186.373] GetProcessHeap () returned 0x4e0000 [0186.373] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0186.373] GetProcessHeap () returned 0x4e0000 [0186.373] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0186.373] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18208_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18208_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18208_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18208_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0186.375] CloseHandle (hObject=0x100) returned 1 [0186.376] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96603600, ftCreationTime.dwHighDateTime=0x1bdcf21, ftLastAccessTime.dwLowDateTime=0xbcbd9a60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x96603600, ftLastWriteTime.dwHighDateTime=0x1bdcf21, nFileSizeHigh=0x0, nFileSizeLow=0xc6e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18209_.WMF", cAlternateFileName="")) returned 1 [0186.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18209_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18209_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0186.377] GetProcessHeap () returned 0x4e0000 [0186.377] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0186.377] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0186.377] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0186.378] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x2, lpOverlapped=0x0) returned 1 [0186.379] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.379] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.379] GetProcessHeap () returned 0x4e0000 [0186.379] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0186.379] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0186.379] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.379] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0186.379] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0186.380] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0186.380] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0186.380] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0186.380] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0186.380] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.380] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.380] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.380] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xc6e, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xc6e, lpOverlapped=0x0) returned 1 [0186.380] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc70, dwBufLen=0xc70 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc70) returned 1 [0186.380] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.380] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc70, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xc70, lpOverlapped=0x0) returned 1 [0186.380] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.380] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xd44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.380] SetEndOfFile (hFile=0x100) returned 1 [0186.382] GetProcessHeap () returned 0x4e0000 [0186.382] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0186.382] GetProcessHeap () returned 0x4e0000 [0186.382] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0186.382] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18209_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18209_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18209_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18209_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0186.384] CloseHandle (hObject=0x100) returned 1 [0186.384] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28673f00, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcbd9a60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x28673f00, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0xc4c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18210_.WMF", cAlternateFileName="")) returned 1 [0186.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18210_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18210_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0186.385] GetProcessHeap () returned 0x4e0000 [0186.385] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0186.385] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0186.385] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0186.385] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0186.390] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.390] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.390] GetProcessHeap () returned 0x4e0000 [0186.390] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0186.390] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0186.390] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.390] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0186.391] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0186.391] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0186.391] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0186.391] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0186.391] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0186.391] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.391] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.391] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.391] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xc4c, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xc4c, lpOverlapped=0x0) returned 1 [0186.391] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc50, dwBufLen=0xc50 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc50) returned 1 [0186.391] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.391] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xc50, lpOverlapped=0x0) returned 1 [0186.391] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.391] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xd24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.391] SetEndOfFile (hFile=0x100) returned 1 [0186.393] GetProcessHeap () returned 0x4e0000 [0186.393] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0186.393] GetProcessHeap () returned 0x4e0000 [0186.393] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0186.393] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18210_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18210_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18210_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18210_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0186.395] CloseHandle (hObject=0x100) returned 1 [0186.395] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea699700, ftCreationTime.dwHighDateTime=0x1bdfe4c, ftLastAccessTime.dwLowDateTime=0xbcbffbc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xea699700, ftLastWriteTime.dwHighDateTime=0x1bdfe4c, nFileSizeHigh=0x0, nFileSizeLow=0x738, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18211_.WMF", cAlternateFileName="")) returned 1 [0186.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18211_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18211_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0186.396] GetProcessHeap () returned 0x4e0000 [0186.396] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0186.396] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0186.396] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0186.396] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0186.398] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.398] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.398] GetProcessHeap () returned 0x4e0000 [0186.398] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0186.398] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0186.398] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.398] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0186.398] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0186.398] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0186.398] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0186.399] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0186.399] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0186.399] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.399] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.399] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.399] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x738, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x738, lpOverlapped=0x0) returned 1 [0186.399] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x740, dwBufLen=0x740 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x740) returned 1 [0186.399] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.399] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x740, lpOverlapped=0x0) returned 1 [0186.399] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.399] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.399] SetEndOfFile (hFile=0x100) returned 1 [0186.401] GetProcessHeap () returned 0x4e0000 [0186.401] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0186.401] GetProcessHeap () returned 0x4e0000 [0186.401] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0186.401] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18211_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18211_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18211_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18211_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0186.403] CloseHandle (hObject=0x100) returned 1 [0186.403] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85941c00, ftCreationTime.dwHighDateTime=0x1bddca6, ftLastAccessTime.dwLowDateTime=0xbcbffbc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x85941c00, ftLastWriteTime.dwHighDateTime=0x1bddca6, nFileSizeHigh=0x0, nFileSizeLow=0x3d5c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18212_.WMF", cAlternateFileName="")) returned 1 [0186.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18212_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18212_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0186.404] GetProcessHeap () returned 0x4e0000 [0186.404] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0186.404] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0186.404] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0186.404] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0186.406] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.406] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.406] GetProcessHeap () returned 0x4e0000 [0186.406] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0186.406] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0186.406] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.406] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0186.406] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0186.406] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0186.406] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0186.406] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0186.406] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0186.406] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.407] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.407] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.407] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3d5c, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x3d5c, lpOverlapped=0x0) returned 1 [0186.415] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x3d60, dwBufLen=0x3d60 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x3d60) returned 1 [0186.415] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.415] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3d60, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x3d60, lpOverlapped=0x0) returned 1 [0186.415] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.415] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x3e34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.415] SetEndOfFile (hFile=0x100) returned 1 [0186.417] GetProcessHeap () returned 0x4e0000 [0186.417] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0186.417] GetProcessHeap () returned 0x4e0000 [0186.417] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0186.417] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18212_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18212_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18212_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18212_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0186.419] CloseHandle (hObject=0x100) returned 1 [0186.419] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1638d100, ftCreationTime.dwHighDateTime=0x1bdcf1f, ftLastAccessTime.dwLowDateTime=0xbcbffbc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1638d100, ftLastWriteTime.dwHighDateTime=0x1bdcf1f, nFileSizeHigh=0x0, nFileSizeLow=0x704, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18213_.WMF", cAlternateFileName="")) returned 1 [0186.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18213_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18213_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0186.421] GetProcessHeap () returned 0x4e0000 [0186.421] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0186.421] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0186.421] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0186.421] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xc, lpOverlapped=0x0) returned 1 [0186.532] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.532] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.532] GetProcessHeap () returned 0x4e0000 [0186.532] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0186.532] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0186.532] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.532] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0186.532] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0186.532] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0186.532] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0186.532] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0186.533] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0186.533] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.533] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.533] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.533] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x704, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x704, lpOverlapped=0x0) returned 1 [0186.533] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x710, dwBufLen=0x710 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x710) returned 1 [0186.533] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.533] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x710, lpOverlapped=0x0) returned 1 [0186.533] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.533] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x7e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.533] SetEndOfFile (hFile=0x100) returned 1 [0186.536] GetProcessHeap () returned 0x4e0000 [0186.536] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0186.536] GetProcessHeap () returned 0x4e0000 [0186.536] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0186.536] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18213_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18213_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18213_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18213_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0186.538] CloseHandle (hObject=0x100) returned 1 [0186.538] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c0d7900, ftCreationTime.dwHighDateTime=0x1bdcf1f, ftLastAccessTime.dwLowDateTime=0xbcbffbc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6c0d7900, ftLastWriteTime.dwHighDateTime=0x1bdcf1f, nFileSizeHigh=0x0, nFileSizeLow=0x7fc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18214_.WMF", cAlternateFileName="")) returned 1 [0186.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18214_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18214_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0186.540] GetProcessHeap () returned 0x4e0000 [0186.540] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0186.540] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0186.540] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0186.540] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0186.728] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.728] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.728] GetProcessHeap () returned 0x4e0000 [0186.728] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0186.728] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0186.728] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.728] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0186.729] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0186.729] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0186.729] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0186.729] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0186.729] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0186.729] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.729] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.729] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.729] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7fc, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x7fc, lpOverlapped=0x0) returned 1 [0186.729] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x800, dwBufLen=0x800 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x800) returned 1 [0186.729] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.729] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x800, lpOverlapped=0x0) returned 1 [0186.730] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.730] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x8d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.730] SetEndOfFile (hFile=0x100) returned 1 [0186.733] GetProcessHeap () returned 0x4e0000 [0186.733] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0186.733] GetProcessHeap () returned 0x4e0000 [0186.733] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0186.733] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18214_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18214_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18214_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18214_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0186.735] CloseHandle (hObject=0x100) returned 1 [0186.735] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b613000, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbcbffbc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2b613000, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0x6a4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18215_.WMF", cAlternateFileName="")) returned 1 [0186.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18215_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18215_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0186.737] GetProcessHeap () returned 0x4e0000 [0186.737] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0186.737] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0186.737] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0186.737] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xc, lpOverlapped=0x0) returned 1 [0186.809] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.809] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.809] GetProcessHeap () returned 0x4e0000 [0186.809] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0186.809] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0186.809] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.809] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0186.809] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0186.809] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0186.810] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0186.810] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0186.810] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0186.810] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.810] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.810] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.810] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x6a4, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x6a4, lpOverlapped=0x0) returned 1 [0186.810] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x6b0, dwBufLen=0x6b0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x6b0) returned 1 [0186.810] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.810] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6b0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x6b0, lpOverlapped=0x0) returned 1 [0186.822] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.822] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x784, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.822] SetEndOfFile (hFile=0x100) returned 1 [0186.825] GetProcessHeap () returned 0x4e0000 [0186.825] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0186.825] GetProcessHeap () returned 0x4e0000 [0186.825] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0186.825] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18215_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18215_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18215_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18215_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0186.828] CloseHandle (hObject=0x100) returned 1 [0186.828] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cab3c00, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcbffbc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3cab3c00, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0x726, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18216_.WMF", cAlternateFileName="")) returned 1 [0186.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18216_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18216_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0186.830] GetProcessHeap () returned 0x4e0000 [0186.830] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0186.830] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0186.830] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0186.830] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xa, lpOverlapped=0x0) returned 1 [0186.834] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.834] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.834] GetProcessHeap () returned 0x4e0000 [0186.834] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0186.834] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0186.834] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.834] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0186.834] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0186.834] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0186.834] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0186.835] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0186.835] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0186.835] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.835] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.835] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.835] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x726, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x726, lpOverlapped=0x0) returned 1 [0186.835] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x730, dwBufLen=0x730 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x730) returned 1 [0186.835] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.835] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x730, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x730, lpOverlapped=0x0) returned 1 [0186.835] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.835] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x804, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.835] SetEndOfFile (hFile=0x100) returned 1 [0186.838] GetProcessHeap () returned 0x4e0000 [0186.838] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0186.838] GetProcessHeap () returned 0x4e0000 [0186.838] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0186.838] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18216_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18216_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18216_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18216_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0186.841] CloseHandle (hObject=0x100) returned 1 [0186.841] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ded1d00, ftCreationTime.dwHighDateTime=0x1bdcf1b, ftLastAccessTime.dwLowDateTime=0xbcbffbc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7ded1d00, ftLastWriteTime.dwHighDateTime=0x1bdcf1b, nFileSizeHigh=0x0, nFileSizeLow=0x1552, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18217_.WMF", cAlternateFileName="")) returned 1 [0186.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18217_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18217_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0186.847] GetProcessHeap () returned 0x4e0000 [0186.847] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0186.847] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0186.847] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0186.847] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xe, lpOverlapped=0x0) returned 1 [0186.851] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.851] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.851] GetProcessHeap () returned 0x4e0000 [0186.851] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0186.851] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0186.851] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.851] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0186.852] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0186.852] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0186.852] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0186.852] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0186.852] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0186.852] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.852] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.852] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.852] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1552, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x1552, lpOverlapped=0x0) returned 1 [0186.853] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1560, dwBufLen=0x1560 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1560) returned 1 [0186.853] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.854] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1560, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x1560, lpOverlapped=0x0) returned 1 [0186.854] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.854] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1634, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.854] SetEndOfFile (hFile=0x100) returned 1 [0186.857] GetProcessHeap () returned 0x4e0000 [0186.857] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0186.857] GetProcessHeap () returned 0x4e0000 [0186.857] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0186.857] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18217_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18217_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18217_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18217_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0186.859] CloseHandle (hObject=0x100) returned 1 [0186.860] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fcec000, ftCreationTime.dwHighDateTime=0x1bdcf1b, ftLastAccessTime.dwLowDateTime=0xbcc25d20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8fcec000, ftLastWriteTime.dwHighDateTime=0x1bdcf1b, nFileSizeHigh=0x0, nFileSizeLow=0x1212, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18218_.WMF", cAlternateFileName="")) returned 1 [0186.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18218_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18218_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0186.861] GetProcessHeap () returned 0x4e0000 [0186.861] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0186.862] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0186.862] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0186.862] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xe, lpOverlapped=0x0) returned 1 [0186.864] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.864] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.864] GetProcessHeap () returned 0x4e0000 [0186.864] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0186.864] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0186.864] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.864] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0186.865] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0186.865] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0186.865] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0186.865] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0186.865] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0186.865] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.865] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.865] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.865] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1212, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x1212, lpOverlapped=0x0) returned 1 [0186.866] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1220, dwBufLen=0x1220 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1220) returned 1 [0186.867] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.867] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x1220, lpOverlapped=0x0) returned 1 [0186.867] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.867] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x12f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.867] SetEndOfFile (hFile=0x100) returned 1 [0186.870] GetProcessHeap () returned 0x4e0000 [0186.870] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0186.870] GetProcessHeap () returned 0x4e0000 [0186.870] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0186.870] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18218_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18218_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18218_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18218_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0186.872] CloseHandle (hObject=0x100) returned 1 [0186.872] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f247600, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbcc25d20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4f247600, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0x1136, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18219_.WMF", cAlternateFileName="")) returned 1 [0186.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18219_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18219_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0186.874] GetProcessHeap () returned 0x4e0000 [0186.874] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0186.874] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0186.874] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0186.874] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xa, lpOverlapped=0x0) returned 1 [0186.877] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.877] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.877] GetProcessHeap () returned 0x4e0000 [0186.877] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0186.877] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0186.877] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.877] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0186.877] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0186.877] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0186.877] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0186.877] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0186.877] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0186.877] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.877] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.877] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.877] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1136, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x1136, lpOverlapped=0x0) returned 1 [0186.878] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1140, dwBufLen=0x1140 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1140) returned 1 [0186.878] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.878] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1140, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x1140, lpOverlapped=0x0) returned 1 [0186.879] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.879] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.879] SetEndOfFile (hFile=0x100) returned 1 [0186.881] GetProcessHeap () returned 0x4e0000 [0186.881] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0186.881] GetProcessHeap () returned 0x4e0000 [0186.881] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0186.881] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18219_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18219_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18219_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18219_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0186.883] CloseHandle (hObject=0x100) returned 1 [0186.883] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aadf500, ftCreationTime.dwHighDateTime=0x1bddca5, ftLastAccessTime.dwLowDateTime=0xbcc25d20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2aadf500, ftLastWriteTime.dwHighDateTime=0x1bddca5, nFileSizeHigh=0x0, nFileSizeLow=0x213c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18220_.WMF", cAlternateFileName="")) returned 1 [0186.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18220_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18220_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0186.885] GetProcessHeap () returned 0x4e0000 [0186.885] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0186.885] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0186.885] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0186.885] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0186.887] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.887] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.887] GetProcessHeap () returned 0x4e0000 [0186.887] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0186.887] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0186.887] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.887] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0186.888] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0186.888] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0186.888] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0186.888] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0186.888] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0186.888] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.889] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.889] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.889] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x213c, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x213c, lpOverlapped=0x0) returned 1 [0186.891] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x2140, dwBufLen=0x2140 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x2140) returned 1 [0186.891] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.891] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2140, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x2140, lpOverlapped=0x0) returned 1 [0186.891] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.891] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x2214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.891] SetEndOfFile (hFile=0x100) returned 1 [0186.896] GetProcessHeap () returned 0x4e0000 [0186.896] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0186.896] GetProcessHeap () returned 0x4e0000 [0186.896] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0186.896] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18220_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18220_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18220_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18220_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0186.898] CloseHandle (hObject=0x100) returned 1 [0186.899] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0346a00, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbcc25d20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa0346a00, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0x72c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18221_.WMF", cAlternateFileName="")) returned 1 [0186.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18221_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18221_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0186.901] GetProcessHeap () returned 0x4e0000 [0186.901] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0186.901] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0186.901] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0186.901] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0186.903] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.903] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.903] GetProcessHeap () returned 0x4e0000 [0186.904] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0186.904] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0186.904] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.904] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0186.904] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0186.904] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0186.904] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0186.904] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0186.904] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0186.904] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.904] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.904] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.905] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x72c, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x72c, lpOverlapped=0x0) returned 1 [0186.905] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x730, dwBufLen=0x730 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x730) returned 1 [0186.905] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.905] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x730, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x730, lpOverlapped=0x0) returned 1 [0186.905] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.905] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x804, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.905] SetEndOfFile (hFile=0x100) returned 1 [0186.908] GetProcessHeap () returned 0x4e0000 [0186.908] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0186.908] GetProcessHeap () returned 0x4e0000 [0186.908] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0186.908] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18221_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18221_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18221_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18221_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0186.910] CloseHandle (hObject=0x100) returned 1 [0186.910] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5a99400, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbcc25d20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb5a99400, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0x756, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18222_.WMF", cAlternateFileName="")) returned 1 [0186.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18222_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18222_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0186.912] GetProcessHeap () returned 0x4e0000 [0186.912] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0186.912] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0186.912] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0186.912] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xa, lpOverlapped=0x0) returned 1 [0186.915] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.915] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.916] GetProcessHeap () returned 0x4e0000 [0186.916] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0186.916] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0186.916] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.916] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0186.916] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0186.916] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0186.916] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0186.916] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0186.916] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0186.916] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.916] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.916] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.917] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x756, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x756, lpOverlapped=0x0) returned 1 [0186.917] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x760, dwBufLen=0x760 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x760) returned 1 [0186.917] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.917] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x760, lpOverlapped=0x0) returned 1 [0186.917] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.917] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.917] SetEndOfFile (hFile=0x100) returned 1 [0186.920] GetProcessHeap () returned 0x4e0000 [0186.920] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0186.920] GetProcessHeap () returned 0x4e0000 [0186.920] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0186.920] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18222_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18222_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18222_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18222_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0186.922] CloseHandle (hObject=0x100) returned 1 [0186.922] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ee4c100, ftCreationTime.dwHighDateTime=0x1bddb92, ftLastAccessTime.dwLowDateTime=0xbcc25d20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5ee4c100, ftLastWriteTime.dwHighDateTime=0x1bddb92, nFileSizeHigh=0x0, nFileSizeLow=0xc5a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18223_.WMF", cAlternateFileName="")) returned 1 [0186.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18223_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18223_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0186.924] GetProcessHeap () returned 0x4e0000 [0186.924] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0186.924] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0186.924] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0186.924] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x6, lpOverlapped=0x0) returned 1 [0186.926] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.926] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.926] GetProcessHeap () returned 0x4e0000 [0186.926] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0186.926] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0186.926] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.926] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0186.926] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0186.927] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0186.927] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0186.927] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0186.927] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0186.927] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.927] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.927] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.927] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xc5a, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xc5a, lpOverlapped=0x0) returned 1 [0186.927] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc60, dwBufLen=0xc60 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc60) returned 1 [0186.927] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.927] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc60, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xc60, lpOverlapped=0x0) returned 1 [0186.927] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.927] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xd34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.928] SetEndOfFile (hFile=0x100) returned 1 [0186.930] GetProcessHeap () returned 0x4e0000 [0186.930] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0186.930] GetProcessHeap () returned 0x4e0000 [0186.930] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0186.930] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18223_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18223_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18223_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18223_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0186.932] CloseHandle (hObject=0x100) returned 1 [0186.932] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9730600, ftCreationTime.dwHighDateTime=0x1bdcf21, ftLastAccessTime.dwLowDateTime=0xbcc4be80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa9730600, ftLastWriteTime.dwHighDateTime=0x1bdcf21, nFileSizeHigh=0x0, nFileSizeLow=0x680, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18224_.WMF", cAlternateFileName="")) returned 1 [0186.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18224_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18224_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0186.934] GetProcessHeap () returned 0x4e0000 [0186.934] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0186.934] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0186.934] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0186.934] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.934] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.934] GetProcessHeap () returned 0x4e0000 [0186.934] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0186.934] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0186.934] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.934] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0186.937] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0186.937] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0186.937] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0186.937] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0186.937] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0186.937] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.937] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.937] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.937] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x680, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x680, lpOverlapped=0x0) returned 1 [0186.937] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x680, dwBufLen=0x680 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x680) returned 1 [0186.937] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.938] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x680, lpOverlapped=0x0) returned 1 [0186.938] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.938] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x754, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.938] SetEndOfFile (hFile=0x100) returned 1 [0186.941] GetProcessHeap () returned 0x4e0000 [0186.941] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0186.941] GetProcessHeap () returned 0x4e0000 [0186.941] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0186.941] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18224_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18224_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18224_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18224_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0186.944] CloseHandle (hObject=0x100) returned 1 [0186.944] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2357bf00, ftCreationTime.dwHighDateTime=0x1bdcf23, ftLastAccessTime.dwLowDateTime=0xbcc4be80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2357bf00, ftLastWriteTime.dwHighDateTime=0x1bdcf23, nFileSizeHigh=0x0, nFileSizeLow=0xd10, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18225_.WMF", cAlternateFileName="")) returned 1 [0186.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18225_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18225_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0186.947] GetProcessHeap () returned 0x4e0000 [0186.947] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0186.947] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0186.947] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0186.947] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.947] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.947] GetProcessHeap () returned 0x4e0000 [0186.947] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0186.947] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0186.947] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.947] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0186.950] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0186.950] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0186.950] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0186.950] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0186.950] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0186.950] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.950] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.950] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.951] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xd10, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xd10, lpOverlapped=0x0) returned 1 [0186.951] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xd10, dwBufLen=0xd10 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xd10) returned 1 [0186.951] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.951] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xd10, lpOverlapped=0x0) returned 1 [0186.951] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.951] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xde4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.951] SetEndOfFile (hFile=0x100) returned 1 [0186.954] GetProcessHeap () returned 0x4e0000 [0186.954] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0186.954] GetProcessHeap () returned 0x4e0000 [0186.954] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0186.954] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18225_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18225_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18225_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18225_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0186.956] CloseHandle (hObject=0x100) returned 1 [0186.956] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d10e600, ftCreationTime.dwHighDateTime=0x1bdcf23, ftLastAccessTime.dwLowDateTime=0xbcc4be80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4d10e600, ftLastWriteTime.dwHighDateTime=0x1bdcf23, nFileSizeHigh=0x0, nFileSizeLow=0x7b4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18226_.WMF", cAlternateFileName="")) returned 1 [0186.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18226_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18226_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0186.958] GetProcessHeap () returned 0x4e0000 [0186.958] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0186.958] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0186.958] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0186.958] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xc, lpOverlapped=0x0) returned 1 [0186.960] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.960] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.960] GetProcessHeap () returned 0x4e0000 [0186.960] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0186.961] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0186.961] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.961] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0186.961] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0186.961] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0186.961] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0186.961] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0186.961] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0186.961] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.961] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.961] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.961] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7b4, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x7b4, lpOverlapped=0x0) returned 1 [0186.961] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x7c0, dwBufLen=0x7c0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x7c0) returned 1 [0186.961] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.962] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7c0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x7c0, lpOverlapped=0x0) returned 1 [0186.962] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.962] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x894, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.962] SetEndOfFile (hFile=0x100) returned 1 [0186.964] GetProcessHeap () returned 0x4e0000 [0186.965] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0186.965] GetProcessHeap () returned 0x4e0000 [0186.965] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0186.965] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18226_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18226_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18226_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18226_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0186.967] CloseHandle (hObject=0x100) returned 1 [0186.967] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83e4fd00, ftCreationTime.dwHighDateTime=0x1bdcf1f, ftLastAccessTime.dwLowDateTime=0xbcc4be80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x83e4fd00, ftLastWriteTime.dwHighDateTime=0x1bdcf1f, nFileSizeHigh=0x0, nFileSizeLow=0xdec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18227_.WMF", cAlternateFileName="")) returned 1 [0186.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18227_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18227_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0186.969] GetProcessHeap () returned 0x4e0000 [0186.969] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0186.969] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0186.969] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0186.969] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0186.971] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.971] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.971] GetProcessHeap () returned 0x4e0000 [0186.971] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0186.971] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0186.971] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.971] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0186.972] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0186.972] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0186.972] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0186.972] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0186.972] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0186.972] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.972] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.972] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.972] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xdec, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xdec, lpOverlapped=0x0) returned 1 [0186.972] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xdf0, dwBufLen=0xdf0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xdf0) returned 1 [0186.972] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.973] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xdf0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xdf0, lpOverlapped=0x0) returned 1 [0186.973] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.973] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xec4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.973] SetEndOfFile (hFile=0x100) returned 1 [0186.975] GetProcessHeap () returned 0x4e0000 [0186.975] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0186.976] GetProcessHeap () returned 0x4e0000 [0186.976] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0186.976] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18227_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18227_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18227_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18227_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0186.977] CloseHandle (hObject=0x100) returned 1 [0186.978] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb337000, ftCreationTime.dwHighDateTime=0x1bdcf22, ftLastAccessTime.dwLowDateTime=0xbcc4be80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb337000, ftLastWriteTime.dwHighDateTime=0x1bdcf22, nFileSizeHigh=0x0, nFileSizeLow=0x884, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18228_.WMF", cAlternateFileName="")) returned 1 [0186.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18228_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18228_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0186.979] GetProcessHeap () returned 0x4e0000 [0186.979] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0186.979] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0186.979] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0186.979] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xc, lpOverlapped=0x0) returned 1 [0186.981] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.981] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.981] GetProcessHeap () returned 0x4e0000 [0186.982] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0186.982] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0186.982] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.982] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0186.982] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0186.982] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0186.982] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0186.982] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0186.982] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0186.982] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.983] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.983] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.983] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x884, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x884, lpOverlapped=0x0) returned 1 [0186.983] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x890, dwBufLen=0x890 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x890) returned 1 [0186.983] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.983] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x890, lpOverlapped=0x0) returned 1 [0186.983] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.983] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x964, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.983] SetEndOfFile (hFile=0x100) returned 1 [0186.986] GetProcessHeap () returned 0x4e0000 [0186.986] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0186.986] GetProcessHeap () returned 0x4e0000 [0186.986] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0186.986] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18228_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18228_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18228_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18228_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0186.988] CloseHandle (hObject=0x100) returned 1 [0186.988] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3405b200, ftCreationTime.dwHighDateTime=0x1bdfe4c, ftLastAccessTime.dwLowDateTime=0xbcc4be80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3405b200, ftLastWriteTime.dwHighDateTime=0x1bdfe4c, nFileSizeHigh=0x0, nFileSizeLow=0x7e4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18229_.WMF", cAlternateFileName="")) returned 1 [0186.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18229_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18229_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0186.991] GetProcessHeap () returned 0x4e0000 [0186.991] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0186.991] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0186.991] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0186.991] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xc, lpOverlapped=0x0) returned 1 [0186.993] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.993] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.993] GetProcessHeap () returned 0x4e0000 [0186.993] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0186.993] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0186.993] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.993] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0186.993] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0186.994] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0186.994] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0186.994] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0186.994] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0186.994] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0186.994] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0186.994] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.994] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7e4, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x7e4, lpOverlapped=0x0) returned 1 [0186.994] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x7f0, dwBufLen=0x7f0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x7f0) returned 1 [0186.994] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.994] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x7f0, lpOverlapped=0x0) returned 1 [0186.994] CryptDestroyKey (hKey=0x522fd8) returned 1 [0186.994] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x8c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.995] SetEndOfFile (hFile=0x100) returned 1 [0186.997] GetProcessHeap () returned 0x4e0000 [0186.997] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0186.997] GetProcessHeap () returned 0x4e0000 [0186.997] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0186.997] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18229_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18229_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18229_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18229_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.000] CloseHandle (hObject=0x100) returned 1 [0187.000] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef2cd000, ftCreationTime.dwHighDateTime=0x1bdcf1b, ftLastAccessTime.dwLowDateTime=0xbcc4be80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xef2cd000, ftLastWriteTime.dwHighDateTime=0x1bdcf1b, nFileSizeHigh=0x0, nFileSizeLow=0x724, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18230_.WMF", cAlternateFileName="")) returned 1 [0187.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18230_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18230_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.001] GetProcessHeap () returned 0x4e0000 [0187.001] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.001] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.001] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.001] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xc, lpOverlapped=0x0) returned 1 [0187.004] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.004] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.004] GetProcessHeap () returned 0x4e0000 [0187.004] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.004] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.004] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.004] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.004] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.004] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.004] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.004] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.004] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.005] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.005] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.005] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.005] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x724, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x724, lpOverlapped=0x0) returned 1 [0187.005] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x730, dwBufLen=0x730 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x730) returned 1 [0187.005] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.005] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x730, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x730, lpOverlapped=0x0) returned 1 [0187.005] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.005] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x804, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.005] SetEndOfFile (hFile=0x100) returned 1 [0187.008] GetProcessHeap () returned 0x4e0000 [0187.008] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.008] GetProcessHeap () returned 0x4e0000 [0187.008] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.008] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18230_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18230_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18230_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18230_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.010] CloseHandle (hObject=0x100) returned 1 [0187.010] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfa3500, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcc71fe0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xcfa3500, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x67c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18231_.WMF", cAlternateFileName="")) returned 1 [0187.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18231_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18231_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.011] GetProcessHeap () returned 0x4e0000 [0187.011] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.011] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.011] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.012] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.014] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.014] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.014] GetProcessHeap () returned 0x4e0000 [0187.014] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.014] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.014] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.014] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.014] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.014] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.014] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.015] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.015] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.015] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.015] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.015] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.015] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x67c, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x67c, lpOverlapped=0x0) returned 1 [0187.015] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x680, dwBufLen=0x680 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x680) returned 1 [0187.015] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.015] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x680, lpOverlapped=0x0) returned 1 [0187.015] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.015] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x754, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.015] SetEndOfFile (hFile=0x100) returned 1 [0187.018] GetProcessHeap () returned 0x4e0000 [0187.018] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.018] GetProcessHeap () returned 0x4e0000 [0187.018] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.018] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18231_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18231_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18231_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18231_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.020] CloseHandle (hObject=0x100) returned 1 [0187.020] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4763d200, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcc71fe0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4763d200, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x66c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18232_.WMF", cAlternateFileName="")) returned 1 [0187.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18232_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18232_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.021] GetProcessHeap () returned 0x4e0000 [0187.022] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.022] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.022] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.022] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.024] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.024] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.024] GetProcessHeap () returned 0x4e0000 [0187.024] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.024] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.025] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.025] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.025] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.025] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.025] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.025] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.025] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.025] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.025] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.025] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.025] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x66c, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x66c, lpOverlapped=0x0) returned 1 [0187.025] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x670, dwBufLen=0x670 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x670) returned 1 [0187.025] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.026] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x670, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x670, lpOverlapped=0x0) returned 1 [0187.026] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.026] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x744, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.026] SetEndOfFile (hFile=0x100) returned 1 [0187.028] GetProcessHeap () returned 0x4e0000 [0187.029] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.029] GetProcessHeap () returned 0x4e0000 [0187.029] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.029] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18232_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18232_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18232_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18232_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.030] CloseHandle (hObject=0x100) returned 1 [0187.030] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a76a200, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcc71fe0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5a76a200, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x64c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18233_.WMF", cAlternateFileName="")) returned 1 [0187.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18233_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18233_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.032] GetProcessHeap () returned 0x4e0000 [0187.032] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.032] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.032] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.032] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.035] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.035] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.035] GetProcessHeap () returned 0x4e0000 [0187.035] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.035] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.035] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.035] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.035] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.035] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.035] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.035] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.035] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.036] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.036] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.036] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.036] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x64c, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x64c, lpOverlapped=0x0) returned 1 [0187.036] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x650, dwBufLen=0x650 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x650) returned 1 [0187.036] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.036] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x650, lpOverlapped=0x0) returned 1 [0187.036] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.036] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x724, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.036] SetEndOfFile (hFile=0x100) returned 1 [0187.039] GetProcessHeap () returned 0x4e0000 [0187.039] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.039] GetProcessHeap () returned 0x4e0000 [0187.039] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.039] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18233_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18233_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18233_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18233_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.040] CloseHandle (hObject=0x100) returned 1 [0187.041] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eba9f00, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcc71fe0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6eba9f00, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x754, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18234_.WMF", cAlternateFileName="")) returned 1 [0187.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18234_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.042] GetProcessHeap () returned 0x4e0000 [0187.042] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.042] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.042] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.042] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xc, lpOverlapped=0x0) returned 1 [0187.044] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.044] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.044] GetProcessHeap () returned 0x4e0000 [0187.044] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.044] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.044] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.044] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.045] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.045] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.045] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.045] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.045] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.045] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.045] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.045] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.045] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x754, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x754, lpOverlapped=0x0) returned 1 [0187.045] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x760, dwBufLen=0x760 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x760) returned 1 [0187.045] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.045] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x760, lpOverlapped=0x0) returned 1 [0187.046] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.046] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.046] SetEndOfFile (hFile=0x100) returned 1 [0187.048] GetProcessHeap () returned 0x4e0000 [0187.048] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.048] GetProcessHeap () returned 0x4e0000 [0187.048] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.048] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18234_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18234_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18234_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18234_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.050] CloseHandle (hObject=0x100) returned 1 [0187.050] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a25aa00, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcc71fe0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8a25aa00, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18235_.WMF", cAlternateFileName="")) returned 1 [0187.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18235_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.051] GetProcessHeap () returned 0x4e0000 [0187.051] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.051] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.051] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.051] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.053] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.053] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.053] GetProcessHeap () returned 0x4e0000 [0187.053] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.053] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.053] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.053] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.054] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.054] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.054] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.054] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.054] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.054] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.054] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.054] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.054] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x73c, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x73c, lpOverlapped=0x0) returned 1 [0187.054] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x740, dwBufLen=0x740 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x740) returned 1 [0187.054] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.054] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x740, lpOverlapped=0x0) returned 1 [0187.055] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.055] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.055] SetEndOfFile (hFile=0x100) returned 1 [0187.057] GetProcessHeap () returned 0x4e0000 [0187.057] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.057] GetProcessHeap () returned 0x4e0000 [0187.058] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.058] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18235_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18235_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18235_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18235_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.060] CloseHandle (hObject=0x100) returned 1 [0187.060] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f9ad400, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcc71fe0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9f9ad400, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x6d4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18236_.WMF", cAlternateFileName="")) returned 1 [0187.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18236_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18236_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.061] GetProcessHeap () returned 0x4e0000 [0187.061] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.061] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.061] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.061] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xc, lpOverlapped=0x0) returned 1 [0187.063] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.063] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.063] GetProcessHeap () returned 0x4e0000 [0187.063] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.063] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.064] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.064] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.064] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.064] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.064] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.064] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.064] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.064] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.064] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.064] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.064] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x6d4, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x6d4, lpOverlapped=0x0) returned 1 [0187.064] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x6e0, dwBufLen=0x6e0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x6e0) returned 1 [0187.065] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.065] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6e0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x6e0, lpOverlapped=0x0) returned 1 [0187.065] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.065] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x7b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.065] SetEndOfFile (hFile=0x100) returned 1 [0187.067] GetProcessHeap () returned 0x4e0000 [0187.068] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.068] GetProcessHeap () returned 0x4e0000 [0187.068] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.068] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18236_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18236_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18236_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18236_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.069] CloseHandle (hObject=0x100) returned 1 [0187.070] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29966d00, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcc98140, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x29966d00, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x5fc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18237_.WMF", cAlternateFileName="")) returned 1 [0187.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18237_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18237_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.072] GetProcessHeap () returned 0x4e0000 [0187.072] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.072] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.072] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.072] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.074] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.074] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.074] GetProcessHeap () returned 0x4e0000 [0187.074] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.074] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.074] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.074] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.075] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.075] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.075] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.075] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.075] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.075] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.075] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.075] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.076] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5fc, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x5fc, lpOverlapped=0x0) returned 1 [0187.076] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x600, dwBufLen=0x600 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x600) returned 1 [0187.076] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.076] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x600, lpOverlapped=0x0) returned 1 [0187.076] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.076] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x6d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.076] SetEndOfFile (hFile=0x100) returned 1 [0187.079] GetProcessHeap () returned 0x4e0000 [0187.079] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.079] GetProcessHeap () returned 0x4e0000 [0187.079] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.079] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18237_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18237_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18237_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18237_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.081] CloseHandle (hObject=0x100) returned 1 [0187.081] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb50ffe00, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcc98140, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb50ffe00, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x634, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18238_.WMF", cAlternateFileName="")) returned 1 [0187.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18238_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18238_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.082] GetProcessHeap () returned 0x4e0000 [0187.082] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.082] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.082] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.083] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xc, lpOverlapped=0x0) returned 1 [0187.085] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.085] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.085] GetProcessHeap () returned 0x4e0000 [0187.085] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.085] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.085] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.085] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.085] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.085] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.085] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.086] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.086] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.086] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.086] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.086] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.086] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x634, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x634, lpOverlapped=0x0) returned 1 [0187.086] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x640, dwBufLen=0x640 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x640) returned 1 [0187.086] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.086] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x640, lpOverlapped=0x0) returned 1 [0187.086] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.086] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.086] SetEndOfFile (hFile=0x100) returned 1 [0187.088] GetProcessHeap () returned 0x4e0000 [0187.088] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.088] GetProcessHeap () returned 0x4e0000 [0187.088] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.088] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18238_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18238_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18238_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18238_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.091] CloseHandle (hObject=0x100) returned 1 [0187.091] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9086900, ftCreationTime.dwHighDateTime=0x1bddcaa, ftLastAccessTime.dwLowDateTime=0xbcc98140, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd9086900, ftLastWriteTime.dwHighDateTime=0x1bddcaa, nFileSizeHigh=0x0, nFileSizeLow=0x93c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18239_.WMF", cAlternateFileName="")) returned 1 [0187.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18239_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18239_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.092] GetProcessHeap () returned 0x4e0000 [0187.092] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.092] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.092] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.092] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xc, lpOverlapped=0x0) returned 1 [0187.094] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.094] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.094] GetProcessHeap () returned 0x4e0000 [0187.094] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.094] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.094] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.094] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.094] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.094] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.094] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.094] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.094] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.094] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.094] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.094] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.095] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x93c4, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x93c4, lpOverlapped=0x0) returned 1 [0187.096] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x93d0, dwBufLen=0x93d0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x93d0) returned 1 [0187.096] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.096] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x93d0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x93d0, lpOverlapped=0x0) returned 1 [0187.096] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.096] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x94a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.096] SetEndOfFile (hFile=0x100) returned 1 [0187.098] GetProcessHeap () returned 0x4e0000 [0187.099] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.099] GetProcessHeap () returned 0x4e0000 [0187.099] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.099] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18239_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18239_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18239_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18239_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.100] CloseHandle (hObject=0x100) returned 1 [0187.100] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2305400, ftCreationTime.dwHighDateTime=0x1bddca6, ftLastAccessTime.dwLowDateTime=0xbcc98140, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa2305400, ftLastWriteTime.dwHighDateTime=0x1bddca6, nFileSizeHigh=0x0, nFileSizeLow=0xac8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18241_.WMF", cAlternateFileName="")) returned 1 [0187.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18241_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18241_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.101] GetProcessHeap () returned 0x4e0000 [0187.101] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.101] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.101] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.101] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.103] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.103] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.103] GetProcessHeap () returned 0x4e0000 [0187.103] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.103] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.103] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.103] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.103] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.103] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.103] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.103] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.103] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.104] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.104] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.104] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.104] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xac8, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xac8, lpOverlapped=0x0) returned 1 [0187.104] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xad0, dwBufLen=0xad0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xad0) returned 1 [0187.104] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.104] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xad0, lpOverlapped=0x0) returned 1 [0187.104] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.104] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xba4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.104] SetEndOfFile (hFile=0x100) returned 1 [0187.108] GetProcessHeap () returned 0x4e0000 [0187.108] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.108] GetProcessHeap () returned 0x4e0000 [0187.108] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.108] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18241_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18241_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18241_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18241_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.109] CloseHandle (hObject=0x100) returned 1 [0187.109] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a42b600, ftCreationTime.dwHighDateTime=0x1bdcf1d, ftLastAccessTime.dwLowDateTime=0xbcc98140, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6a42b600, ftLastWriteTime.dwHighDateTime=0x1bdcf1d, nFileSizeHigh=0x0, nFileSizeLow=0x822, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18242_.WMF", cAlternateFileName="")) returned 1 [0187.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18242_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.111] GetProcessHeap () returned 0x4e0000 [0187.111] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.111] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.111] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.111] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xe, lpOverlapped=0x0) returned 1 [0187.112] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.112] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.112] GetProcessHeap () returned 0x4e0000 [0187.112] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.112] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.112] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.112] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.113] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.113] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.113] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.113] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.113] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.113] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.113] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.113] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.113] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x822, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x822, lpOverlapped=0x0) returned 1 [0187.113] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x830, dwBufLen=0x830 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x830) returned 1 [0187.113] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.113] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x830, lpOverlapped=0x0) returned 1 [0187.113] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.113] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x904, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.113] SetEndOfFile (hFile=0x100) returned 1 [0187.115] GetProcessHeap () returned 0x4e0000 [0187.115] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.115] GetProcessHeap () returned 0x4e0000 [0187.115] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.115] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18242_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18242_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18242_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18242_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.117] CloseHandle (hObject=0x100) returned 1 [0187.117] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fb7e000, ftCreationTime.dwHighDateTime=0x1bdcf1d, ftLastAccessTime.dwLowDateTime=0xbcc98140, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7fb7e000, ftLastWriteTime.dwHighDateTime=0x1bdcf1d, nFileSizeHigh=0x0, nFileSizeLow=0x822, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18243_.WMF", cAlternateFileName="")) returned 1 [0187.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18243_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18243_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.118] GetProcessHeap () returned 0x4e0000 [0187.118] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.118] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.118] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.118] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xe, lpOverlapped=0x0) returned 1 [0187.119] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.120] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.120] GetProcessHeap () returned 0x4e0000 [0187.120] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.120] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.120] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.120] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.120] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.120] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.120] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.120] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.120] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.120] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.120] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.120] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.120] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x822, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x822, lpOverlapped=0x0) returned 1 [0187.120] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x830, dwBufLen=0x830 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x830) returned 1 [0187.120] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.120] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x830, lpOverlapped=0x0) returned 1 [0187.120] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.120] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x904, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.121] SetEndOfFile (hFile=0x100) returned 1 [0187.123] GetProcessHeap () returned 0x4e0000 [0187.123] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.123] GetProcessHeap () returned 0x4e0000 [0187.123] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.123] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18243_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18243_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18243_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18243_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.124] CloseHandle (hObject=0x100) returned 1 [0187.124] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d151300, ftCreationTime.dwHighDateTime=0x1bdcf22, ftLastAccessTime.dwLowDateTime=0xbcc98140, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1d151300, ftLastWriteTime.dwHighDateTime=0x1bdcf22, nFileSizeHigh=0x0, nFileSizeLow=0x6ec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18244_.WMF", cAlternateFileName="")) returned 1 [0187.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18244_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18244_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.125] GetProcessHeap () returned 0x4e0000 [0187.125] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.125] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.125] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.125] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.127] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.127] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.127] GetProcessHeap () returned 0x4e0000 [0187.127] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.127] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.128] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.128] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.128] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.128] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.128] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.128] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.128] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.128] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.128] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.128] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.128] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x6ec, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x6ec, lpOverlapped=0x0) returned 1 [0187.128] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x6f0, dwBufLen=0x6f0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x6f0) returned 1 [0187.128] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.128] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6f0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x6f0, lpOverlapped=0x0) returned 1 [0187.128] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.128] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x7c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.128] SetEndOfFile (hFile=0x100) returned 1 [0187.130] GetProcessHeap () returned 0x4e0000 [0187.130] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.130] GetProcessHeap () returned 0x4e0000 [0187.130] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.131] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18244_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18244_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18244_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18244_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.132] CloseHandle (hObject=0x100) returned 1 [0187.132] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3027e300, ftCreationTime.dwHighDateTime=0x1bdcf22, ftLastAccessTime.dwLowDateTime=0xbccbe2a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3027e300, ftLastWriteTime.dwHighDateTime=0x1bdcf22, nFileSizeHigh=0x0, nFileSizeLow=0xea2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18245_.WMF", cAlternateFileName="")) returned 1 [0187.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18245_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18245_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.132] GetProcessHeap () returned 0x4e0000 [0187.133] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.133] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.133] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.133] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xe, lpOverlapped=0x0) returned 1 [0187.134] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.134] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.134] GetProcessHeap () returned 0x4e0000 [0187.134] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.134] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.134] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.135] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.135] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.135] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.135] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.135] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.135] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.135] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.135] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.135] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.135] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xea2, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xea2, lpOverlapped=0x0) returned 1 [0187.135] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xeb0, dwBufLen=0xeb0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xeb0) returned 1 [0187.135] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.135] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xeb0, lpOverlapped=0x0) returned 1 [0187.135] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.135] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xf84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.135] SetEndOfFile (hFile=0x100) returned 1 [0187.137] GetProcessHeap () returned 0x4e0000 [0187.137] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.138] GetProcessHeap () returned 0x4e0000 [0187.138] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.138] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18245_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18245_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18245_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18245_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.139] CloseHandle (hObject=0x100) returned 1 [0187.139] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc4feb00, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbccbe2a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xcc4feb00, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0xa28, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18246_.WMF", cAlternateFileName="")) returned 1 [0187.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18246_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18246_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.140] GetProcessHeap () returned 0x4e0000 [0187.140] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.140] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.140] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.140] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.142] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.142] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.142] GetProcessHeap () returned 0x4e0000 [0187.142] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.142] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.142] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.142] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.142] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.142] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.142] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.143] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.143] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.143] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.143] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.143] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.143] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xa28, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xa28, lpOverlapped=0x0) returned 1 [0187.143] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xa30, dwBufLen=0xa30 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xa30) returned 1 [0187.143] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.143] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xa30, lpOverlapped=0x0) returned 1 [0187.143] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.143] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xb04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.143] SetEndOfFile (hFile=0x100) returned 1 [0187.145] GetProcessHeap () returned 0x4e0000 [0187.145] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.145] GetProcessHeap () returned 0x4e0000 [0187.145] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.145] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18246_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18246_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18246_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18246_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.146] CloseHandle (hObject=0x100) returned 1 [0187.146] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba237c00, ftCreationTime.dwHighDateTime=0x1bdcf21, ftLastAccessTime.dwLowDateTime=0xbccbe2a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xba237c00, ftLastWriteTime.dwHighDateTime=0x1bdcf21, nFileSizeHigh=0x0, nFileSizeLow=0xd68, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18247_.WMF", cAlternateFileName="")) returned 1 [0187.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18247_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18247_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.147] GetProcessHeap () returned 0x4e0000 [0187.147] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.147] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.147] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.147] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.149] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.149] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.149] GetProcessHeap () returned 0x4e0000 [0187.149] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.149] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.149] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.149] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.149] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.149] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.149] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.149] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.149] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.149] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.149] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.149] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.149] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xd68, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xd68, lpOverlapped=0x0) returned 1 [0187.149] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xd70, dwBufLen=0xd70 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xd70) returned 1 [0187.150] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.150] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xd70, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xd70, lpOverlapped=0x0) returned 1 [0187.150] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.150] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xe44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.150] SetEndOfFile (hFile=0x100) returned 1 [0187.152] GetProcessHeap () returned 0x4e0000 [0187.152] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.152] GetProcessHeap () returned 0x4e0000 [0187.152] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.152] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18247_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18247_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18247_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18247_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.153] CloseHandle (hObject=0x100) returned 1 [0187.153] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd364c00, ftCreationTime.dwHighDateTime=0x1bdcf21, ftLastAccessTime.dwLowDateTime=0xbccbe2a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xcd364c00, ftLastWriteTime.dwHighDateTime=0x1bdcf21, nFileSizeHigh=0x0, nFileSizeLow=0xd70, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18248_.WMF", cAlternateFileName="")) returned 1 [0187.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18248_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18248_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.154] GetProcessHeap () returned 0x4e0000 [0187.154] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.154] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.154] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.154] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.154] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.154] GetProcessHeap () returned 0x4e0000 [0187.154] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.154] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.154] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.154] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.155] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.156] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.156] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.156] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.156] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.156] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.156] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.156] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.156] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xd70, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xd70, lpOverlapped=0x0) returned 1 [0187.156] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xd70, dwBufLen=0xd70 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xd70) returned 1 [0187.156] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.156] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xd70, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xd70, lpOverlapped=0x0) returned 1 [0187.156] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.156] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xe44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.156] SetEndOfFile (hFile=0x100) returned 1 [0187.158] GetProcessHeap () returned 0x4e0000 [0187.158] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.158] GetProcessHeap () returned 0x4e0000 [0187.158] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.158] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18248_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18248_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18248_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18248_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.159] CloseHandle (hObject=0x100) returned 1 [0187.159] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b2f4300, ftCreationTime.dwHighDateTime=0x1bdcf23, ftLastAccessTime.dwLowDateTime=0xbccbe2a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3b2f4300, ftLastWriteTime.dwHighDateTime=0x1bdcf23, nFileSizeHigh=0x0, nFileSizeLow=0x8a4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18249_.WMF", cAlternateFileName="")) returned 1 [0187.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18249_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18249_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.160] GetProcessHeap () returned 0x4e0000 [0187.160] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.160] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.160] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.160] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xc, lpOverlapped=0x0) returned 1 [0187.217] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.217] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.217] GetProcessHeap () returned 0x4e0000 [0187.217] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.217] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.217] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.218] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.218] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.218] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.218] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.218] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.218] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.219] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.219] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.219] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.219] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x8a4, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x8a4, lpOverlapped=0x0) returned 1 [0187.219] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x8b0, dwBufLen=0x8b0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x8b0) returned 1 [0187.219] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.219] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x8b0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x8b0, lpOverlapped=0x0) returned 1 [0187.219] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.219] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x984, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.219] SetEndOfFile (hFile=0x100) returned 1 [0187.222] GetProcessHeap () returned 0x4e0000 [0187.222] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.222] GetProcessHeap () returned 0x4e0000 [0187.222] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.222] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18249_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18249_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18249_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18249_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.227] CloseHandle (hObject=0x100) returned 1 [0187.227] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf17ef00, ftCreationTime.dwHighDateTime=0x1bdcf21, ftLastAccessTime.dwLowDateTime=0xbccbe2a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdf17ef00, ftLastWriteTime.dwHighDateTime=0x1bdcf21, nFileSizeHigh=0x0, nFileSizeLow=0x142e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18250_.WMF", cAlternateFileName="")) returned 1 [0187.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18250_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18250_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.230] GetProcessHeap () returned 0x4e0000 [0187.230] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.230] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.230] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.230] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x2, lpOverlapped=0x0) returned 1 [0187.232] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.232] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.232] GetProcessHeap () returned 0x4e0000 [0187.232] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.232] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.232] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.232] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.232] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.233] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.233] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.233] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.233] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.233] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.233] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.233] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.233] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x142e, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x142e, lpOverlapped=0x0) returned 1 [0187.234] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1430, dwBufLen=0x1430 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1430) returned 1 [0187.234] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.234] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1430, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x1430, lpOverlapped=0x0) returned 1 [0187.234] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.234] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1504, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.234] SetEndOfFile (hFile=0x100) returned 1 [0187.237] GetProcessHeap () returned 0x4e0000 [0187.237] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.237] GetProcessHeap () returned 0x4e0000 [0187.237] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.237] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18250_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18250_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18250_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18250_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.239] CloseHandle (hObject=0x100) returned 1 [0187.239] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefc86500, ftCreationTime.dwHighDateTime=0x1bdcf21, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xefc86500, ftLastWriteTime.dwHighDateTime=0x1bdcf21, nFileSizeHigh=0x0, nFileSizeLow=0x90c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18251_.WMF", cAlternateFileName="")) returned 1 [0187.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18251_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18251_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.241] GetProcessHeap () returned 0x4e0000 [0187.241] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.241] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.241] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.241] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.243] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.243] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.243] GetProcessHeap () returned 0x4e0000 [0187.243] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.243] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.243] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.243] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.243] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.243] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.243] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.244] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.244] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.244] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.244] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.244] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.244] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x90c, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x90c, lpOverlapped=0x0) returned 1 [0187.244] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x910, dwBufLen=0x910 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x910) returned 1 [0187.244] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.244] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x910, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x910, lpOverlapped=0x0) returned 1 [0187.244] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.244] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x9e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.244] SetEndOfFile (hFile=0x100) returned 1 [0187.247] GetProcessHeap () returned 0x4e0000 [0187.247] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.247] GetProcessHeap () returned 0x4e0000 [0187.247] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.247] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18251_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18251_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18251_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18251_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.249] CloseHandle (hObject=0x100) returned 1 [0187.249] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8ec2300, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe8ec2300, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0x756, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18252_.WMF", cAlternateFileName="")) returned 1 [0187.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18252_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18252_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.250] GetProcessHeap () returned 0x4e0000 [0187.250] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.251] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.251] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.251] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xa, lpOverlapped=0x0) returned 1 [0187.259] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.259] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.259] GetProcessHeap () returned 0x4e0000 [0187.259] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.259] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.259] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.259] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.259] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.260] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.260] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.260] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.260] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.260] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.260] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.260] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.260] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x756, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x756, lpOverlapped=0x0) returned 1 [0187.260] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x760, dwBufLen=0x760 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x760) returned 1 [0187.260] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.260] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x760, lpOverlapped=0x0) returned 1 [0187.260] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.260] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.261] SetEndOfFile (hFile=0x100) returned 1 [0187.263] GetProcessHeap () returned 0x4e0000 [0187.264] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.264] GetProcessHeap () returned 0x4e0000 [0187.264] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.264] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18252_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18252_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18252_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18252_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.266] CloseHandle (hObject=0x100) returned 1 [0187.266] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb803b00, ftCreationTime.dwHighDateTime=0x1bdcf23, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb803b00, ftLastWriteTime.dwHighDateTime=0x1bdcf23, nFileSizeHigh=0x0, nFileSizeLow=0x6ac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18253_.WMF", cAlternateFileName="")) returned 1 [0187.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18253_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18253_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.267] GetProcessHeap () returned 0x4e0000 [0187.267] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.268] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.268] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.268] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.270] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.270] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.270] GetProcessHeap () returned 0x4e0000 [0187.270] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.270] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.270] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.270] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.270] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.270] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.271] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.271] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.271] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.271] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.271] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.271] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.271] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x6ac, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x6ac, lpOverlapped=0x0) returned 1 [0187.271] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x6b0, dwBufLen=0x6b0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x6b0) returned 1 [0187.271] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.271] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x6b0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x6b0, lpOverlapped=0x0) returned 1 [0187.271] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.271] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x784, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.271] SetEndOfFile (hFile=0x100) returned 1 [0187.274] GetProcessHeap () returned 0x4e0000 [0187.274] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.274] GetProcessHeap () returned 0x4e0000 [0187.274] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.274] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18253_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18253_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18253_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18253_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.276] CloseHandle (hObject=0x100) returned 1 [0187.276] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bca4100, ftCreationTime.dwHighDateTime=0x1bddcab, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1bca4100, ftLastWriteTime.dwHighDateTime=0x1bddcab, nFileSizeHigh=0x0, nFileSizeLow=0x796, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18254_.WMF", cAlternateFileName="")) returned 1 [0187.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18254_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18254_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.278] GetProcessHeap () returned 0x4e0000 [0187.278] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.278] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.278] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.279] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xa, lpOverlapped=0x0) returned 1 [0187.280] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.281] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.281] GetProcessHeap () returned 0x4e0000 [0187.281] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.281] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.281] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.281] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.281] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.281] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.281] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.281] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.281] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.281] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.281] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.281] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.281] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x796, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x796, lpOverlapped=0x0) returned 1 [0187.282] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x7a0, dwBufLen=0x7a0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x7a0) returned 1 [0187.282] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.282] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x7a0, lpOverlapped=0x0) returned 1 [0187.282] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.282] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x874, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.282] SetEndOfFile (hFile=0x100) returned 1 [0187.285] GetProcessHeap () returned 0x4e0000 [0187.285] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.285] GetProcessHeap () returned 0x4e0000 [0187.285] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.285] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18254_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18254_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18254_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18254_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.286] CloseHandle (hObject=0x100) returned 1 [0187.286] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55feb900, ftCreationTime.dwHighDateTime=0x1bdcf1d, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x55feb900, ftLastWriteTime.dwHighDateTime=0x1bdcf1d, nFileSizeHigh=0x0, nFileSizeLow=0x822, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18255_.WMF", cAlternateFileName="")) returned 1 [0187.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18255_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18255_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.287] GetProcessHeap () returned 0x4e0000 [0187.288] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.288] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.288] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.288] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xe, lpOverlapped=0x0) returned 1 [0187.290] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.290] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.290] GetProcessHeap () returned 0x4e0000 [0187.290] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.290] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.290] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.290] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.290] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.290] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.290] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.290] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.290] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.291] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.291] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.291] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.291] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x822, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x822, lpOverlapped=0x0) returned 1 [0187.291] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x830, dwBufLen=0x830 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x830) returned 1 [0187.291] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.291] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x830, lpOverlapped=0x0) returned 1 [0187.291] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.291] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x904, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.291] SetEndOfFile (hFile=0x100) returned 1 [0187.294] GetProcessHeap () returned 0x4e0000 [0187.294] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.294] GetProcessHeap () returned 0x4e0000 [0187.294] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.294] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18255_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18255_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18255_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18255_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.296] CloseHandle (hObject=0x100) returned 1 [0187.296] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7a21700, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd7a21700, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x8ac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18256_.WMF", cAlternateFileName="")) returned 1 [0187.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18256_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18256_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.297] GetProcessHeap () returned 0x4e0000 [0187.297] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.297] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.297] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.297] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.299] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.299] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.299] GetProcessHeap () returned 0x4e0000 [0187.299] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.299] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.299] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.299] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.299] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.300] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.300] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.300] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.300] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.300] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.300] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.300] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.300] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x8ac, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x8ac, lpOverlapped=0x0) returned 1 [0187.300] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x8b0, dwBufLen=0x8b0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x8b0) returned 1 [0187.300] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.300] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x8b0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x8b0, lpOverlapped=0x0) returned 1 [0187.300] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.301] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x984, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.301] SetEndOfFile (hFile=0x100) returned 1 [0187.303] GetProcessHeap () returned 0x4e0000 [0187.303] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.303] GetProcessHeap () returned 0x4e0000 [0187.303] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.303] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18256_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18256_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18256_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18256_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.305] CloseHandle (hObject=0x100) returned 1 [0187.305] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd83b2900, ftCreationTime.dwHighDateTime=0x1bdfe4b, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd83b2900, ftLastWriteTime.dwHighDateTime=0x1bdfe4b, nFileSizeHigh=0x0, nFileSizeLow=0x12ea, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18257_.WMF", cAlternateFileName="")) returned 1 [0187.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18257_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18257_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.306] GetProcessHeap () returned 0x4e0000 [0187.306] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.306] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.306] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.306] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x6, lpOverlapped=0x0) returned 1 [0187.308] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.308] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.308] GetProcessHeap () returned 0x4e0000 [0187.308] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.308] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.308] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.309] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.309] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.309] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.309] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.309] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.309] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.309] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.309] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.309] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.309] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x12ea, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x12ea, lpOverlapped=0x0) returned 1 [0187.310] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x12f0, dwBufLen=0x12f0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x12f0) returned 1 [0187.310] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.310] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x12f0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x12f0, lpOverlapped=0x0) returned 1 [0187.311] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.311] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x13c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.311] SetEndOfFile (hFile=0x100) returned 1 [0187.313] GetProcessHeap () returned 0x4e0000 [0187.313] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.313] GetProcessHeap () returned 0x4e0000 [0187.313] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.313] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18257_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18257_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18257_.WMF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18257_.wmf.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.315] CloseHandle (hObject=0x100) returned 1 [0187.315] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd83b2900, ftCreationTime.dwHighDateTime=0x1bdfe4b, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd83b2900, ftLastWriteTime.dwHighDateTime=0x1bdfe4b, nFileSizeHigh=0x0, nFileSizeLow=0x12ea, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD18257_.WMF", cAlternateFileName="")) returned 0 [0187.315] GetProcessHeap () returned 0x4e0000 [0187.315] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.315] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0187.315] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df020 | out: pbData=0x4f53d8, pdwDataLen=0x24df020) returned 1 [0187.315] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.315] GetProcessHeap () returned 0x4e0000 [0187.315] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0187.315] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0187.315] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df020 | out: pbData=0x4f5420, pdwDataLen=0x24df020) returned 1 [0187.315] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.316] GetProcessHeap () returned 0x4e0000 [0187.316] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x53a538 [0187.316] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0187.316] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x53a538, pdwDataLen=0x24df020 | out: pbData=0x53a538, pdwDataLen=0x24df020) returned 1 [0187.316] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.316] wsprintfW (in: param_1=0x24ddffc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\readme-warning.txt") returned 76 [0187.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\readme-warning.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.317] WriteFile (in: hFile=0x100, lpBuffer=0x53a538*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddff8, lpOverlapped=0x0 | out: lpBuffer=0x53a538*, lpNumberOfBytesWritten=0x24ddff8*=0x6c3, lpOverlapped=0x0) returned 1 [0187.318] CloseHandle (hObject=0x100) returned 1 [0187.318] GetProcessHeap () returned 0x4e0000 [0187.318] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x53a538 | out: hHeap=0x4e0000) returned 1 [0187.318] GetProcessHeap () returned 0x4e0000 [0187.318] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0187.318] GetProcessHeap () returned 0x4e0000 [0187.318] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.318] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0187.318] GetProcessHeap () returned 0x4e0000 [0187.318] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5229e8 | out: hHeap=0x4e0000) returned 1 [0187.318] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5178e0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbd42e760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd42e760, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BULLETS", cAlternateFileName="")) returned 1 [0187.318] GetProcessHeap () returned 0x4e0000 [0187.319] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x82) returned 0x4fa058 [0187.319] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5178e0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbd42e760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd42e760, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0187.321] GetProcessHeap () returned 0x4e0000 [0187.321] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa058 | out: hHeap=0x4e0000) returned 1 [0187.321] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5178e0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbd42e760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd42e760, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0187.322] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x992c8400, ftCreationTime.dwHighDateTime=0x1bd5de4, ftLastAccessTime.dwLowDateTime=0xbc847960, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x992c8400, ftLastWriteTime.dwHighDateTime=0x1bd5de4, nFileSizeHigh=0x0, nFileSizeLow=0x967, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD10253_.GIF", cAlternateFileName="")) returned 1 [0187.322] GetProcessHeap () returned 0x4e0000 [0187.322] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x284) returned 0x5229e8 [0187.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10253_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10253_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.324] GetProcessHeap () returned 0x4e0000 [0187.324] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.324] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.324] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.324] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x9, lpOverlapped=0x0) returned 1 [0187.327] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.327] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.327] GetProcessHeap () returned 0x4e0000 [0187.327] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.327] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.327] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.327] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.327] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.327] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.327] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.327] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.327] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.327] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.327] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.328] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.328] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x967, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x967, lpOverlapped=0x0) returned 1 [0187.328] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x970, dwBufLen=0x970 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x970) returned 1 [0187.328] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.328] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x970, lpOverlapped=0x0) returned 1 [0187.328] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.328] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xa44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.328] SetEndOfFile (hFile=0x100) returned 1 [0187.331] GetProcessHeap () returned 0x4e0000 [0187.331] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.331] GetProcessHeap () returned 0x4e0000 [0187.331] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.331] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10253_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10253_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10253_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10253_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.332] CloseHandle (hObject=0x100) returned 1 [0187.332] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dec3400, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc847960, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5dec3400, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD10254_.GIF", cAlternateFileName="")) returned 1 [0187.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10254_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10254_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.334] GetProcessHeap () returned 0x4e0000 [0187.334] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.334] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.334] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.334] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.334] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.334] GetProcessHeap () returned 0x4e0000 [0187.334] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.334] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.334] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.334] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.336] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.336] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.336] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.336] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.336] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.336] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.336] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.336] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.336] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xf0, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xf0, lpOverlapped=0x0) returned 1 [0187.336] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xf0, dwBufLen=0xf0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xf0) returned 1 [0187.336] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.336] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xf0, lpOverlapped=0x0) returned 1 [0187.337] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.337] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.337] SetEndOfFile (hFile=0x100) returned 1 [0187.339] GetProcessHeap () returned 0x4e0000 [0187.339] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.339] GetProcessHeap () returned 0x4e0000 [0187.339] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.339] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10254_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10254_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10254_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10254_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.341] CloseHandle (hObject=0x100) returned 1 [0187.341] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f1d6100, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc847960, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5f1d6100, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD10255_.GIF", cAlternateFileName="")) returned 1 [0187.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10255_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10255_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.342] GetProcessHeap () returned 0x4e0000 [0187.342] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.342] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.342] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.342] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x6, lpOverlapped=0x0) returned 1 [0187.344] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.344] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.344] GetProcessHeap () returned 0x4e0000 [0187.344] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.344] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.344] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.344] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.344] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.344] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.344] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.344] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.344] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.344] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.344] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.344] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.344] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xea, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xea, lpOverlapped=0x0) returned 1 [0187.344] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xf0, dwBufLen=0xf0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xf0) returned 1 [0187.345] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.345] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xf0, lpOverlapped=0x0) returned 1 [0187.345] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.345] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.345] SetEndOfFile (hFile=0x100) returned 1 [0187.347] GetProcessHeap () returned 0x4e0000 [0187.347] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.347] GetProcessHeap () returned 0x4e0000 [0187.347] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.347] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10255_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10255_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10255_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10255_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.348] CloseHandle (hObject=0x100) returned 1 [0187.348] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe10b8b00, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc86dac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe10b8b00, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0x297, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD10263_.GIF", cAlternateFileName="")) returned 1 [0187.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10263_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10263_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.349] GetProcessHeap () returned 0x4e0000 [0187.349] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.349] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.349] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.349] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x9, lpOverlapped=0x0) returned 1 [0187.351] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.351] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.351] GetProcessHeap () returned 0x4e0000 [0187.351] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.351] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.351] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.351] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.351] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.351] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.351] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.351] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.351] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.351] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.351] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.351] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.352] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x297, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x297, lpOverlapped=0x0) returned 1 [0187.352] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x2a0, dwBufLen=0x2a0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x2a0) returned 1 [0187.352] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.352] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x2a0, lpOverlapped=0x0) returned 1 [0187.352] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.352] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x374, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.352] SetEndOfFile (hFile=0x100) returned 1 [0187.354] GetProcessHeap () returned 0x4e0000 [0187.354] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.354] GetProcessHeap () returned 0x4e0000 [0187.354] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.354] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10263_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10263_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10263_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10263_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.357] CloseHandle (hObject=0x100) returned 1 [0187.357] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe10b8b00, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc86dac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe10b8b00, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD10264_.GIF", cAlternateFileName="")) returned 1 [0187.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10264_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10264_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.357] GetProcessHeap () returned 0x4e0000 [0187.357] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.358] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.358] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.358] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x7, lpOverlapped=0x0) returned 1 [0187.359] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.359] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.359] GetProcessHeap () returned 0x4e0000 [0187.359] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.359] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.359] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.359] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.359] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.359] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.359] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.359] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.359] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.359] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.359] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.360] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.360] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb9, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xb9, lpOverlapped=0x0) returned 1 [0187.360] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0, dwBufLen=0xc0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0) returned 1 [0187.360] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.360] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xc0, lpOverlapped=0x0) returned 1 [0187.360] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.360] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.360] SetEndOfFile (hFile=0x100) returned 1 [0187.362] GetProcessHeap () returned 0x4e0000 [0187.362] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.362] GetProcessHeap () returned 0x4e0000 [0187.362] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.362] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10264_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10264_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10264_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10264_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.363] CloseHandle (hObject=0x100) returned 1 [0187.363] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe10b8b00, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc86dac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe10b8b00, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0x134, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD10265_.GIF", cAlternateFileName="")) returned 1 [0187.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10265_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10265_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.364] GetProcessHeap () returned 0x4e0000 [0187.364] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.364] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.364] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.364] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xc, lpOverlapped=0x0) returned 1 [0187.365] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.365] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.365] GetProcessHeap () returned 0x4e0000 [0187.365] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.366] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.366] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.366] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.366] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.366] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.366] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.366] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.366] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.366] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.366] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.366] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.366] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x134, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x134, lpOverlapped=0x0) returned 1 [0187.366] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x140, dwBufLen=0x140 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x140) returned 1 [0187.366] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.366] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x140, lpOverlapped=0x0) returned 1 [0187.366] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.366] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.366] SetEndOfFile (hFile=0x100) returned 1 [0187.368] GetProcessHeap () returned 0x4e0000 [0187.368] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.368] GetProcessHeap () returned 0x4e0000 [0187.368] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.369] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10265_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10265_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10265_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10265_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.424] CloseHandle (hObject=0x100) returned 1 [0187.425] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe23cb800, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc86dac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe23cb800, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0xb1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD10266_.GIF", cAlternateFileName="")) returned 1 [0187.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10266_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10266_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.426] GetProcessHeap () returned 0x4e0000 [0187.426] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.426] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.426] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.426] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xf, lpOverlapped=0x0) returned 1 [0187.427] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.427] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.427] GetProcessHeap () returned 0x4e0000 [0187.428] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.428] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.428] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.428] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.428] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.428] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.428] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.428] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.428] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.428] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.428] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.428] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.428] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb1, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xb1, lpOverlapped=0x0) returned 1 [0187.428] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0, dwBufLen=0xc0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0) returned 1 [0187.428] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.428] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xc0, lpOverlapped=0x0) returned 1 [0187.428] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.428] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.429] SetEndOfFile (hFile=0x100) returned 1 [0187.431] GetProcessHeap () returned 0x4e0000 [0187.431] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.431] GetProcessHeap () returned 0x4e0000 [0187.431] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.431] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10266_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10266_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10266_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10266_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.432] CloseHandle (hObject=0x100) returned 1 [0187.432] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe23cb800, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc86dac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe23cb800, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0x137, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD10267_.GIF", cAlternateFileName="")) returned 1 [0187.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10267_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10267_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.433] GetProcessHeap () returned 0x4e0000 [0187.433] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.433] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.433] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.433] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x9, lpOverlapped=0x0) returned 1 [0187.435] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.435] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.435] GetProcessHeap () returned 0x4e0000 [0187.435] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.435] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.435] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.435] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.435] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.435] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.435] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.435] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.435] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.435] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.435] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.435] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.435] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x137, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x137, lpOverlapped=0x0) returned 1 [0187.435] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x140, dwBufLen=0x140 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x140) returned 1 [0187.435] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.435] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x140, lpOverlapped=0x0) returned 1 [0187.436] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.436] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.436] SetEndOfFile (hFile=0x100) returned 1 [0187.438] GetProcessHeap () returned 0x4e0000 [0187.438] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.438] GetProcessHeap () returned 0x4e0000 [0187.438] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.438] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10267_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10267_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10267_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10267_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.458] CloseHandle (hObject=0x100) returned 1 [0187.459] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe23cb800, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc86dac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe23cb800, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0xb1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD10268_.GIF", cAlternateFileName="")) returned 1 [0187.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10268_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10268_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.460] GetProcessHeap () returned 0x4e0000 [0187.460] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.460] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.460] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.460] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xf, lpOverlapped=0x0) returned 1 [0187.462] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.462] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.462] GetProcessHeap () returned 0x4e0000 [0187.462] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.462] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.462] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.462] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.463] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.463] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.463] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.463] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.463] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.463] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.463] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.463] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.463] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb1, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xb1, lpOverlapped=0x0) returned 1 [0187.463] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0, dwBufLen=0xc0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0) returned 1 [0187.463] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.463] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xc0, lpOverlapped=0x0) returned 1 [0187.464] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.464] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.464] SetEndOfFile (hFile=0x100) returned 1 [0187.467] GetProcessHeap () returned 0x4e0000 [0187.467] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.467] GetProcessHeap () returned 0x4e0000 [0187.467] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.467] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10268_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10268_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10268_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10268_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.469] CloseHandle (hObject=0x100) returned 1 [0187.469] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70656e00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc893c20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x70656e00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x46b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD10297_.GIF", cAlternateFileName="")) returned 1 [0187.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10297_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.471] GetProcessHeap () returned 0x4e0000 [0187.471] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.471] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.471] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.471] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x5, lpOverlapped=0x0) returned 1 [0187.473] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.473] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.473] GetProcessHeap () returned 0x4e0000 [0187.473] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.473] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.473] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.473] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.474] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.474] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.474] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.474] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.474] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.474] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.474] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.474] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.474] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x46b, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x46b, lpOverlapped=0x0) returned 1 [0187.474] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x470, dwBufLen=0x470 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x470) returned 1 [0187.474] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.474] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x470, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x470, lpOverlapped=0x0) returned 1 [0187.475] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.475] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x544, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.475] SetEndOfFile (hFile=0x100) returned 1 [0187.477] GetProcessHeap () returned 0x4e0000 [0187.477] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.477] GetProcessHeap () returned 0x4e0000 [0187.477] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.477] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10297_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10297_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.479] CloseHandle (hObject=0x100) returned 1 [0187.479] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70656e00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc893c20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x70656e00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x467, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD10298_.GIF", cAlternateFileName="")) returned 1 [0187.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10298_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.496] GetProcessHeap () returned 0x4e0000 [0187.496] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.496] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.496] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.496] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x9, lpOverlapped=0x0) returned 1 [0187.545] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.545] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.545] GetProcessHeap () returned 0x4e0000 [0187.545] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.545] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.545] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.545] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.545] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.545] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.545] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.546] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.546] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.546] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.546] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.546] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.546] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x467, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x467, lpOverlapped=0x0) returned 1 [0187.546] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x470, dwBufLen=0x470 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x470) returned 1 [0187.546] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.546] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x470, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x470, lpOverlapped=0x0) returned 1 [0187.546] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.546] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x544, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.546] SetEndOfFile (hFile=0x100) returned 1 [0187.549] GetProcessHeap () returned 0x4e0000 [0187.549] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.549] GetProcessHeap () returned 0x4e0000 [0187.549] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.549] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10298_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10298_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.551] CloseHandle (hObject=0x100) returned 1 [0187.551] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71969b00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc893c20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x71969b00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x13b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD10299_.GIF", cAlternateFileName="")) returned 1 [0187.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10299_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10299_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.554] GetProcessHeap () returned 0x4e0000 [0187.555] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.555] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.555] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.555] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x5, lpOverlapped=0x0) returned 1 [0187.556] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.556] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.557] GetProcessHeap () returned 0x4e0000 [0187.557] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.557] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.557] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.557] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.557] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.557] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.557] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.557] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.557] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.557] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.557] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.557] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.557] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x13b, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x13b, lpOverlapped=0x0) returned 1 [0187.558] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x140, dwBufLen=0x140 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x140) returned 1 [0187.558] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.558] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x140, lpOverlapped=0x0) returned 1 [0187.558] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.558] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.558] SetEndOfFile (hFile=0x100) returned 1 [0187.561] GetProcessHeap () returned 0x4e0000 [0187.561] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.561] GetProcessHeap () returned 0x4e0000 [0187.561] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.561] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10299_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10299_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10299_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10299_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.565] CloseHandle (hObject=0x100) returned 1 [0187.565] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71969b00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc893c20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x71969b00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x105, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD10300_.GIF", cAlternateFileName="")) returned 1 [0187.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10300_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10300_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.567] GetProcessHeap () returned 0x4e0000 [0187.567] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.567] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.567] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.567] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xb, lpOverlapped=0x0) returned 1 [0187.569] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.569] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.569] GetProcessHeap () returned 0x4e0000 [0187.569] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.569] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.569] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.569] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.569] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.569] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.569] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.569] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.570] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.570] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.570] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.570] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.570] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x105, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x105, lpOverlapped=0x0) returned 1 [0187.570] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x110, dwBufLen=0x110 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x110) returned 1 [0187.570] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.570] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x110, lpOverlapped=0x0) returned 1 [0187.570] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.570] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.570] SetEndOfFile (hFile=0x100) returned 1 [0187.573] GetProcessHeap () returned 0x4e0000 [0187.573] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.573] GetProcessHeap () returned 0x4e0000 [0187.573] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.573] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10300_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10300_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10300_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10300_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.575] CloseHandle (hObject=0x100) returned 1 [0187.575] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71969b00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc893c20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x71969b00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD10301_.GIF", cAlternateFileName="")) returned 1 [0187.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10301_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10301_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.577] GetProcessHeap () returned 0x4e0000 [0187.577] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.577] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.577] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.577] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x7, lpOverlapped=0x0) returned 1 [0187.578] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.578] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.578] GetProcessHeap () returned 0x4e0000 [0187.578] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.578] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.579] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.579] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.579] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.579] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.579] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.579] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.579] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.579] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.579] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.579] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.579] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x109, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x109, lpOverlapped=0x0) returned 1 [0187.579] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x110, dwBufLen=0x110 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x110) returned 1 [0187.579] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.580] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x110, lpOverlapped=0x0) returned 1 [0187.580] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.580] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.580] SetEndOfFile (hFile=0x100) returned 1 [0187.582] GetProcessHeap () returned 0x4e0000 [0187.582] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.582] GetProcessHeap () returned 0x4e0000 [0187.582] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.582] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10301_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10301_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10301_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10301_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.584] CloseHandle (hObject=0x100) returned 1 [0187.584] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72c7c800, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc8b9d80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x72c7c800, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xfd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD10302_.GIF", cAlternateFileName="")) returned 1 [0187.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10302_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10302_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.586] GetProcessHeap () returned 0x4e0000 [0187.586] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.586] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.586] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.586] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x3, lpOverlapped=0x0) returned 1 [0187.587] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.587] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.587] GetProcessHeap () returned 0x4e0000 [0187.587] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.588] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.588] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.588] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.588] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.588] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.588] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.588] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.588] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.588] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.588] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.588] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.588] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xfd, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xfd, lpOverlapped=0x0) returned 1 [0187.588] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x100, dwBufLen=0x100 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x100) returned 1 [0187.588] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.589] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x100, lpOverlapped=0x0) returned 1 [0187.589] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.589] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.589] SetEndOfFile (hFile=0x100) returned 1 [0187.592] GetProcessHeap () returned 0x4e0000 [0187.592] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.592] GetProcessHeap () returned 0x4e0000 [0187.592] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.592] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10302_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10302_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10302_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10302_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.593] CloseHandle (hObject=0x100) returned 1 [0187.593] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x604e8e00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc8b9d80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x604e8e00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD10335_.GIF", cAlternateFileName="")) returned 1 [0187.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10335_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10335_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.595] GetProcessHeap () returned 0x4e0000 [0187.595] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.595] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.595] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.595] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x6, lpOverlapped=0x0) returned 1 [0187.597] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.597] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.597] GetProcessHeap () returned 0x4e0000 [0187.597] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.597] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.597] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.597] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.597] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.598] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.598] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.598] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.598] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.598] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.598] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.598] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.598] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x11a, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x11a, lpOverlapped=0x0) returned 1 [0187.598] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x120, dwBufLen=0x120 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x120) returned 1 [0187.598] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.598] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x120, lpOverlapped=0x0) returned 1 [0187.598] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.598] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.598] SetEndOfFile (hFile=0x100) returned 1 [0187.601] GetProcessHeap () returned 0x4e0000 [0187.601] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.601] GetProcessHeap () returned 0x4e0000 [0187.601] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.601] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10335_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10335_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10335_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10335_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.603] CloseHandle (hObject=0x100) returned 1 [0187.603] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x604e8e00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc8b9d80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x604e8e00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xcc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD10336_.GIF", cAlternateFileName="")) returned 1 [0187.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10336_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10336_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.604] GetProcessHeap () returned 0x4e0000 [0187.604] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.604] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.604] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.604] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.605] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.606] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.606] GetProcessHeap () returned 0x4e0000 [0187.606] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.606] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.606] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.606] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.606] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.606] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.606] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.606] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.606] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.607] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.607] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.607] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.607] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xcc, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xcc, lpOverlapped=0x0) returned 1 [0187.607] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xd0, dwBufLen=0xd0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xd0) returned 1 [0187.607] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.607] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xd0, lpOverlapped=0x0) returned 1 [0187.607] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.607] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.607] SetEndOfFile (hFile=0x100) returned 1 [0187.610] GetProcessHeap () returned 0x4e0000 [0187.610] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.610] GetProcessHeap () returned 0x4e0000 [0187.610] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.610] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10336_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10336_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10336_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10336_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.611] CloseHandle (hObject=0x100) returned 1 [0187.611] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x604e8e00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc8b9d80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x604e8e00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD10337_.GIF", cAlternateFileName="")) returned 1 [0187.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10337_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10337_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.613] GetProcessHeap () returned 0x4e0000 [0187.613] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.613] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.613] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.613] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.613] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.613] GetProcessHeap () returned 0x4e0000 [0187.613] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.613] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.613] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.613] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.615] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.615] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.615] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.615] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.615] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.615] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.615] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.615] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.615] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xf0, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xf0, lpOverlapped=0x0) returned 1 [0187.616] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xf0, dwBufLen=0xf0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xf0) returned 1 [0187.616] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.616] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xf0, lpOverlapped=0x0) returned 1 [0187.616] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.616] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.616] SetEndOfFile (hFile=0x100) returned 1 [0187.618] GetProcessHeap () returned 0x4e0000 [0187.619] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.619] GetProcessHeap () returned 0x4e0000 [0187.619] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.619] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10337_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10337_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10337_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10337_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.621] CloseHandle (hObject=0x100) returned 1 [0187.621] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7ebfa00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc8dfee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb7ebfa00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD14513_.GIF", cAlternateFileName="")) returned 1 [0187.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14513_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14513_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.623] GetProcessHeap () returned 0x4e0000 [0187.623] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.623] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.623] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.623] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x2, lpOverlapped=0x0) returned 1 [0187.625] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.625] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.625] GetProcessHeap () returned 0x4e0000 [0187.625] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.625] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.625] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.625] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.625] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.625] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.626] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.626] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.626] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.626] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.626] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.626] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.626] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xce, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xce, lpOverlapped=0x0) returned 1 [0187.626] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xd0, dwBufLen=0xd0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xd0) returned 1 [0187.626] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.626] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xd0, lpOverlapped=0x0) returned 1 [0187.626] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.626] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.626] SetEndOfFile (hFile=0x100) returned 1 [0187.629] GetProcessHeap () returned 0x4e0000 [0187.629] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.629] GetProcessHeap () returned 0x4e0000 [0187.629] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.629] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14513_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14513_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14513_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14513_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.631] CloseHandle (hObject=0x100) returned 1 [0187.631] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb91d2700, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc8dfee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb91d2700, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD14514_.GIF", cAlternateFileName="")) returned 1 [0187.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14514_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14514_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.633] GetProcessHeap () returned 0x4e0000 [0187.633] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.633] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.633] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.633] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xd, lpOverlapped=0x0) returned 1 [0187.634] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.634] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.634] GetProcessHeap () returned 0x4e0000 [0187.634] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.634] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.635] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.635] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.635] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.635] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.635] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.635] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.635] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.635] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.635] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.635] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.635] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xb3, lpOverlapped=0x0) returned 1 [0187.635] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0, dwBufLen=0xc0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0) returned 1 [0187.635] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.635] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xc0, lpOverlapped=0x0) returned 1 [0187.636] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.636] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.636] SetEndOfFile (hFile=0x100) returned 1 [0187.639] GetProcessHeap () returned 0x4e0000 [0187.639] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.639] GetProcessHeap () returned 0x4e0000 [0187.639] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.639] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14514_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14514_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14514_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14514_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.641] CloseHandle (hObject=0x100) returned 1 [0187.641] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb91d2700, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc8dfee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb91d2700, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD14515_.GIF", cAlternateFileName="")) returned 1 [0187.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14515_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14515_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.642] GetProcessHeap () returned 0x4e0000 [0187.642] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.642] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.642] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.643] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xd, lpOverlapped=0x0) returned 1 [0187.644] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.644] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.644] GetProcessHeap () returned 0x4e0000 [0187.644] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.644] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.644] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.644] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.644] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.645] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.645] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.645] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.645] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.645] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.645] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.645] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.645] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xb3, lpOverlapped=0x0) returned 1 [0187.645] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0, dwBufLen=0xc0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0) returned 1 [0187.645] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.645] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xc0, lpOverlapped=0x0) returned 1 [0187.645] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.645] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.646] SetEndOfFile (hFile=0x100) returned 1 [0187.648] GetProcessHeap () returned 0x4e0000 [0187.648] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.648] GetProcessHeap () returned 0x4e0000 [0187.648] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.648] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14515_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14515_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14515_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14515_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.650] CloseHandle (hObject=0x100) returned 1 [0187.650] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd05b1500, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc8dfee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd05b1500, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0x111, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD14528_.GIF", cAlternateFileName="")) returned 1 [0187.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14528_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14528_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.651] GetProcessHeap () returned 0x4e0000 [0187.651] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.652] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.652] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.652] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xf, lpOverlapped=0x0) returned 1 [0187.654] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.654] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.654] GetProcessHeap () returned 0x4e0000 [0187.654] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.654] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.654] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.655] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.655] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.655] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.655] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.655] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.655] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.655] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.655] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.655] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.655] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x111, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x111, lpOverlapped=0x0) returned 1 [0187.655] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x120, dwBufLen=0x120 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x120) returned 1 [0187.655] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.655] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x120, lpOverlapped=0x0) returned 1 [0187.656] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.656] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.656] SetEndOfFile (hFile=0x100) returned 1 [0187.661] GetProcessHeap () returned 0x4e0000 [0187.661] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.661] GetProcessHeap () returned 0x4e0000 [0187.661] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.661] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14528_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14528_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14528_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14528_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.663] CloseHandle (hObject=0x100) returned 1 [0187.663] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd18c4200, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc8dfee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd18c4200, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD14529_.GIF", cAlternateFileName="")) returned 1 [0187.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14529_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14529_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.665] GetProcessHeap () returned 0x4e0000 [0187.665] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.665] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.665] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.665] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xe, lpOverlapped=0x0) returned 1 [0187.667] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.667] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.667] GetProcessHeap () returned 0x4e0000 [0187.667] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.667] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.667] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.667] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.667] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.667] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.668] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.668] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.668] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.669] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.669] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.669] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.669] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x112, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x112, lpOverlapped=0x0) returned 1 [0187.669] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x120, dwBufLen=0x120 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x120) returned 1 [0187.669] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.669] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x120, lpOverlapped=0x0) returned 1 [0187.669] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.669] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.669] SetEndOfFile (hFile=0x100) returned 1 [0187.672] GetProcessHeap () returned 0x4e0000 [0187.672] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.672] GetProcessHeap () returned 0x4e0000 [0187.672] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.672] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14529_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14529_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14529_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14529_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.681] CloseHandle (hObject=0x100) returned 1 [0187.681] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd18c4200, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc8dfee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd18c4200, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0x13c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD14530_.GIF", cAlternateFileName="")) returned 1 [0187.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14530_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14530_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.682] GetProcessHeap () returned 0x4e0000 [0187.682] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.682] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.682] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.683] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.684] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.684] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.684] GetProcessHeap () returned 0x4e0000 [0187.684] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.684] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.684] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.684] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.684] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.684] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.684] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.684] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.685] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.685] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.685] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.685] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.685] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x13c, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x13c, lpOverlapped=0x0) returned 1 [0187.685] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x140, dwBufLen=0x140 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x140) returned 1 [0187.685] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.685] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x140, lpOverlapped=0x0) returned 1 [0187.685] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.685] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.685] SetEndOfFile (hFile=0x100) returned 1 [0187.687] GetProcessHeap () returned 0x4e0000 [0187.687] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.687] GetProcessHeap () returned 0x4e0000 [0187.687] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.687] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14530_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14530_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14530_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14530_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.690] CloseHandle (hObject=0x100) returned 1 [0187.690] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2bd6f00, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc906040, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd2bd6f00, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0xf5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD14531_.GIF", cAlternateFileName="")) returned 1 [0187.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14531_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14531_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.691] GetProcessHeap () returned 0x4e0000 [0187.691] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.691] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.691] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.691] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xb, lpOverlapped=0x0) returned 1 [0187.694] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.694] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.694] GetProcessHeap () returned 0x4e0000 [0187.694] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.694] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.694] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.694] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.694] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.694] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.694] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.694] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.694] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.694] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.694] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.694] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.695] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xf5, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xf5, lpOverlapped=0x0) returned 1 [0187.695] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x100, dwBufLen=0x100 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x100) returned 1 [0187.695] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.695] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x100, lpOverlapped=0x0) returned 1 [0187.695] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.695] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.695] SetEndOfFile (hFile=0x100) returned 1 [0187.697] GetProcessHeap () returned 0x4e0000 [0187.697] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.697] GetProcessHeap () returned 0x4e0000 [0187.697] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.697] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14531_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14531_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14531_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14531_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.699] CloseHandle (hObject=0x100) returned 1 [0187.708] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2bd6f00, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc906040, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd2bd6f00, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0xf5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD14532_.GIF", cAlternateFileName="")) returned 1 [0187.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14532_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14532_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.709] GetProcessHeap () returned 0x4e0000 [0187.709] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.709] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.709] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.709] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xb, lpOverlapped=0x0) returned 1 [0187.711] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.711] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.711] GetProcessHeap () returned 0x4e0000 [0187.711] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.711] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.711] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.711] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.711] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.711] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.711] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.711] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.711] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.711] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.711] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.712] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.712] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xf5, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xf5, lpOverlapped=0x0) returned 1 [0187.712] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x100, dwBufLen=0x100 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x100) returned 1 [0187.712] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.712] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x100, lpOverlapped=0x0) returned 1 [0187.712] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.712] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.712] SetEndOfFile (hFile=0x100) returned 1 [0187.714] GetProcessHeap () returned 0x4e0000 [0187.714] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.714] GetProcessHeap () returned 0x4e0000 [0187.714] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.714] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14532_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14532_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14532_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14532_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.717] CloseHandle (hObject=0x100) returned 1 [0187.717] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2bd6f00, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc906040, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd2bd6f00, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0xf5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD14533_.GIF", cAlternateFileName="")) returned 1 [0187.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14533_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14533_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.718] GetProcessHeap () returned 0x4e0000 [0187.718] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.718] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.718] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.718] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xb, lpOverlapped=0x0) returned 1 [0187.720] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.720] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.720] GetProcessHeap () returned 0x4e0000 [0187.720] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.720] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.720] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.720] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.720] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.720] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.720] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.720] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.720] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.720] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.720] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.720] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.720] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xf5, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xf5, lpOverlapped=0x0) returned 1 [0187.721] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x100, dwBufLen=0x100 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x100) returned 1 [0187.721] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.721] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x100, lpOverlapped=0x0) returned 1 [0187.721] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.721] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.721] SetEndOfFile (hFile=0x100) returned 1 [0187.723] GetProcessHeap () returned 0x4e0000 [0187.723] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.723] GetProcessHeap () returned 0x4e0000 [0187.723] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.723] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14533_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14533_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14533_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14533_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.724] CloseHandle (hObject=0x100) returned 1 [0187.724] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe7b7100, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc92c1a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe7b7100, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xb7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD14565_.GIF", cAlternateFileName="")) returned 1 [0187.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14565_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14565_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.726] GetProcessHeap () returned 0x4e0000 [0187.726] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.726] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.726] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.726] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x9, lpOverlapped=0x0) returned 1 [0187.727] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.727] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.727] GetProcessHeap () returned 0x4e0000 [0187.727] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.727] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.727] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.727] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.727] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.727] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.728] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.728] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.728] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.728] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.728] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.728] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.728] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb7, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xb7, lpOverlapped=0x0) returned 1 [0187.728] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0, dwBufLen=0xc0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0) returned 1 [0187.728] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.728] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xc0, lpOverlapped=0x0) returned 1 [0187.728] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.728] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.728] SetEndOfFile (hFile=0x100) returned 1 [0187.731] GetProcessHeap () returned 0x4e0000 [0187.731] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.731] GetProcessHeap () returned 0x4e0000 [0187.731] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.731] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14565_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14565_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14565_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14565_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.732] CloseHandle (hObject=0x100) returned 1 [0187.732] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7eb38a00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc92c1a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7eb38a00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xc8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD14578_.GIF", cAlternateFileName="")) returned 1 [0187.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14578_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14578_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.733] GetProcessHeap () returned 0x4e0000 [0187.733] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.733] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.733] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.733] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.734] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.734] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.734] GetProcessHeap () returned 0x4e0000 [0187.734] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.734] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.734] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.734] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.734] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.734] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.734] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.735] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.735] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.735] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.735] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.735] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.735] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xc8, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xc8, lpOverlapped=0x0) returned 1 [0187.735] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xd0, dwBufLen=0xd0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xd0) returned 1 [0187.735] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.735] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xd0, lpOverlapped=0x0) returned 1 [0187.735] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.735] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.735] SetEndOfFile (hFile=0x100) returned 1 [0187.737] GetProcessHeap () returned 0x4e0000 [0187.737] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.737] GetProcessHeap () returned 0x4e0000 [0187.737] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.737] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14578_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14578_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14578_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14578_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.738] CloseHandle (hObject=0x100) returned 1 [0187.738] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7eb38a00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc92c1a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7eb38a00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x10b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD14579_.GIF", cAlternateFileName="")) returned 1 [0187.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14579_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14579_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.740] GetProcessHeap () returned 0x4e0000 [0187.740] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.740] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.740] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.740] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x5, lpOverlapped=0x0) returned 1 [0187.741] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.741] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.741] GetProcessHeap () returned 0x4e0000 [0187.741] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.741] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.741] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.741] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.741] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.741] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.742] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.742] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.742] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.742] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.742] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.742] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.742] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x10b, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x10b, lpOverlapped=0x0) returned 1 [0187.742] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x110, dwBufLen=0x110 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x110) returned 1 [0187.742] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.742] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x110, lpOverlapped=0x0) returned 1 [0187.742] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.742] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.742] SetEndOfFile (hFile=0x100) returned 1 [0187.744] GetProcessHeap () returned 0x4e0000 [0187.744] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.744] GetProcessHeap () returned 0x4e0000 [0187.744] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.744] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14579_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14579_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14579_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14579_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.745] CloseHandle (hObject=0x100) returned 1 [0187.745] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fe4b700, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc92c1a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7fe4b700, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD14580_.GIF", cAlternateFileName="")) returned 1 [0187.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14580_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14580_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.746] GetProcessHeap () returned 0x4e0000 [0187.746] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.746] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.746] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.747] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x7, lpOverlapped=0x0) returned 1 [0187.748] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.748] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.748] GetProcessHeap () returned 0x4e0000 [0187.748] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.748] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.748] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.748] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.748] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.748] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.748] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.748] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.748] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.748] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.748] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.748] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.748] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb9, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xb9, lpOverlapped=0x0) returned 1 [0187.749] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0, dwBufLen=0xc0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0) returned 1 [0187.749] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.749] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xc0, lpOverlapped=0x0) returned 1 [0187.749] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.749] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.749] SetEndOfFile (hFile=0x100) returned 1 [0187.751] GetProcessHeap () returned 0x4e0000 [0187.751] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.751] GetProcessHeap () returned 0x4e0000 [0187.751] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.751] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14580_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14580_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14580_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14580_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.752] CloseHandle (hObject=0x100) returned 1 [0187.752] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fe4b700, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc92c1a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7fe4b700, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD14581_.GIF", cAlternateFileName="")) returned 1 [0187.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14581_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14581_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.753] GetProcessHeap () returned 0x4e0000 [0187.753] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.753] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.753] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.753] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x2, lpOverlapped=0x0) returned 1 [0187.754] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.754] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.754] GetProcessHeap () returned 0x4e0000 [0187.754] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.754] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.754] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.754] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.754] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.754] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.754] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.755] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.755] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.755] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.755] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.755] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.755] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xce, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xce, lpOverlapped=0x0) returned 1 [0187.755] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xd0, dwBufLen=0xd0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xd0) returned 1 [0187.755] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.755] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xd0, lpOverlapped=0x0) returned 1 [0187.755] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.755] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.755] SetEndOfFile (hFile=0x100) returned 1 [0187.757] GetProcessHeap () returned 0x4e0000 [0187.757] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.757] GetProcessHeap () returned 0x4e0000 [0187.757] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.757] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14581_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14581_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14581_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14581_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.758] CloseHandle (hObject=0x100) returned 1 [0187.758] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fe4b700, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc92c1a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7fe4b700, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD14582_.GIF", cAlternateFileName="")) returned 1 [0187.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14582_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14582_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.759] GetProcessHeap () returned 0x4e0000 [0187.759] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.759] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.759] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.759] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x7, lpOverlapped=0x0) returned 1 [0187.760] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.760] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.760] GetProcessHeap () returned 0x4e0000 [0187.760] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.760] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.760] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.760] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.760] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.760] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.761] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.761] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.761] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.761] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.761] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.761] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.761] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb9, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xb9, lpOverlapped=0x0) returned 1 [0187.761] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0, dwBufLen=0xc0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0) returned 1 [0187.761] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.761] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xc0, lpOverlapped=0x0) returned 1 [0187.761] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.761] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.761] SetEndOfFile (hFile=0x100) returned 1 [0187.763] GetProcessHeap () returned 0x4e0000 [0187.763] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.763] GetProcessHeap () returned 0x4e0000 [0187.764] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.764] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14582_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14582_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14582_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14582_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.765] CloseHandle (hObject=0x100) returned 1 [0187.765] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8115e400, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc952300, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8115e400, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xaf, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD14583_.GIF", cAlternateFileName="")) returned 1 [0187.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14583_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14583_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.767] GetProcessHeap () returned 0x4e0000 [0187.768] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.768] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.768] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.768] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x1, lpOverlapped=0x0) returned 1 [0187.769] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.769] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.769] GetProcessHeap () returned 0x4e0000 [0187.769] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.769] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.769] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.769] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.769] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.769] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.769] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.769] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.769] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.770] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.770] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.770] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.770] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xaf, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xaf, lpOverlapped=0x0) returned 1 [0187.770] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xb0, dwBufLen=0xb0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xb0) returned 1 [0187.770] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.770] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xb0, lpOverlapped=0x0) returned 1 [0187.770] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.770] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x184, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.770] SetEndOfFile (hFile=0x100) returned 1 [0187.772] GetProcessHeap () returned 0x4e0000 [0187.772] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.772] GetProcessHeap () returned 0x4e0000 [0187.772] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.772] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14583_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14583_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14583_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14583_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.773] CloseHandle (hObject=0x100) returned 1 [0187.773] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4a53e00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc952300, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb4a53e00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD14654_.GIF", cAlternateFileName="")) returned 1 [0187.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14654_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14654_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.774] GetProcessHeap () returned 0x4e0000 [0187.774] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.774] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.774] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.774] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x7, lpOverlapped=0x0) returned 1 [0187.775] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.775] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.775] GetProcessHeap () returned 0x4e0000 [0187.775] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.776] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.776] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.776] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.776] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.776] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.776] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.776] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.776] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.776] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.776] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.776] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.776] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb9, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xb9, lpOverlapped=0x0) returned 1 [0187.776] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0, dwBufLen=0xc0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0) returned 1 [0187.776] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.776] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xc0, lpOverlapped=0x0) returned 1 [0187.776] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.776] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.776] SetEndOfFile (hFile=0x100) returned 1 [0187.779] GetProcessHeap () returned 0x4e0000 [0187.779] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.779] GetProcessHeap () returned 0x4e0000 [0187.779] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.779] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14654_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14654_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14654_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14654_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.780] CloseHandle (hObject=0x100) returned 1 [0187.780] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4a53e00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc952300, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb4a53e00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xad, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD14655_.GIF", cAlternateFileName="")) returned 1 [0187.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14655_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14655_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.781] GetProcessHeap () returned 0x4e0000 [0187.781] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.781] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.782] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.782] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x3, lpOverlapped=0x0) returned 1 [0187.783] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.783] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.783] GetProcessHeap () returned 0x4e0000 [0187.783] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.783] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.783] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.783] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.783] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.783] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.783] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.783] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.783] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.783] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.784] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.784] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.784] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xad, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xad, lpOverlapped=0x0) returned 1 [0187.784] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xb0, dwBufLen=0xb0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xb0) returned 1 [0187.784] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.784] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xb0, lpOverlapped=0x0) returned 1 [0187.784] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.784] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x184, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.784] SetEndOfFile (hFile=0x100) returned 1 [0187.786] GetProcessHeap () returned 0x4e0000 [0187.786] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.786] GetProcessHeap () returned 0x4e0000 [0187.786] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.786] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14655_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14655_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14655_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14655_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.787] CloseHandle (hObject=0x100) returned 1 [0187.787] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5d66b00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc952300, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb5d66b00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xad, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD14656_.GIF", cAlternateFileName="")) returned 1 [0187.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14656_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14656_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.788] GetProcessHeap () returned 0x4e0000 [0187.788] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.788] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.788] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.788] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x3, lpOverlapped=0x0) returned 1 [0187.789] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.789] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.789] GetProcessHeap () returned 0x4e0000 [0187.789] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.789] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.789] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.789] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.789] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.789] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.789] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.790] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.790] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.790] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.790] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.790] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.790] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xad, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xad, lpOverlapped=0x0) returned 1 [0187.790] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xb0, dwBufLen=0xb0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xb0) returned 1 [0187.790] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.790] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xb0, lpOverlapped=0x0) returned 1 [0187.790] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.790] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x184, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.790] SetEndOfFile (hFile=0x100) returned 1 [0187.792] GetProcessHeap () returned 0x4e0000 [0187.792] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.792] GetProcessHeap () returned 0x4e0000 [0187.792] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.792] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14656_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14656_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14656_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14656_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.794] CloseHandle (hObject=0x100) returned 1 [0187.794] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4248700, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc978460, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc4248700, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD14691_.GIF", cAlternateFileName="")) returned 1 [0187.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14691_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14691_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.794] GetProcessHeap () returned 0x4e0000 [0187.795] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.795] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.795] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.795] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x7, lpOverlapped=0x0) returned 1 [0187.805] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.805] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.805] GetProcessHeap () returned 0x4e0000 [0187.805] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.805] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.805] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.805] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.805] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.805] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.806] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.806] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.806] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.806] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.806] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.806] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.806] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb9, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xb9, lpOverlapped=0x0) returned 1 [0187.806] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0, dwBufLen=0xc0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0) returned 1 [0187.806] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.806] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xc0, lpOverlapped=0x0) returned 1 [0187.806] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.806] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.806] SetEndOfFile (hFile=0x100) returned 1 [0187.808] GetProcessHeap () returned 0x4e0000 [0187.808] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.808] GetProcessHeap () returned 0x4e0000 [0187.808] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.808] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14691_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14691_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14691_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14691_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.810] CloseHandle (hObject=0x100) returned 1 [0187.810] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4248700, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc978460, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc4248700, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xb1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD14692_.GIF", cAlternateFileName="")) returned 1 [0187.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14692_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14692_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.812] GetProcessHeap () returned 0x4e0000 [0187.813] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.813] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.813] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.813] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xf, lpOverlapped=0x0) returned 1 [0187.814] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.814] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.814] GetProcessHeap () returned 0x4e0000 [0187.814] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.814] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.814] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.814] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.814] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.814] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.814] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.814] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.815] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.815] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.815] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.815] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.815] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb1, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xb1, lpOverlapped=0x0) returned 1 [0187.815] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0, dwBufLen=0xc0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0) returned 1 [0187.815] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.815] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xc0, lpOverlapped=0x0) returned 1 [0187.815] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.815] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.815] SetEndOfFile (hFile=0x100) returned 1 [0187.817] GetProcessHeap () returned 0x4e0000 [0187.817] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.817] GetProcessHeap () returned 0x4e0000 [0187.817] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.817] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14692_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14692_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14692_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14692_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.819] CloseHandle (hObject=0x100) returned 1 [0187.819] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc555b400, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc978460, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc555b400, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xad, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD14693_.GIF", cAlternateFileName="")) returned 1 [0187.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14693_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14693_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.820] GetProcessHeap () returned 0x4e0000 [0187.820] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.820] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.820] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.820] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x3, lpOverlapped=0x0) returned 1 [0187.823] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.824] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.824] GetProcessHeap () returned 0x4e0000 [0187.824] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.824] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.824] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.824] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.824] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.824] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.824] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.824] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.824] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.825] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.825] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.825] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.825] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xad, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xad, lpOverlapped=0x0) returned 1 [0187.825] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xb0, dwBufLen=0xb0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xb0) returned 1 [0187.825] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.825] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xb0, lpOverlapped=0x0) returned 1 [0187.825] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.825] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x184, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.825] SetEndOfFile (hFile=0x100) returned 1 [0187.827] GetProcessHeap () returned 0x4e0000 [0187.827] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.827] GetProcessHeap () returned 0x4e0000 [0187.827] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.827] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14693_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14693_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14693_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14693_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.829] CloseHandle (hObject=0x100) returned 1 [0187.829] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecac8100, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc978460, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xecac8100, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD14752_.GIF", cAlternateFileName="")) returned 1 [0187.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14752_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14752_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.831] GetProcessHeap () returned 0x4e0000 [0187.831] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.831] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.831] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.831] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x5, lpOverlapped=0x0) returned 1 [0187.832] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.832] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.832] GetProcessHeap () returned 0x4e0000 [0187.832] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.833] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.833] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.833] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.833] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.833] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.833] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.833] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.833] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.833] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.833] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.833] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.833] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x29b, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x29b, lpOverlapped=0x0) returned 1 [0187.833] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x2a0, dwBufLen=0x2a0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x2a0) returned 1 [0187.833] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.833] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x2a0, lpOverlapped=0x0) returned 1 [0187.833] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.833] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x374, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.833] SetEndOfFile (hFile=0x100) returned 1 [0187.835] GetProcessHeap () returned 0x4e0000 [0187.835] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.836] GetProcessHeap () returned 0x4e0000 [0187.836] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.836] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14752_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14752_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14752_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14752_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.837] CloseHandle (hObject=0x100) returned 1 [0187.837] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecac8100, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc99e5c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xecac8100, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xbc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD14753_.GIF", cAlternateFileName="")) returned 1 [0187.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14753_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14753_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.838] GetProcessHeap () returned 0x4e0000 [0187.838] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.838] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.838] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.838] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.840] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.840] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.840] GetProcessHeap () returned 0x4e0000 [0187.840] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.840] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.840] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.840] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.840] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.840] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.840] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.840] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.840] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.840] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.840] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.840] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.840] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xbc, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xbc, lpOverlapped=0x0) returned 1 [0187.840] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0, dwBufLen=0xc0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0) returned 1 [0187.841] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.841] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xc0, lpOverlapped=0x0) returned 1 [0187.841] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.841] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.841] SetEndOfFile (hFile=0x100) returned 1 [0187.843] GetProcessHeap () returned 0x4e0000 [0187.843] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.843] GetProcessHeap () returned 0x4e0000 [0187.843] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.843] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14753_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14753_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14753_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14753_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.844] CloseHandle (hObject=0x100) returned 1 [0187.845] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecac8100, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc99e5c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xecac8100, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xb0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD14754_.GIF", cAlternateFileName="")) returned 1 [0187.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14754_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14754_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.846] GetProcessHeap () returned 0x4e0000 [0187.846] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.846] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.846] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.846] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.846] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.846] GetProcessHeap () returned 0x4e0000 [0187.846] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.846] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.846] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.846] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.847] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.847] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.847] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.847] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.847] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.848] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.848] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.848] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.848] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb0, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xb0, lpOverlapped=0x0) returned 1 [0187.848] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xb0, dwBufLen=0xb0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xb0) returned 1 [0187.848] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.848] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xb0, lpOverlapped=0x0) returned 1 [0187.848] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.848] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x184, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.848] SetEndOfFile (hFile=0x100) returned 1 [0187.850] GetProcessHeap () returned 0x4e0000 [0187.850] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.850] GetProcessHeap () returned 0x4e0000 [0187.850] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.850] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14754_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14754_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14754_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14754_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.851] CloseHandle (hObject=0x100) returned 1 [0187.852] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2fd2f700, ftCreationTime.dwHighDateTime=0x1bd4f43, ftLastAccessTime.dwLowDateTime=0xbc99e5c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2fd2f700, ftLastWriteTime.dwHighDateTime=0x1bd4f43, nFileSizeHigh=0x0, nFileSizeLow=0x44, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD14755_.GIF", cAlternateFileName="")) returned 1 [0187.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14755_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14755_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.853] GetProcessHeap () returned 0x4e0000 [0187.853] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.853] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.853] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.853] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xc, lpOverlapped=0x0) returned 1 [0187.854] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.854] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.854] GetProcessHeap () returned 0x4e0000 [0187.854] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.854] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.854] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.854] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.854] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.854] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.855] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.855] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.855] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.855] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.855] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.855] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.855] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x44, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x44, lpOverlapped=0x0) returned 1 [0187.855] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x50, dwBufLen=0x50 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x50) returned 1 [0187.855] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.855] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x50, lpOverlapped=0x0) returned 1 [0187.855] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.855] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x124, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.855] SetEndOfFile (hFile=0x100) returned 1 [0187.857] GetProcessHeap () returned 0x4e0000 [0187.857] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.858] GetProcessHeap () returned 0x4e0000 [0187.858] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.858] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14755_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14755_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14755_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14755_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.859] CloseHandle (hObject=0x100) returned 1 [0187.859] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedddae00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc99e5c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xedddae00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xbf, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD14756_.GIF", cAlternateFileName="")) returned 1 [0187.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14756_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14756_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.861] GetProcessHeap () returned 0x4e0000 [0187.861] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.861] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.861] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.861] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x1, lpOverlapped=0x0) returned 1 [0187.862] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.862] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.862] GetProcessHeap () returned 0x4e0000 [0187.862] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.862] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.862] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.862] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.862] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.863] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.863] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.863] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.863] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.863] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.863] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.863] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.863] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xbf, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xbf, lpOverlapped=0x0) returned 1 [0187.863] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0, dwBufLen=0xc0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0) returned 1 [0187.863] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.863] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xc0, lpOverlapped=0x0) returned 1 [0187.863] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.863] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.863] SetEndOfFile (hFile=0x100) returned 1 [0187.865] GetProcessHeap () returned 0x4e0000 [0187.865] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.865] GetProcessHeap () returned 0x4e0000 [0187.865] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.865] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14756_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14756_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14756_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14756_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.867] CloseHandle (hObject=0x100) returned 1 [0187.867] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedddae00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc99e5c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xedddae00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD14757_.GIF", cAlternateFileName="")) returned 1 [0187.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14757_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14757_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.868] GetProcessHeap () returned 0x4e0000 [0187.868] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.868] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.868] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.868] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xd, lpOverlapped=0x0) returned 1 [0187.869] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.869] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.869] GetProcessHeap () returned 0x4e0000 [0187.869] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.869] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.869] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.869] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.869] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.869] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.869] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.869] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.869] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.870] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.870] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.870] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.870] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xb3, lpOverlapped=0x0) returned 1 [0187.870] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0, dwBufLen=0xc0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0) returned 1 [0187.870] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.870] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xc0, lpOverlapped=0x0) returned 1 [0187.870] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.870] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.870] SetEndOfFile (hFile=0x100) returned 1 [0187.873] GetProcessHeap () returned 0x4e0000 [0187.873] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.873] GetProcessHeap () returned 0x4e0000 [0187.873] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.873] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14757_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14757_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14757_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14757_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.874] CloseHandle (hObject=0x100) returned 1 [0187.874] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfafa9d00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc9c4720, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfafa9d00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0x111, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD14790_.GIF", cAlternateFileName="")) returned 1 [0187.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14790_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14790_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.876] GetProcessHeap () returned 0x4e0000 [0187.876] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.876] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.876] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.876] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xf, lpOverlapped=0x0) returned 1 [0187.877] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.877] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.877] GetProcessHeap () returned 0x4e0000 [0187.877] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.877] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.877] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.877] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.877] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.877] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.878] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.878] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.878] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.878] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.878] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.878] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.878] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x111, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x111, lpOverlapped=0x0) returned 1 [0187.878] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x120, dwBufLen=0x120 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x120) returned 1 [0187.878] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.878] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x120, lpOverlapped=0x0) returned 1 [0187.878] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.878] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.878] SetEndOfFile (hFile=0x100) returned 1 [0187.880] GetProcessHeap () returned 0x4e0000 [0187.880] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.880] GetProcessHeap () returned 0x4e0000 [0187.880] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.880] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14790_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14790_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14790_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14790_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.881] CloseHandle (hObject=0x100) returned 1 [0187.881] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfafa9d00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc9c4720, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfafa9d00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0x45b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD14791_.GIF", cAlternateFileName="")) returned 1 [0187.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14791_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14791_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.882] GetProcessHeap () returned 0x4e0000 [0187.882] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.882] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.882] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.882] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x5, lpOverlapped=0x0) returned 1 [0187.884] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.884] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.884] GetProcessHeap () returned 0x4e0000 [0187.884] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.884] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.884] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.884] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.884] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.884] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.885] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.885] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.885] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.885] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.885] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.885] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.885] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x45b, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x45b, lpOverlapped=0x0) returned 1 [0187.885] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x460, dwBufLen=0x460 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x460) returned 1 [0187.885] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.885] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x460, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x460, lpOverlapped=0x0) returned 1 [0187.885] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.885] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x534, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.885] SetEndOfFile (hFile=0x100) returned 1 [0187.887] GetProcessHeap () returned 0x4e0000 [0187.887] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.887] GetProcessHeap () returned 0x4e0000 [0187.888] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.888] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14791_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14791_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14791_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14791_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.889] CloseHandle (hObject=0x100) returned 1 [0187.890] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfafa9d00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc9c4720, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfafa9d00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD14792_.GIF", cAlternateFileName="")) returned 1 [0187.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14792_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14792_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.891] GetProcessHeap () returned 0x4e0000 [0187.891] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.891] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.891] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.891] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x5, lpOverlapped=0x0) returned 1 [0187.892] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.892] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.892] GetProcessHeap () returned 0x4e0000 [0187.892] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.892] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.892] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.892] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.892] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.892] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.892] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.893] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.893] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.893] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.893] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.893] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.893] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xfb, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xfb, lpOverlapped=0x0) returned 1 [0187.893] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x100, dwBufLen=0x100 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x100) returned 1 [0187.893] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.893] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x100, lpOverlapped=0x0) returned 1 [0187.893] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.893] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.893] SetEndOfFile (hFile=0x100) returned 1 [0187.895] GetProcessHeap () returned 0x4e0000 [0187.895] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.895] GetProcessHeap () returned 0x4e0000 [0187.895] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.895] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14792_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14792_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14792_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14792_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.897] CloseHandle (hObject=0x100) returned 1 [0187.897] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc2bca00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc9c4720, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfc2bca00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD14793_.GIF", cAlternateFileName="")) returned 1 [0187.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14793_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14793_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.898] GetProcessHeap () returned 0x4e0000 [0187.898] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.898] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.898] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.898] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.898] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.898] GetProcessHeap () returned 0x4e0000 [0187.898] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.898] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.898] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.899] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.900] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.900] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.900] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.900] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.900] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.900] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.900] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.900] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.900] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xf0, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xf0, lpOverlapped=0x0) returned 1 [0187.900] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xf0, dwBufLen=0xf0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xf0) returned 1 [0187.900] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.900] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xf0, lpOverlapped=0x0) returned 1 [0187.900] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.900] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.901] SetEndOfFile (hFile=0x100) returned 1 [0187.903] GetProcessHeap () returned 0x4e0000 [0187.903] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.903] GetProcessHeap () returned 0x4e0000 [0187.903] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.903] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14793_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14793_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14793_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14793_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.904] CloseHandle (hObject=0x100) returned 1 [0187.904] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc2bca00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc9c4720, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfc2bca00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD14794_.GIF", cAlternateFileName="")) returned 1 [0187.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14794_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14794_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.906] GetProcessHeap () returned 0x4e0000 [0187.906] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.906] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.906] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.906] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xd, lpOverlapped=0x0) returned 1 [0187.907] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.907] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.907] GetProcessHeap () returned 0x4e0000 [0187.907] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.907] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.907] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.907] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.907] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.907] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.907] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.908] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.908] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.908] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.908] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.908] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.908] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x103, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x103, lpOverlapped=0x0) returned 1 [0187.908] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x110, dwBufLen=0x110 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x110) returned 1 [0187.908] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.908] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x110, lpOverlapped=0x0) returned 1 [0187.908] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.908] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.908] SetEndOfFile (hFile=0x100) returned 1 [0187.910] GetProcessHeap () returned 0x4e0000 [0187.910] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.910] GetProcessHeap () returned 0x4e0000 [0187.910] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.910] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14794_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14794_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14794_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14794_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.913] CloseHandle (hObject=0x100) returned 1 [0187.914] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc2bca00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc9c4720, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfc2bca00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD14795_.GIF", cAlternateFileName="")) returned 1 [0187.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14795_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14795_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.915] GetProcessHeap () returned 0x4e0000 [0187.915] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.915] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.915] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.915] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x5, lpOverlapped=0x0) returned 1 [0187.916] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.916] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.916] GetProcessHeap () returned 0x4e0000 [0187.916] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.916] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.916] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.916] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.916] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.916] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.916] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.916] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.917] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.917] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.917] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.917] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.917] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xdb, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xdb, lpOverlapped=0x0) returned 1 [0187.917] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xe0, dwBufLen=0xe0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xe0) returned 1 [0187.917] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.917] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xe0, lpOverlapped=0x0) returned 1 [0187.917] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.917] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.917] SetEndOfFile (hFile=0x100) returned 1 [0187.919] GetProcessHeap () returned 0x4e0000 [0187.919] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.919] GetProcessHeap () returned 0x4e0000 [0187.919] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.919] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14795_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14795_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14795_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14795_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.921] CloseHandle (hObject=0x100) returned 1 [0187.921] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x948b900, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc9ea880, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x948b900, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xc0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD14828_.GIF", cAlternateFileName="")) returned 1 [0187.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14828_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14828_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.922] GetProcessHeap () returned 0x4e0000 [0187.922] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.922] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.922] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.923] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.923] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.923] GetProcessHeap () returned 0x4e0000 [0187.923] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.923] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.923] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.923] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.924] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.924] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.924] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.924] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.924] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.924] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.924] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.924] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.924] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xc0, lpOverlapped=0x0) returned 1 [0187.925] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0, dwBufLen=0xc0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0) returned 1 [0187.925] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.925] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xc0, lpOverlapped=0x0) returned 1 [0187.925] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.925] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.925] SetEndOfFile (hFile=0x100) returned 1 [0187.927] GetProcessHeap () returned 0x4e0000 [0187.927] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.927] GetProcessHeap () returned 0x4e0000 [0187.927] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.927] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14828_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14828_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14828_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14828_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.928] CloseHandle (hObject=0x100) returned 1 [0187.928] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x948b900, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc9ea880, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x948b900, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xbf, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD14829_.GIF", cAlternateFileName="")) returned 1 [0187.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14829_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14829_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.929] GetProcessHeap () returned 0x4e0000 [0187.929] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.929] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.929] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.929] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x1, lpOverlapped=0x0) returned 1 [0187.931] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.931] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.931] GetProcessHeap () returned 0x4e0000 [0187.931] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.931] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.931] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.931] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.931] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.931] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.931] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.931] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.931] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.931] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.931] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.931] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.931] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xbf, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xbf, lpOverlapped=0x0) returned 1 [0187.931] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0, dwBufLen=0xc0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0) returned 1 [0187.931] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.931] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xc0, lpOverlapped=0x0) returned 1 [0187.932] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.932] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.932] SetEndOfFile (hFile=0x100) returned 1 [0187.934] GetProcessHeap () returned 0x4e0000 [0187.934] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.934] GetProcessHeap () returned 0x4e0000 [0187.934] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.934] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14829_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14829_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14829_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14829_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.936] CloseHandle (hObject=0x100) returned 1 [0187.936] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa79e600, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc9ea880, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa79e600, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xb8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD14830_.GIF", cAlternateFileName="")) returned 1 [0187.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14830_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14830_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.937] GetProcessHeap () returned 0x4e0000 [0187.937] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.937] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.937] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.937] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.938] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.938] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.938] GetProcessHeap () returned 0x4e0000 [0187.938] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.938] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.938] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.938] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.938] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.938] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.938] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.938] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.939] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.939] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.939] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.939] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.939] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb8, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xb8, lpOverlapped=0x0) returned 1 [0187.939] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0, dwBufLen=0xc0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0) returned 1 [0187.939] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.939] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xc0, lpOverlapped=0x0) returned 1 [0187.939] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.939] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.939] SetEndOfFile (hFile=0x100) returned 1 [0187.941] GetProcessHeap () returned 0x4e0000 [0187.941] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.941] GetProcessHeap () returned 0x4e0000 [0187.941] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.941] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14830_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14830_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14830_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14830_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.942] CloseHandle (hObject=0x100) returned 1 [0187.942] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa79e600, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc9ea880, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa79e600, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD14831_.GIF", cAlternateFileName="")) returned 1 [0187.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14831_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14831_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.943] GetProcessHeap () returned 0x4e0000 [0187.943] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.943] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.943] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.943] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xd, lpOverlapped=0x0) returned 1 [0187.944] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.944] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.944] GetProcessHeap () returned 0x4e0000 [0187.944] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.944] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.944] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.944] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.945] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.945] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.945] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.945] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.945] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.945] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.945] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.945] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.945] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xb3, lpOverlapped=0x0) returned 1 [0187.945] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0, dwBufLen=0xc0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0) returned 1 [0187.945] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.945] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xc0, lpOverlapped=0x0) returned 1 [0187.945] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.945] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.945] SetEndOfFile (hFile=0x100) returned 1 [0187.947] GetProcessHeap () returned 0x4e0000 [0187.947] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.947] GetProcessHeap () returned 0x4e0000 [0187.947] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.947] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14831_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14831_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14831_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14831_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.948] CloseHandle (hObject=0x100) returned 1 [0187.948] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa79e600, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc9ea880, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa79e600, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xb4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD14832_.GIF", cAlternateFileName="")) returned 1 [0187.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14832_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14832_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.951] GetProcessHeap () returned 0x4e0000 [0187.951] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.951] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.951] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.951] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xc, lpOverlapped=0x0) returned 1 [0187.954] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.954] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.954] GetProcessHeap () returned 0x4e0000 [0187.954] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.954] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.954] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.954] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.954] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.954] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.954] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.954] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.955] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.955] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.955] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.955] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.955] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb4, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xb4, lpOverlapped=0x0) returned 1 [0187.955] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0, dwBufLen=0xc0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0) returned 1 [0187.955] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.955] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xc0, lpOverlapped=0x0) returned 1 [0187.955] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.955] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.955] SetEndOfFile (hFile=0x100) returned 1 [0187.957] GetProcessHeap () returned 0x4e0000 [0187.957] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.957] GetProcessHeap () returned 0x4e0000 [0187.957] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.957] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14832_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14832_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14832_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14832_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.958] CloseHandle (hObject=0x100) returned 1 [0187.959] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa79e600, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca109e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa79e600, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD14833_.GIF", cAlternateFileName="")) returned 1 [0187.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14833_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14833_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.960] GetProcessHeap () returned 0x4e0000 [0187.960] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.960] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.960] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.960] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xe, lpOverlapped=0x0) returned 1 [0187.961] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.961] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.961] GetProcessHeap () returned 0x4e0000 [0187.961] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.962] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.962] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.962] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.962] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.962] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.962] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.962] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.962] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.962] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.962] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.962] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.962] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb2, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xb2, lpOverlapped=0x0) returned 1 [0187.962] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0, dwBufLen=0xc0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0) returned 1 [0187.962] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.962] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xc0, lpOverlapped=0x0) returned 1 [0187.962] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.962] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.962] SetEndOfFile (hFile=0x100) returned 1 [0187.965] GetProcessHeap () returned 0x4e0000 [0187.965] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.965] GetProcessHeap () returned 0x4e0000 [0187.965] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.965] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14833_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14833_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14833_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14833_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.988] CloseHandle (hObject=0x100) returned 1 [0187.988] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1796d500, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca109e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1796d500, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x1f5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD14866_.GIF", cAlternateFileName="")) returned 1 [0187.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14866_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14866_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0187.991] GetProcessHeap () returned 0x4e0000 [0187.991] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0187.991] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0187.991] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0187.991] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xb, lpOverlapped=0x0) returned 1 [0187.992] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.993] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.993] GetProcessHeap () returned 0x4e0000 [0187.993] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0187.993] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0187.993] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.993] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0187.993] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0187.993] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0187.993] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0187.993] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0187.993] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0187.993] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0187.993] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0187.993] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.994] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1f5, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x1f5, lpOverlapped=0x0) returned 1 [0187.994] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x200, dwBufLen=0x200 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x200) returned 1 [0187.994] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.994] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x200, lpOverlapped=0x0) returned 1 [0187.994] CryptDestroyKey (hKey=0x522fd8) returned 1 [0187.994] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x2d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.994] SetEndOfFile (hFile=0x100) returned 1 [0187.997] GetProcessHeap () returned 0x4e0000 [0187.997] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0187.997] GetProcessHeap () returned 0x4e0000 [0187.997] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0187.997] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14866_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14866_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14866_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14866_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0187.999] CloseHandle (hObject=0x100) returned 1 [0187.999] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18c80200, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca109e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x18c80200, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xfd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD14867_.GIF", cAlternateFileName="")) returned 1 [0187.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14867_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14867_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0188.000] GetProcessHeap () returned 0x4e0000 [0188.000] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0188.000] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0188.000] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0188.000] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x3, lpOverlapped=0x0) returned 1 [0188.002] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.002] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.002] GetProcessHeap () returned 0x4e0000 [0188.002] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0188.002] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0188.002] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.002] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0188.002] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0188.002] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0188.002] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0188.002] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0188.002] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0188.003] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.003] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.003] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.003] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xfd, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xfd, lpOverlapped=0x0) returned 1 [0188.003] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x100, dwBufLen=0x100 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x100) returned 1 [0188.003] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.003] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x100, lpOverlapped=0x0) returned 1 [0188.003] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.003] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.003] SetEndOfFile (hFile=0x100) returned 1 [0188.006] GetProcessHeap () returned 0x4e0000 [0188.006] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0188.006] GetProcessHeap () returned 0x4e0000 [0188.006] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0188.006] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14867_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14867_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14867_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14867_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0188.007] CloseHandle (hObject=0x100) returned 1 [0188.007] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18c80200, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca109e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x18c80200, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x1a3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD14868_.GIF", cAlternateFileName="")) returned 1 [0188.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14868_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14868_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0188.009] GetProcessHeap () returned 0x4e0000 [0188.009] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0188.009] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0188.009] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0188.009] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xd, lpOverlapped=0x0) returned 1 [0188.011] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.011] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.011] GetProcessHeap () returned 0x4e0000 [0188.011] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0188.011] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0188.011] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.011] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0188.011] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0188.011] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0188.011] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0188.012] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0188.012] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0188.012] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.012] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.012] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.012] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1a3, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x1a3, lpOverlapped=0x0) returned 1 [0188.012] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1b0, dwBufLen=0x1b0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1b0) returned 1 [0188.012] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.012] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1b0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x1b0, lpOverlapped=0x0) returned 1 [0188.012] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.012] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x284, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.012] SetEndOfFile (hFile=0x100) returned 1 [0188.015] GetProcessHeap () returned 0x4e0000 [0188.015] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0188.015] GetProcessHeap () returned 0x4e0000 [0188.015] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0188.015] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14868_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14868_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14868_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14868_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0188.021] CloseHandle (hObject=0x100) returned 1 [0188.021] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18c80200, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca109e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x18c80200, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD14869_.GIF", cAlternateFileName="")) returned 1 [0188.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14869_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14869_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0188.023] GetProcessHeap () returned 0x4e0000 [0188.023] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0188.023] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0188.023] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0188.023] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xc, lpOverlapped=0x0) returned 1 [0188.025] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.025] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.025] GetProcessHeap () returned 0x4e0000 [0188.025] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0188.025] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0188.025] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.025] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0188.025] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0188.025] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0188.026] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0188.026] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0188.026] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0188.026] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.026] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.026] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.026] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xc4, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xc4, lpOverlapped=0x0) returned 1 [0188.026] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xd0, dwBufLen=0xd0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xd0) returned 1 [0188.026] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.026] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xd0, lpOverlapped=0x0) returned 1 [0188.026] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.026] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.026] SetEndOfFile (hFile=0x100) returned 1 [0188.029] GetProcessHeap () returned 0x4e0000 [0188.029] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0188.029] GetProcessHeap () returned 0x4e0000 [0188.029] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0188.029] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14869_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14869_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14869_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14869_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0188.031] CloseHandle (hObject=0x100) returned 1 [0188.031] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19f92f00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca36b40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x19f92f00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x1a4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD14870_.GIF", cAlternateFileName="")) returned 1 [0188.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14870_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14870_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0188.033] GetProcessHeap () returned 0x4e0000 [0188.033] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0188.033] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0188.033] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0188.033] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xc, lpOverlapped=0x0) returned 1 [0188.035] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.035] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.035] GetProcessHeap () returned 0x4e0000 [0188.035] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0188.035] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0188.035] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.035] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0188.035] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0188.035] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0188.035] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0188.036] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0188.036] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0188.036] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.036] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.036] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.036] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1a4, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x1a4, lpOverlapped=0x0) returned 1 [0188.036] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1b0, dwBufLen=0x1b0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1b0) returned 1 [0188.036] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.036] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1b0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x1b0, lpOverlapped=0x0) returned 1 [0188.036] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.036] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x284, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.036] SetEndOfFile (hFile=0x100) returned 1 [0188.039] GetProcessHeap () returned 0x4e0000 [0188.039] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0188.039] GetProcessHeap () returned 0x4e0000 [0188.039] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0188.039] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14870_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14870_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14870_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14870_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0188.046] CloseHandle (hObject=0x100) returned 1 [0188.046] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19f92f00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca36b40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x19f92f00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xc2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD14871_.GIF", cAlternateFileName="")) returned 1 [0188.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14871_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14871_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0188.047] GetProcessHeap () returned 0x4e0000 [0188.047] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0188.047] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0188.047] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0188.047] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xe, lpOverlapped=0x0) returned 1 [0188.049] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.049] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.049] GetProcessHeap () returned 0x4e0000 [0188.049] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0188.049] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0188.049] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.049] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0188.049] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0188.049] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0188.049] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0188.050] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0188.050] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0188.050] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.050] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.050] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.050] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xc2, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xc2, lpOverlapped=0x0) returned 1 [0188.050] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xd0, dwBufLen=0xd0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xd0) returned 1 [0188.050] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.050] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xd0, lpOverlapped=0x0) returned 1 [0188.050] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.050] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.050] SetEndOfFile (hFile=0x100) returned 1 [0188.053] GetProcessHeap () returned 0x4e0000 [0188.053] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0188.053] GetProcessHeap () returned 0x4e0000 [0188.053] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0188.053] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14871_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14871_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14871_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14871_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0188.054] CloseHandle (hObject=0x100) returned 1 [0188.054] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c3a5000, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca36b40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6c3a5000, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD14980_.GIF", cAlternateFileName="")) returned 1 [0188.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14980_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14980_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0188.056] GetProcessHeap () returned 0x4e0000 [0188.056] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0188.056] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0188.056] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0188.056] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x1, lpOverlapped=0x0) returned 1 [0188.058] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.058] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.058] GetProcessHeap () returned 0x4e0000 [0188.058] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0188.058] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0188.058] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.058] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0188.058] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0188.058] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0188.059] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0188.059] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0188.059] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0188.059] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.059] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.059] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.059] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1cf, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x1cf, lpOverlapped=0x0) returned 1 [0188.059] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1d0) returned 1 [0188.059] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.059] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x1d0, lpOverlapped=0x0) returned 1 [0188.059] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.059] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x2a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.059] SetEndOfFile (hFile=0x100) returned 1 [0188.062] GetProcessHeap () returned 0x4e0000 [0188.062] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0188.062] GetProcessHeap () returned 0x4e0000 [0188.062] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0188.062] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14980_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14980_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14980_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14980_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0188.065] CloseHandle (hObject=0x100) returned 1 [0188.065] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d6b7d00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca36b40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6d6b7d00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x164, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD14981_.GIF", cAlternateFileName="")) returned 1 [0188.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14981_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14981_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0188.066] GetProcessHeap () returned 0x4e0000 [0188.066] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0188.066] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0188.066] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0188.066] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xc, lpOverlapped=0x0) returned 1 [0188.068] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.068] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.068] GetProcessHeap () returned 0x4e0000 [0188.068] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0188.068] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0188.068] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.068] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0188.068] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0188.068] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0188.068] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0188.068] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0188.069] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0188.069] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.069] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.069] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.069] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x164, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x164, lpOverlapped=0x0) returned 1 [0188.069] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x170, dwBufLen=0x170 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x170) returned 1 [0188.069] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.069] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x170, lpOverlapped=0x0) returned 1 [0188.069] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.069] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x244, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.069] SetEndOfFile (hFile=0x100) returned 1 [0188.072] GetProcessHeap () returned 0x4e0000 [0188.072] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0188.072] GetProcessHeap () returned 0x4e0000 [0188.072] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0188.072] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14981_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14981_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14981_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14981_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0188.103] CloseHandle (hObject=0x100) returned 1 [0188.103] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc56d8700, ftCreationTime.dwHighDateTime=0x1bd4f41, ftLastAccessTime.dwLowDateTime=0xbca5cca0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc56d8700, ftLastWriteTime.dwHighDateTime=0x1bd4f41, nFileSizeHigh=0x0, nFileSizeLow=0xc6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD14982_.GIF", cAlternateFileName="")) returned 1 [0188.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14982_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14982_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0188.105] GetProcessHeap () returned 0x4e0000 [0188.105] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0188.105] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0188.105] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0188.105] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xa, lpOverlapped=0x0) returned 1 [0188.107] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.107] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.107] GetProcessHeap () returned 0x4e0000 [0188.107] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0188.107] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0188.107] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.107] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0188.107] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0188.107] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0188.107] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0188.107] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0188.107] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0188.107] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.107] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.107] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.107] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xc6, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xc6, lpOverlapped=0x0) returned 1 [0188.107] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xd0, dwBufLen=0xd0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xd0) returned 1 [0188.107] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.107] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xd0, lpOverlapped=0x0) returned 1 [0188.108] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.108] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.108] SetEndOfFile (hFile=0x100) returned 1 [0188.110] GetProcessHeap () returned 0x4e0000 [0188.110] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0188.110] GetProcessHeap () returned 0x4e0000 [0188.110] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0188.110] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14982_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14982_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14982_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14982_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0188.112] CloseHandle (hObject=0x100) returned 1 [0188.112] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc43c5a00, ftCreationTime.dwHighDateTime=0x1bd4f41, ftLastAccessTime.dwLowDateTime=0xbca5cca0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc43c5a00, ftLastWriteTime.dwHighDateTime=0x1bd4f41, nFileSizeHigh=0x0, nFileSizeLow=0x7c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD14983_.GIF", cAlternateFileName="")) returned 1 [0188.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14983_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14983_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0188.113] GetProcessHeap () returned 0x4e0000 [0188.113] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0188.114] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0188.114] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0188.114] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0188.115] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.115] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.115] GetProcessHeap () returned 0x4e0000 [0188.115] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0188.115] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0188.115] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.115] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0188.115] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0188.115] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0188.115] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0188.115] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0188.115] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0188.116] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.116] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.116] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.116] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7c, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x7c, lpOverlapped=0x0) returned 1 [0188.116] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x80, dwBufLen=0x80 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x80) returned 1 [0188.116] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.116] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x80, lpOverlapped=0x0) returned 1 [0188.116] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.116] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x154, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.116] SetEndOfFile (hFile=0x100) returned 1 [0188.118] GetProcessHeap () returned 0x4e0000 [0188.118] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0188.118] GetProcessHeap () returned 0x4e0000 [0188.118] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0188.118] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14983_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14983_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14983_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14983_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0188.119] CloseHandle (hObject=0x100) returned 1 [0188.119] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc30b2d00, ftCreationTime.dwHighDateTime=0x1bd4f41, ftLastAccessTime.dwLowDateTime=0xbca5cca0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc30b2d00, ftLastWriteTime.dwHighDateTime=0x1bd4f41, nFileSizeHigh=0x0, nFileSizeLow=0xb6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD14984_.GIF", cAlternateFileName="")) returned 1 [0188.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14984_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14984_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0188.121] GetProcessHeap () returned 0x4e0000 [0188.121] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0188.121] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0188.121] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0188.121] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xa, lpOverlapped=0x0) returned 1 [0188.122] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.122] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.122] GetProcessHeap () returned 0x4e0000 [0188.122] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0188.122] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0188.122] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.122] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0188.122] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0188.122] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0188.122] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0188.123] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0188.123] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0188.123] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.123] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.123] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.123] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb6, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xb6, lpOverlapped=0x0) returned 1 [0188.123] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0, dwBufLen=0xc0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0) returned 1 [0188.123] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.123] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xc0, lpOverlapped=0x0) returned 1 [0188.123] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.123] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.123] SetEndOfFile (hFile=0x100) returned 1 [0188.125] GetProcessHeap () returned 0x4e0000 [0188.125] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0188.125] GetProcessHeap () returned 0x4e0000 [0188.125] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0188.125] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14984_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14984_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14984_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14984_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0188.126] CloseHandle (hObject=0x100) returned 1 [0188.126] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1da0000, ftCreationTime.dwHighDateTime=0x1bd4f41, ftLastAccessTime.dwLowDateTime=0xbca5cca0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc1da0000, ftLastWriteTime.dwHighDateTime=0x1bd4f41, nFileSizeHigh=0x0, nFileSizeLow=0x40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD14985_.GIF", cAlternateFileName="")) returned 1 [0188.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14985_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14985_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0188.127] GetProcessHeap () returned 0x4e0000 [0188.127] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0188.127] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0188.127] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0188.127] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.127] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.127] GetProcessHeap () returned 0x4e0000 [0188.127] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0188.127] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0188.127] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.127] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0188.129] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0188.129] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0188.129] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0188.129] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0188.129] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0188.129] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.129] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.129] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.129] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x40, lpOverlapped=0x0) returned 1 [0188.129] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x40, dwBufLen=0x40 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x40) returned 1 [0188.129] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.129] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x40, lpOverlapped=0x0) returned 1 [0188.129] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.129] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x114, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.129] SetEndOfFile (hFile=0x100) returned 1 [0188.132] GetProcessHeap () returned 0x4e0000 [0188.132] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0188.132] GetProcessHeap () returned 0x4e0000 [0188.132] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0188.132] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14985_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14985_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14985_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14985_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0188.133] CloseHandle (hObject=0x100) returned 1 [0188.133] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57254000, ftCreationTime.dwHighDateTime=0x1bd5ec1, ftLastAccessTime.dwLowDateTime=0xbca5cca0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x57254000, ftLastWriteTime.dwHighDateTime=0x1bd5ec1, nFileSizeHigh=0x0, nFileSizeLow=0x40f6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD15018_.GIF", cAlternateFileName="")) returned 1 [0188.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15018_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15018_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0188.134] GetProcessHeap () returned 0x4e0000 [0188.134] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0188.135] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0188.135] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0188.135] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xa, lpOverlapped=0x0) returned 1 [0188.162] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.162] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.162] GetProcessHeap () returned 0x4e0000 [0188.162] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0188.162] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0188.162] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.162] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0188.162] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0188.162] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0188.162] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0188.162] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0188.162] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0188.162] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.162] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.162] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.163] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x40f6, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x40f6, lpOverlapped=0x0) returned 1 [0188.164] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x4100, dwBufLen=0x4100 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x4100) returned 1 [0188.164] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.164] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4100, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x4100, lpOverlapped=0x0) returned 1 [0188.164] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.164] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x41d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.164] SetEndOfFile (hFile=0x100) returned 1 [0188.166] GetProcessHeap () returned 0x4e0000 [0188.166] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0188.166] GetProcessHeap () returned 0x4e0000 [0188.166] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0188.166] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15018_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15018_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15018_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15018_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0188.168] CloseHandle (hObject=0x100) returned 1 [0188.168] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bb99900, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca82e00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7bb99900, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD15019_.GIF", cAlternateFileName="")) returned 1 [0188.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15019_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15019_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0188.170] GetProcessHeap () returned 0x4e0000 [0188.170] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0188.170] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0188.170] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0188.170] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x2, lpOverlapped=0x0) returned 1 [0188.171] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.171] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.171] GetProcessHeap () returned 0x4e0000 [0188.171] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0188.171] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0188.171] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.171] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0188.171] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0188.171] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0188.172] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0188.172] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0188.172] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0188.172] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.172] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.172] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.172] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xfe, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xfe, lpOverlapped=0x0) returned 1 [0188.172] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x100, dwBufLen=0x100 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x100) returned 1 [0188.172] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.172] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x100, lpOverlapped=0x0) returned 1 [0188.172] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.172] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.172] SetEndOfFile (hFile=0x100) returned 1 [0188.174] GetProcessHeap () returned 0x4e0000 [0188.174] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0188.174] GetProcessHeap () returned 0x4e0000 [0188.174] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0188.174] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15019_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15019_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15019_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15019_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0188.176] CloseHandle (hObject=0x100) returned 1 [0188.176] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83dcdc00, ftCreationTime.dwHighDateTime=0x1bd4f41, ftLastAccessTime.dwLowDateTime=0xbca82e00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x83dcdc00, ftLastWriteTime.dwHighDateTime=0x1bd4f41, nFileSizeHigh=0x0, nFileSizeLow=0x63, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD15020_.GIF", cAlternateFileName="")) returned 1 [0188.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15020_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15020_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0188.177] GetProcessHeap () returned 0x4e0000 [0188.177] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0188.177] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0188.177] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0188.177] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xd, lpOverlapped=0x0) returned 1 [0188.178] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.178] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.178] GetProcessHeap () returned 0x4e0000 [0188.178] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0188.178] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0188.178] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.178] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0188.179] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0188.179] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0188.179] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0188.179] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0188.179] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0188.179] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.179] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.179] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.179] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x63, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x63, lpOverlapped=0x0) returned 1 [0188.179] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x70, dwBufLen=0x70 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x70) returned 1 [0188.179] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.179] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x70, lpOverlapped=0x0) returned 1 [0188.179] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.179] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x144, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.179] SetEndOfFile (hFile=0x100) returned 1 [0188.181] GetProcessHeap () returned 0x4e0000 [0188.182] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0188.182] GetProcessHeap () returned 0x4e0000 [0188.182] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0188.182] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15020_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15020_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15020_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15020_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0188.183] CloseHandle (hObject=0x100) returned 1 [0188.183] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82abaf00, ftCreationTime.dwHighDateTime=0x1bd4f41, ftLastAccessTime.dwLowDateTime=0xbca82e00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x82abaf00, ftLastWriteTime.dwHighDateTime=0x1bd4f41, nFileSizeHigh=0x0, nFileSizeLow=0x4a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD15021_.GIF", cAlternateFileName="")) returned 1 [0188.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15021_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15021_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0188.184] GetProcessHeap () returned 0x4e0000 [0188.184] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0188.184] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0188.184] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0188.184] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x6, lpOverlapped=0x0) returned 1 [0188.185] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.185] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.185] GetProcessHeap () returned 0x4e0000 [0188.185] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0188.186] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0188.186] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.186] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0188.186] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0188.186] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0188.186] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0188.186] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0188.186] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0188.186] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.186] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.186] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.186] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4a, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x4a, lpOverlapped=0x0) returned 1 [0188.186] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x50, dwBufLen=0x50 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x50) returned 1 [0188.186] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.186] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x50, lpOverlapped=0x0) returned 1 [0188.186] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.186] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x124, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.186] SetEndOfFile (hFile=0x100) returned 1 [0188.188] GetProcessHeap () returned 0x4e0000 [0188.188] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0188.188] GetProcessHeap () returned 0x4e0000 [0188.188] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0188.189] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15021_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15021_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15021_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15021_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0188.189] CloseHandle (hObject=0x100) returned 1 [0188.190] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x817a8200, ftCreationTime.dwHighDateTime=0x1bd4f41, ftLastAccessTime.dwLowDateTime=0xbca82e00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x817a8200, ftLastWriteTime.dwHighDateTime=0x1bd4f41, nFileSizeHigh=0x0, nFileSizeLow=0x61, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD15022_.GIF", cAlternateFileName="")) returned 1 [0188.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15022_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15022_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0188.191] GetProcessHeap () returned 0x4e0000 [0188.191] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0188.191] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0188.191] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0188.191] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xf, lpOverlapped=0x0) returned 1 [0188.193] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.193] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.193] GetProcessHeap () returned 0x4e0000 [0188.193] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0188.193] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0188.193] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.193] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0188.193] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0188.193] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0188.193] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0188.193] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0188.193] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0188.193] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.193] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.193] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.193] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x61, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x61, lpOverlapped=0x0) returned 1 [0188.193] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x70, dwBufLen=0x70 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x70) returned 1 [0188.193] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.193] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x70, lpOverlapped=0x0) returned 1 [0188.193] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.194] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x144, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.194] SetEndOfFile (hFile=0x100) returned 1 [0188.196] GetProcessHeap () returned 0x4e0000 [0188.196] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0188.196] GetProcessHeap () returned 0x4e0000 [0188.196] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0188.196] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15022_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15022_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15022_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15022_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0188.197] CloseHandle (hObject=0x100) returned 1 [0188.197] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80495500, ftCreationTime.dwHighDateTime=0x1bd4f41, ftLastAccessTime.dwLowDateTime=0xbca82e00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x80495500, ftLastWriteTime.dwHighDateTime=0x1bd4f41, nFileSizeHigh=0x0, nFileSizeLow=0x7a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD15023_.GIF", cAlternateFileName="")) returned 1 [0188.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15023_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15023_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0188.198] GetProcessHeap () returned 0x4e0000 [0188.198] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0188.198] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0188.198] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0188.199] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x6, lpOverlapped=0x0) returned 1 [0188.200] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.200] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.200] GetProcessHeap () returned 0x4e0000 [0188.200] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0188.200] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0188.200] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.200] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0188.200] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0188.200] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0188.200] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0188.200] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0188.200] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0188.201] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.201] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.201] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.201] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7a, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x7a, lpOverlapped=0x0) returned 1 [0188.201] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x80, dwBufLen=0x80 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x80) returned 1 [0188.201] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.201] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x80, lpOverlapped=0x0) returned 1 [0188.201] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.201] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x154, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.201] SetEndOfFile (hFile=0x100) returned 1 [0188.203] GetProcessHeap () returned 0x4e0000 [0188.203] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0188.203] GetProcessHeap () returned 0x4e0000 [0188.203] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0188.203] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15023_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15023_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15023_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15023_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0188.204] CloseHandle (hObject=0x100) returned 1 [0188.204] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95f37700, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcaa8f60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x95f37700, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD15056_.GIF", cAlternateFileName="")) returned 1 [0188.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15056_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15056_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0188.206] GetProcessHeap () returned 0x4e0000 [0188.206] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0188.206] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0188.206] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0188.206] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x6, lpOverlapped=0x0) returned 1 [0188.207] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.207] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.207] GetProcessHeap () returned 0x4e0000 [0188.207] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0188.207] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0188.207] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.207] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0188.207] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0188.208] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0188.208] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0188.208] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0188.208] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0188.208] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.208] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.208] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.208] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xda, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xda, lpOverlapped=0x0) returned 1 [0188.208] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xe0, dwBufLen=0xe0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xe0) returned 1 [0188.208] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.208] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xe0, lpOverlapped=0x0) returned 1 [0188.208] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.208] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.208] SetEndOfFile (hFile=0x100) returned 1 [0188.210] GetProcessHeap () returned 0x4e0000 [0188.210] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0188.210] GetProcessHeap () returned 0x4e0000 [0188.210] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0188.210] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15056_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15056_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15056_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15056_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0188.212] CloseHandle (hObject=0x100) returned 1 [0188.212] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95f37700, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcaa8f60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x95f37700, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD15057_.GIF", cAlternateFileName="")) returned 1 [0188.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15057_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15057_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0188.212] GetProcessHeap () returned 0x4e0000 [0188.212] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0188.213] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0188.213] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0188.213] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x6, lpOverlapped=0x0) returned 1 [0188.215] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.215] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.215] GetProcessHeap () returned 0x4e0000 [0188.215] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0188.215] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0188.215] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.215] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0188.215] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0188.215] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0188.215] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0188.215] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0188.216] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0188.216] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.216] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.216] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.216] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xda, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xda, lpOverlapped=0x0) returned 1 [0188.216] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xe0, dwBufLen=0xe0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xe0) returned 1 [0188.216] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.216] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xe0, lpOverlapped=0x0) returned 1 [0188.216] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.216] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.216] SetEndOfFile (hFile=0x100) returned 1 [0188.218] GetProcessHeap () returned 0x4e0000 [0188.218] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0188.218] GetProcessHeap () returned 0x4e0000 [0188.218] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0188.218] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15057_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15057_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15057_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15057_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0188.219] CloseHandle (hObject=0x100) returned 1 [0188.219] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9724a400, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcaa8f60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9724a400, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xc7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD15058_.GIF", cAlternateFileName="")) returned 1 [0188.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15058_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15058_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0188.220] GetProcessHeap () returned 0x4e0000 [0188.220] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0188.220] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0188.220] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0188.220] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x9, lpOverlapped=0x0) returned 1 [0188.221] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.222] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.222] GetProcessHeap () returned 0x4e0000 [0188.222] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0188.222] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0188.222] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.222] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0188.222] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0188.222] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0188.222] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0188.222] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0188.222] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0188.222] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.222] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.222] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.222] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xc7, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xc7, lpOverlapped=0x0) returned 1 [0188.222] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xd0, dwBufLen=0xd0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xd0) returned 1 [0188.222] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.222] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xd0, lpOverlapped=0x0) returned 1 [0188.222] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.223] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.223] SetEndOfFile (hFile=0x100) returned 1 [0188.225] GetProcessHeap () returned 0x4e0000 [0188.225] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0188.225] GetProcessHeap () returned 0x4e0000 [0188.225] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0188.225] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15058_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15058_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15058_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15058_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0188.226] CloseHandle (hObject=0x100) returned 1 [0188.226] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x319bbb00, ftCreationTime.dwHighDateTime=0x1bd4f41, ftLastAccessTime.dwLowDateTime=0xbcaa8f60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x319bbb00, ftLastWriteTime.dwHighDateTime=0x1bd4f41, nFileSizeHigh=0x0, nFileSizeLow=0xaa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD15059_.GIF", cAlternateFileName="")) returned 1 [0188.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15059_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15059_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0188.227] GetProcessHeap () returned 0x4e0000 [0188.227] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0188.227] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0188.227] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0188.227] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x6, lpOverlapped=0x0) returned 1 [0188.228] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.228] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.228] GetProcessHeap () returned 0x4e0000 [0188.228] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0188.228] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0188.228] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.228] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0188.228] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0188.229] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0188.229] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0188.229] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0188.229] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0188.229] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.229] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.229] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.229] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xaa, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xaa, lpOverlapped=0x0) returned 1 [0188.229] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xb0, dwBufLen=0xb0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xb0) returned 1 [0188.229] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.229] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xb0, lpOverlapped=0x0) returned 1 [0188.229] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.229] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x184, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.229] SetEndOfFile (hFile=0x100) returned 1 [0188.233] GetProcessHeap () returned 0x4e0000 [0188.233] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0188.233] GetProcessHeap () returned 0x4e0000 [0188.233] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0188.233] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15059_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15059_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15059_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15059_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0188.235] CloseHandle (hObject=0x100) returned 1 [0188.235] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x306a8e00, ftCreationTime.dwHighDateTime=0x1bd4f41, ftLastAccessTime.dwLowDateTime=0xbcaa8f60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x306a8e00, ftLastWriteTime.dwHighDateTime=0x1bd4f41, nFileSizeHigh=0x0, nFileSizeLow=0x78, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD15060_.GIF", cAlternateFileName="")) returned 1 [0188.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15060_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15060_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0188.236] GetProcessHeap () returned 0x4e0000 [0188.236] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0188.236] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0188.236] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0188.236] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0188.238] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.238] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.238] GetProcessHeap () returned 0x4e0000 [0188.238] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0188.238] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0188.238] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.238] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0188.238] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0188.238] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0188.238] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0188.238] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0188.238] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0188.238] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.238] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.238] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.238] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x78, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x78, lpOverlapped=0x0) returned 1 [0188.238] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x80, dwBufLen=0x80 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x80) returned 1 [0188.239] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.239] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x80, lpOverlapped=0x0) returned 1 [0188.239] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.239] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x154, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.239] SetEndOfFile (hFile=0x100) returned 1 [0188.241] GetProcessHeap () returned 0x4e0000 [0188.241] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0188.241] GetProcessHeap () returned 0x4e0000 [0188.241] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0188.241] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15060_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15060_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15060_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15060_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0188.242] CloseHandle (hObject=0x100) returned 1 [0188.242] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f396100, ftCreationTime.dwHighDateTime=0x1bd4f41, ftLastAccessTime.dwLowDateTime=0xbcaa8f60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2f396100, ftLastWriteTime.dwHighDateTime=0x1bd4f41, nFileSizeHigh=0x0, nFileSizeLow=0x77, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD15061_.GIF", cAlternateFileName="")) returned 1 [0188.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15061_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15061_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0188.243] GetProcessHeap () returned 0x4e0000 [0188.243] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0188.243] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0188.243] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0188.243] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x9, lpOverlapped=0x0) returned 1 [0188.245] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.245] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.245] GetProcessHeap () returned 0x4e0000 [0188.245] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0188.245] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0188.245] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.245] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0188.245] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0188.245] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0188.245] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0188.245] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0188.245] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0188.245] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.245] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.245] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.245] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x77, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x77, lpOverlapped=0x0) returned 1 [0188.246] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x80, dwBufLen=0x80 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x80) returned 1 [0188.246] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.246] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x80, lpOverlapped=0x0) returned 1 [0188.246] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.246] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x154, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.246] SetEndOfFile (hFile=0x100) returned 1 [0188.248] GetProcessHeap () returned 0x4e0000 [0188.248] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0188.248] GetProcessHeap () returned 0x4e0000 [0188.248] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0188.248] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15061_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15061_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15061_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15061_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0188.249] CloseHandle (hObject=0x100) returned 1 [0188.249] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfac9e00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcacf0c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbfac9e00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD15132_.GIF", cAlternateFileName="")) returned 1 [0188.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15132_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15132_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0188.251] GetProcessHeap () returned 0x4e0000 [0188.251] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0188.251] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0188.251] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0188.251] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x7, lpOverlapped=0x0) returned 1 [0188.252] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.252] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.252] GetProcessHeap () returned 0x4e0000 [0188.252] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0188.252] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0188.252] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.253] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0188.253] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0188.253] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0188.253] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0188.253] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0188.253] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0188.253] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.253] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.253] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.253] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb9, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xb9, lpOverlapped=0x0) returned 1 [0188.253] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0, dwBufLen=0xc0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0) returned 1 [0188.253] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.253] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xc0, lpOverlapped=0x0) returned 1 [0188.253] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.253] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.253] SetEndOfFile (hFile=0x100) returned 1 [0188.255] GetProcessHeap () returned 0x4e0000 [0188.255] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0188.255] GetProcessHeap () returned 0x4e0000 [0188.255] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0188.255] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15132_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15132_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15132_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15132_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0188.257] CloseHandle (hObject=0x100) returned 1 [0188.257] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0ddcb00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcacf0c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc0ddcb00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xb0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD15133_.GIF", cAlternateFileName="")) returned 1 [0188.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15133_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15133_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0188.258] GetProcessHeap () returned 0x4e0000 [0188.258] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0188.258] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0188.258] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0188.258] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.258] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.258] GetProcessHeap () returned 0x4e0000 [0188.258] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0188.258] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0188.258] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.258] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0188.259] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0188.259] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0188.259] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0188.259] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0188.259] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0188.260] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.260] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.260] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.260] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb0, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xb0, lpOverlapped=0x0) returned 1 [0188.260] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xb0, dwBufLen=0xb0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xb0) returned 1 [0188.260] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.260] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xb0, lpOverlapped=0x0) returned 1 [0188.260] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.260] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x184, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.260] SetEndOfFile (hFile=0x100) returned 1 [0188.262] GetProcessHeap () returned 0x4e0000 [0188.262] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0188.262] GetProcessHeap () returned 0x4e0000 [0188.262] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0188.262] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15133_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15133_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15133_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15133_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0188.264] CloseHandle (hObject=0x100) returned 1 [0188.264] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0ddcb00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcacf0c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc0ddcb00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xb1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD15134_.GIF", cAlternateFileName="")) returned 1 [0188.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15134_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15134_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0188.265] GetProcessHeap () returned 0x4e0000 [0188.265] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0188.265] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0188.265] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0188.265] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xf, lpOverlapped=0x0) returned 1 [0188.266] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.266] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.266] GetProcessHeap () returned 0x4e0000 [0188.266] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0188.266] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0188.266] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.266] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0188.266] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0188.266] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0188.266] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0188.267] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0188.267] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0188.267] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.267] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.267] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.267] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb1, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xb1, lpOverlapped=0x0) returned 1 [0188.267] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0, dwBufLen=0xc0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0) returned 1 [0188.267] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.267] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xc0, lpOverlapped=0x0) returned 1 [0188.267] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.267] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.267] SetEndOfFile (hFile=0x100) returned 1 [0188.269] GetProcessHeap () returned 0x4e0000 [0188.269] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0188.269] GetProcessHeap () returned 0x4e0000 [0188.269] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0188.269] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15134_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15134_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15134_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15134_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0188.271] CloseHandle (hObject=0x100) returned 1 [0188.271] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0ddcb00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcacf0c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc0ddcb00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xaf, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD15135_.GIF", cAlternateFileName="")) returned 1 [0188.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15135_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15135_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0188.272] GetProcessHeap () returned 0x4e0000 [0188.272] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0188.272] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0188.272] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0188.272] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x1, lpOverlapped=0x0) returned 1 [0188.273] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.273] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.273] GetProcessHeap () returned 0x4e0000 [0188.273] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0188.273] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0188.273] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.274] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0188.274] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0188.274] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0188.274] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0188.274] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0188.274] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0188.274] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.274] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.274] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.274] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xaf, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xaf, lpOverlapped=0x0) returned 1 [0188.274] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xb0, dwBufLen=0xb0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xb0) returned 1 [0188.274] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.274] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xb0, lpOverlapped=0x0) returned 1 [0188.274] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.274] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x184, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.274] SetEndOfFile (hFile=0x100) returned 1 [0188.277] GetProcessHeap () returned 0x4e0000 [0188.277] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0188.277] GetProcessHeap () returned 0x4e0000 [0188.277] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0188.277] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15135_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15135_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15135_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15135_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0188.278] CloseHandle (hObject=0x100) returned 1 [0188.278] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc20ef800, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcaf5220, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc20ef800, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xaf, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD15136_.GIF", cAlternateFileName="")) returned 1 [0188.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15136_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15136_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0188.282] GetProcessHeap () returned 0x4e0000 [0188.282] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0188.282] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0188.282] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0188.282] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x1, lpOverlapped=0x0) returned 1 [0188.283] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.283] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.283] GetProcessHeap () returned 0x4e0000 [0188.283] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0188.283] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0188.283] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.284] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0188.284] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0188.284] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0188.284] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0188.284] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0188.284] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0188.284] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.284] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.284] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.284] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xaf, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xaf, lpOverlapped=0x0) returned 1 [0188.284] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xb0, dwBufLen=0xb0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xb0) returned 1 [0188.284] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.284] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xb0, lpOverlapped=0x0) returned 1 [0188.284] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.284] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x184, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.285] SetEndOfFile (hFile=0x100) returned 1 [0188.286] GetProcessHeap () returned 0x4e0000 [0188.287] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0188.287] GetProcessHeap () returned 0x4e0000 [0188.287] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0188.287] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15136_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15136_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15136_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15136_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0188.288] CloseHandle (hObject=0x100) returned 1 [0188.288] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdfaba00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcaf5220, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xcdfaba00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x14b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD15168_.GIF", cAlternateFileName="")) returned 1 [0188.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15168_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15168_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0188.289] GetProcessHeap () returned 0x4e0000 [0188.290] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0188.290] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0188.290] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0188.290] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x5, lpOverlapped=0x0) returned 1 [0188.291] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.291] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.291] GetProcessHeap () returned 0x4e0000 [0188.291] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0188.291] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0188.291] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.291] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0188.291] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0188.291] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0188.291] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0188.291] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0188.291] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0188.292] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.292] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.292] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.292] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x14b, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x14b, lpOverlapped=0x0) returned 1 [0188.292] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x150, dwBufLen=0x150 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x150) returned 1 [0188.292] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.292] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x150, lpOverlapped=0x0) returned 1 [0188.292] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.292] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.292] SetEndOfFile (hFile=0x100) returned 1 [0188.294] GetProcessHeap () returned 0x4e0000 [0188.295] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0188.295] GetProcessHeap () returned 0x4e0000 [0188.295] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0188.295] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15168_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15168_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15168_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15168_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0188.297] CloseHandle (hObject=0x100) returned 1 [0188.297] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdfaba00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcaf5220, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xcdfaba00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x154, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD15169_.GIF", cAlternateFileName="")) returned 1 [0188.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15169_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15169_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0188.299] GetProcessHeap () returned 0x4e0000 [0188.299] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0188.299] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0188.299] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0188.299] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xc, lpOverlapped=0x0) returned 1 [0188.300] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.301] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.301] GetProcessHeap () returned 0x4e0000 [0188.301] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0188.301] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0188.301] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.301] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0188.301] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0188.301] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0188.301] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0188.301] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0188.301] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0188.301] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.301] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.301] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.301] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x154, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x154, lpOverlapped=0x0) returned 1 [0188.301] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x160, dwBufLen=0x160 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x160) returned 1 [0188.301] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.301] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x160, lpOverlapped=0x0) returned 1 [0188.301] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.301] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x234, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.302] SetEndOfFile (hFile=0x100) returned 1 [0188.304] GetProcessHeap () returned 0x4e0000 [0188.304] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0188.304] GetProcessHeap () returned 0x4e0000 [0188.304] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0188.304] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15169_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15169_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15169_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15169_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0188.370] CloseHandle (hObject=0x100) returned 1 [0188.370] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf2be700, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcaf5220, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xcf2be700, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD15170_.GIF", cAlternateFileName="")) returned 1 [0188.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15170_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15170_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0188.372] GetProcessHeap () returned 0x4e0000 [0188.372] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0188.372] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0188.372] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0188.372] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xf, lpOverlapped=0x0) returned 1 [0188.374] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.374] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.374] GetProcessHeap () returned 0x4e0000 [0188.374] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0188.374] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0188.374] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.374] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0188.374] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0188.374] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0188.375] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0188.375] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0188.375] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0188.375] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.375] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.375] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.375] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x101, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x101, lpOverlapped=0x0) returned 1 [0188.375] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x110, dwBufLen=0x110 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x110) returned 1 [0188.375] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.375] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x110, lpOverlapped=0x0) returned 1 [0188.375] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.375] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.375] SetEndOfFile (hFile=0x100) returned 1 [0188.378] GetProcessHeap () returned 0x4e0000 [0188.378] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0188.378] GetProcessHeap () returned 0x4e0000 [0188.378] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0188.378] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15170_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15170_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15170_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15170_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0188.380] CloseHandle (hObject=0x100) returned 1 [0188.380] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a06a900, ftCreationTime.dwHighDateTime=0x1bd4f40, ftLastAccessTime.dwLowDateTime=0xbcaf5220, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7a06a900, ftLastWriteTime.dwHighDateTime=0x1bd4f40, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD15171_.GIF", cAlternateFileName="")) returned 1 [0188.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15171_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15171_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0188.382] GetProcessHeap () returned 0x4e0000 [0188.382] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0188.382] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0188.382] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0188.382] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xf, lpOverlapped=0x0) returned 1 [0188.383] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.384] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.384] GetProcessHeap () returned 0x4e0000 [0188.384] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0188.384] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0188.384] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.384] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0188.384] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0188.384] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0188.384] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0188.384] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0188.384] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0188.384] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.384] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.384] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.384] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x91, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x91, lpOverlapped=0x0) returned 1 [0188.384] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xa0, dwBufLen=0xa0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xa0) returned 1 [0188.384] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.384] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xa0, lpOverlapped=0x0) returned 1 [0188.385] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.385] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x174, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.385] SetEndOfFile (hFile=0x100) returned 1 [0188.387] GetProcessHeap () returned 0x4e0000 [0188.387] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0188.387] GetProcessHeap () returned 0x4e0000 [0188.387] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0188.387] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15171_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15171_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15171_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15171_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0188.388] CloseHandle (hObject=0x100) returned 1 [0188.388] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf2be700, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcb1b380, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xcf2be700, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x130, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD15172_.GIF", cAlternateFileName="")) returned 1 [0188.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15172_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15172_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0188.389] GetProcessHeap () returned 0x4e0000 [0188.389] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0188.390] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0188.390] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0188.390] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.390] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.390] GetProcessHeap () returned 0x4e0000 [0188.390] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0188.390] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0188.390] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.390] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0188.391] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0188.391] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0188.391] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0188.391] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0188.391] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0188.391] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.391] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.391] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.391] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x130, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x130, lpOverlapped=0x0) returned 1 [0188.392] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x130, dwBufLen=0x130 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x130) returned 1 [0188.392] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.392] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x130, lpOverlapped=0x0) returned 1 [0188.392] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.392] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.392] SetEndOfFile (hFile=0x100) returned 1 [0188.394] GetProcessHeap () returned 0x4e0000 [0188.394] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0188.394] GetProcessHeap () returned 0x4e0000 [0188.394] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0188.394] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15172_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15172_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15172_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15172_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0188.396] CloseHandle (hObject=0x100) returned 1 [0188.397] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77a44f00, ftCreationTime.dwHighDateTime=0x1bd4f40, ftLastAccessTime.dwLowDateTime=0xbcb1b380, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x77a44f00, ftLastWriteTime.dwHighDateTime=0x1bd4f40, nFileSizeHigh=0x0, nFileSizeLow=0x8a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD15173_.GIF", cAlternateFileName="")) returned 1 [0188.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15173_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15173_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0188.398] GetProcessHeap () returned 0x4e0000 [0188.398] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0188.398] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0188.399] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0188.399] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x6, lpOverlapped=0x0) returned 1 [0188.400] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.400] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.400] GetProcessHeap () returned 0x4e0000 [0188.400] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0188.400] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0188.400] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.400] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0188.400] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0188.400] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0188.400] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0188.400] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0188.400] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0188.400] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.400] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.401] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.401] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x8a, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x8a, lpOverlapped=0x0) returned 1 [0188.401] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x90, dwBufLen=0x90 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x90) returned 1 [0188.401] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.401] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x90, lpOverlapped=0x0) returned 1 [0188.401] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.401] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x164, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.401] SetEndOfFile (hFile=0x100) returned 1 [0188.403] GetProcessHeap () returned 0x4e0000 [0188.403] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0188.403] GetProcessHeap () returned 0x4e0000 [0188.403] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0188.403] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15173_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15173_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15173_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15173_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0188.404] CloseHandle (hObject=0x100) returned 1 [0188.405] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb476800, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcb1b380, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfb476800, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x1c8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD15272_.GIF", cAlternateFileName="")) returned 1 [0188.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15272_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15272_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0188.405] GetProcessHeap () returned 0x4e0000 [0188.405] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0188.406] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0188.406] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0188.406] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0188.407] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.407] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.407] GetProcessHeap () returned 0x4e0000 [0188.407] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0188.407] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0188.407] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.407] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0188.407] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0188.407] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0188.407] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0188.407] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0188.407] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0188.408] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.408] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.408] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.408] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1c8, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x1c8, lpOverlapped=0x0) returned 1 [0188.408] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1d0) returned 1 [0188.408] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.408] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x1d0, lpOverlapped=0x0) returned 1 [0188.408] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.408] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x2a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.408] SetEndOfFile (hFile=0x100) returned 1 [0188.410] GetProcessHeap () returned 0x4e0000 [0188.410] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0188.410] GetProcessHeap () returned 0x4e0000 [0188.410] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0188.410] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15272_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15272_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15272_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15272_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0188.614] CloseHandle (hObject=0x100) returned 1 [0188.614] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc789500, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcb1b380, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfc789500, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD15273_.GIF", cAlternateFileName="")) returned 1 [0188.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15273_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15273_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0188.617] GetProcessHeap () returned 0x4e0000 [0188.617] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0188.617] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0188.617] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0188.617] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x7, lpOverlapped=0x0) returned 1 [0188.619] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.619] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.620] GetProcessHeap () returned 0x4e0000 [0188.620] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0188.620] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0188.620] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.620] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0188.620] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0188.620] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0188.620] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0188.620] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0188.620] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0188.620] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.620] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.621] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.621] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb9, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xb9, lpOverlapped=0x0) returned 1 [0188.621] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0, dwBufLen=0xc0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0) returned 1 [0188.621] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.621] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xc0, lpOverlapped=0x0) returned 1 [0188.621] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.621] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.621] SetEndOfFile (hFile=0x100) returned 1 [0188.624] GetProcessHeap () returned 0x4e0000 [0188.624] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0188.624] GetProcessHeap () returned 0x4e0000 [0188.624] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0188.624] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15273_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15273_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15273_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15273_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0188.630] CloseHandle (hObject=0x100) returned 1 [0188.630] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc998a500, ftCreationTime.dwHighDateTime=0x1bd4f3f, ftLastAccessTime.dwLowDateTime=0xbcb414e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc998a500, ftLastWriteTime.dwHighDateTime=0x1bd4f3f, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD15274_.GIF", cAlternateFileName="")) returned 1 [0188.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15274_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15274_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0188.632] GetProcessHeap () returned 0x4e0000 [0188.632] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0188.632] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0188.632] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0188.632] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.632] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.632] GetProcessHeap () returned 0x4e0000 [0188.633] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0188.633] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0188.633] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.633] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0188.634] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0188.634] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0188.635] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0188.635] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0188.635] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0188.635] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.635] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.635] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.635] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xd0, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xd0, lpOverlapped=0x0) returned 1 [0188.635] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xd0, dwBufLen=0xd0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xd0) returned 1 [0188.635] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.636] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xd0, lpOverlapped=0x0) returned 1 [0188.636] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.636] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x1a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.636] SetEndOfFile (hFile=0x100) returned 1 [0188.644] GetProcessHeap () returned 0x4e0000 [0188.644] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0188.644] GetProcessHeap () returned 0x4e0000 [0188.644] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0188.644] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15274_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15274_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15274_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15274_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0188.648] CloseHandle (hObject=0x100) returned 1 [0188.648] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7364b00, ftCreationTime.dwHighDateTime=0x1bd4f3f, ftLastAccessTime.dwLowDateTime=0xbcb414e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc7364b00, ftLastWriteTime.dwHighDateTime=0x1bd4f3f, nFileSizeHigh=0x0, nFileSizeLow=0x3f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD15275_.GIF", cAlternateFileName="")) returned 1 [0188.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15275_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15275_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0188.650] GetProcessHeap () returned 0x4e0000 [0188.650] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0188.650] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0188.650] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0188.650] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x1, lpOverlapped=0x0) returned 1 [0188.652] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.652] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.652] GetProcessHeap () returned 0x4e0000 [0188.652] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0188.652] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0188.652] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.652] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0188.652] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0188.652] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0188.652] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0188.652] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0188.653] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0188.653] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.653] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.653] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.653] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3f, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x3f, lpOverlapped=0x0) returned 1 [0188.653] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x40, dwBufLen=0x40 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x40) returned 1 [0188.653] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.653] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x40, lpOverlapped=0x0) returned 1 [0188.653] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.653] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x114, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.653] SetEndOfFile (hFile=0x100) returned 1 [0188.656] GetProcessHeap () returned 0x4e0000 [0188.656] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0188.656] GetProcessHeap () returned 0x4e0000 [0188.656] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0188.656] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15275_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15275_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15275_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15275_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0188.659] CloseHandle (hObject=0x100) returned 1 [0188.659] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3a2c400, ftCreationTime.dwHighDateTime=0x1bd4f3f, ftLastAccessTime.dwLowDateTime=0xbcb414e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc3a2c400, ftLastWriteTime.dwHighDateTime=0x1bd4f3f, nFileSizeHigh=0x0, nFileSizeLow=0x49, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD15276_.GIF", cAlternateFileName="")) returned 1 [0188.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15276_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15276_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0188.661] GetProcessHeap () returned 0x4e0000 [0188.661] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0188.661] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0188.661] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0188.661] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x7, lpOverlapped=0x0) returned 1 [0188.663] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.663] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.663] GetProcessHeap () returned 0x4e0000 [0188.663] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0188.663] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0188.663] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.663] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0188.663] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0188.664] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0188.664] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0188.664] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0188.664] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0188.664] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.664] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.664] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.664] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x49, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x49, lpOverlapped=0x0) returned 1 [0188.664] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x50, dwBufLen=0x50 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x50) returned 1 [0188.664] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.664] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x50, lpOverlapped=0x0) returned 1 [0188.664] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.664] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x124, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.665] SetEndOfFile (hFile=0x100) returned 1 [0188.667] GetProcessHeap () returned 0x4e0000 [0188.667] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0188.668] GetProcessHeap () returned 0x4e0000 [0188.668] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0188.668] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15276_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15276_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15276_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15276_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0188.670] CloseHandle (hObject=0x100) returned 1 [0188.670] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2719700, ftCreationTime.dwHighDateTime=0x1bd4f3f, ftLastAccessTime.dwLowDateTime=0xbcb414e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc2719700, ftLastWriteTime.dwHighDateTime=0x1bd4f3f, nFileSizeHigh=0x0, nFileSizeLow=0x3c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD15277_.GIF", cAlternateFileName="")) returned 1 [0188.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15277_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15277_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0188.672] GetProcessHeap () returned 0x4e0000 [0188.672] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0188.672] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0188.672] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0188.672] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0188.673] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.674] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.674] GetProcessHeap () returned 0x4e0000 [0188.674] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0188.674] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0188.674] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.674] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0188.674] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0188.674] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0188.674] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0188.674] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0188.674] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0188.674] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.674] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.675] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.675] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3c, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x3c, lpOverlapped=0x0) returned 1 [0188.675] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x40, dwBufLen=0x40 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x40) returned 1 [0188.675] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.675] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x40, lpOverlapped=0x0) returned 1 [0188.675] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.675] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x114, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.675] SetEndOfFile (hFile=0x100) returned 1 [0188.678] GetProcessHeap () returned 0x4e0000 [0188.678] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0188.678] GetProcessHeap () returned 0x4e0000 [0188.678] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0188.678] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15277_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15277_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15277_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15277_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0188.680] CloseHandle (hObject=0x100) returned 1 [0188.680] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42390f00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd0a560, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x42390f00, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x7a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD21294_.GIF", cAlternateFileName="")) returned 1 [0188.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21294_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21294_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0188.687] GetProcessHeap () returned 0x4e0000 [0188.687] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0188.687] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0188.687] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0188.687] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x6, lpOverlapped=0x0) returned 1 [0188.692] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.692] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.692] GetProcessHeap () returned 0x4e0000 [0188.692] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0188.692] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0188.693] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.693] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0188.693] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0188.693] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0188.693] WriteFile (in: hFile=0x100, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0188.693] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0188.693] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0188.693] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.693] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.693] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.693] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x7a, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x7a, lpOverlapped=0x0) returned 1 [0188.693] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x80, dwBufLen=0x80 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x80) returned 1 [0188.694] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.694] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x80, lpOverlapped=0x0) returned 1 [0188.694] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.694] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x154, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.694] SetEndOfFile (hFile=0x100) returned 1 [0188.696] GetProcessHeap () returned 0x4e0000 [0188.697] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0188.697] GetProcessHeap () returned 0x4e0000 [0188.697] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0188.697] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21294_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21294_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21294_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21294_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0188.699] CloseHandle (hObject=0x100) returned 1 [0188.699] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x436a3c00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd0a560, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x436a3c00, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD21295_.GIF", cAlternateFileName="")) returned 1 [0188.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21295_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21295_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0188.701] GetProcessHeap () returned 0x4e0000 [0188.701] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0188.701] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0188.701] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0188.701] WriteFile (in: hFile=0x100, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xa, lpOverlapped=0x0) returned 1 [0188.702] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.702] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.703] GetProcessHeap () returned 0x4e0000 [0188.703] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0188.703] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0188.703] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.703] WriteFile (in: hFile=0x100, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0188.703] WriteFile (in: hFile=0x100, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0188.703] WriteFile (in: hFile=0x100, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0188.703] WriteFile (in: hFile=0x100, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0188.703] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0188.703] WriteFile (in: hFile=0x100, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0188.703] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.703] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.703] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.704] ReadFile (in: hFile=0x100, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x96, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x96, lpOverlapped=0x0) returned 1 [0188.704] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xa0, dwBufLen=0xa0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xa0) returned 1 [0188.704] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.704] WriteFile (in: hFile=0x100, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xa0, lpOverlapped=0x0) returned 1 [0188.704] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.704] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x174, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.704] SetEndOfFile (hFile=0x100) returned 1 [0188.707] GetProcessHeap () returned 0x4e0000 [0188.707] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0188.707] GetProcessHeap () returned 0x4e0000 [0188.707] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0188.707] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21295_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21295_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21295_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21295_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0188.708] CloseHandle (hObject=0x100) returned 1 [0188.709] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45cc9600, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd0a560, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x45cc9600, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x94, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD21296_.GIF", cAlternateFileName="")) returned 1 [0188.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21296_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21296_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0188.714] GetProcessHeap () returned 0x4e0000 [0188.714] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0188.714] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0188.714] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0188.714] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xc, lpOverlapped=0x0) returned 1 [0188.716] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.716] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.716] GetProcessHeap () returned 0x4e0000 [0188.716] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0188.716] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0188.716] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.716] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0188.716] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0188.716] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0188.716] WriteFile (in: hFile=0x11c, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0188.717] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0188.717] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0188.717] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.717] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.717] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.717] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x94, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x94, lpOverlapped=0x0) returned 1 [0188.717] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xa0, dwBufLen=0xa0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xa0) returned 1 [0188.717] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.717] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xa0, lpOverlapped=0x0) returned 1 [0188.717] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.717] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x174, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.717] SetEndOfFile (hFile=0x11c) returned 1 [0188.720] GetProcessHeap () returned 0x4e0000 [0188.720] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0188.720] GetProcessHeap () returned 0x4e0000 [0188.720] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0188.720] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21296_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21296_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21296_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21296_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0188.722] CloseHandle (hObject=0x11c) returned 1 [0188.722] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x449b6900, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd0a560, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x449b6900, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x370, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD21297_.GIF", cAlternateFileName="")) returned 1 [0188.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21297_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21297_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0188.724] GetProcessHeap () returned 0x4e0000 [0188.724] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0188.724] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0188.724] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0188.724] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.724] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.724] GetProcessHeap () returned 0x4e0000 [0188.724] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0188.724] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0188.724] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.724] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0188.791] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0188.792] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0188.792] WriteFile (in: hFile=0x11c, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0188.792] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0188.792] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0188.792] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.792] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.792] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.792] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x370, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x370, lpOverlapped=0x0) returned 1 [0188.792] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x370, dwBufLen=0x370 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x370) returned 1 [0188.792] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.792] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x370, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x370, lpOverlapped=0x0) returned 1 [0188.793] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.793] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x444, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.793] SetEndOfFile (hFile=0x11c) returned 1 [0188.795] GetProcessHeap () returned 0x4e0000 [0188.795] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0188.795] GetProcessHeap () returned 0x4e0000 [0188.795] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0188.795] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21297_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21297_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21297_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21297_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0188.798] CloseHandle (hObject=0x11c) returned 1 [0188.798] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a914a00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd0a560, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4a914a00, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x65, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD21298_.GIF", cAlternateFileName="")) returned 1 [0188.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21298_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21298_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0188.814] GetProcessHeap () returned 0x4e0000 [0188.814] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0188.814] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0188.814] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0188.814] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xb, lpOverlapped=0x0) returned 1 [0188.816] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.816] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.816] GetProcessHeap () returned 0x4e0000 [0188.816] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0188.816] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0188.816] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.816] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0188.816] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0188.816] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0188.816] WriteFile (in: hFile=0x11c, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0188.817] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0188.817] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0188.817] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.817] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.817] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.817] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x65, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x65, lpOverlapped=0x0) returned 1 [0188.817] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x70, dwBufLen=0x70 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x70) returned 1 [0188.817] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.817] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x70, lpOverlapped=0x0) returned 1 [0188.817] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.817] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x144, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.817] SetEndOfFile (hFile=0x11c) returned 1 [0188.819] GetProcessHeap () returned 0x4e0000 [0188.819] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0188.819] GetProcessHeap () returned 0x4e0000 [0188.819] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0188.819] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21298_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21298_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21298_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21298_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0188.821] CloseHandle (hObject=0x11c) returned 1 [0188.821] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49601d00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd0a560, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x49601d00, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x4f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD21299_.GIF", cAlternateFileName="")) returned 1 [0188.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21299_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21299_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0188.823] GetProcessHeap () returned 0x4e0000 [0188.823] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0188.823] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0188.823] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0188.823] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x1, lpOverlapped=0x0) returned 1 [0188.824] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.824] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.824] GetProcessHeap () returned 0x4e0000 [0188.824] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0188.824] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0188.824] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.824] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0188.825] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0188.825] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0188.825] WriteFile (in: hFile=0x11c, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0188.825] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0188.825] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0188.825] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.825] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.825] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.825] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x4f, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x4f, lpOverlapped=0x0) returned 1 [0188.825] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x50, dwBufLen=0x50 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x50) returned 1 [0188.825] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.825] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x50, lpOverlapped=0x0) returned 1 [0188.825] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.825] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x124, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.825] SetEndOfFile (hFile=0x11c) returned 1 [0188.827] GetProcessHeap () returned 0x4e0000 [0188.827] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0188.827] GetProcessHeap () returned 0x4e0000 [0188.827] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0188.827] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21299_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21299_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21299_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21299_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0188.829] CloseHandle (hObject=0x11c) returned 1 [0188.829] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x482ef000, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd306c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x482ef000, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x8c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD21300_.GIF", cAlternateFileName="")) returned 1 [0188.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21300_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21300_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0188.830] GetProcessHeap () returned 0x4e0000 [0188.830] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0188.831] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0188.831] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0188.831] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0188.832] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.832] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.832] GetProcessHeap () returned 0x4e0000 [0188.832] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0188.832] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0188.832] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.832] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0188.832] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0188.832] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0188.832] WriteFile (in: hFile=0x11c, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0188.832] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0188.832] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0188.833] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.833] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.833] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.833] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x8c, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x8c, lpOverlapped=0x0) returned 1 [0188.833] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x90, dwBufLen=0x90 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x90) returned 1 [0188.833] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.833] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x90, lpOverlapped=0x0) returned 1 [0188.833] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.833] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x164, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.833] SetEndOfFile (hFile=0x11c) returned 1 [0188.835] GetProcessHeap () returned 0x4e0000 [0188.835] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0188.835] GetProcessHeap () returned 0x4e0000 [0188.835] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0188.835] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21300_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21300_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21300_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21300_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0188.837] CloseHandle (hObject=0x11c) returned 1 [0188.837] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51b85800, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd306c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x51b85800, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0xcc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD21301_.GIF", cAlternateFileName="")) returned 1 [0188.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21301_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21301_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0188.837] GetProcessHeap () returned 0x4e0000 [0188.837] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0188.837] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0188.837] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0188.838] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0188.840] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.840] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.840] GetProcessHeap () returned 0x4e0000 [0188.840] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0188.840] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0188.840] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.840] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0188.840] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0188.840] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0188.840] WriteFile (in: hFile=0x11c, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0188.841] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0188.841] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0188.841] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.841] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.841] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.841] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xcc, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xcc, lpOverlapped=0x0) returned 1 [0188.841] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xd0, dwBufLen=0xd0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xd0) returned 1 [0188.841] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.841] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xd0, lpOverlapped=0x0) returned 1 [0188.841] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.841] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x1a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.841] SetEndOfFile (hFile=0x11c) returned 1 [0188.843] GetProcessHeap () returned 0x4e0000 [0188.843] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0188.843] GetProcessHeap () returned 0x4e0000 [0188.843] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0188.843] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21301_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21301_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21301_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21301_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0188.846] CloseHandle (hObject=0x11c) returned 1 [0188.846] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50872b00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd306c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x50872b00, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x11d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD21302_.GIF", cAlternateFileName="")) returned 1 [0188.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21302_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21302_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0188.847] GetProcessHeap () returned 0x4e0000 [0188.848] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0188.848] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0188.848] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0188.848] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x3, lpOverlapped=0x0) returned 1 [0188.849] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.849] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.849] GetProcessHeap () returned 0x4e0000 [0188.849] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0188.849] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0188.849] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.849] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0188.849] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0188.849] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0188.849] WriteFile (in: hFile=0x11c, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0188.849] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0188.849] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0188.850] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.850] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.850] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.850] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x11d, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x11d, lpOverlapped=0x0) returned 1 [0188.850] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x120, dwBufLen=0x120 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x120) returned 1 [0188.850] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.850] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x120, lpOverlapped=0x0) returned 1 [0188.850] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.850] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x1f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.850] SetEndOfFile (hFile=0x11c) returned 1 [0188.852] GetProcessHeap () returned 0x4e0000 [0188.852] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0188.852] GetProcessHeap () returned 0x4e0000 [0188.852] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0188.852] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21302_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21302_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21302_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21302_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0188.853] CloseHandle (hObject=0x11c) returned 1 [0188.853] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4cf3a400, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd306c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4cf3a400, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD21304_.GIF", cAlternateFileName="")) returned 1 [0188.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21304_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21304_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0188.854] GetProcessHeap () returned 0x4e0000 [0188.854] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0188.854] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0188.854] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0188.854] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x1, lpOverlapped=0x0) returned 1 [0188.855] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.855] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.855] GetProcessHeap () returned 0x4e0000 [0188.855] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0188.855] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0188.855] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.856] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0188.856] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0188.856] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0188.856] WriteFile (in: hFile=0x11c, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0188.856] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0188.856] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0188.856] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.856] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.856] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.856] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x24f, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x24f, lpOverlapped=0x0) returned 1 [0188.856] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x250, dwBufLen=0x250 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x250) returned 1 [0188.856] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.856] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x250, lpOverlapped=0x0) returned 1 [0188.856] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.856] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x324, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.856] SetEndOfFile (hFile=0x11c) returned 1 [0188.859] GetProcessHeap () returned 0x4e0000 [0188.859] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0188.859] GetProcessHeap () returned 0x4e0000 [0188.859] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0188.859] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21304_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21304_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21304_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21304_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0188.861] CloseHandle (hObject=0x11c) returned 1 [0188.861] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bc27700, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd306c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4bc27700, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD21306_.GIF", cAlternateFileName="")) returned 1 [0188.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21306_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21306_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0188.863] GetProcessHeap () returned 0x4e0000 [0188.863] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0188.863] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0188.863] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0188.863] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x1, lpOverlapped=0x0) returned 1 [0188.864] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.864] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.864] GetProcessHeap () returned 0x4e0000 [0188.864] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0188.864] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0188.864] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.864] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0188.864] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0188.864] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0188.864] WriteFile (in: hFile=0x11c, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0188.864] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0188.865] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0188.865] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.865] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.865] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.865] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x24f, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x24f, lpOverlapped=0x0) returned 1 [0188.865] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x250, dwBufLen=0x250 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x250) returned 1 [0188.865] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.865] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x250, lpOverlapped=0x0) returned 1 [0188.865] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.865] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x324, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.865] SetEndOfFile (hFile=0x11c) returned 1 [0188.867] GetProcessHeap () returned 0x4e0000 [0188.867] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0188.867] GetProcessHeap () returned 0x4e0000 [0188.867] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0188.868] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21306_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21306_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21306_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21306_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0188.868] CloseHandle (hObject=0x11c) returned 1 [0188.868] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4107e200, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd56820, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4107e200, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x3d7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD21308_.GIF", cAlternateFileName="")) returned 1 [0188.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21308_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21308_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0188.869] GetProcessHeap () returned 0x4e0000 [0188.869] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0188.869] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0188.869] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0188.869] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x9, lpOverlapped=0x0) returned 1 [0188.874] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.874] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.874] GetProcessHeap () returned 0x4e0000 [0188.874] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0188.874] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0188.874] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.874] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0188.874] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0188.874] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0188.874] WriteFile (in: hFile=0x11c, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0188.874] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0188.875] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0188.875] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.875] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.875] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.875] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3d7, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x3d7, lpOverlapped=0x0) returned 1 [0188.875] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x3e0, dwBufLen=0x3e0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x3e0) returned 1 [0188.875] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.875] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3e0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x3e0, lpOverlapped=0x0) returned 1 [0188.875] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.875] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x4b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.875] SetEndOfFile (hFile=0x11c) returned 1 [0188.877] GetProcessHeap () returned 0x4e0000 [0188.877] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0188.877] GetProcessHeap () returned 0x4e0000 [0188.877] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0188.877] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21308_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21308_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21308_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21308_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0188.878] CloseHandle (hObject=0x11c) returned 1 [0188.879] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ea58800, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd56820, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3ea58800, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x3d4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD21310_.GIF", cAlternateFileName="")) returned 1 [0188.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21310_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21310_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0188.880] GetProcessHeap () returned 0x4e0000 [0188.880] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0188.880] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0188.880] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0188.880] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xc, lpOverlapped=0x0) returned 1 [0188.882] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.882] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.882] GetProcessHeap () returned 0x4e0000 [0188.882] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0188.882] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0188.882] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.882] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0188.882] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0188.882] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0188.882] WriteFile (in: hFile=0x11c, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0188.882] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0188.882] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0188.884] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.884] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.884] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.885] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3d4, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x3d4, lpOverlapped=0x0) returned 1 [0188.885] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x3e0, dwBufLen=0x3e0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x3e0) returned 1 [0188.885] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.885] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3e0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x3e0, lpOverlapped=0x0) returned 1 [0188.885] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.885] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x4b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.885] SetEndOfFile (hFile=0x11c) returned 1 [0188.887] GetProcessHeap () returned 0x4e0000 [0188.887] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0188.887] GetProcessHeap () returned 0x4e0000 [0188.887] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0188.887] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21310_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21310_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21310_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21310_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0188.888] CloseHandle (hObject=0x11c) returned 1 [0188.888] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c432e00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd56820, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3c432e00, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD21312_.GIF", cAlternateFileName="")) returned 1 [0188.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21312_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21312_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0188.889] GetProcessHeap () returned 0x4e0000 [0188.889] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0188.889] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0188.889] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0188.889] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xf, lpOverlapped=0x0) returned 1 [0188.891] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.891] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.891] GetProcessHeap () returned 0x4e0000 [0188.891] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0188.891] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0188.891] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.891] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0188.891] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0188.891] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0188.891] WriteFile (in: hFile=0x11c, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0188.891] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0188.891] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0188.891] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.891] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.891] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.891] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x101, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x101, lpOverlapped=0x0) returned 1 [0188.891] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x110, dwBufLen=0x110 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x110) returned 1 [0188.891] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.892] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x110, lpOverlapped=0x0) returned 1 [0188.892] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.892] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x1e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.892] SetEndOfFile (hFile=0x11c) returned 1 [0188.895] GetProcessHeap () returned 0x4e0000 [0188.895] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0188.895] GetProcessHeap () returned 0x4e0000 [0188.895] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0188.895] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21312_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21312_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21312_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21312_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0188.910] CloseHandle (hObject=0x11c) returned 1 [0188.910] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38afa700, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd7c980, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x38afa700, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x45, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD21314_.GIF", cAlternateFileName="")) returned 1 [0188.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21314_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21314_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0188.912] GetProcessHeap () returned 0x4e0000 [0188.912] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0188.912] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0188.912] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0188.912] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xb, lpOverlapped=0x0) returned 1 [0188.913] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.913] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.913] GetProcessHeap () returned 0x4e0000 [0188.913] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0188.913] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0188.913] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.913] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0188.913] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0188.913] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0188.913] WriteFile (in: hFile=0x11c, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0188.914] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0188.914] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0188.914] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.914] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.914] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.914] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x45, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x45, lpOverlapped=0x0) returned 1 [0188.914] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x50, dwBufLen=0x50 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x50) returned 1 [0188.914] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.914] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x50, lpOverlapped=0x0) returned 1 [0188.914] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.914] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x124, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.914] SetEndOfFile (hFile=0x11c) returned 1 [0188.917] GetProcessHeap () returned 0x4e0000 [0188.917] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0188.917] GetProcessHeap () returned 0x4e0000 [0188.917] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0188.917] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21314_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21314_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21314_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21314_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0188.918] CloseHandle (hObject=0x11c) returned 1 [0188.918] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33eaf300, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd7c980, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x33eaf300, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x113, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD21316_.GIF", cAlternateFileName="")) returned 1 [0188.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21316_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21316_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0188.919] GetProcessHeap () returned 0x4e0000 [0188.919] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0188.919] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0188.919] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0188.919] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xd, lpOverlapped=0x0) returned 1 [0188.920] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.920] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.920] GetProcessHeap () returned 0x4e0000 [0188.920] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0188.920] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0188.920] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.920] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0188.920] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0188.920] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0188.921] WriteFile (in: hFile=0x11c, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0188.921] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0188.921] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0188.921] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.921] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.921] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.921] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x113, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x113, lpOverlapped=0x0) returned 1 [0188.921] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x120, dwBufLen=0x120 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x120) returned 1 [0188.921] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.921] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x120, lpOverlapped=0x0) returned 1 [0188.921] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.921] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x1f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.921] SetEndOfFile (hFile=0x11c) returned 1 [0188.923] GetProcessHeap () returned 0x4e0000 [0188.923] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0188.923] GetProcessHeap () returned 0x4e0000 [0188.923] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0188.923] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21316_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21316_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21316_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21316_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0188.924] CloseHandle (hObject=0x11c) returned 1 [0188.924] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cc3e500, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcda2ae0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2cc3e500, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD21327_.GIF", cAlternateFileName="")) returned 1 [0188.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21327_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21327_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0188.926] GetProcessHeap () returned 0x4e0000 [0188.926] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0188.926] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0188.926] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0188.926] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x2, lpOverlapped=0x0) returned 1 [0188.927] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.927] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.927] GetProcessHeap () returned 0x4e0000 [0188.927] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0188.927] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0188.927] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.927] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0188.927] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0188.927] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0188.928] WriteFile (in: hFile=0x11c, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0188.928] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0188.928] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0188.928] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.928] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.928] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.928] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xae, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xae, lpOverlapped=0x0) returned 1 [0188.928] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xb0, dwBufLen=0xb0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xb0) returned 1 [0188.928] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.928] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xb0, lpOverlapped=0x0) returned 1 [0188.928] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.928] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x184, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.928] SetEndOfFile (hFile=0x11c) returned 1 [0188.930] GetProcessHeap () returned 0x4e0000 [0188.930] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0188.930] GetProcessHeap () returned 0x4e0000 [0188.930] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0188.930] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21327_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21327_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21327_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21327_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0188.931] CloseHandle (hObject=0x11c) returned 1 [0188.931] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29305e00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcdc8c40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x29305e00, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x131, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD21329_.GIF", cAlternateFileName="")) returned 1 [0188.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21329_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21329_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0188.932] GetProcessHeap () returned 0x4e0000 [0188.932] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0188.932] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0188.932] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0188.932] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xf, lpOverlapped=0x0) returned 1 [0188.935] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.935] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.936] GetProcessHeap () returned 0x4e0000 [0188.936] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0188.940] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0188.940] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.940] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0188.940] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0188.940] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0188.940] WriteFile (in: hFile=0x11c, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0188.940] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0188.940] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0188.940] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0188.940] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0188.940] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.941] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x131, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x131, lpOverlapped=0x0) returned 1 [0188.941] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x140, dwBufLen=0x140 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x140) returned 1 [0188.941] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.941] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x140, lpOverlapped=0x0) returned 1 [0188.941] CryptDestroyKey (hKey=0x522fd8) returned 1 [0188.941] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.941] SetEndOfFile (hFile=0x11c) returned 1 [0188.943] GetProcessHeap () returned 0x4e0000 [0188.943] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0188.943] GetProcessHeap () returned 0x4e0000 [0188.943] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0188.943] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21329_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21329_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21329_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21329_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.027] CloseHandle (hObject=0x11c) returned 1 [0189.027] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x259cd700, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcdc8c40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x259cd700, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD21331_.GIF", cAlternateFileName="")) returned 1 [0189.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21331_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21331_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.029] GetProcessHeap () returned 0x4e0000 [0189.029] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.029] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.029] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.029] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.029] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.029] GetProcessHeap () returned 0x4e0000 [0189.029] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.029] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.029] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.029] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.052] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.052] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.052] WriteFile (in: hFile=0x11c, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.053] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.053] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.053] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.053] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.053] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.053] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x460, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x460, lpOverlapped=0x0) returned 1 [0189.053] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x460, dwBufLen=0x460 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x460) returned 1 [0189.053] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.053] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x460, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x460, lpOverlapped=0x0) returned 1 [0189.053] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.053] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x534, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.053] SetEndOfFile (hFile=0x11c) returned 1 [0189.064] GetProcessHeap () returned 0x4e0000 [0189.065] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.065] GetProcessHeap () returned 0x4e0000 [0189.065] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.065] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21331_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21331_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21331_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21331_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.067] CloseHandle (hObject=0x11c) returned 1 [0189.067] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20d82300, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcdc8c40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x20d82300, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD21333_.GIF", cAlternateFileName="")) returned 1 [0189.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21333_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21333_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.069] GetProcessHeap () returned 0x4e0000 [0189.069] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.069] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.069] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.069] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.069] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.069] GetProcessHeap () returned 0x4e0000 [0189.069] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.069] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.069] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.069] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.071] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.071] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.071] WriteFile (in: hFile=0x11c, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.071] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.071] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.072] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.072] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.072] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.072] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x1a0, lpOverlapped=0x0) returned 1 [0189.072] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1a0, dwBufLen=0x1a0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1a0) returned 1 [0189.072] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.072] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x1a0, lpOverlapped=0x0) returned 1 [0189.072] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.072] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x274, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.072] SetEndOfFile (hFile=0x11c) returned 1 [0189.075] GetProcessHeap () returned 0x4e0000 [0189.075] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.075] GetProcessHeap () returned 0x4e0000 [0189.075] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.075] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21333_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21333_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21333_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21333_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.080] CloseHandle (hObject=0x11c) returned 1 [0189.080] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d449c00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcdeeda0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1d449c00, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x3cb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD21335_.GIF", cAlternateFileName="")) returned 1 [0189.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21335_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21335_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.087] GetProcessHeap () returned 0x4e0000 [0189.087] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.087] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.087] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.087] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x5, lpOverlapped=0x0) returned 1 [0189.195] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.195] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.195] GetProcessHeap () returned 0x4e0000 [0189.195] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.195] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.195] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.195] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.196] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.196] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.196] WriteFile (in: hFile=0x11c, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.196] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.197] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.197] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.197] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.197] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.197] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3cb, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x3cb, lpOverlapped=0x0) returned 1 [0189.197] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x3d0) returned 1 [0189.197] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.197] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x3d0, lpOverlapped=0x0) returned 1 [0189.197] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.197] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x4a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.197] SetEndOfFile (hFile=0x11c) returned 1 [0189.200] GetProcessHeap () returned 0x4e0000 [0189.200] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.200] GetProcessHeap () returned 0x4e0000 [0189.200] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.200] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21335_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21335_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21335_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21335_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.203] CloseHandle (hObject=0x11c) returned 1 [0189.203] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c136f00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcdeeda0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1c136f00, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD21337_.GIF", cAlternateFileName="")) returned 1 [0189.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21337_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21337_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.204] GetProcessHeap () returned 0x4e0000 [0189.204] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.205] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.205] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.205] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xa, lpOverlapped=0x0) returned 1 [0189.207] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.207] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.207] GetProcessHeap () returned 0x4e0000 [0189.207] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.207] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.207] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.207] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.207] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.207] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.207] WriteFile (in: hFile=0x11c, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.208] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.208] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.208] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.208] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.208] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.208] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x146, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x146, lpOverlapped=0x0) returned 1 [0189.208] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x150, dwBufLen=0x150 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x150) returned 1 [0189.208] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.208] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x150, lpOverlapped=0x0) returned 1 [0189.208] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.208] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.208] SetEndOfFile (hFile=0x11c) returned 1 [0189.211] GetProcessHeap () returned 0x4e0000 [0189.211] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.211] GetProcessHeap () returned 0x4e0000 [0189.211] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.211] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21337_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21337_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21337_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21337_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.215] CloseHandle (hObject=0x11c) returned 1 [0189.215] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19b11500, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcdeeda0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x19b11500, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x6c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD21339_.GIF", cAlternateFileName="")) returned 1 [0189.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21339_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21339_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.217] GetProcessHeap () returned 0x4e0000 [0189.218] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.218] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.218] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.218] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.219] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.219] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.219] GetProcessHeap () returned 0x4e0000 [0189.220] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.220] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.220] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.220] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.220] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.220] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.220] WriteFile (in: hFile=0x11c, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.220] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.220] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.220] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.220] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.220] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.220] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x6c, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x6c, lpOverlapped=0x0) returned 1 [0189.221] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x70, dwBufLen=0x70 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x70) returned 1 [0189.221] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.221] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x70, lpOverlapped=0x0) returned 1 [0189.221] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.221] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x144, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.221] SetEndOfFile (hFile=0x11c) returned 1 [0189.223] GetProcessHeap () returned 0x4e0000 [0189.224] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.224] GetProcessHeap () returned 0x4e0000 [0189.224] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.224] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21339_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21339_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21339_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21339_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.225] CloseHandle (hObject=0x11c) returned 1 [0189.225] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d01a600, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbce14f00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8d01a600, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x10a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD21342_.GIF", cAlternateFileName="")) returned 1 [0189.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21342_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21342_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.226] GetProcessHeap () returned 0x4e0000 [0189.226] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.227] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.227] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.227] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x6, lpOverlapped=0x0) returned 1 [0189.229] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.229] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.229] GetProcessHeap () returned 0x4e0000 [0189.229] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.229] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.229] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.229] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.229] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.229] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.229] WriteFile (in: hFile=0x11c, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.229] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.230] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.230] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.230] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.230] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.230] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x10a, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x10a, lpOverlapped=0x0) returned 1 [0189.230] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x110, dwBufLen=0x110 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x110) returned 1 [0189.230] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.230] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x110, lpOverlapped=0x0) returned 1 [0189.230] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.230] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x1e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.230] SetEndOfFile (hFile=0x11c) returned 1 [0189.233] GetProcessHeap () returned 0x4e0000 [0189.233] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.233] GetProcessHeap () returned 0x4e0000 [0189.233] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.233] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21342_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21342_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21342_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21342_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.234] CloseHandle (hObject=0x11c) returned 1 [0189.235] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d01a600, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbce14f00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8d01a600, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xb6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD21343_.GIF", cAlternateFileName="")) returned 1 [0189.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21343_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21343_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.236] GetProcessHeap () returned 0x4e0000 [0189.236] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.236] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.236] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.236] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xa, lpOverlapped=0x0) returned 1 [0189.237] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.237] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.238] GetProcessHeap () returned 0x4e0000 [0189.238] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.238] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.238] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.238] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.238] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.238] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.238] WriteFile (in: hFile=0x11c, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.238] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.238] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.238] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.238] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.238] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.239] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb6, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xb6, lpOverlapped=0x0) returned 1 [0189.239] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0, dwBufLen=0xc0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0) returned 1 [0189.239] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.239] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xc0, lpOverlapped=0x0) returned 1 [0189.239] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.239] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.239] SetEndOfFile (hFile=0x11c) returned 1 [0189.241] GetProcessHeap () returned 0x4e0000 [0189.242] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.242] GetProcessHeap () returned 0x4e0000 [0189.242] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.242] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21343_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21343_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21343_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21343_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.243] CloseHandle (hObject=0x11c) returned 1 [0189.243] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e32d300, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbce3b060, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8e32d300, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD21344_.GIF", cAlternateFileName="")) returned 1 [0189.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21344_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21344_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.245] GetProcessHeap () returned 0x4e0000 [0189.245] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.245] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.246] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.246] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xe, lpOverlapped=0x0) returned 1 [0189.247] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.247] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.247] GetProcessHeap () returned 0x4e0000 [0189.247] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.247] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.247] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.247] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.248] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.248] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.248] WriteFile (in: hFile=0x11c, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.248] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.248] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.248] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.248] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.248] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.248] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb2, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xb2, lpOverlapped=0x0) returned 1 [0189.248] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0, dwBufLen=0xc0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0) returned 1 [0189.248] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.248] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xc0, lpOverlapped=0x0) returned 1 [0189.249] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.249] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.249] SetEndOfFile (hFile=0x11c) returned 1 [0189.251] GetProcessHeap () returned 0x4e0000 [0189.251] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.251] GetProcessHeap () returned 0x4e0000 [0189.251] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.251] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21344_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21344_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21344_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21344_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.253] CloseHandle (hObject=0x11c) returned 1 [0189.253] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52007200, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbce3b060, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x52007200, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xf5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD21364_.GIF", cAlternateFileName="")) returned 1 [0189.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21364_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21364_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.254] GetProcessHeap () returned 0x4e0000 [0189.254] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.254] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.254] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.254] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xb, lpOverlapped=0x0) returned 1 [0189.255] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.256] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.256] GetProcessHeap () returned 0x4e0000 [0189.256] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.256] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.256] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.256] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.256] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.256] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.256] WriteFile (in: hFile=0x11c, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.256] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.256] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.256] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.256] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.256] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.257] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xf5, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xf5, lpOverlapped=0x0) returned 1 [0189.257] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x100, dwBufLen=0x100 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x100) returned 1 [0189.257] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.257] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x100, lpOverlapped=0x0) returned 1 [0189.257] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.257] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x1d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.257] SetEndOfFile (hFile=0x11c) returned 1 [0189.260] GetProcessHeap () returned 0x4e0000 [0189.260] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.260] GetProcessHeap () returned 0x4e0000 [0189.260] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.260] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21364_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21364_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21364_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21364_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.261] CloseHandle (hObject=0x11c) returned 1 [0189.261] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52007200, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbce3b060, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x52007200, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD21365_.GIF", cAlternateFileName="")) returned 1 [0189.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21365_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21365_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.262] GetProcessHeap () returned 0x4e0000 [0189.262] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.262] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.262] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.263] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.264] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.264] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.264] GetProcessHeap () returned 0x4e0000 [0189.264] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.264] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.264] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.264] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.264] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.265] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.265] WriteFile (in: hFile=0x11c, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.265] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.265] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.265] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.265] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.265] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.265] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xec, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xec, lpOverlapped=0x0) returned 1 [0189.265] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xf0, dwBufLen=0xf0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xf0) returned 1 [0189.265] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.265] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xf0, lpOverlapped=0x0) returned 1 [0189.265] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.265] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x1c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.266] SetEndOfFile (hFile=0x11c) returned 1 [0189.268] GetProcessHeap () returned 0x4e0000 [0189.268] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.268] GetProcessHeap () returned 0x4e0000 [0189.268] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.268] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21365_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21365_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21365_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21365_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.270] CloseHandle (hObject=0x11c) returned 1 [0189.270] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52007200, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbce3b060, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x52007200, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xc8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD21366_.GIF", cAlternateFileName="")) returned 1 [0189.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21366_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21366_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.272] GetProcessHeap () returned 0x4e0000 [0189.272] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.272] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.272] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.272] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.277] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.277] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.277] GetProcessHeap () returned 0x4e0000 [0189.277] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.277] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.277] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.277] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.277] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.277] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.277] WriteFile (in: hFile=0x11c, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.277] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.277] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.277] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.277] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.277] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.277] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xc8, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xc8, lpOverlapped=0x0) returned 1 [0189.277] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xd0, dwBufLen=0xd0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xd0) returned 1 [0189.277] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.278] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xd0, lpOverlapped=0x0) returned 1 [0189.278] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.278] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x1a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.278] SetEndOfFile (hFile=0x11c) returned 1 [0189.280] GetProcessHeap () returned 0x4e0000 [0189.280] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.280] GetProcessHeap () returned 0x4e0000 [0189.280] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.280] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21366_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21366_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21366_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21366_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.281] CloseHandle (hObject=0x11c) returned 1 [0189.281] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88d68800, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbce611c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x88d68800, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD21375_.GIF", cAlternateFileName="")) returned 1 [0189.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21375_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21375_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.282] GetProcessHeap () returned 0x4e0000 [0189.282] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.282] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.282] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.282] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xc, lpOverlapped=0x0) returned 1 [0189.284] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.284] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.284] GetProcessHeap () returned 0x4e0000 [0189.284] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.284] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.284] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.284] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.284] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.284] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.284] WriteFile (in: hFile=0x11c, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.284] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.284] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.284] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.284] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.284] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.284] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xd4, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xd4, lpOverlapped=0x0) returned 1 [0189.285] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xe0, dwBufLen=0xe0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xe0) returned 1 [0189.285] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.285] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xe0, lpOverlapped=0x0) returned 1 [0189.285] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.285] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x1b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.285] SetEndOfFile (hFile=0x11c) returned 1 [0189.287] GetProcessHeap () returned 0x4e0000 [0189.287] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.287] GetProcessHeap () returned 0x4e0000 [0189.287] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.287] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21375_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21375_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21375_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21375_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.288] CloseHandle (hObject=0x11c) returned 1 [0189.288] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a07b500, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbce611c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8a07b500, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xb4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD21376_.GIF", cAlternateFileName="")) returned 1 [0189.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21376_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21376_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.289] GetProcessHeap () returned 0x4e0000 [0189.289] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.289] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.289] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.289] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xc, lpOverlapped=0x0) returned 1 [0189.290] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.290] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.291] GetProcessHeap () returned 0x4e0000 [0189.291] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.291] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.291] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.291] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.291] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.291] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.291] WriteFile (in: hFile=0x11c, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.291] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.291] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.291] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.291] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.291] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.291] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb4, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xb4, lpOverlapped=0x0) returned 1 [0189.291] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0, dwBufLen=0xc0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0) returned 1 [0189.291] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.291] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xc0, lpOverlapped=0x0) returned 1 [0189.291] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.291] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.292] SetEndOfFile (hFile=0x11c) returned 1 [0189.294] GetProcessHeap () returned 0x4e0000 [0189.294] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.294] GetProcessHeap () returned 0x4e0000 [0189.294] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.294] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21376_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21376_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21376_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21376_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.295] CloseHandle (hObject=0x11c) returned 1 [0189.295] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a07b500, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbce611c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8a07b500, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xaf, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD21377_.GIF", cAlternateFileName="")) returned 1 [0189.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21377_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21377_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.296] GetProcessHeap () returned 0x4e0000 [0189.296] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.296] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.296] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.296] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x1, lpOverlapped=0x0) returned 1 [0189.298] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.298] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.298] GetProcessHeap () returned 0x4e0000 [0189.298] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.298] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.298] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.298] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.298] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.298] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.298] WriteFile (in: hFile=0x11c, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.298] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.298] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.298] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.298] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.298] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.298] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xaf, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xaf, lpOverlapped=0x0) returned 1 [0189.298] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xb0, dwBufLen=0xb0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xb0) returned 1 [0189.298] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.299] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xb0, lpOverlapped=0x0) returned 1 [0189.299] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.299] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x184, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.299] SetEndOfFile (hFile=0x11c) returned 1 [0189.301] GetProcessHeap () returned 0x4e0000 [0189.301] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.301] GetProcessHeap () returned 0x4e0000 [0189.301] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.301] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21377_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21377_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21377_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21377_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.303] CloseHandle (hObject=0x11c) returned 1 [0189.303] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb28faf00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbce611c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb28faf00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD21398_.GIF", cAlternateFileName="")) returned 1 [0189.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21398_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21398_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.303] GetProcessHeap () returned 0x4e0000 [0189.303] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.303] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.303] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.304] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xa, lpOverlapped=0x0) returned 1 [0189.305] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.305] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.305] GetProcessHeap () returned 0x4e0000 [0189.305] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.305] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.305] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.305] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.305] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.305] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.305] WriteFile (in: hFile=0x11c, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.305] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.305] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.306] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.306] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.306] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.306] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x146, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x146, lpOverlapped=0x0) returned 1 [0189.306] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x150, dwBufLen=0x150 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x150) returned 1 [0189.306] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.306] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x150, lpOverlapped=0x0) returned 1 [0189.306] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.306] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.306] SetEndOfFile (hFile=0x11c) returned 1 [0189.308] GetProcessHeap () returned 0x4e0000 [0189.308] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.308] GetProcessHeap () returned 0x4e0000 [0189.308] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.308] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21398_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21398_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21398_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21398_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.311] CloseHandle (hObject=0x11c) returned 1 [0189.311] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3c0dc00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbce611c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb3c0dc00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD21399_.GIF", cAlternateFileName="")) returned 1 [0189.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21399_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21399_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.312] GetProcessHeap () returned 0x4e0000 [0189.312] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.312] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.312] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.312] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xe, lpOverlapped=0x0) returned 1 [0189.313] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.314] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.314] GetProcessHeap () returned 0x4e0000 [0189.314] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.314] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.314] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.314] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.314] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.314] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.314] WriteFile (in: hFile=0x11c, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.314] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.314] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.314] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.314] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.314] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.314] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x102, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x102, lpOverlapped=0x0) returned 1 [0189.314] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x110, dwBufLen=0x110 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x110) returned 1 [0189.314] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.314] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x110, lpOverlapped=0x0) returned 1 [0189.314] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.315] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x1e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.315] SetEndOfFile (hFile=0x11c) returned 1 [0189.317] GetProcessHeap () returned 0x4e0000 [0189.317] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.317] GetProcessHeap () returned 0x4e0000 [0189.317] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.317] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21399_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21399_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21399_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21399_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.318] CloseHandle (hObject=0x11c) returned 1 [0189.318] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3c0dc00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbce87320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb3c0dc00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD21400_.GIF", cAlternateFileName="")) returned 1 [0189.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21400_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21400_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.319] GetProcessHeap () returned 0x4e0000 [0189.319] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.319] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.319] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.319] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x7, lpOverlapped=0x0) returned 1 [0189.321] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.321] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.321] GetProcessHeap () returned 0x4e0000 [0189.321] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.321] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.321] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.321] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.321] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.321] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.321] WriteFile (in: hFile=0x11c, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.321] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.321] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.321] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.321] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.321] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.321] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xe9, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xe9, lpOverlapped=0x0) returned 1 [0189.322] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xf0, dwBufLen=0xf0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xf0) returned 1 [0189.322] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.322] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xf0, lpOverlapped=0x0) returned 1 [0189.322] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.322] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x1c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.322] SetEndOfFile (hFile=0x11c) returned 1 [0189.324] GetProcessHeap () returned 0x4e0000 [0189.324] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.324] GetProcessHeap () returned 0x4e0000 [0189.324] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.324] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21400_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21400_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21400_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21400_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.325] CloseHandle (hObject=0x11c) returned 1 [0189.325] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac6b100, ftCreationTime.dwHighDateTime=0x1bd8f93, ftLastAccessTime.dwLowDateTime=0xbce87320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xac6b100, ftLastWriteTime.dwHighDateTime=0x1bd8f93, nFileSizeHigh=0x0, nFileSizeLow=0x11f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD21421_.GIF", cAlternateFileName="")) returned 1 [0189.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21421_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21421_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.326] GetProcessHeap () returned 0x4e0000 [0189.326] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.326] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.326] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.326] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x1, lpOverlapped=0x0) returned 1 [0189.327] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.327] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.327] GetProcessHeap () returned 0x4e0000 [0189.327] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.327] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.328] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.328] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.328] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.328] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.328] WriteFile (in: hFile=0x11c, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.328] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.328] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.328] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.328] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.328] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.328] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x11f, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x11f, lpOverlapped=0x0) returned 1 [0189.328] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x120, dwBufLen=0x120 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x120) returned 1 [0189.328] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.328] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x120, lpOverlapped=0x0) returned 1 [0189.328] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.328] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x1f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.328] SetEndOfFile (hFile=0x11c) returned 1 [0189.331] GetProcessHeap () returned 0x4e0000 [0189.331] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.331] GetProcessHeap () returned 0x4e0000 [0189.331] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.331] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21421_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21421_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21421_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21421_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.333] CloseHandle (hObject=0x11c) returned 1 [0189.333] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac6b100, ftCreationTime.dwHighDateTime=0x1bd8f93, ftLastAccessTime.dwLowDateTime=0xbce87320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xac6b100, ftLastWriteTime.dwHighDateTime=0x1bd8f93, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD21422_.GIF", cAlternateFileName="")) returned 1 [0189.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21422_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21422_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.333] GetProcessHeap () returned 0x4e0000 [0189.334] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.334] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.334] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.334] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xf, lpOverlapped=0x0) returned 1 [0189.335] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.335] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.335] GetProcessHeap () returned 0x4e0000 [0189.335] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.336] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.336] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.336] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.336] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.336] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.336] WriteFile (in: hFile=0x11c, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.336] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.336] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.336] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.336] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.336] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.336] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x101, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x101, lpOverlapped=0x0) returned 1 [0189.336] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x110, dwBufLen=0x110 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x110) returned 1 [0189.336] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.336] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x110, lpOverlapped=0x0) returned 1 [0189.336] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.336] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x1e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.336] SetEndOfFile (hFile=0x11c) returned 1 [0189.338] GetProcessHeap () returned 0x4e0000 [0189.338] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.338] GetProcessHeap () returned 0x4e0000 [0189.339] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.339] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21422_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21422_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21422_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21422_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.340] CloseHandle (hObject=0x11c) returned 1 [0189.340] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf7de00, ftCreationTime.dwHighDateTime=0x1bd8f93, ftLastAccessTime.dwLowDateTime=0xbce87320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbf7de00, ftLastWriteTime.dwHighDateTime=0x1bd8f93, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD21423_.GIF", cAlternateFileName="")) returned 1 [0189.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21423_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21423_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.342] GetProcessHeap () returned 0x4e0000 [0189.342] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.342] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.342] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.342] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x7, lpOverlapped=0x0) returned 1 [0189.344] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.344] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.344] GetProcessHeap () returned 0x4e0000 [0189.344] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.344] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.344] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.344] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.344] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.344] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.345] WriteFile (in: hFile=0x11c, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.345] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.345] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.345] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.345] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.345] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.345] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xe9, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xe9, lpOverlapped=0x0) returned 1 [0189.345] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xf0, dwBufLen=0xf0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xf0) returned 1 [0189.345] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.345] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xf0, lpOverlapped=0x0) returned 1 [0189.345] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.345] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x1c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.345] SetEndOfFile (hFile=0x11c) returned 1 [0189.348] GetProcessHeap () returned 0x4e0000 [0189.348] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.348] GetProcessHeap () returned 0x4e0000 [0189.348] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.348] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21423_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21423_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21423_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21423_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.350] CloseHandle (hObject=0x11c) returned 1 [0189.350] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91c65a00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbce87320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x91c65a00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD21433_.GIF", cAlternateFileName="")) returned 1 [0189.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21433_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21433_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.351] GetProcessHeap () returned 0x4e0000 [0189.351] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.351] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.351] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.351] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x7, lpOverlapped=0x0) returned 1 [0189.352] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.352] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.352] GetProcessHeap () returned 0x4e0000 [0189.352] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.352] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.352] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.352] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.353] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.353] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.353] WriteFile (in: hFile=0x11c, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.353] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.353] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.354] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.354] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.354] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.354] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb9, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xb9, lpOverlapped=0x0) returned 1 [0189.354] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0, dwBufLen=0xc0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0) returned 1 [0189.354] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.354] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xc0, lpOverlapped=0x0) returned 1 [0189.354] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.354] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.354] SetEndOfFile (hFile=0x11c) returned 1 [0189.356] GetProcessHeap () returned 0x4e0000 [0189.356] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.356] GetProcessHeap () returned 0x4e0000 [0189.356] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.356] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21433_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21433_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21433_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21433_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.357] CloseHandle (hObject=0x11c) returned 1 [0189.357] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91c65a00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbcead480, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x91c65a00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xb1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD21434_.GIF", cAlternateFileName="")) returned 1 [0189.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21434_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21434_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.358] GetProcessHeap () returned 0x4e0000 [0189.358] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.358] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.358] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.358] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xf, lpOverlapped=0x0) returned 1 [0189.359] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.360] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.360] GetProcessHeap () returned 0x4e0000 [0189.360] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.360] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.360] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.360] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.360] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.360] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.360] WriteFile (in: hFile=0x11c, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.360] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.360] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.360] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.360] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.360] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.360] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb1, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xb1, lpOverlapped=0x0) returned 1 [0189.360] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0, dwBufLen=0xc0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0) returned 1 [0189.360] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.360] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xc0, lpOverlapped=0x0) returned 1 [0189.360] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.360] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.361] SetEndOfFile (hFile=0x11c) returned 1 [0189.363] GetProcessHeap () returned 0x4e0000 [0189.363] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.363] GetProcessHeap () returned 0x4e0000 [0189.363] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.363] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21434_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21434_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21434_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21434_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.364] CloseHandle (hObject=0x11c) returned 1 [0189.364] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f78700, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbcead480, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x92f78700, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xad, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD21435_.GIF", cAlternateFileName="")) returned 1 [0189.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21435_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21435_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.365] GetProcessHeap () returned 0x4e0000 [0189.365] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.365] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.365] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.365] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x3, lpOverlapped=0x0) returned 1 [0189.367] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.367] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.367] GetProcessHeap () returned 0x4e0000 [0189.367] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.367] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.367] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.367] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.367] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.367] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.367] WriteFile (in: hFile=0x11c, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.367] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.367] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.367] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.367] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.368] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.368] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xad, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xad, lpOverlapped=0x0) returned 1 [0189.368] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xb0, dwBufLen=0xb0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xb0) returned 1 [0189.368] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.368] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xb0, lpOverlapped=0x0) returned 1 [0189.368] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.368] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x184, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.368] SetEndOfFile (hFile=0x11c) returned 1 [0189.370] GetProcessHeap () returned 0x4e0000 [0189.370] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.370] GetProcessHeap () returned 0x4e0000 [0189.370] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.370] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21435_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21435_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21435_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21435_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.371] CloseHandle (hObject=0x11c) returned 1 [0189.371] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5593f900, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcead480, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5593f900, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x14e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD21480_.GIF", cAlternateFileName="")) returned 1 [0189.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21480_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21480_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.372] GetProcessHeap () returned 0x4e0000 [0189.372] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.372] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.372] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.372] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x2, lpOverlapped=0x0) returned 1 [0189.373] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.373] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.373] GetProcessHeap () returned 0x4e0000 [0189.373] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.374] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.374] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.374] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.374] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.374] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.374] WriteFile (in: hFile=0x11c, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.374] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.374] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.374] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.374] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.374] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.374] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x14e, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x14e, lpOverlapped=0x0) returned 1 [0189.374] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x150, dwBufLen=0x150 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x150) returned 1 [0189.374] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.374] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x150, lpOverlapped=0x0) returned 1 [0189.374] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.374] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.374] SetEndOfFile (hFile=0x11c) returned 1 [0189.376] GetProcessHeap () returned 0x4e0000 [0189.376] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.376] GetProcessHeap () returned 0x4e0000 [0189.377] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.377] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21480_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21480_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21480_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21480_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.378] CloseHandle (hObject=0x11c) returned 1 [0189.378] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56c52600, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcead480, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x56c52600, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD21481_.GIF", cAlternateFileName="")) returned 1 [0189.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21481_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21481_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.379] GetProcessHeap () returned 0x4e0000 [0189.379] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.379] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.379] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.379] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x5, lpOverlapped=0x0) returned 1 [0189.380] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.380] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.380] GetProcessHeap () returned 0x4e0000 [0189.381] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.381] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.381] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.381] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.381] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.381] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.381] WriteFile (in: hFile=0x11c, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.381] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.381] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.381] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.381] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.381] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.381] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xeb, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xeb, lpOverlapped=0x0) returned 1 [0189.381] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xf0, dwBufLen=0xf0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xf0) returned 1 [0189.381] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.381] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xf0, lpOverlapped=0x0) returned 1 [0189.381] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.381] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x1c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.381] SetEndOfFile (hFile=0x11c) returned 1 [0189.383] GetProcessHeap () returned 0x4e0000 [0189.384] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.384] GetProcessHeap () returned 0x4e0000 [0189.384] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.384] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21481_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21481_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21481_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21481_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.385] CloseHandle (hObject=0x11c) returned 1 [0189.385] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56c52600, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcead480, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x56c52600, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xf7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD21482_.GIF", cAlternateFileName="")) returned 1 [0189.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21482_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21482_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.387] GetProcessHeap () returned 0x4e0000 [0189.387] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.387] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.387] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.387] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x9, lpOverlapped=0x0) returned 1 [0189.389] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.389] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.389] GetProcessHeap () returned 0x4e0000 [0189.389] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.389] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.389] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.389] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.389] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.389] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.389] WriteFile (in: hFile=0x11c, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.389] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.389] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.389] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.389] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.389] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.390] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xf7, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xf7, lpOverlapped=0x0) returned 1 [0189.390] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x100, dwBufLen=0x100 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x100) returned 1 [0189.390] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.390] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x100, lpOverlapped=0x0) returned 1 [0189.390] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.390] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x1d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.390] SetEndOfFile (hFile=0x11c) returned 1 [0189.392] GetProcessHeap () returned 0x4e0000 [0189.392] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.392] GetProcessHeap () returned 0x4e0000 [0189.392] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.392] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21482_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21482_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21482_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21482_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.393] CloseHandle (hObject=0x11c) returned 1 [0189.393] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ffd9600, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbced35e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8ffd9600, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD21503_.GIF", cAlternateFileName="")) returned 1 [0189.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21503_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21503_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.394] GetProcessHeap () returned 0x4e0000 [0189.394] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.394] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.395] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.395] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x2, lpOverlapped=0x0) returned 1 [0189.396] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.396] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.396] GetProcessHeap () returned 0x4e0000 [0189.396] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.396] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.396] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.396] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.396] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.396] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.396] WriteFile (in: hFile=0x11c, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.396] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.396] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.397] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.397] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.397] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.397] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xfe, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xfe, lpOverlapped=0x0) returned 1 [0189.397] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x100, dwBufLen=0x100 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x100) returned 1 [0189.397] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.397] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x100, lpOverlapped=0x0) returned 1 [0189.397] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.397] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x1d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.397] SetEndOfFile (hFile=0x11c) returned 1 [0189.399] GetProcessHeap () returned 0x4e0000 [0189.399] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.399] GetProcessHeap () returned 0x4e0000 [0189.399] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.399] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21503_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21503_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21503_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21503_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.400] CloseHandle (hObject=0x11c) returned 1 [0189.400] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912ec300, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbced35e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x912ec300, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xb6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD21504_.GIF", cAlternateFileName="")) returned 1 [0189.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21504_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21504_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.401] GetProcessHeap () returned 0x4e0000 [0189.401] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.401] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.401] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.401] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xa, lpOverlapped=0x0) returned 1 [0189.403] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.403] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.403] GetProcessHeap () returned 0x4e0000 [0189.403] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.403] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.403] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.403] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.403] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.403] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.403] WriteFile (in: hFile=0x11c, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.403] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.403] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.403] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.403] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.403] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.403] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb6, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xb6, lpOverlapped=0x0) returned 1 [0189.403] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0, dwBufLen=0xc0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0) returned 1 [0189.403] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.403] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xc0, lpOverlapped=0x0) returned 1 [0189.404] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.404] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.404] SetEndOfFile (hFile=0x11c) returned 1 [0189.406] GetProcessHeap () returned 0x4e0000 [0189.406] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.406] GetProcessHeap () returned 0x4e0000 [0189.406] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.406] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21504_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21504_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21504_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21504_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.407] CloseHandle (hObject=0x11c) returned 1 [0189.407] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912ec300, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcef9740, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x912ec300, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xaf, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD21505_.GIF", cAlternateFileName="")) returned 1 [0189.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21505_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21505_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.409] GetProcessHeap () returned 0x4e0000 [0189.409] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.409] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.409] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.410] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x1, lpOverlapped=0x0) returned 1 [0189.411] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.411] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.411] GetProcessHeap () returned 0x4e0000 [0189.411] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.411] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.411] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.411] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.411] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.411] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.411] WriteFile (in: hFile=0x11c, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.411] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.411] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.411] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.411] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.411] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.412] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xaf, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xaf, lpOverlapped=0x0) returned 1 [0189.412] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xb0, dwBufLen=0xb0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xb0) returned 1 [0189.412] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.412] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xb0, lpOverlapped=0x0) returned 1 [0189.412] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.412] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x184, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.412] SetEndOfFile (hFile=0x11c) returned 1 [0189.414] GetProcessHeap () returned 0x4e0000 [0189.414] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.414] GetProcessHeap () returned 0x4e0000 [0189.414] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.414] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21505_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21505_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21505_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21505_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.416] CloseHandle (hObject=0x11c) returned 1 [0189.416] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9b6bd00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcef9740, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb9b6bd00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD21518_.GIF", cAlternateFileName="")) returned 1 [0189.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21518_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21518_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.417] GetProcessHeap () returned 0x4e0000 [0189.417] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.417] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.417] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.417] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x1, lpOverlapped=0x0) returned 1 [0189.418] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.418] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.418] GetProcessHeap () returned 0x4e0000 [0189.418] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.418] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.419] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.419] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.419] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.419] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.419] WriteFile (in: hFile=0x11c, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.419] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.419] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.419] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.419] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.419] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.419] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xff, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xff, lpOverlapped=0x0) returned 1 [0189.419] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x100, dwBufLen=0x100 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x100) returned 1 [0189.419] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.419] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x100, lpOverlapped=0x0) returned 1 [0189.419] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.419] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x1d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.419] SetEndOfFile (hFile=0x11c) returned 1 [0189.422] GetProcessHeap () returned 0x4e0000 [0189.422] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.422] GetProcessHeap () returned 0x4e0000 [0189.422] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.422] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21518_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21518_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21518_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21518_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.423] CloseHandle (hObject=0x11c) returned 1 [0189.423] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbae7ea00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcef9740, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbae7ea00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xb0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD21519_.GIF", cAlternateFileName="")) returned 1 [0189.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21519_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21519_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.424] GetProcessHeap () returned 0x4e0000 [0189.424] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.424] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.424] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.424] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.424] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.424] GetProcessHeap () returned 0x4e0000 [0189.424] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.424] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.424] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.424] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.425] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.425] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.426] WriteFile (in: hFile=0x11c, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.426] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.426] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.426] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.426] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.426] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.426] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb0, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xb0, lpOverlapped=0x0) returned 1 [0189.426] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xb0, dwBufLen=0xb0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xb0) returned 1 [0189.426] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.426] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xb0, lpOverlapped=0x0) returned 1 [0189.426] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.426] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x184, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.426] SetEndOfFile (hFile=0x11c) returned 1 [0189.428] GetProcessHeap () returned 0x4e0000 [0189.428] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.428] GetProcessHeap () returned 0x4e0000 [0189.428] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.428] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21519_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21519_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21519_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21519_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.429] CloseHandle (hObject=0x11c) returned 1 [0189.429] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbae7ea00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcef9740, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbae7ea00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xb0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD21520_.GIF", cAlternateFileName="")) returned 1 [0189.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21520_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21520_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.433] GetProcessHeap () returned 0x4e0000 [0189.433] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.433] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.433] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.433] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.433] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.433] GetProcessHeap () returned 0x4e0000 [0189.433] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.433] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.434] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.434] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.435] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.435] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.435] WriteFile (in: hFile=0x11c, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.435] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.435] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.435] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.435] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.435] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.435] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb0, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xb0, lpOverlapped=0x0) returned 1 [0189.435] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xb0, dwBufLen=0xb0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xb0) returned 1 [0189.435] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.435] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xb0, lpOverlapped=0x0) returned 1 [0189.435] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.436] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x184, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.436] SetEndOfFile (hFile=0x11c) returned 1 [0189.438] GetProcessHeap () returned 0x4e0000 [0189.438] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.438] GetProcessHeap () returned 0x4e0000 [0189.438] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.438] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21520_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21520_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21520_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21520_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.439] CloseHandle (hObject=0x11c) returned 1 [0189.439] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8b6500, ftCreationTime.dwHighDateTime=0x1bd8f93, ftLastAccessTime.dwLowDateTime=0xbcf1f8a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf8b6500, ftLastWriteTime.dwHighDateTime=0x1bd8f93, nFileSizeHigh=0x0, nFileSizeLow=0x148, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD21533_.GIF", cAlternateFileName="")) returned 1 [0189.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21533_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21533_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.439] GetProcessHeap () returned 0x4e0000 [0189.439] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.439] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.440] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.440] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.441] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.441] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.441] GetProcessHeap () returned 0x4e0000 [0189.441] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.441] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.441] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.441] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.441] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.441] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.441] WriteFile (in: hFile=0x11c, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.441] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.441] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.441] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.441] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.441] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.442] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x148, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x148, lpOverlapped=0x0) returned 1 [0189.442] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x150, dwBufLen=0x150 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x150) returned 1 [0189.442] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.442] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x150, lpOverlapped=0x0) returned 1 [0189.442] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.442] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.442] SetEndOfFile (hFile=0x11c) returned 1 [0189.444] GetProcessHeap () returned 0x4e0000 [0189.444] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.444] GetProcessHeap () returned 0x4e0000 [0189.444] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.444] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21533_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21533_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21533_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21533_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.446] CloseHandle (hObject=0x11c) returned 1 [0189.446] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8b6500, ftCreationTime.dwHighDateTime=0x1bd8f93, ftLastAccessTime.dwLowDateTime=0xbcf1f8a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf8b6500, ftLastWriteTime.dwHighDateTime=0x1bd8f93, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD21534_.GIF", cAlternateFileName="")) returned 1 [0189.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21534_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21534_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.447] GetProcessHeap () returned 0x4e0000 [0189.447] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.447] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.447] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.447] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.447] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.447] GetProcessHeap () returned 0x4e0000 [0189.447] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.447] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.447] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.447] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.449] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.449] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.449] WriteFile (in: hFile=0x11c, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.449] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.449] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.449] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.449] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.449] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.449] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xf0, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xf0, lpOverlapped=0x0) returned 1 [0189.449] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xf0, dwBufLen=0xf0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xf0) returned 1 [0189.449] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.449] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xf0, lpOverlapped=0x0) returned 1 [0189.449] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.449] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x1c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.449] SetEndOfFile (hFile=0x11c) returned 1 [0189.451] GetProcessHeap () returned 0x4e0000 [0189.451] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.451] GetProcessHeap () returned 0x4e0000 [0189.451] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.451] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21534_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21534_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21534_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21534_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.452] CloseHandle (hObject=0x11c) returned 1 [0189.452] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8b6500, ftCreationTime.dwHighDateTime=0x1bd8f93, ftLastAccessTime.dwLowDateTime=0xbcf1f8a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf8b6500, ftLastWriteTime.dwHighDateTime=0x1bd8f93, nFileSizeHigh=0x0, nFileSizeLow=0x12b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD21535_.GIF", cAlternateFileName="")) returned 1 [0189.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21535_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21535_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.453] GetProcessHeap () returned 0x4e0000 [0189.453] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.453] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.453] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.453] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x5, lpOverlapped=0x0) returned 1 [0189.455] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.455] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.455] GetProcessHeap () returned 0x4e0000 [0189.455] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.455] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.455] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.455] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.455] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.455] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.455] WriteFile (in: hFile=0x11c, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.455] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.455] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.455] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.456] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.456] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.456] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x12b, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x12b, lpOverlapped=0x0) returned 1 [0189.456] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x130, dwBufLen=0x130 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x130) returned 1 [0189.456] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.456] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x130, lpOverlapped=0x0) returned 1 [0189.456] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.456] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.456] SetEndOfFile (hFile=0x11c) returned 1 [0189.458] GetProcessHeap () returned 0x4e0000 [0189.458] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.458] GetProcessHeap () returned 0x4e0000 [0189.458] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.458] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21535_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21535_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21535_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21535_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.460] CloseHandle (hObject=0x11c) returned 1 [0189.460] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3475600, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x51b201b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3475600, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x3ba0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BULLETS.DLL", cAlternateFileName="")) returned 1 [0189.460] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2f35a00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbd3e24a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc2f35a00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0115834.GIF", cAlternateFileName="")) returned 1 [0189.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115834.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115834.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.461] GetProcessHeap () returned 0x4e0000 [0189.461] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.461] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.461] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.461] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x7, lpOverlapped=0x0) returned 1 [0189.463] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.463] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.463] GetProcessHeap () returned 0x4e0000 [0189.463] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.463] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.463] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.463] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.463] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.463] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.463] WriteFile (in: hFile=0x11c, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.463] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.463] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.463] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.463] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.463] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.463] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb9, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xb9, lpOverlapped=0x0) returned 1 [0189.463] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0, dwBufLen=0xc0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0) returned 1 [0189.463] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.464] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xc0, lpOverlapped=0x0) returned 1 [0189.464] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.464] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.464] SetEndOfFile (hFile=0x11c) returned 1 [0189.466] GetProcessHeap () returned 0x4e0000 [0189.466] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.466] GetProcessHeap () returned 0x4e0000 [0189.466] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.466] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115834.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115834.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115834.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115834.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.467] CloseHandle (hObject=0x11c) returned 1 [0189.467] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4248700, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbd3e24a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc4248700, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xb1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0115835.GIF", cAlternateFileName="")) returned 1 [0189.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115835.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115835.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.468] GetProcessHeap () returned 0x4e0000 [0189.468] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.468] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.468] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.468] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xf, lpOverlapped=0x0) returned 1 [0189.469] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.470] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.470] GetProcessHeap () returned 0x4e0000 [0189.470] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.470] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.470] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.470] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.470] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.470] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.470] WriteFile (in: hFile=0x11c, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.470] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.470] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.470] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.470] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.470] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.470] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb1, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xb1, lpOverlapped=0x0) returned 1 [0189.470] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0, dwBufLen=0xc0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0) returned 1 [0189.470] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.470] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xc0, lpOverlapped=0x0) returned 1 [0189.470] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.471] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.471] SetEndOfFile (hFile=0x11c) returned 1 [0189.473] GetProcessHeap () returned 0x4e0000 [0189.473] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.473] GetProcessHeap () returned 0x4e0000 [0189.473] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.473] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115835.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115835.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115835.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115835.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.474] CloseHandle (hObject=0x11c) returned 1 [0189.474] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc555b400, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbd3e24a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc555b400, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xad, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0115836.GIF", cAlternateFileName="")) returned 1 [0189.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115836.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115836.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.476] GetProcessHeap () returned 0x4e0000 [0189.476] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.476] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.476] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.476] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x3, lpOverlapped=0x0) returned 1 [0189.477] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.477] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.477] GetProcessHeap () returned 0x4e0000 [0189.477] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.501] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.501] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.501] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.501] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.501] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.501] WriteFile (in: hFile=0x11c, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.501] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.501] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.502] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.502] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.502] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.502] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xad, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xad, lpOverlapped=0x0) returned 1 [0189.502] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xb0, dwBufLen=0xb0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xb0) returned 1 [0189.502] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.502] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xb0, lpOverlapped=0x0) returned 1 [0189.502] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.502] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x184, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.502] SetEndOfFile (hFile=0x11c) returned 1 [0189.504] GetProcessHeap () returned 0x4e0000 [0189.504] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.504] GetProcessHeap () returned 0x4e0000 [0189.504] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.504] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115836.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115836.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115836.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115836.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.506] CloseHandle (hObject=0x11c) returned 1 [0189.506] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x497bb300, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbd3e24a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x497bb300, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0115839.GIF", cAlternateFileName="")) returned 1 [0189.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115839.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115839.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.508] GetProcessHeap () returned 0x4e0000 [0189.508] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.508] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.508] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.508] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x2, lpOverlapped=0x0) returned 1 [0189.509] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.509] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.509] GetProcessHeap () returned 0x4e0000 [0189.510] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.510] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.510] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.510] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.510] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.510] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.510] WriteFile (in: hFile=0x11c, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.510] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.510] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.510] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.510] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.510] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.510] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xbe, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xbe, lpOverlapped=0x0) returned 1 [0189.510] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0, dwBufLen=0xc0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0) returned 1 [0189.510] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.510] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xc0, lpOverlapped=0x0) returned 1 [0189.510] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.510] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.511] SetEndOfFile (hFile=0x11c) returned 1 [0189.513] GetProcessHeap () returned 0x4e0000 [0189.513] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.513] GetProcessHeap () returned 0x4e0000 [0189.513] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.513] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115839.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115839.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115839.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115839.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.514] CloseHandle (hObject=0x11c) returned 1 [0189.514] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4aace000, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbd408600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4aace000, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0115840.GIF", cAlternateFileName="")) returned 1 [0189.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115840.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115840.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.515] GetProcessHeap () returned 0x4e0000 [0189.515] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.515] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.515] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.516] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x2, lpOverlapped=0x0) returned 1 [0189.518] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.518] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.518] GetProcessHeap () returned 0x4e0000 [0189.518] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.519] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.519] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.519] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.519] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.519] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.519] WriteFile (in: hFile=0x11c, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.519] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.519] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.519] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.519] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.519] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.519] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xbe, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xbe, lpOverlapped=0x0) returned 1 [0189.519] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0, dwBufLen=0xc0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0) returned 1 [0189.519] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.519] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xc0, lpOverlapped=0x0) returned 1 [0189.519] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.519] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.519] SetEndOfFile (hFile=0x11c) returned 1 [0189.521] GetProcessHeap () returned 0x4e0000 [0189.521] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.521] GetProcessHeap () returned 0x4e0000 [0189.522] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.522] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115840.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115840.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115840.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115840.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.523] CloseHandle (hObject=0x11c) returned 1 [0189.523] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4aace000, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbd408600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4aace000, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0xb1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0115841.GIF", cAlternateFileName="")) returned 1 [0189.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115841.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115841.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.524] GetProcessHeap () returned 0x4e0000 [0189.524] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.524] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.524] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.524] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xf, lpOverlapped=0x0) returned 1 [0189.531] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.531] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.531] GetProcessHeap () returned 0x4e0000 [0189.531] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.531] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.531] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.531] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.531] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.531] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.531] WriteFile (in: hFile=0x11c, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.531] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.531] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.532] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.532] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.532] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.532] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb1, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xb1, lpOverlapped=0x0) returned 1 [0189.532] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0, dwBufLen=0xc0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0) returned 1 [0189.532] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.532] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xc0, lpOverlapped=0x0) returned 1 [0189.532] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.532] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.532] SetEndOfFile (hFile=0x11c) returned 1 [0189.534] GetProcessHeap () returned 0x4e0000 [0189.534] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.535] GetProcessHeap () returned 0x4e0000 [0189.535] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.535] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115841.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115841.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115841.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115841.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.537] CloseHandle (hObject=0x11c) returned 1 [0189.537] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4aace000, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbd408600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4aace000, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0xb0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0115842.GIF", cAlternateFileName="")) returned 1 [0189.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115842.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115842.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.544] GetProcessHeap () returned 0x4e0000 [0189.545] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.545] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.545] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.546] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.546] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.546] GetProcessHeap () returned 0x4e0000 [0189.546] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.546] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.546] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.546] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.548] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.548] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.548] WriteFile (in: hFile=0x11c, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.548] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.548] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.548] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.548] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.548] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.548] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb0, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xb0, lpOverlapped=0x0) returned 1 [0189.548] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xb0, dwBufLen=0xb0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xb0) returned 1 [0189.548] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.548] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xb0, lpOverlapped=0x0) returned 1 [0189.549] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.549] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x184, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.549] SetEndOfFile (hFile=0x11c) returned 1 [0189.551] GetProcessHeap () returned 0x4e0000 [0189.551] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.552] GetProcessHeap () returned 0x4e0000 [0189.552] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.552] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115842.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115842.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115842.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115842.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.554] CloseHandle (hObject=0x11c) returned 1 [0189.554] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4aace000, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbd408600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4aace000, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0xb0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0115843.GIF", cAlternateFileName="")) returned 1 [0189.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115843.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115843.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.555] GetProcessHeap () returned 0x4e0000 [0189.555] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.555] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.556] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.556] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.556] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.556] GetProcessHeap () returned 0x4e0000 [0189.556] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.556] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.556] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.556] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.557] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.557] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.557] WriteFile (in: hFile=0x11c, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.557] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.557] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.558] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.558] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.558] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.558] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb0, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xb0, lpOverlapped=0x0) returned 1 [0189.558] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xb0, dwBufLen=0xb0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xb0) returned 1 [0189.558] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.558] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xb0, lpOverlapped=0x0) returned 1 [0189.558] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.558] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x184, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.558] SetEndOfFile (hFile=0x11c) returned 1 [0189.560] GetProcessHeap () returned 0x4e0000 [0189.560] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.560] GetProcessHeap () returned 0x4e0000 [0189.560] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.560] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115843.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115843.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115843.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115843.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.562] CloseHandle (hObject=0x11c) returned 1 [0189.562] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bde0d00, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbd408600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4bde0d00, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0xb0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0115844.GIF", cAlternateFileName="")) returned 1 [0189.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115844.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115844.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.563] GetProcessHeap () returned 0x4e0000 [0189.563] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.563] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.563] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.563] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.563] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.563] GetProcessHeap () returned 0x4e0000 [0189.563] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.563] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.563] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.563] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.564] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.565] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.565] WriteFile (in: hFile=0x11c, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.565] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.565] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.565] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.565] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.565] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.565] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb0, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xb0, lpOverlapped=0x0) returned 1 [0189.565] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xb0, dwBufLen=0xb0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xb0) returned 1 [0189.565] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.565] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xb0, lpOverlapped=0x0) returned 1 [0189.565] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.565] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x184, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.565] SetEndOfFile (hFile=0x11c) returned 1 [0189.567] GetProcessHeap () returned 0x4e0000 [0189.567] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.567] GetProcessHeap () returned 0x4e0000 [0189.567] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.567] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115844.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115844.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115844.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115844.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.569] CloseHandle (hObject=0x11c) returned 1 [0189.569] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57c9cf00, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbd42e760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x57c9cf00, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0115863.GIF", cAlternateFileName="")) returned 1 [0189.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115863.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115863.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.571] GetProcessHeap () returned 0x4e0000 [0189.571] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.571] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.571] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.571] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x3, lpOverlapped=0x0) returned 1 [0189.573] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.573] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.573] GetProcessHeap () returned 0x4e0000 [0189.573] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.573] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.573] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.573] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.573] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.573] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.573] WriteFile (in: hFile=0x11c, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.573] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.573] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.573] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.573] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.573] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.574] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xed, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xed, lpOverlapped=0x0) returned 1 [0189.574] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xf0, dwBufLen=0xf0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xf0) returned 1 [0189.574] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.574] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xf0, lpOverlapped=0x0) returned 1 [0189.574] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.574] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x1c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.574] SetEndOfFile (hFile=0x11c) returned 1 [0189.576] GetProcessHeap () returned 0x4e0000 [0189.576] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.576] GetProcessHeap () returned 0x4e0000 [0189.576] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.576] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115863.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115863.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115863.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115863.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.578] CloseHandle (hObject=0x11c) returned 1 [0189.578] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57c9cf00, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbd42e760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x57c9cf00, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0115864.GIF", cAlternateFileName="")) returned 1 [0189.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115864.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115864.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.579] GetProcessHeap () returned 0x4e0000 [0189.579] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.579] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.579] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.579] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x7, lpOverlapped=0x0) returned 1 [0189.580] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.580] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.580] GetProcessHeap () returned 0x4e0000 [0189.580] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.580] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.580] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.580] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.581] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.581] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.581] WriteFile (in: hFile=0x11c, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.581] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.581] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.581] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.581] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.581] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.581] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xb9, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xb9, lpOverlapped=0x0) returned 1 [0189.581] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0, dwBufLen=0xc0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xc0) returned 1 [0189.581] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.581] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xc0, lpOverlapped=0x0) returned 1 [0189.581] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.581] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.581] SetEndOfFile (hFile=0x11c) returned 1 [0189.583] GetProcessHeap () returned 0x4e0000 [0189.583] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.583] GetProcessHeap () returned 0x4e0000 [0189.583] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.583] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115864.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115864.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115864.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115864.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.586] CloseHandle (hObject=0x11c) returned 1 [0189.586] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57c9cf00, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbd42e760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x57c9cf00, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0115865.GIF", cAlternateFileName="")) returned 1 [0189.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115865.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115865.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.587] GetProcessHeap () returned 0x4e0000 [0189.587] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.587] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.587] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.587] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.587] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.587] GetProcessHeap () returned 0x4e0000 [0189.587] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.587] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.587] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.587] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.588] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.588] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.589] WriteFile (in: hFile=0x11c, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.589] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.589] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.589] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.589] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.589] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.589] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xe0, lpOverlapped=0x0) returned 1 [0189.589] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xe0, dwBufLen=0xe0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xe0) returned 1 [0189.589] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.589] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xe0, lpOverlapped=0x0) returned 1 [0189.589] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.589] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x1b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.589] SetEndOfFile (hFile=0x11c) returned 1 [0189.591] GetProcessHeap () returned 0x4e0000 [0189.591] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.591] GetProcessHeap () returned 0x4e0000 [0189.591] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.591] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115865.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115865.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115865.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115865.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.592] CloseHandle (hObject=0x11c) returned 1 [0189.592] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58fafc00, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbd42e760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x58fafc00, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0115866.GIF", cAlternateFileName="")) returned 1 [0189.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115866.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115866.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.594] GetProcessHeap () returned 0x4e0000 [0189.594] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.594] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.594] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.594] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.594] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.594] GetProcessHeap () returned 0x4e0000 [0189.594] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.594] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.594] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.594] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.596] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.596] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.596] WriteFile (in: hFile=0x11c, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.596] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.596] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.596] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.596] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.596] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.596] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xe0, lpOverlapped=0x0) returned 1 [0189.596] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xe0, dwBufLen=0xe0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xe0) returned 1 [0189.596] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.596] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xe0, lpOverlapped=0x0) returned 1 [0189.596] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.596] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x1b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.597] SetEndOfFile (hFile=0x11c) returned 1 [0189.598] GetProcessHeap () returned 0x4e0000 [0189.598] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.599] GetProcessHeap () returned 0x4e0000 [0189.599] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.599] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115866.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115866.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115866.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115866.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.600] CloseHandle (hObject=0x11c) returned 1 [0189.600] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58fafc00, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbd42e760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x58fafc00, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0115867.GIF", cAlternateFileName="")) returned 1 [0189.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115867.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115867.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.601] GetProcessHeap () returned 0x4e0000 [0189.601] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.601] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.601] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.601] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.601] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.601] GetProcessHeap () returned 0x4e0000 [0189.601] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.601] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.601] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.601] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.603] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.603] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.603] WriteFile (in: hFile=0x11c, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.603] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.603] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.603] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.603] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.603] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.603] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xe0, lpOverlapped=0x0) returned 1 [0189.603] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xe0, dwBufLen=0xe0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xe0) returned 1 [0189.603] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.603] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xe0, lpOverlapped=0x0) returned 1 [0189.603] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.603] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x1b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.604] SetEndOfFile (hFile=0x11c) returned 1 [0189.606] GetProcessHeap () returned 0x4e0000 [0189.606] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.606] GetProcessHeap () returned 0x4e0000 [0189.606] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.606] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115867.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115867.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115867.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115867.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.607] CloseHandle (hObject=0x11c) returned 1 [0189.607] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58fafc00, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbd42e760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x58fafc00, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0115868.GIF", cAlternateFileName="")) returned 1 [0189.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115868.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115868.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.608] GetProcessHeap () returned 0x4e0000 [0189.608] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.608] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.608] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.608] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.608] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.608] GetProcessHeap () returned 0x4e0000 [0189.608] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.608] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.609] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.609] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.610] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.610] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.610] WriteFile (in: hFile=0x11c, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.610] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.610] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.610] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.610] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.610] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.610] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xe0, lpOverlapped=0x0) returned 1 [0189.610] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xe0, dwBufLen=0xe0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xe0) returned 1 [0189.610] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.610] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xe0, lpOverlapped=0x0) returned 1 [0189.610] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.610] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x1b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.611] SetEndOfFile (hFile=0x11c) returned 1 [0189.613] GetProcessHeap () returned 0x4e0000 [0189.613] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.613] GetProcessHeap () returned 0x4e0000 [0189.613] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.613] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115868.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115868.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115868.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115868.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.614] CloseHandle (hObject=0x11c) returned 1 [0189.614] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58fafc00, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbd42e760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x58fafc00, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0115868.GIF", cAlternateFileName="")) returned 0 [0189.614] GetProcessHeap () returned 0x4e0000 [0189.614] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.614] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0189.614] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8, pdwDataLen=0x24df020 | out: pbData=0x4f53d8, pdwDataLen=0x24df020) returned 1 [0189.614] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.614] GetProcessHeap () returned 0x4e0000 [0189.614] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f5420 [0189.614] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0189.614] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f5420, pdwDataLen=0x24df020 | out: pbData=0x4f5420, pdwDataLen=0x24df020) returned 1 [0189.614] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.614] GetProcessHeap () returned 0x4e0000 [0189.614] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6e0) returned 0x53a538 [0189.614] CryptImportKey (in: hProv=0x4f0590, pbData=0x24defb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4f01b4 | out: phKey=0x4f01b4*=0x522fd8) returned 1 [0189.614] CryptDecrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x53a538, pdwDataLen=0x24df020 | out: pbData=0x53a538, pdwDataLen=0x24df020) returned 1 [0189.614] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.614] wsprintfW (in: param_1=0x24ddffc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\readme-warning.txt") returned 75 [0189.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\readme-warning.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.615] WriteFile (in: hFile=0x11c, lpBuffer=0x53a538*, nNumberOfBytesToWrite=0x6c3, lpNumberOfBytesWritten=0x24ddff8, lpOverlapped=0x0 | out: lpBuffer=0x53a538*, lpNumberOfBytesWritten=0x24ddff8*=0x6c3, lpOverlapped=0x0) returned 1 [0189.616] CloseHandle (hObject=0x11c) returned 1 [0189.616] GetProcessHeap () returned 0x4e0000 [0189.616] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x53a538 | out: hHeap=0x4e0000) returned 1 [0189.616] GetProcessHeap () returned 0x4e0000 [0189.616] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5420 | out: hHeap=0x4e0000) returned 1 [0189.616] GetProcessHeap () returned 0x4e0000 [0189.616] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.616] FindClose (in: hFindFile=0x522f98 | out: hFindFile=0x522f98) returned 1 [0189.616] GetProcessHeap () returned 0x4e0000 [0189.616] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5229e8 | out: hHeap=0x4e0000) returned 1 [0189.616] FindNextFileW (in: hFindFile=0x522f58, lpFindFileData=0x24df2e0 | out: lpFindFileData=0x24df2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5178e0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd4548c0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LINES", cAlternateFileName="")) returned 1 [0189.616] GetProcessHeap () returned 0x4e0000 [0189.616] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x7e) returned 0x4f9930 [0189.616] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\*.*", lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5178e0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd4548c0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x522f98 [0189.623] GetProcessHeap () returned 0x4e0000 [0189.623] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f9930 | out: hHeap=0x4e0000) returned 1 [0189.623] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5178e0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd4548c0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0189.624] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b0e4a00, ftCreationTime.dwHighDateTime=0x1bd5ead, ftLastAccessTime.dwLowDateTime=0xbc847960, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9b0e4a00, ftLastWriteTime.dwHighDateTime=0x1bd5ead, nFileSizeHigh=0x0, nFileSizeLow=0x3d2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD10219_.GIF", cAlternateFileName="")) returned 1 [0189.624] GetProcessHeap () returned 0x4e0000 [0189.624] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x280) returned 0x5229e8 [0189.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10219_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10219_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.626] GetProcessHeap () returned 0x4e0000 [0189.626] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.626] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.626] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.626] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xe, lpOverlapped=0x0) returned 1 [0189.627] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.627] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.627] GetProcessHeap () returned 0x4e0000 [0189.627] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.627] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.627] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.627] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.628] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.628] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.628] WriteFile (in: hFile=0x11c, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.628] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.628] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.628] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.628] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.628] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.628] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3d2, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x3d2, lpOverlapped=0x0) returned 1 [0189.628] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x3e0, dwBufLen=0x3e0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x3e0) returned 1 [0189.628] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.628] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3e0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x3e0, lpOverlapped=0x0) returned 1 [0189.628] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.628] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x4b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.628] SetEndOfFile (hFile=0x11c) returned 1 [0189.630] GetProcessHeap () returned 0x4e0000 [0189.631] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.631] GetProcessHeap () returned 0x4e0000 [0189.631] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.631] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10219_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10219_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10219_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10219_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.632] CloseHandle (hObject=0x11c) returned 1 [0189.632] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8d9c300, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbc847960, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8d9c300, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0x97e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD10256_.GIF", cAlternateFileName="")) returned 1 [0189.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10256_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10256_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.633] GetProcessHeap () returned 0x4e0000 [0189.633] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.634] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.634] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.634] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x2, lpOverlapped=0x0) returned 1 [0189.635] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.635] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.635] GetProcessHeap () returned 0x4e0000 [0189.635] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.635] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.636] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.636] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.636] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.636] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.636] WriteFile (in: hFile=0x11c, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.636] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.636] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.636] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.636] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.636] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.636] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x97e, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x97e, lpOverlapped=0x0) returned 1 [0189.636] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x980, dwBufLen=0x980 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x980) returned 1 [0189.636] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.636] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x980, lpOverlapped=0x0) returned 1 [0189.636] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.636] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xa54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.636] SetEndOfFile (hFile=0x11c) returned 1 [0189.638] GetProcessHeap () returned 0x4e0000 [0189.638] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.639] GetProcessHeap () returned 0x4e0000 [0189.639] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.639] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10256_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10256_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10256_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10256_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.640] CloseHandle (hObject=0x11c) returned 1 [0189.640] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e031400, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc893c20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6e031400, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x124, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD10289_.GIF", cAlternateFileName="")) returned 1 [0189.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10289_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10289_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.643] GetProcessHeap () returned 0x4e0000 [0189.643] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.643] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.643] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.643] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xc, lpOverlapped=0x0) returned 1 [0189.644] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.644] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.644] GetProcessHeap () returned 0x4e0000 [0189.644] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.644] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.644] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.644] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.644] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.644] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.645] WriteFile (in: hFile=0x11c, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.645] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.645] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.645] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.645] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.645] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.645] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x124, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x124, lpOverlapped=0x0) returned 1 [0189.645] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x130, dwBufLen=0x130 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x130) returned 1 [0189.645] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.645] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x130, lpOverlapped=0x0) returned 1 [0189.645] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.645] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.645] SetEndOfFile (hFile=0x11c) returned 1 [0189.647] GetProcessHeap () returned 0x4e0000 [0189.647] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.647] GetProcessHeap () returned 0x4e0000 [0189.647] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.647] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10289_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10289_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10289_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10289_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.650] CloseHandle (hObject=0x11c) returned 1 [0189.651] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e031400, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc893c20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6e031400, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x134, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD10290_.GIF", cAlternateFileName="")) returned 1 [0189.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10290_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10290_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.652] GetProcessHeap () returned 0x4e0000 [0189.652] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.652] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.652] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.652] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xc, lpOverlapped=0x0) returned 1 [0189.653] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.653] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.653] GetProcessHeap () returned 0x4e0000 [0189.653] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.653] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.653] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.653] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.654] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.654] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.654] WriteFile (in: hFile=0x11c, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.654] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.654] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.654] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.654] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.654] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.654] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x134, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x134, lpOverlapped=0x0) returned 1 [0189.654] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x140, dwBufLen=0x140 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x140) returned 1 [0189.654] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.654] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x140, lpOverlapped=0x0) returned 1 [0189.654] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.654] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.654] SetEndOfFile (hFile=0x11c) returned 1 [0189.656] GetProcessHeap () returned 0x4e0000 [0189.656] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.656] GetProcessHeap () returned 0x4e0000 [0189.656] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.656] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10290_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10290_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10290_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10290_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.659] CloseHandle (hObject=0x11c) returned 1 [0189.659] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73f8f500, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc8b9d80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x73f8f500, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x497, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD10307_.GIF", cAlternateFileName="")) returned 1 [0189.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10307_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10307_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.661] GetProcessHeap () returned 0x4e0000 [0189.661] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.661] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.661] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.661] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x9, lpOverlapped=0x0) returned 1 [0189.663] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.663] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.663] GetProcessHeap () returned 0x4e0000 [0189.663] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.663] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.663] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.663] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.663] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.663] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.663] WriteFile (in: hFile=0x11c, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.663] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.663] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.663] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.663] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.663] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.663] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x497, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x497, lpOverlapped=0x0) returned 1 [0189.664] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x4a0, dwBufLen=0x4a0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x4a0) returned 1 [0189.664] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.664] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x4a0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x4a0, lpOverlapped=0x0) returned 1 [0189.664] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.664] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x574, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.664] SetEndOfFile (hFile=0x11c) returned 1 [0189.667] GetProcessHeap () returned 0x4e0000 [0189.667] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.667] GetProcessHeap () returned 0x4e0000 [0189.667] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.667] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10307_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10307_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10307_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10307_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.670] CloseHandle (hObject=0x11c) returned 1 [0189.670] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x752a2200, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc8b9d80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x752a2200, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x27d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD10308_.GIF", cAlternateFileName="")) returned 1 [0189.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10308_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10308_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.671] GetProcessHeap () returned 0x4e0000 [0189.671] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.671] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.672] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.672] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x3, lpOverlapped=0x0) returned 1 [0189.673] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.673] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.673] GetProcessHeap () returned 0x4e0000 [0189.673] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.673] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.673] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.674] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.674] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.674] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.674] WriteFile (in: hFile=0x11c, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.674] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.674] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.674] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.674] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.674] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.674] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x27d, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x27d, lpOverlapped=0x0) returned 1 [0189.674] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x280, dwBufLen=0x280 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x280) returned 1 [0189.675] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.675] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x280, lpOverlapped=0x0) returned 1 [0189.675] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.675] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x354, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.675] SetEndOfFile (hFile=0x11c) returned 1 [0189.677] GetProcessHeap () returned 0x4e0000 [0189.677] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.678] GetProcessHeap () returned 0x4e0000 [0189.678] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.678] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10308_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10308_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10308_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10308_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.680] CloseHandle (hObject=0x11c) returned 1 [0189.680] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68a6c900, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc8b9d80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x68a6c900, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x3a4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD10358_.GIF", cAlternateFileName="")) returned 1 [0189.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10358_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10358_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.682] GetProcessHeap () returned 0x4e0000 [0189.682] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.682] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.682] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.682] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xc, lpOverlapped=0x0) returned 1 [0189.685] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.685] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.685] GetProcessHeap () returned 0x4e0000 [0189.685] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.685] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.685] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.685] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.685] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.685] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.685] WriteFile (in: hFile=0x11c, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.686] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.686] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.686] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.686] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.686] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.686] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x3a4, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x3a4, lpOverlapped=0x0) returned 1 [0189.686] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x3b0, dwBufLen=0x3b0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x3b0) returned 1 [0189.686] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.686] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x3b0, lpOverlapped=0x0) returned 1 [0189.686] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.686] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x484, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.686] SetEndOfFile (hFile=0x11c) returned 1 [0189.689] GetProcessHeap () returned 0x4e0000 [0189.689] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.689] GetProcessHeap () returned 0x4e0000 [0189.689] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.689] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10358_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10358_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10358_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10358_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.691] CloseHandle (hObject=0x11c) returned 1 [0189.691] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb91d2700, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc8dfee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb91d2700, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x160, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD14516_.GIF", cAlternateFileName="")) returned 1 [0189.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14516_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14516_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.694] GetProcessHeap () returned 0x4e0000 [0189.694] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.694] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.694] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.694] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.694] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.694] GetProcessHeap () returned 0x4e0000 [0189.694] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.694] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.694] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.694] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.696] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.696] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.697] WriteFile (in: hFile=0x11c, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.697] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.697] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.697] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.697] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.697] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.697] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x160, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x160, lpOverlapped=0x0) returned 1 [0189.697] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x160, dwBufLen=0x160 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x160) returned 1 [0189.697] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.697] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x160, lpOverlapped=0x0) returned 1 [0189.697] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.697] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x234, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.697] SetEndOfFile (hFile=0x11c) returned 1 [0189.700] GetProcessHeap () returned 0x4e0000 [0189.700] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.700] GetProcessHeap () returned 0x4e0000 [0189.700] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.700] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14516_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14516_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14516_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14516_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.703] CloseHandle (hObject=0x11c) returned 1 [0189.703] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8d9c300, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbc906040, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8d9c300, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0x617, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD14538_.GIF", cAlternateFileName="")) returned 1 [0189.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14538_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14538_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.705] GetProcessHeap () returned 0x4e0000 [0189.705] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.705] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.705] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.705] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x9, lpOverlapped=0x0) returned 1 [0189.707] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.707] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.707] GetProcessHeap () returned 0x4e0000 [0189.707] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.708] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.708] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.708] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.708] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.708] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.708] WriteFile (in: hFile=0x11c, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.708] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.708] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.708] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.708] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.708] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.708] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x617, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x617, lpOverlapped=0x0) returned 1 [0189.708] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x620, dwBufLen=0x620 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x620) returned 1 [0189.708] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.709] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x620, lpOverlapped=0x0) returned 1 [0189.709] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.709] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x6f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.709] SetEndOfFile (hFile=0x11c) returned 1 [0189.712] GetProcessHeap () returned 0x4e0000 [0189.712] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.712] GetProcessHeap () returned 0x4e0000 [0189.712] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.712] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14538_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14538_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14538_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14538_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.714] CloseHandle (hObject=0x11c) returned 1 [0189.714] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa0af000, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbc906040, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaa0af000, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0x5ab, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD14539_.GIF", cAlternateFileName="")) returned 1 [0189.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14539_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14539_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.716] GetProcessHeap () returned 0x4e0000 [0189.716] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.716] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.716] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.716] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x5, lpOverlapped=0x0) returned 1 [0189.718] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.718] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.718] GetProcessHeap () returned 0x4e0000 [0189.718] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.718] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.718] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.718] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.718] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.718] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.719] WriteFile (in: hFile=0x11c, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.719] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.719] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.719] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.719] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.719] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.719] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x5ab, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x5ab, lpOverlapped=0x0) returned 1 [0189.719] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x5b0) returned 1 [0189.719] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.719] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x5b0, lpOverlapped=0x0) returned 1 [0189.719] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.719] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.719] SetEndOfFile (hFile=0x11c) returned 1 [0189.721] GetProcessHeap () returned 0x4e0000 [0189.721] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.721] GetProcessHeap () returned 0x4e0000 [0189.721] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.721] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14539_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14539_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14539_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14539_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.723] CloseHandle (hObject=0x11c) returned 1 [0189.723] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84a96b00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc952300, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x84a96b00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x25b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD14594_.GIF", cAlternateFileName="")) returned 1 [0189.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14594_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14594_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.724] GetProcessHeap () returned 0x4e0000 [0189.724] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.724] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.724] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.724] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x5, lpOverlapped=0x0) returned 1 [0189.726] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.726] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.726] GetProcessHeap () returned 0x4e0000 [0189.726] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.726] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.726] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.726] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.726] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.726] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.726] WriteFile (in: hFile=0x11c, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.726] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.726] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.726] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.726] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.726] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.727] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x25b, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x25b, lpOverlapped=0x0) returned 1 [0189.727] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x260, dwBufLen=0x260 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x260) returned 1 [0189.727] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.727] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x260, lpOverlapped=0x0) returned 1 [0189.727] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.727] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x334, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.727] SetEndOfFile (hFile=0x11c) returned 1 [0189.729] GetProcessHeap () returned 0x4e0000 [0189.729] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.729] GetProcessHeap () returned 0x4e0000 [0189.729] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.729] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14594_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14594_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14594_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14594_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.730] CloseHandle (hObject=0x11c) returned 1 [0189.730] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84a96b00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc952300, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x84a96b00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD14595_.GIF", cAlternateFileName="")) returned 1 [0189.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14595_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14595_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.731] GetProcessHeap () returned 0x4e0000 [0189.731] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.731] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.731] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.732] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x9, lpOverlapped=0x0) returned 1 [0189.733] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.733] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.733] GetProcessHeap () returned 0x4e0000 [0189.733] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.733] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.733] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.733] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.733] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.733] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.733] WriteFile (in: hFile=0x11c, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.733] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.733] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.733] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.733] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.734] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.734] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1d7, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x1d7, lpOverlapped=0x0) returned 1 [0189.734] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1e0) returned 1 [0189.734] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.734] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x1e0, lpOverlapped=0x0) returned 1 [0189.734] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.734] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x2b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.734] SetEndOfFile (hFile=0x11c) returned 1 [0189.736] GetProcessHeap () returned 0x4e0000 [0189.736] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.736] GetProcessHeap () returned 0x4e0000 [0189.736] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.736] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14595_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14595_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14595_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14595_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.738] CloseHandle (hObject=0x11c) returned 1 [0189.738] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe2ea600, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc952300, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe2ea600, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0x11c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD14677_.GIF", cAlternateFileName="")) returned 1 [0189.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14677_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14677_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.739] GetProcessHeap () returned 0x4e0000 [0189.739] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.739] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.739] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.740] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.741] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.741] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.741] GetProcessHeap () returned 0x4e0000 [0189.741] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.741] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.741] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.741] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.741] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.741] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.741] WriteFile (in: hFile=0x11c, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.742] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.742] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.742] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.742] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.742] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.742] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x11c, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x11c, lpOverlapped=0x0) returned 1 [0189.742] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x120, dwBufLen=0x120 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x120) returned 1 [0189.742] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.742] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x120, lpOverlapped=0x0) returned 1 [0189.742] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.742] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x1f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.742] SetEndOfFile (hFile=0x11c) returned 1 [0189.744] GetProcessHeap () returned 0x4e0000 [0189.744] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.744] GetProcessHeap () returned 0x4e0000 [0189.744] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.744] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14677_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14677_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14677_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14677_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.746] CloseHandle (hObject=0x11c) returned 1 [0189.746] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdadef00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc978460, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xcdadef00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0x2fe, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD14710_.GIF", cAlternateFileName="")) returned 1 [0189.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14710_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14710_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.747] GetProcessHeap () returned 0x4e0000 [0189.747] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.747] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.747] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.747] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x2, lpOverlapped=0x0) returned 1 [0189.749] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.749] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.749] GetProcessHeap () returned 0x4e0000 [0189.749] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.749] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.749] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.749] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.749] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.749] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.749] WriteFile (in: hFile=0x11c, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.749] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.749] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.749] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.749] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.750] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.750] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2fe, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x2fe, lpOverlapped=0x0) returned 1 [0189.750] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x300, dwBufLen=0x300 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x300) returned 1 [0189.750] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.750] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x300, lpOverlapped=0x0) returned 1 [0189.750] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.750] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x3d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.750] SetEndOfFile (hFile=0x11c) returned 1 [0189.752] GetProcessHeap () returned 0x4e0000 [0189.752] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.752] GetProcessHeap () returned 0x4e0000 [0189.752] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.752] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14710_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14710_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14710_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14710_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.754] CloseHandle (hObject=0x11c) returned 1 [0189.754] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdadef00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc978460, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xcdadef00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xa97, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD14711_.GIF", cAlternateFileName="")) returned 1 [0189.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14711_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14711_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.755] GetProcessHeap () returned 0x4e0000 [0189.755] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.755] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.755] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.755] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x9, lpOverlapped=0x0) returned 1 [0189.757] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.757] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.757] GetProcessHeap () returned 0x4e0000 [0189.757] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.757] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.757] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.757] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.757] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.757] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.757] WriteFile (in: hFile=0x11c, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.757] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.757] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.758] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.758] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.758] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.758] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0xa97, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0xa97, lpOverlapped=0x0) returned 1 [0189.758] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0xaa0, dwBufLen=0xaa0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0xaa0) returned 1 [0189.758] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.758] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xaa0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0xaa0, lpOverlapped=0x0) returned 1 [0189.758] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.758] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xb74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.758] SetEndOfFile (hFile=0x11c) returned 1 [0189.760] GetProcessHeap () returned 0x4e0000 [0189.760] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.760] GetProcessHeap () returned 0x4e0000 [0189.760] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.760] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14711_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14711_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14711_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14711_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.762] CloseHandle (hObject=0x11c) returned 1 [0189.762] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2a26200, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc99e5c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf2a26200, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0x1a7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD14768_.GIF", cAlternateFileName="")) returned 1 [0189.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14768_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14768_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.763] GetProcessHeap () returned 0x4e0000 [0189.763] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.763] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.763] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.763] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x9, lpOverlapped=0x0) returned 1 [0189.764] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.764] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.764] GetProcessHeap () returned 0x4e0000 [0189.764] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.764] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.764] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.764] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.764] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.764] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.764] WriteFile (in: hFile=0x11c, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.765] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.765] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.765] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.765] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.765] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.765] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1a7, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x1a7, lpOverlapped=0x0) returned 1 [0189.765] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1b0, dwBufLen=0x1b0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1b0) returned 1 [0189.765] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.765] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1b0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x1b0, lpOverlapped=0x0) returned 1 [0189.765] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.765] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x284, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.765] SetEndOfFile (hFile=0x11c) returned 1 [0189.767] GetProcessHeap () returned 0x4e0000 [0189.767] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.767] GetProcessHeap () returned 0x4e0000 [0189.767] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.767] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14768_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14768_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14768_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14768_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.770] CloseHandle (hObject=0x11c) returned 1 [0189.770] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2a26200, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc99e5c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf2a26200, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD14769_.GIF", cAlternateFileName="")) returned 1 [0189.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14769_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14769_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.771] GetProcessHeap () returned 0x4e0000 [0189.771] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.771] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.771] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.771] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x6, lpOverlapped=0x0) returned 1 [0189.772] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.772] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.773] GetProcessHeap () returned 0x4e0000 [0189.773] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.773] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.773] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.773] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.773] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.773] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.773] WriteFile (in: hFile=0x11c, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.773] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.773] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.773] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.773] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.773] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.773] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x16a, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x16a, lpOverlapped=0x0) returned 1 [0189.774] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x170, dwBufLen=0x170 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x170) returned 1 [0189.774] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.774] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x170, lpOverlapped=0x0) returned 1 [0189.774] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.774] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x244, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.774] SetEndOfFile (hFile=0x11c) returned 1 [0189.777] GetProcessHeap () returned 0x4e0000 [0189.777] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.777] GetProcessHeap () returned 0x4e0000 [0189.777] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.777] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14769_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14769_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14769_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14769_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.779] CloseHandle (hObject=0x11c) returned 1 [0189.779] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa0af000, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbc9c4720, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaa0af000, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0x1f3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD14800_.GIF", cAlternateFileName="")) returned 1 [0189.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14800_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14800_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.781] GetProcessHeap () returned 0x4e0000 [0189.781] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.781] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.781] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.781] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xd, lpOverlapped=0x0) returned 1 [0189.782] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.782] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.782] GetProcessHeap () returned 0x4e0000 [0189.782] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.782] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.782] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.782] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.782] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.783] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.783] WriteFile (in: hFile=0x11c, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.783] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.783] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.783] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.783] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.783] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.783] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1f3, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x1f3, lpOverlapped=0x0) returned 1 [0189.783] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x200, dwBufLen=0x200 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x200) returned 1 [0189.783] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.783] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x200, lpOverlapped=0x0) returned 1 [0189.783] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.783] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x2d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.783] SetEndOfFile (hFile=0x11c) returned 1 [0189.785] GetProcessHeap () returned 0x4e0000 [0189.785] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.785] GetProcessHeap () returned 0x4e0000 [0189.785] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.786] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14800_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14800_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14800_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14800_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.787] CloseHandle (hObject=0x11c) returned 1 [0189.797] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa0af000, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbc9ea880, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaa0af000, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0x384, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD14801_.GIF", cAlternateFileName="")) returned 1 [0189.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14801_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14801_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.798] GetProcessHeap () returned 0x4e0000 [0189.798] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.799] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.799] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.799] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xc, lpOverlapped=0x0) returned 1 [0189.810] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.810] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.810] GetProcessHeap () returned 0x4e0000 [0189.810] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.810] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.810] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.810] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.810] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.810] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.810] WriteFile (in: hFile=0x11c, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.810] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.810] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.811] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.811] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.811] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.811] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x384, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x384, lpOverlapped=0x0) returned 1 [0189.811] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x390, dwBufLen=0x390 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x390) returned 1 [0189.811] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.811] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x390, lpOverlapped=0x0) returned 1 [0189.811] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.811] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.811] SetEndOfFile (hFile=0x11c) returned 1 [0189.813] GetProcessHeap () returned 0x4e0000 [0189.813] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.813] GetProcessHeap () returned 0x4e0000 [0189.813] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.813] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14801_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14801_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14801_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14801_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.817] CloseHandle (hObject=0x11c) returned 1 [0189.817] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3e9a00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca109e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf3e9a00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x13c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD14844_.GIF", cAlternateFileName="")) returned 1 [0189.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14844_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14844_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.819] GetProcessHeap () returned 0x4e0000 [0189.819] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.819] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.819] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.819] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.820] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.820] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.820] GetProcessHeap () returned 0x4e0000 [0189.820] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.820] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.820] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.820] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.821] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.821] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.821] WriteFile (in: hFile=0x11c, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.821] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.821] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.821] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.821] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.821] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.821] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x13c, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x13c, lpOverlapped=0x0) returned 1 [0189.821] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x140, dwBufLen=0x140 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x140) returned 1 [0189.821] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.821] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x140, lpOverlapped=0x0) returned 1 [0189.822] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.822] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.822] SetEndOfFile (hFile=0x11c) returned 1 [0189.824] GetProcessHeap () returned 0x4e0000 [0189.824] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.824] GetProcessHeap () returned 0x4e0000 [0189.824] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.824] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14844_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14844_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14844_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14844_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.828] CloseHandle (hObject=0x11c) returned 1 [0189.828] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3e9a00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca109e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf3e9a00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x117, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD14845_.GIF", cAlternateFileName="")) returned 1 [0189.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14845_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14845_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.830] GetProcessHeap () returned 0x4e0000 [0189.830] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.830] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.830] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.830] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x9, lpOverlapped=0x0) returned 1 [0189.832] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.832] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.832] GetProcessHeap () returned 0x4e0000 [0189.832] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.832] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.832] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.832] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.832] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.832] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.832] WriteFile (in: hFile=0x11c, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.832] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.832] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.833] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.833] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.833] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.833] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x117, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x117, lpOverlapped=0x0) returned 1 [0189.833] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x120, dwBufLen=0x120 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x120) returned 1 [0189.833] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.833] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x120, lpOverlapped=0x0) returned 1 [0189.833] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.833] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x1f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.833] SetEndOfFile (hFile=0x11c) returned 1 [0189.835] GetProcessHeap () returned 0x4e0000 [0189.835] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.835] GetProcessHeap () returned 0x4e0000 [0189.835] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.835] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14845_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14845_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14845_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14845_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.837] CloseHandle (hObject=0x11c) returned 1 [0189.837] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ebde300, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca36b40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1ebde300, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x17d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD14882_.GIF", cAlternateFileName="")) returned 1 [0189.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14882_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14882_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.839] GetProcessHeap () returned 0x4e0000 [0189.839] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.839] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.839] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.839] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x3, lpOverlapped=0x0) returned 1 [0189.840] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.840] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.840] GetProcessHeap () returned 0x4e0000 [0189.840] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.840] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.840] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.840] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.841] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.841] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.841] WriteFile (in: hFile=0x11c, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.841] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.841] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.841] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.841] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.841] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.841] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x17d, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x17d, lpOverlapped=0x0) returned 1 [0189.841] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x180, dwBufLen=0x180 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x180) returned 1 [0189.841] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.841] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x180, lpOverlapped=0x0) returned 1 [0189.841] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.841] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x254, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.841] SetEndOfFile (hFile=0x11c) returned 1 [0189.844] GetProcessHeap () returned 0x4e0000 [0189.844] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.844] GetProcessHeap () returned 0x4e0000 [0189.844] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.844] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14882_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14882_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14882_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14882_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.847] CloseHandle (hObject=0x11c) returned 1 [0189.847] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ebde300, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca36b40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1ebde300, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x144, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD14883_.GIF", cAlternateFileName="")) returned 1 [0189.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14883_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14883_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.849] GetProcessHeap () returned 0x4e0000 [0189.849] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.849] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.849] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.849] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xc, lpOverlapped=0x0) returned 1 [0189.850] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.850] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.850] GetProcessHeap () returned 0x4e0000 [0189.850] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.850] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.850] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.850] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.850] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.851] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.851] WriteFile (in: hFile=0x11c, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.851] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.851] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.851] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.851] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.851] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.851] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x144, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x144, lpOverlapped=0x0) returned 1 [0189.851] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x150, dwBufLen=0x150 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x150) returned 1 [0189.851] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.851] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x150, lpOverlapped=0x0) returned 1 [0189.851] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.851] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.851] SetEndOfFile (hFile=0x11c) returned 1 [0189.854] GetProcessHeap () returned 0x4e0000 [0189.854] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.854] GetProcessHeap () returned 0x4e0000 [0189.854] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.854] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14883_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14883_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14883_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14883_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.856] CloseHandle (hObject=0x11c) returned 1 [0189.856] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73615e00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca5cca0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x73615e00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD14996_.GIF", cAlternateFileName="")) returned 1 [0189.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14996_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14996_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.858] GetProcessHeap () returned 0x4e0000 [0189.858] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.858] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.858] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.858] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x9, lpOverlapped=0x0) returned 1 [0189.860] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.860] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.860] GetProcessHeap () returned 0x4e0000 [0189.860] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.860] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.860] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.860] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.860] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.860] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.860] WriteFile (in: hFile=0x11c, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.860] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.861] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.861] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.861] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.861] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.861] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2d7, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x2d7, lpOverlapped=0x0) returned 1 [0189.861] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x2e0) returned 1 [0189.861] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.861] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x2e0, lpOverlapped=0x0) returned 1 [0189.861] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.861] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x3b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.861] SetEndOfFile (hFile=0x11c) returned 1 [0189.863] GetProcessHeap () returned 0x4e0000 [0189.863] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.864] GetProcessHeap () returned 0x4e0000 [0189.864] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.864] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14996_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14996_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14996_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14996_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.866] CloseHandle (hObject=0x11c) returned 1 [0189.866] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73615e00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca5cca0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x73615e00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x2ae, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD14997_.GIF", cAlternateFileName="")) returned 1 [0189.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14997_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14997_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.867] GetProcessHeap () returned 0x4e0000 [0189.867] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.867] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.867] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.867] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x2, lpOverlapped=0x0) returned 1 [0189.869] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.869] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.869] GetProcessHeap () returned 0x4e0000 [0189.869] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.869] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.869] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.869] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.870] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.870] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.870] WriteFile (in: hFile=0x11c, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.870] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.870] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.870] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.870] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.870] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.870] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x2ae, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x2ae, lpOverlapped=0x0) returned 1 [0189.870] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x2b0, dwBufLen=0x2b0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x2b0) returned 1 [0189.870] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.870] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x2b0, lpOverlapped=0x0) returned 1 [0189.870] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.870] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x384, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.870] SetEndOfFile (hFile=0x11c) returned 1 [0189.872] GetProcessHeap () returned 0x4e0000 [0189.872] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.872] GetProcessHeap () returned 0x4e0000 [0189.872] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.873] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14997_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14997_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14997_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14997_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.875] CloseHandle (hObject=0x11c) returned 1 [0189.875] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81af7a00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca82e00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x81af7a00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x220, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD15034_.GIF", cAlternateFileName="")) returned 1 [0189.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15034_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15034_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.876] GetProcessHeap () returned 0x4e0000 [0189.876] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.876] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.877] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.877] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.877] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.877] GetProcessHeap () returned 0x4e0000 [0189.877] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.877] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.877] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.877] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.878] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.878] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.878] WriteFile (in: hFile=0x11c, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.879] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.879] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.879] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.879] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.879] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.879] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x220, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x220, lpOverlapped=0x0) returned 1 [0189.879] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x220, dwBufLen=0x220 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x220) returned 1 [0189.879] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.879] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x220, lpOverlapped=0x0) returned 1 [0189.879] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.879] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x2f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.879] SetEndOfFile (hFile=0x11c) returned 1 [0189.881] GetProcessHeap () returned 0x4e0000 [0189.881] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.881] GetProcessHeap () returned 0x4e0000 [0189.881] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.881] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15034_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15034_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15034_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15034_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.883] CloseHandle (hObject=0x11c) returned 1 [0189.883] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81af7a00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcaa8f60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x81af7a00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x16e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD15035_.GIF", cAlternateFileName="")) returned 1 [0189.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15035_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15035_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.885] GetProcessHeap () returned 0x4e0000 [0189.885] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.885] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.885] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.885] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x2, lpOverlapped=0x0) returned 1 [0189.887] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.887] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.887] GetProcessHeap () returned 0x4e0000 [0189.887] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.887] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.887] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.887] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.888] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.888] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.888] WriteFile (in: hFile=0x11c, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.888] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.888] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.888] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.888] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.888] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.888] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x16e, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x16e, lpOverlapped=0x0) returned 1 [0189.888] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x170, dwBufLen=0x170 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x170) returned 1 [0189.888] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.889] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x170, lpOverlapped=0x0) returned 1 [0189.889] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.889] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x244, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.889] SetEndOfFile (hFile=0x11c) returned 1 [0189.892] GetProcessHeap () returned 0x4e0000 [0189.892] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.892] GetProcessHeap () returned 0x4e0000 [0189.892] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.892] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15035_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15035_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15035_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15035_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.913] CloseHandle (hObject=0x11c) returned 1 [0189.913] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9be95800, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcacf0c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9be95800, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x1a7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD15072_.GIF", cAlternateFileName="")) returned 1 [0189.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15072_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15072_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.915] GetProcessHeap () returned 0x4e0000 [0189.915] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.915] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.915] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.915] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0x9, lpOverlapped=0x0) returned 1 [0189.916] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.916] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.916] GetProcessHeap () returned 0x4e0000 [0189.916] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.917] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.917] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.917] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.917] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.917] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.917] WriteFile (in: hFile=0x11c, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.917] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.917] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.917] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.917] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.917] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.917] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x1a7, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x1a7, lpOverlapped=0x0) returned 1 [0189.917] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1b0, dwBufLen=0x1b0 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x1b0) returned 1 [0189.917] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.917] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x1b0, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x1b0, lpOverlapped=0x0) returned 1 [0189.917] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.917] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x284, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.917] SetEndOfFile (hFile=0x11c) returned 1 [0189.920] GetProcessHeap () returned 0x4e0000 [0189.920] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.920] GetProcessHeap () returned 0x4e0000 [0189.920] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.920] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15072_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15072_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15072_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15072_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.924] CloseHandle (hObject=0x11c) returned 1 [0189.924] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d1a8500, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcacf0c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9d1a8500, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD15073_.GIF", cAlternateFileName="")) returned 1 [0189.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15073_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15073_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.925] GetProcessHeap () returned 0x4e0000 [0189.925] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.926] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.926] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.926] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xa, lpOverlapped=0x0) returned 1 [0189.927] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.927] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.927] GetProcessHeap () returned 0x4e0000 [0189.928] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.928] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.928] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.928] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.928] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.928] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.928] WriteFile (in: hFile=0x11c, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.928] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.928] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.928] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.928] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.929] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.929] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x186, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x186, lpOverlapped=0x0) returned 1 [0189.929] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x190, dwBufLen=0x190 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x190) returned 1 [0189.929] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.929] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x190, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x190, lpOverlapped=0x0) returned 1 [0189.929] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.929] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x264, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.929] SetEndOfFile (hFile=0x11c) returned 1 [0189.932] GetProcessHeap () returned 0x4e0000 [0189.932] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.932] GetProcessHeap () returned 0x4e0000 [0189.932] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.932] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15073_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15073_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15073_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15073_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.936] CloseHandle (hObject=0x11c) returned 1 [0189.936] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab3c1d00, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbcaf5220, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xab3c1d00, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0x115, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD15155_.GIF", cAlternateFileName="")) returned 1 [0189.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15155_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15155_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.937] GetProcessHeap () returned 0x4e0000 [0189.937] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.937] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.937] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.937] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xb, lpOverlapped=0x0) returned 1 [0189.939] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.939] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.939] GetProcessHeap () returned 0x4e0000 [0189.939] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.939] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.939] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.939] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.940] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.940] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.940] WriteFile (in: hFile=0x11c, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.940] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.940] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.940] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.940] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.940] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.940] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x115, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x115, lpOverlapped=0x0) returned 1 [0189.940] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x120, dwBufLen=0x120 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x120) returned 1 [0189.940] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.940] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x120, lpOverlapped=0x0) returned 1 [0189.941] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.941] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x1f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.941] SetEndOfFile (hFile=0x11c) returned 1 [0189.944] GetProcessHeap () returned 0x4e0000 [0189.944] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.944] GetProcessHeap () returned 0x4e0000 [0189.944] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.944] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15155_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15155_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15155_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15155_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.946] CloseHandle (hObject=0x11c) returned 1 [0189.946] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab3c1d00, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbcaf5220, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xab3c1d00, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0x143, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD15156_.GIF", cAlternateFileName="")) returned 1 [0189.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15156_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15156_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.948] GetProcessHeap () returned 0x4e0000 [0189.948] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.948] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.948] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.948] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xd, lpOverlapped=0x0) returned 1 [0189.950] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.950] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.950] GetProcessHeap () returned 0x4e0000 [0189.950] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.950] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.950] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.950] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.950] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.950] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.950] WriteFile (in: hFile=0x11c, lpBuffer=0x4f9798*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f9798*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.950] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.950] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.951] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.951] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.951] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.951] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x143, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x143, lpOverlapped=0x0) returned 1 [0189.951] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x150, dwBufLen=0x150 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x150) returned 1 [0189.951] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.951] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x150, lpOverlapped=0x0) returned 1 [0189.951] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.951] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.951] SetEndOfFile (hFile=0x11c) returned 1 [0189.954] GetProcessHeap () returned 0x4e0000 [0189.954] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.954] GetProcessHeap () returned 0x4e0000 [0189.954] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.954] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15156_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15156_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15156_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15156_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.961] CloseHandle (hObject=0x11c) returned 1 [0189.961] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3f09b00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcb1b380, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd3f09b00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x482, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD15184_.GIF", cAlternateFileName="")) returned 1 [0189.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15184_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15184_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.963] GetProcessHeap () returned 0x4e0000 [0189.963] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.963] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.963] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.963] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xe, lpOverlapped=0x0) returned 1 [0189.965] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.965] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.965] GetProcessHeap () returned 0x4e0000 [0189.965] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.965] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.965] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.965] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.965] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.965] WriteFile (in: hFile=0x11c, lpBuffer=0x4f72f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f72f0*, lpNumberOfBytesWritten=0x24defc8*=0x10, lpOverlapped=0x0) returned 1 [0189.966] WriteFile (in: hFile=0x11c, lpBuffer=0x4fd3a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4fd3a8*, lpNumberOfBytesWritten=0x24defc8*=0x80, lpOverlapped=0x0) returned 1 [0189.966] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defd8 | out: lpNewFilePointer=0x0) returned 1 [0189.966] WriteFile (in: hFile=0x11c, lpBuffer=0x24defe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defe8*, lpNumberOfBytesWritten=0x24defc8*=0x8, lpOverlapped=0x0) returned 1 [0189.966] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcbf8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.966] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.966] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.966] ReadFile (in: hFile=0x11c, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x482, lpNumberOfBytesRead=0x24def80, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x24def80*=0x482, lpOverlapped=0x0) returned 1 [0189.966] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x22d0020*, pdwDataLen=0x24def88*=0x490, dwBufLen=0x490 | out: pbData=0x22d0020*, pdwDataLen=0x24def88*=0x490) returned 1 [0189.966] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.966] WriteFile (in: hFile=0x11c, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x24def84, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x24def84*=0x490, lpOverlapped=0x0) returned 1 [0189.966] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.966] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x564, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.966] SetEndOfFile (hFile=0x11c) returned 1 [0189.969] GetProcessHeap () returned 0x4e0000 [0189.969] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f53d8 | out: hHeap=0x4e0000) returned 1 [0189.969] GetProcessHeap () returned 0x4e0000 [0189.969] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f72f0 | out: hHeap=0x4e0000) returned 1 [0189.969] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15184_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15184_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15184_.GIF.[4B2E4630].[agares_helpdesk@tutanota.com].moloch" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15184_.gif.[4b2e4630].[agares_helpdesk@tutanota.com].moloch")) returned 1 [0189.971] CloseHandle (hObject=0x11c) returned 1 [0189.971] FindNextFileW (in: hFindFile=0x522f98, lpFindFileData=0x24df050 | out: lpFindFileData=0x24df050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3f09b00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcb1b380, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd3f09b00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x482, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD15185_.GIF", cAlternateFileName="")) returned 1 [0189.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15185_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15185_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0189.973] GetProcessHeap () returned 0x4e0000 [0189.973] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f72f0 [0189.973] CryptGenRandom (in: hProv=0x4f0590, dwLen=0x10, pbBuffer=0x4f72f0 | out: pbBuffer=0x4f72f0) returned 1 [0189.973] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x24defe0 | out: lpNewFilePointer=0x0) returned 1 [0189.973] WriteFile (in: hFile=0x11c, lpBuffer=0x24deff0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24deff0*, lpNumberOfBytesWritten=0x24defc8*=0xe, lpOverlapped=0x0) returned 1 [0189.975] CryptImportKey (in: hProv=0x4f0590, pbData=0x4fcd48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x24defcc | out: phKey=0x24defcc*=0x522fd8) returned 1 [0189.975] CryptSetKeyParam (hKey=0x522fd8, dwParam=0x1, pbData=0x4f72f0, dwFlags=0x0) returned 1 [0189.975] GetProcessHeap () returned 0x4e0000 [0189.975] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x4f53d8 [0189.975] CryptEncrypt (in: hKey=0x522fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40, dwBufLen=0x40 | out: pbData=0x4f53d8*, pdwDataLen=0x24defa8*=0x40) returned 1 [0189.975] CryptDestroyKey (hKey=0x522fd8) returned 1 [0189.975] WriteFile (in: hFile=0x11c, lpBuffer=0x4f53d8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x4f53d8*, lpNumberOfBytesWritten=0x24defc8*=0x40, lpOverlapped=0x0) returned 1 [0189.976] WriteFile (in: hFile=0x11c, lpBuffer=0x24defd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0 | out: lpBuffer=0x24defd0*, lpNumberOfBytesWritten=0x24defc8*=0x4, lpOverlapped=0x0) returned 1 [0189.976] WriteFile (hFile=0x11c, lpBuffer=0x4f72f0, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x24defc8, lpOverlapped=0x0) Process: id = "3" image_name = "qdgotnx2vapbkvcb.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qdgotnx2vapbkvcb.exe" page_root = "0x40286000" os_pid = "0x244" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x290" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QDgotnX2VapbkvCb.exe\" n656" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 6 os_tid = 0x3b4 [0070.648] SetErrorMode (uMode=0x8001) returned 0x0 [0070.661] GetVersion () returned 0x1db10106 [0070.662] GetModuleHandleA (lpModuleName="KERNEL32") returned 0x76d30000 [0070.662] GetProcAddress (hModule=0x76d30000, lpProcName="SetDefaultDllDirectories") returned 0x0 [0070.662] GetSystemDirectoryA (in: lpBuffer=0x18fcd0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0070.662] wsprintfA (in: param_1=0x18fce3, param_2="%s%s.dll" | out: param_1="\\UXTHEME.dll") returned 12 [0070.663] LoadLibraryExA (lpLibFileName="C:\\Windows\\system32\\UXTHEME.dll", hFile=0x0, dwFlags=0x8) returned 0x750f0000 [0070.665] lstrlenA (lpString="UXTHEME") returned 7 [0070.665] GetSystemDirectoryA (in: lpBuffer=0x18fcd0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0070.665] wsprintfA (in: param_1=0x18fce3, param_2="%s%s.dll" | out: param_1="\\USERENV.dll") returned 12 [0070.665] LoadLibraryExA (lpLibFileName="C:\\Windows\\system32\\USERENV.dll", hFile=0x0, dwFlags=0x8) returned 0x75660000 [0070.670] lstrlenA (lpString="USERENV") returned 7 [0070.670] GetSystemDirectoryA (in: lpBuffer=0x18fcd0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0070.670] wsprintfA (in: param_1=0x18fce3, param_2="%s%s.dll" | out: param_1="\\SETUPAPI.dll") returned 13 [0070.670] LoadLibraryExA (lpLibFileName="C:\\Windows\\system32\\SETUPAPI.dll", hFile=0x0, dwFlags=0x8) returned 0x76950000 [0070.675] lstrlenA (lpString="SETUPAPI") returned 8 [0070.675] GetSystemDirectoryA (in: lpBuffer=0x18fcd0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0070.675] wsprintfA (in: param_1=0x18fce3, param_2="%s%s.dll" | out: param_1="\\APPHELP.dll") returned 12 [0070.675] LoadLibraryExA (lpLibFileName="C:\\Windows\\system32\\APPHELP.dll", hFile=0x0, dwFlags=0x8) returned 0x75600000 [0070.678] lstrlenA (lpString="APPHELP") returned 7 [0070.678] GetSystemDirectoryA (in: lpBuffer=0x18fcd0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0070.678] wsprintfA (in: param_1=0x18fce3, param_2="%s%s.dll" | out: param_1="\\PROPSYS.dll") returned 12 [0070.678] LoadLibraryExA (lpLibFileName="C:\\Windows\\system32\\PROPSYS.dll", hFile=0x0, dwFlags=0x8) returned 0x75460000 [0070.683] lstrlenA (lpString="PROPSYS") returned 7 [0070.683] GetSystemDirectoryA (in: lpBuffer=0x18fcd0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0070.683] wsprintfA (in: param_1=0x18fce3, param_2="%s%s.dll" | out: param_1="\\DWMAPI.dll") returned 11 [0070.683] LoadLibraryExA (lpLibFileName="C:\\Windows\\system32\\DWMAPI.dll", hFile=0x0, dwFlags=0x8) returned 0x750d0000 [0070.684] lstrlenA (lpString="DWMAPI") returned 6 [0070.684] GetSystemDirectoryA (in: lpBuffer=0x18fcd0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0070.684] wsprintfA (in: param_1=0x18fce3, param_2="%s%s.dll" | out: param_1="\\CRYPTBASE.dll") returned 14 [0070.684] LoadLibraryExA (lpLibFileName="C:\\Windows\\system32\\CRYPTBASE.dll", hFile=0x0, dwFlags=0x8) returned 0x75790000 [0070.685] lstrlenA (lpString="CRYPTBASE") returned 9 [0070.685] GetSystemDirectoryA (in: lpBuffer=0x18fcd0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0070.685] wsprintfA (in: param_1=0x18fce3, param_2="%s%s.dll" | out: param_1="\\OLEACC.dll") returned 11 [0070.685] LoadLibraryExA (lpLibFileName="C:\\Windows\\system32\\OLEACC.dll", hFile=0x0, dwFlags=0x8) returned 0x75420000 [0070.688] lstrlenA (lpString="OLEACC") returned 6 [0070.688] GetSystemDirectoryA (in: lpBuffer=0x18fcd0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0070.688] wsprintfA (in: param_1=0x18fce3, param_2="%s%s.dll" | out: param_1="\\CLBCATQ.dll") returned 12 [0070.688] LoadLibraryExA (lpLibFileName="C:\\Windows\\system32\\CLBCATQ.dll", hFile=0x0, dwFlags=0x8) returned 0x77670000 [0070.689] lstrlenA (lpString="CLBCATQ") returned 7 [0070.689] GetSystemDirectoryA (in: lpBuffer=0x18fcd0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0070.689] wsprintfA (in: param_1=0x18fce3, param_2="%s%s.dll" | out: param_1="\\NTMARTA.dll") returned 12 [0070.689] LoadLibraryExA (lpLibFileName="C:\\Windows\\system32\\NTMARTA.dll", hFile=0x0, dwFlags=0x8) returned 0x753f0000 [0070.693] lstrlenA (lpString="NTMARTA") returned 7 [0070.693] GetModuleHandleA (lpModuleName="VERSION") returned 0x0 [0070.693] GetSystemDirectoryA (in: lpBuffer=0x18fcc0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0070.693] wsprintfA (in: param_1=0x18fcd3, param_2="%s%s.dll" | out: param_1="\\VERSION.dll") returned 12 [0070.693] LoadLibraryExA (lpLibFileName="C:\\Windows\\system32\\VERSION.dll", hFile=0x0, dwFlags=0x8) returned 0x755f0000 [0070.694] GetProcAddress (hModule=0x755f0000, lpProcName="GetFileVersionInfoA") returned 0x755f1ced [0070.694] GetModuleHandleA (lpModuleName="SHFOLDER") returned 0x0 [0070.694] GetSystemDirectoryA (in: lpBuffer=0x18fcc0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0070.694] wsprintfA (in: param_1=0x18fcd3, param_2="%s%s.dll" | out: param_1="\\SHFOLDER.dll") returned 13 [0070.694] LoadLibraryExA (lpLibFileName="C:\\Windows\\system32\\SHFOLDER.dll", hFile=0x0, dwFlags=0x8) returned 0x753d0000 [0070.695] GetProcAddress (hModule=0x753d0000, lpProcName="SHGetFolderPathA") returned 0x753d1528 [0070.695] GetModuleHandleA (lpModuleName="SHLWAPI") returned 0x772f0000 [0070.695] GetProcAddress (hModule=0x772f0000, lpProcName=0x1b5) returned 0x7730bee6 [0070.695] IsOS (dwOS=0x1e) returned 1 [0070.695] InitCommonControls () [0070.695] OleInitialize (pvReserved=0x0) returned 0x0 [0070.700] SHGetFileInfoA (in: pszPath="", dwFileAttributes=0x0, psfi=0x18fe2c, cbFileInfo=0x160, uFlags=0x0 | out: psfi=0x18fe2c) returned 0x1 [0070.742] lstrcpynA (in: lpString1=0x42ec20, lpString2="NSIS Error", iMaxLength=1024 | out: lpString1="NSIS Error") returned="NSIS Error" [0070.742] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QDgotnX2VapbkvCb.exe\" n656" [0070.742] lstrcpynA (in: lpString1=0x435000, lpString2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QDgotnX2VapbkvCb.exe\" n656", iMaxLength=1024 | out: lpString1="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QDgotnX2VapbkvCb.exe\" n656") returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QDgotnX2VapbkvCb.exe\" n656" [0070.743] GetTempPathA (in: nBufferLength=0x400, lpBuffer=0x436400 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0070.748] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 36 [0070.748] lstrcatA (in: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", lpString2="\\" | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\" [0070.748] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp"), lpSecurityAttributes=0x0) returned 0 [0070.749] GetLastError () returned 0xb7 [0070.749] GetTickCount () returned 0x1148611 [0070.749] GetTempFileNameA (in: lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\", lpPrefixString="nsx", uUnique=0x0, lpTempFileName=0x436000 | out: lpTempFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsxDD91.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsxdd91.tmp")) returned 0xdd91 [0070.749] DeleteFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsxDD91.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsxdd91.tmp")) returned 1 [0070.750] GetTickCount () returned 0x1148611 [0070.750] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x436c00, nSize=0x400 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QDgotnX2VapbkvCb.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qdgotnx2vapbkvcb.exe")) returned 0x3a [0070.750] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QDgotnX2VapbkvCb.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qdgotnx2vapbkvcb.exe")) returned 0x20 [0070.750] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QDgotnX2VapbkvCb.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qdgotnx2vapbkvcb.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x184 [0070.750] lstrcpynA (in: lpString1=0x435c00, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QDgotnX2VapbkvCb.exe", iMaxLength=1024 | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QDgotnX2VapbkvCb.exe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QDgotnX2VapbkvCb.exe" [0070.750] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QDgotnX2VapbkvCb.exe") returned 58 [0070.751] lstrcpynA (in: lpString1=0x437000, lpString2="QDgotnX2VapbkvCb.exe", iMaxLength=1024 | out: lpString1="QDgotnX2VapbkvCb.exe") returned="QDgotnX2VapbkvCb.exe" [0070.751] GetFileSize (in: hFile=0x184, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x44ad9 [0070.751] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.752] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.752] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.752] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.752] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.752] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.753] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.753] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.753] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.753] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.753] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.753] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.753] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.753] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.753] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.753] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.753] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.753] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.753] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.753] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.753] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.753] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.753] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.753] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.754] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.754] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.754] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.754] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.754] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.754] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.754] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.754] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.754] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.754] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.754] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.754] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.754] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.754] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.754] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.754] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.754] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.754] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.755] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.755] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.755] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.755] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.755] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.755] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.755] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.755] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.755] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.755] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.755] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.755] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.755] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.755] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.755] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.755] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.755] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.755] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.756] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.756] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.756] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.756] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.756] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.756] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.756] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.756] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.756] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.756] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.756] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.756] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.756] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.756] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.756] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.756] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.756] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.757] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.757] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.757] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.757] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.757] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.757] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.757] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.757] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.757] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.757] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.757] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.757] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.757] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.757] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.757] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.758] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.758] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.758] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.758] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.758] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.758] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.758] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.758] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.758] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.758] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.758] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.758] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.758] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.758] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.758] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.759] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.759] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.759] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.759] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.759] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.759] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.759] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.759] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.759] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.759] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.759] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.759] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.759] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.759] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.759] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.759] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.760] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.760] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.760] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.760] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.760] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.760] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.760] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.760] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.760] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.760] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.760] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.760] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.760] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.760] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.760] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.760] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.761] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.761] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.761] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.761] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.761] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.761] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.761] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.761] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.761] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.761] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.761] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.761] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.761] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.761] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.761] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.761] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.762] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.762] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.762] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.762] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.762] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.762] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.762] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.762] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.762] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.762] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.762] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.762] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.763] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.763] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.763] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.763] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.763] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.763] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.763] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.763] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.763] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.763] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.763] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.763] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.763] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.763] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.763] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.763] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.764] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.764] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.764] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.764] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.764] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.764] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.764] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.764] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.764] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.764] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.764] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.764] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.764] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.764] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.765] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.765] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.765] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.765] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.765] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.765] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.765] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.765] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.765] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.765] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.765] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.765] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.765] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.765] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.765] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.765] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.766] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.766] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.766] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.766] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.766] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.766] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.766] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.766] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.766] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.766] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.766] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.766] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.766] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.766] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.766] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.766] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.766] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.767] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.767] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.767] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.767] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.767] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.767] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.767] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.767] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.767] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.767] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.767] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.767] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.767] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.767] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.767] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.767] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.767] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.767] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.768] ReadFile (in: hFile=0x184, lpBuffer=0x415440, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x18fda8, lpOverlapped=0x0 | out: lpBuffer=0x415440*, lpNumberOfBytesRead=0x18fda8*=0x200, lpOverlapped=0x0) returned 1 [0070.780] SetFilePointer (in: hFile=0x184, lDistanceToMove=214044, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3441c [0070.781] GetUserDefaultUILanguage () returned 0x409 [0070.781] wsprintfA (in: param_1=0x436000, param_2="%d" | out: param_1="1033") returned 4 [0070.781] wsprintfA (in: param_1=0x436000, param_2="%d" | out: param_1="1033") returned 4 [0070.781] lstrlenA (lpString="setup") returned 5 [0070.781] lstrcpynA (in: lpString1=0x42ec20, lpString2="setup Setup", iMaxLength=1024 | out: lpString1="setup Setup") returned="setup Setup" [0070.781] SetWindowTextA (hWnd=0x0, lpString="setup Setup") returned 0 [0070.781] lstrcpynA (in: lpString1=0x42bc98, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0070.781] lstrcpynA (in: lpString1=0x42bc98, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0070.781] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x42e3c0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x0 [0070.782] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 45 [0070.782] lstrcpynA (in: lpString1=0x435400, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", iMaxLength=1024 | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0070.782] LoadImageA (hInst=0x400000, name=0x67, type=0x1, cx=0, cy=0, fuLoad=0x8040) returned 0x0 [0070.782] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", iMaxLength=1024 | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0070.782] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 45 [0070.782] lstrcpynA (in: lpString1=0x40a838, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", iMaxLength=1024 | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0070.783] CreateDirectoryA (lpPathName="C:\\Users" (normalized: "c:\\users"), lpSecurityAttributes=0x0) returned 0 [0070.783] GetLastError () returned 0xb7 [0070.783] GetFileAttributesA (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0070.783] CreateDirectoryA (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz"), lpSecurityAttributes=0x0) returned 0 [0070.783] GetLastError () returned 0xb7 [0070.783] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz")) returned 0x10 [0070.783] CreateDirectoryA (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata"), lpSecurityAttributes=0x0) returned 0 [0070.783] GetLastError () returned 0xb7 [0070.783] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata")) returned 0x2012 [0070.783] CreateDirectoryA (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming"), lpSecurityAttributes=0x0) returned 0 [0070.783] GetLastError () returned 0xb7 [0070.783] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming")) returned 0x2010 [0070.783] lstrcpynA (in: lpString1=0x435800, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", iMaxLength=1024 | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0070.783] SetCurrentDirectoryA (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming")) returned 1 [0070.784] lstrcpynA (in: lpString1=0x40a438, lpString2="0", iMaxLength=1024 | out: lpString1="0") returned="0" [0070.784] lstrlenA (lpString="0") returned 1 [0070.784] lstrcpynA (in: lpString1=0x432000, lpString2="0", iMaxLength=1024 | out: lpString1="0") returned="0" [0070.784] lstrcpynA (in: lpString1=0x42e3c0, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0070.784] lstrlenA (lpString="") returned 0 [0070.784] lstrcpynA (in: lpString1=0x40a438, lpString2="-", iMaxLength=1024 | out: lpString1="-") returned="-" [0070.784] lstrlenA (lpString="-") returned 1 [0070.784] lstrcpynA (in: lpString1=0x432400, lpString2="-", iMaxLength=1024 | out: lpString1="-") returned="-" [0070.784] lstrcpynA (in: lpString1=0x42e3c0, lpString2="0", iMaxLength=1024 | out: lpString1="0") returned="0" [0070.784] lstrlenA (lpString="0") returned 1 [0070.784] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="1") returned 1 [0070.784] lstrcpynA (in: lpString1=0x42e3c0, lpString2="1", iMaxLength=1024 | out: lpString1="1") returned="1" [0070.784] lstrlenA (lpString="1") returned 1 [0070.784] lstrcpynA (in: lpString1=0x40ac38, lpString2="1", iMaxLength=1024 | out: lpString1="1") returned="1" [0070.784] lstrcpynA (in: lpString1=0x40b038, lpString2="60000", iMaxLength=1024 | out: lpString1="60000") returned="60000" [0070.784] lstrcmpiA (lpString1="1", lpString2="60000") returned -1 [0070.784] lstrcpynA (in: lpString1=0x42e3c0, lpString2="-", iMaxLength=1024 | out: lpString1="-") returned="-" [0070.784] lstrlenA (lpString="-") returned 1 [0070.784] lstrcpynA (in: lpString1=0x40a438, lpString2="--", iMaxLength=1024 | out: lpString1="--") returned="--" [0070.784] lstrlenA (lpString="--") returned 2 [0070.784] lstrcpynA (in: lpString1=0x432400, lpString2="--", iMaxLength=1024 | out: lpString1="--") returned="--" [0070.784] lstrcpynA (in: lpString1=0x42e3c0, lpString2="1", iMaxLength=1024 | out: lpString1="1") returned="1" [0070.784] lstrlenA (lpString="1") returned 1 [0070.785] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="2") returned 1 [0070.785] lstrcpynA (in: lpString1=0x42e3c0, lpString2="2", iMaxLength=1024 | out: lpString1="2") returned="2" [0070.785] lstrlenA (lpString="2") returned 1 [0070.785] lstrcpynA (in: lpString1=0x40ac38, lpString2="2", iMaxLength=1024 | out: lpString1="2") returned="2" [0070.785] lstrcpynA (in: lpString1=0x40b038, lpString2="60000", iMaxLength=1024 | out: lpString1="60000") returned="60000" [0070.785] lstrcmpiA (lpString1="2", lpString2="60000") returned -1 [0070.785] lstrcpynA (in: lpString1=0x42e3c0, lpString2="--", iMaxLength=1024 | out: lpString1="--") returned="--" [0070.785] lstrlenA (lpString="--") returned 2 [0070.785] lstrcpynA (in: lpString1=0x40a438, lpString2="---", iMaxLength=1024 | out: lpString1="---") returned="---" [0070.785] lstrlenA (lpString="---") returned 3 [0070.785] lstrcpynA (in: lpString1=0x432400, lpString2="---", iMaxLength=1024 | out: lpString1="---") returned="---" [0070.785] lstrcpynA (in: lpString1=0x42e3c0, lpString2="2", iMaxLength=1024 | out: lpString1="2") returned="2" [0070.785] lstrlenA (lpString="2") returned 1 [0070.785] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="3") returned 1 [0070.785] lstrcpynA (in: lpString1=0x42e3c0, lpString2="3", iMaxLength=1024 | out: lpString1="3") returned="3" [0070.785] lstrlenA (lpString="3") returned 1 [0070.785] lstrcpynA (in: lpString1=0x40ac38, lpString2="3", iMaxLength=1024 | out: lpString1="3") returned="3" [0070.785] lstrcpynA (in: lpString1=0x40b038, lpString2="60000", iMaxLength=1024 | out: lpString1="60000") returned="60000" [0070.785] lstrcmpiA (lpString1="3", lpString2="60000") returned -1 [0070.785] lstrcpynA (in: lpString1=0x42e3c0, lpString2="---", iMaxLength=1024 | out: lpString1="---") returned="---" [0070.785] lstrlenA (lpString="---") returned 3 [0070.785] lstrcpynA (in: lpString1=0x40a438, lpString2="----", iMaxLength=1024 | out: lpString1="----") returned="----" [0070.785] lstrlenA (lpString="----") returned 4 [0070.785] lstrcpynA (in: lpString1=0x432400, lpString2="----", iMaxLength=1024 | out: lpString1="----") returned="----" [0070.785] lstrcpynA (in: lpString1=0x42e3c0, lpString2="3", iMaxLength=1024 | out: lpString1="3") returned="3" [0070.785] lstrlenA (lpString="3") returned 1 [0070.786] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="4") returned 1 [0070.786] lstrcpynA (in: lpString1=0x42e3c0, lpString2="4", iMaxLength=1024 | out: lpString1="4") returned="4" [0070.786] lstrlenA (lpString="4") returned 1 [0070.786] lstrcpynA (in: lpString1=0x40ac38, lpString2="4", iMaxLength=1024 | out: lpString1="4") returned="4" [0070.786] lstrcpynA (in: lpString1=0x40b038, lpString2="60000", iMaxLength=1024 | out: lpString1="60000") returned="60000" [0070.786] lstrcmpiA (lpString1="4", lpString2="60000") returned -1 [0070.786] lstrcpynA (in: lpString1=0x42e3c0, lpString2="----", iMaxLength=1024 | out: lpString1="----") returned="----" [0070.786] lstrlenA (lpString="----") returned 4 [0070.786] lstrcpynA (in: lpString1=0x40a438, lpString2="-----", iMaxLength=1024 | out: lpString1="-----") returned="-----" [0070.786] lstrlenA (lpString="-----") returned 5 [0070.786] lstrcpynA (in: lpString1=0x432400, lpString2="-----", iMaxLength=1024 | out: lpString1="-----") returned="-----" [0070.786] lstrcpynA (in: lpString1=0x42e3c0, lpString2="4", iMaxLength=1024 | out: lpString1="4") returned="4" [0070.786] lstrlenA (lpString="4") returned 1 [0070.786] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="5") returned 1 [0070.786] lstrcpynA (in: lpString1=0x42e3c0, lpString2="5", iMaxLength=1024 | out: lpString1="5") returned="5" [0070.786] lstrlenA (lpString="5") returned 1 [0070.786] lstrcpynA (in: lpString1=0x40ac38, lpString2="5", iMaxLength=1024 | out: lpString1="5") returned="5" [0070.786] lstrcpynA (in: lpString1=0x40b038, lpString2="60000", iMaxLength=1024 | out: lpString1="60000") returned="60000" [0070.786] lstrcmpiA (lpString1="5", lpString2="60000") returned -1 [0070.786] lstrcpynA (in: lpString1=0x42e3c0, lpString2="-----", iMaxLength=1024 | out: lpString1="-----") returned="-----" [0070.786] lstrlenA (lpString="-----") returned 5 [0070.786] lstrcpynA (in: lpString1=0x40a438, lpString2="------", iMaxLength=1024 | out: lpString1="------") returned="------" [0070.786] lstrlenA (lpString="------") returned 6 [0070.786] lstrcpynA (in: lpString1=0x432400, lpString2="------", iMaxLength=1024 | out: lpString1="------") returned="------" [0070.786] lstrcpynA (in: lpString1=0x42e3c0, lpString2="5", iMaxLength=1024 | out: lpString1="5") returned="5" [0070.786] lstrlenA (lpString="5") returned 1 [0070.786] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="6") returned 1 [0070.786] lstrcpynA (in: lpString1=0x42e3c0, lpString2="6", iMaxLength=1024 | out: lpString1="6") returned="6" [0070.786] lstrlenA (lpString="6") returned 1 [0070.786] lstrcpynA (in: lpString1=0x40ac38, lpString2="6", iMaxLength=1024 | out: lpString1="6") returned="6" [0070.786] lstrcpynA (in: lpString1=0x40b038, lpString2="60000", iMaxLength=1024 | out: lpString1="60000") returned="60000" [0070.786] lstrcmpiA (lpString1="6", lpString2="60000") returned -1 [0070.786] lstrcpynA (in: lpString1=0x42e3c0, lpString2="------", iMaxLength=1024 | out: lpString1="------") returned="------" [0070.787] lstrlenA (lpString="------") returned 6 [0070.787] lstrcpynA (in: lpString1=0x40a438, lpString2="-------", iMaxLength=1024 | out: lpString1="-------") returned="-------" [0070.787] lstrlenA (lpString="-------") returned 7 [0070.787] lstrcpynA (in: lpString1=0x432400, lpString2="-------", iMaxLength=1024 | out: lpString1="-------") returned="-------" [0070.787] lstrcpynA (in: lpString1=0x42e3c0, lpString2="6", iMaxLength=1024 | out: lpString1="6") returned="6" [0070.787] lstrlenA (lpString="6") returned 1 [0070.787] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="7") returned 1 [0070.787] lstrcpynA (in: lpString1=0x42e3c0, lpString2="7", iMaxLength=1024 | out: lpString1="7") returned="7" [0070.787] lstrlenA (lpString="7") returned 1 [0070.787] lstrcpynA (in: lpString1=0x40ac38, lpString2="7", iMaxLength=1024 | out: lpString1="7") returned="7" [0070.787] lstrcpynA (in: lpString1=0x40b038, lpString2="60000", iMaxLength=1024 | out: lpString1="60000") returned="60000" [0070.787] lstrcmpiA (lpString1="7", lpString2="60000") returned 1 [0070.787] lstrcpynA (in: lpString1=0x42e3c0, lpString2="-------", iMaxLength=1024 | out: lpString1="-------") returned="-------" [0070.787] lstrlenA (lpString="-------") returned 7 [0070.787] lstrcpynA (in: lpString1=0x40a438, lpString2="--------", iMaxLength=1024 | out: lpString1="--------") returned="--------" [0070.787] lstrlenA (lpString="--------") returned 8 [0070.787] lstrcpynA (in: lpString1=0x432400, lpString2="--------", iMaxLength=1024 | out: lpString1="--------") returned="--------" [0070.787] lstrcpynA (in: lpString1=0x42e3c0, lpString2="7", iMaxLength=1024 | out: lpString1="7") returned="7" [0070.787] lstrlenA (lpString="7") returned 1 [0070.787] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="8") returned 1 [0070.787] lstrcpynA (in: lpString1=0x42e3c0, lpString2="8", iMaxLength=1024 | out: lpString1="8") returned="8" [0070.787] lstrlenA (lpString="8") returned 1 [0070.787] lstrcpynA (in: lpString1=0x40ac38, lpString2="8", iMaxLength=1024 | out: lpString1="8") returned="8" [0070.787] lstrcpynA (in: lpString1=0x40b038, lpString2="60000", iMaxLength=1024 | out: lpString1="60000") returned="60000" [0070.787] lstrcmpiA (lpString1="8", lpString2="60000") returned 1 [0070.787] lstrcpynA (in: lpString1=0x42e3c0, lpString2="--------", iMaxLength=1024 | out: lpString1="--------") returned="--------" [0070.787] lstrlenA (lpString="--------") returned 8 [0070.787] lstrcpynA (in: lpString1=0x40a438, lpString2="---------", iMaxLength=1024 | out: lpString1="---------") returned="---------" [0070.787] lstrlenA (lpString="---------") returned 9 [0070.787] lstrcpynA (in: lpString1=0x432400, lpString2="---------", iMaxLength=1024 | out: lpString1="---------") returned="---------" [0070.787] lstrcpynA (in: lpString1=0x42e3c0, lpString2="8", iMaxLength=1024 | out: lpString1="8") returned="8" [0070.787] lstrlenA (lpString="8") returned 1 [0070.788] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="9") returned 1 [0070.788] lstrcpynA (in: lpString1=0x42e3c0, lpString2="9", iMaxLength=1024 | out: lpString1="9") returned="9" [0070.788] lstrlenA (lpString="9") returned 1 [0070.788] lstrcpynA (in: lpString1=0x40ac38, lpString2="9", iMaxLength=1024 | out: lpString1="9") returned="9" [0070.788] lstrcpynA (in: lpString1=0x40b038, lpString2="60000", iMaxLength=1024 | out: lpString1="60000") returned="60000" [0070.788] lstrcmpiA (lpString1="9", lpString2="60000") returned 1 [0070.788] lstrcpynA (in: lpString1=0x42e3c0, lpString2="---------", iMaxLength=1024 | out: lpString1="---------") returned="---------" [0070.788] lstrlenA (lpString="---------") returned 9 [0070.788] lstrcpynA (in: lpString1=0x40a438, lpString2="----------", iMaxLength=1024 | out: lpString1="----------") returned="----------" [0070.788] lstrlenA (lpString="----------") returned 10 [0070.788] lstrcpynA (in: lpString1=0x432400, lpString2="----------", iMaxLength=1024 | out: lpString1="----------") returned="----------" [0070.788] lstrcpynA (in: lpString1=0x42e3c0, lpString2="9", iMaxLength=1024 | out: lpString1="9") returned="9" [0070.788] lstrlenA (lpString="9") returned 1 [0070.788] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="10") returned 2 [0070.788] lstrcpynA (in: lpString1=0x42e3c0, lpString2="10", iMaxLength=1024 | out: lpString1="10") returned="10" [0070.788] lstrlenA (lpString="10") returned 2 [0070.788] lstrcpynA (in: lpString1=0x40ac38, lpString2="10", iMaxLength=1024 | out: lpString1="10") returned="10" [0070.788] lstrcpynA (in: lpString1=0x40b038, lpString2="60000", iMaxLength=1024 | out: lpString1="60000") returned="60000" [0070.788] lstrcmpiA (lpString1="10", lpString2="60000") returned -1 [0070.788] lstrcpynA (in: lpString1=0x42e3c0, lpString2="----------", iMaxLength=1024 | out: lpString1="----------") returned="----------" [0070.788] lstrlenA (lpString="----------") returned 10 [0070.788] lstrcpynA (in: lpString1=0x40a438, lpString2="-----------", iMaxLength=1024 | out: lpString1="-----------") returned="-----------" [0070.788] lstrlenA (lpString="-----------") returned 11 [0070.788] lstrcpynA (in: lpString1=0x432400, lpString2="-----------", iMaxLength=1024 | out: lpString1="-----------") returned="-----------" [0070.788] lstrcpynA (in: lpString1=0x42e3c0, lpString2="10", iMaxLength=1024 | out: lpString1="10") returned="10" [0070.788] lstrlenA (lpString="10") returned 2 [0070.788] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="11") returned 2 [0070.788] lstrcpynA (in: lpString1=0x42e3c0, lpString2="11", iMaxLength=1024 | out: lpString1="11") returned="11" [0070.788] lstrlenA (lpString="11") returned 2 [0070.788] lstrcpynA (in: lpString1=0x40ac38, lpString2="11", iMaxLength=1024 | out: lpString1="11") returned="11" [0070.788] lstrcpynA (in: lpString1=0x40b038, lpString2="60000", iMaxLength=1024 | out: lpString1="60000") returned="60000" [0070.788] lstrcmpiA (lpString1="11", lpString2="60000") returned -1 [0070.789] lstrcpynA (in: lpString1=0x42e3c0, lpString2="-----------", iMaxLength=1024 | out: lpString1="-----------") returned="-----------" [0070.789] lstrlenA (lpString="-----------") returned 11 [0070.789] lstrcpynA (in: lpString1=0x40a438, lpString2="------------", iMaxLength=1024 | out: lpString1="------------") returned="------------" [0070.789] lstrlenA (lpString="------------") returned 12 [0070.789] lstrcpynA (in: lpString1=0x432400, lpString2="------------", iMaxLength=1024 | out: lpString1="------------") returned="------------" [0070.789] lstrcpynA (in: lpString1=0x42e3c0, lpString2="11", iMaxLength=1024 | out: lpString1="11") returned="11" [0070.789] lstrlenA (lpString="11") returned 2 [0070.789] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="12") returned 2 [0070.789] lstrcpynA (in: lpString1=0x42e3c0, lpString2="12", iMaxLength=1024 | out: lpString1="12") returned="12" [0070.789] lstrlenA (lpString="12") returned 2 [0070.789] lstrcpynA (in: lpString1=0x40ac38, lpString2="12", iMaxLength=1024 | out: lpString1="12") returned="12" [0070.789] lstrcpynA (in: lpString1=0x40b038, lpString2="60000", iMaxLength=1024 | out: lpString1="60000") returned="60000" [0070.789] lstrcmpiA (lpString1="12", lpString2="60000") returned -1 [0070.789] lstrcpynA (in: lpString1=0x42e3c0, lpString2="------------", iMaxLength=1024 | out: lpString1="------------") returned="------------" [0070.789] lstrlenA (lpString="------------") returned 12 [0070.789] lstrcpynA (in: lpString1=0x40a438, lpString2="-------------", iMaxLength=1024 | out: lpString1="-------------") returned="-------------" [0070.789] lstrlenA (lpString="-------------") returned 13 [0070.789] lstrcpynA (in: lpString1=0x432400, lpString2="-------------", iMaxLength=1024 | out: lpString1="-------------") returned="-------------" [0070.789] lstrcpynA (in: lpString1=0x42e3c0, lpString2="12", iMaxLength=1024 | out: lpString1="12") returned="12" [0070.789] lstrlenA (lpString="12") returned 2 [0070.789] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="13") returned 2 [0070.789] lstrcpynA (in: lpString1=0x42e3c0, lpString2="13", iMaxLength=1024 | out: lpString1="13") returned="13" [0070.789] lstrlenA (lpString="13") returned 2 [0070.789] lstrcpynA (in: lpString1=0x40ac38, lpString2="13", iMaxLength=1024 | out: lpString1="13") returned="13" [0070.789] lstrcpynA (in: lpString1=0x40b038, lpString2="60000", iMaxLength=1024 | out: lpString1="60000") returned="60000" [0070.789] lstrcmpiA (lpString1="13", lpString2="60000") returned -1 [0070.789] lstrcpynA (in: lpString1=0x42e3c0, lpString2="-------------", iMaxLength=1024 | out: lpString1="-------------") returned="-------------" [0070.789] lstrlenA (lpString="-------------") returned 13 [0070.789] lstrcpynA (in: lpString1=0x40a438, lpString2="--------------", iMaxLength=1024 | out: lpString1="--------------") returned="--------------" [0070.789] lstrlenA (lpString="--------------") returned 14 [0070.789] lstrcpynA (in: lpString1=0x432400, lpString2="--------------", iMaxLength=1024 | out: lpString1="--------------") returned="--------------" [0070.789] lstrcpynA (in: lpString1=0x42e3c0, lpString2="13", iMaxLength=1024 | out: lpString1="13") returned="13" [0070.789] lstrlenA (lpString="13") returned 2 [0070.789] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="14") returned 2 [0070.790] lstrcpynA (in: lpString1=0x42e3c0, lpString2="14", iMaxLength=1024 | out: lpString1="14") returned="14" [0070.790] lstrlenA (lpString="14") returned 2 [0070.790] lstrcpynA (in: lpString1=0x40ac38, lpString2="14", iMaxLength=1024 | out: lpString1="14") returned="14" [0070.790] lstrcpynA (in: lpString1=0x40b038, lpString2="60000", iMaxLength=1024 | out: lpString1="60000") returned="60000" [0070.790] lstrcmpiA (lpString1="14", lpString2="60000") returned -1 [0070.790] lstrcpynA (in: lpString1=0x42e3c0, lpString2="--------------", iMaxLength=1024 | out: lpString1="--------------") returned="--------------" [0070.790] lstrlenA (lpString="--------------") returned 14 [0070.790] lstrcpynA (in: lpString1=0x40a438, lpString2="---------------", iMaxLength=1024 | out: lpString1="---------------") returned="---------------" [0070.790] lstrlenA (lpString="---------------") returned 15 [0070.790] lstrcpynA (in: lpString1=0x432400, lpString2="---------------", iMaxLength=1024 | out: lpString1="---------------") returned="---------------" [0070.790] lstrcpynA (in: lpString1=0x42e3c0, lpString2="14", iMaxLength=1024 | out: lpString1="14") returned="14" [0070.790] lstrlenA (lpString="14") returned 2 [0070.790] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="15") returned 2 [0070.790] lstrcpynA (in: lpString1=0x42e3c0, lpString2="15", iMaxLength=1024 | out: lpString1="15") returned="15" [0070.790] lstrlenA (lpString="15") returned 2 [0070.790] lstrcpynA (in: lpString1=0x40ac38, lpString2="15", iMaxLength=1024 | out: lpString1="15") returned="15" [0070.790] lstrcpynA (in: lpString1=0x40b038, lpString2="60000", iMaxLength=1024 | out: lpString1="60000") returned="60000" [0070.790] lstrcmpiA (lpString1="15", lpString2="60000") returned -1 [0070.790] lstrcpynA (in: lpString1=0x42e3c0, lpString2="---------------", iMaxLength=1024 | out: lpString1="---------------") returned="---------------" [0070.790] lstrlenA (lpString="---------------") returned 15 [0070.790] lstrcpynA (in: lpString1=0x40a438, lpString2="----------------", iMaxLength=1024 | out: lpString1="----------------") returned="----------------" [0070.790] lstrlenA (lpString="----------------") returned 16 [0070.790] lstrcpynA (in: lpString1=0x432400, lpString2="----------------", iMaxLength=1024 | out: lpString1="----------------") returned="----------------" [0070.790] lstrcpynA (in: lpString1=0x42e3c0, lpString2="15", iMaxLength=1024 | out: lpString1="15") returned="15" [0070.790] lstrlenA (lpString="15") returned 2 [0070.790] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="16") returned 2 [0070.790] lstrcpynA (in: lpString1=0x42e3c0, lpString2="16", iMaxLength=1024 | out: lpString1="16") returned="16" [0070.790] lstrlenA (lpString="16") returned 2 [0070.790] lstrcpynA (in: lpString1=0x40ac38, lpString2="16", iMaxLength=1024 | out: lpString1="16") returned="16" [0070.790] lstrcpynA (in: lpString1=0x40b038, lpString2="60000", iMaxLength=1024 | out: lpString1="60000") returned="60000" [0070.790] lstrcmpiA (lpString1="16", lpString2="60000") returned -1 [0070.790] lstrcpynA (in: lpString1=0x42e3c0, lpString2="----------------", iMaxLength=1024 | out: lpString1="----------------") returned="----------------" [0070.791] lstrlenA (lpString="----------------") returned 16 [0070.791] lstrcpynA (in: lpString1=0x40a438, lpString2="-----------------", iMaxLength=1024 | out: lpString1="-----------------") returned="-----------------" [0070.791] lstrlenA (lpString="-----------------") returned 17 [0070.791] lstrcpynA (in: lpString1=0x432400, lpString2="-----------------", iMaxLength=1024 | out: lpString1="-----------------") returned="-----------------" [0070.791] lstrcpynA (in: lpString1=0x42e3c0, lpString2="16", iMaxLength=1024 | out: lpString1="16") returned="16" [0070.791] lstrlenA (lpString="16") returned 2 [0070.791] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="17") returned 2 [0070.791] lstrcpynA (in: lpString1=0x42e3c0, lpString2="17", iMaxLength=1024 | out: lpString1="17") returned="17" [0070.791] lstrlenA (lpString="17") returned 2 [0070.791] lstrcpynA (in: lpString1=0x40ac38, lpString2="17", iMaxLength=1024 | out: lpString1="17") returned="17" [0070.791] lstrcpynA (in: lpString1=0x40b038, lpString2="60000", iMaxLength=1024 | out: lpString1="60000") returned="60000" [0070.791] lstrcmpiA (lpString1="17", lpString2="60000") returned -1 [0070.791] lstrcpynA (in: lpString1=0x42e3c0, lpString2="-----------------", iMaxLength=1024 | out: lpString1="-----------------") returned="-----------------" [0070.791] lstrlenA (lpString="-----------------") returned 17 [0070.791] lstrcpynA (in: lpString1=0x40a438, lpString2="------------------", iMaxLength=1024 | out: lpString1="------------------") returned="------------------" [0070.791] lstrlenA (lpString="------------------") returned 18 [0070.791] lstrcpynA (in: lpString1=0x432400, lpString2="------------------", iMaxLength=1024 | out: lpString1="------------------") returned="------------------" [0070.791] lstrcpynA (in: lpString1=0x42e3c0, lpString2="17", iMaxLength=1024 | out: lpString1="17") returned="17" [0070.791] lstrlenA (lpString="17") returned 2 [0070.791] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="18") returned 2 [0070.791] lstrcpynA (in: lpString1=0x42e3c0, lpString2="18", iMaxLength=1024 | out: lpString1="18") returned="18" [0070.791] lstrlenA (lpString="18") returned 2 [0070.791] lstrcpynA (in: lpString1=0x40ac38, lpString2="18", iMaxLength=1024 | out: lpString1="18") returned="18" [0070.791] lstrcpynA (in: lpString1=0x40b038, lpString2="60000", iMaxLength=1024 | out: lpString1="60000") returned="60000" [0070.791] lstrcmpiA (lpString1="18", lpString2="60000") returned -1 [0070.791] lstrcpynA (in: lpString1=0x42e3c0, lpString2="------------------", iMaxLength=1024 | out: lpString1="------------------") returned="------------------" [0070.791] lstrlenA (lpString="------------------") returned 18 [0070.791] lstrcpynA (in: lpString1=0x40a438, lpString2="-------------------", iMaxLength=1024 | out: lpString1="-------------------") returned="-------------------" [0070.791] lstrlenA (lpString="-------------------") returned 19 [0070.791] lstrcpynA (in: lpString1=0x432400, lpString2="-------------------", iMaxLength=1024 | out: lpString1="-------------------") returned="-------------------" [0070.791] lstrcpynA (in: lpString1=0x42e3c0, lpString2="18", iMaxLength=1024 | out: lpString1="18") returned="18" [0070.791] lstrlenA (lpString="18") returned 2 [0070.792] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="19") returned 2 [0070.792] lstrcpynA (in: lpString1=0x42e3c0, lpString2="19", iMaxLength=1024 | out: lpString1="19") returned="19" [0070.792] lstrlenA (lpString="19") returned 2 [0070.792] lstrcpynA (in: lpString1=0x40ac38, lpString2="19", iMaxLength=1024 | out: lpString1="19") returned="19" [0070.792] lstrcpynA (in: lpString1=0x40b038, lpString2="60000", iMaxLength=1024 | out: lpString1="60000") returned="60000" [0070.792] lstrcmpiA (lpString1="19", lpString2="60000") returned -1 [0070.792] lstrcpynA (in: lpString1=0x42e3c0, lpString2="-------------------", iMaxLength=1024 | out: lpString1="-------------------") returned="-------------------" [0070.792] lstrlenA (lpString="-------------------") returned 19 [0070.792] lstrcpynA (in: lpString1=0x40a438, lpString2="--------------------", iMaxLength=1024 | out: lpString1="--------------------") returned="--------------------" [0070.792] lstrlenA (lpString="--------------------") returned 20 [0070.792] lstrcpynA (in: lpString1=0x432400, lpString2="--------------------", iMaxLength=1024 | out: lpString1="--------------------") returned="--------------------" [0070.792] lstrcpynA (in: lpString1=0x42e3c0, lpString2="19", iMaxLength=1024 | out: lpString1="19") returned="19" [0070.792] lstrlenA (lpString="19") returned 2 [0070.792] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="20") returned 2 [0070.792] lstrcpynA (in: lpString1=0x42e3c0, lpString2="20", iMaxLength=1024 | out: lpString1="20") returned="20" [0070.792] lstrlenA (lpString="20") returned 2 [0070.792] lstrcpynA (in: lpString1=0x40ac38, lpString2="20", iMaxLength=1024 | out: lpString1="20") returned="20" [0070.792] lstrcpynA (in: lpString1=0x40b038, lpString2="60000", iMaxLength=1024 | out: lpString1="60000") returned="60000" [0070.792] lstrcmpiA (lpString1="20", lpString2="60000") returned -1 [0070.792] lstrcpynA (in: lpString1=0x42e3c0, lpString2="--------------------", iMaxLength=1024 | out: lpString1="--------------------") returned="--------------------" [0070.792] lstrlenA (lpString="--------------------") returned 20 [0070.792] lstrcpynA (in: lpString1=0x40a438, lpString2="---------------------", iMaxLength=1024 | out: lpString1="---------------------") returned="---------------------" [0070.792] lstrlenA (lpString="---------------------") returned 21 [0070.792] lstrcpynA (in: lpString1=0x432400, lpString2="---------------------", iMaxLength=1024 | out: lpString1="---------------------") returned="---------------------" [0070.792] lstrcpynA (in: lpString1=0x42e3c0, lpString2="20", iMaxLength=1024 | out: lpString1="20") returned="20" [0070.792] lstrlenA (lpString="20") returned 2 [0070.792] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="21") returned 2 [0070.792] lstrcpynA (in: lpString1=0x42e3c0, lpString2="21", iMaxLength=1024 | out: lpString1="21") returned="21" [0070.792] lstrlenA (lpString="21") returned 2 [0070.792] lstrcpynA (in: lpString1=0x40ac38, lpString2="21", iMaxLength=1024 | out: lpString1="21") returned="21" [0070.792] lstrcpynA (in: lpString1=0x40b038, lpString2="60000", iMaxLength=1024 | out: lpString1="60000") returned="60000" [0070.792] lstrcmpiA (lpString1="21", lpString2="60000") returned -1 [0070.792] lstrcpynA (in: lpString1=0x42e3c0, lpString2="---------------------", iMaxLength=1024 | out: lpString1="---------------------") returned="---------------------" [0070.793] lstrlenA (lpString="---------------------") returned 21 [0070.793] lstrcpynA (in: lpString1=0x40a438, lpString2="----------------------", iMaxLength=1024 | out: lpString1="----------------------") returned="----------------------" [0070.793] lstrlenA (lpString="----------------------") returned 22 [0070.793] lstrcpynA (in: lpString1=0x432400, lpString2="----------------------", iMaxLength=1024 | out: lpString1="----------------------") returned="----------------------" [0070.793] lstrcpynA (in: lpString1=0x42e3c0, lpString2="21", iMaxLength=1024 | out: lpString1="21") returned="21" [0070.793] lstrlenA (lpString="21") returned 2 [0070.793] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="22") returned 2 [0070.793] lstrcpynA (in: lpString1=0x42e3c0, lpString2="22", iMaxLength=1024 | out: lpString1="22") returned="22" [0070.793] lstrlenA (lpString="22") returned 2 [0070.793] lstrcpynA (in: lpString1=0x40ac38, lpString2="22", iMaxLength=1024 | out: lpString1="22") returned="22" [0070.793] lstrcpynA (in: lpString1=0x40b038, lpString2="60000", iMaxLength=1024 | out: lpString1="60000") returned="60000" [0070.793] lstrcmpiA (lpString1="22", lpString2="60000") returned -1 [0070.793] lstrcpynA (in: lpString1=0x42e3c0, lpString2="----------------------", iMaxLength=1024 | out: lpString1="----------------------") returned="----------------------" [0070.793] lstrlenA (lpString="----------------------") returned 22 [0070.793] lstrcpynA (in: lpString1=0x40a438, lpString2="-----------------------", iMaxLength=1024 | out: lpString1="-----------------------") returned="-----------------------" [0070.793] lstrlenA (lpString="-----------------------") returned 23 [0070.793] lstrcpynA (in: lpString1=0x432400, lpString2="-----------------------", iMaxLength=1024 | out: lpString1="-----------------------") returned="-----------------------" [0070.793] lstrcpynA (in: lpString1=0x42e3c0, lpString2="22", iMaxLength=1024 | out: lpString1="22") returned="22" [0070.793] lstrlenA (lpString="22") returned 2 [0070.793] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="23") returned 2 [0070.793] lstrcpynA (in: lpString1=0x42e3c0, lpString2="23", iMaxLength=1024 | out: lpString1="23") returned="23" [0070.793] lstrlenA (lpString="23") returned 2 [0070.793] lstrcpynA (in: lpString1=0x40ac38, lpString2="23", iMaxLength=1024 | out: lpString1="23") returned="23" [0070.793] lstrcpynA (in: lpString1=0x40b038, lpString2="60000", iMaxLength=1024 | out: lpString1="60000") returned="60000" [0070.793] lstrcmpiA (lpString1="23", lpString2="60000") returned -1 [0070.793] lstrcpynA (in: lpString1=0x42e3c0, lpString2="-----------------------", iMaxLength=1024 | out: lpString1="-----------------------") returned="-----------------------" [0070.793] lstrlenA (lpString="-----------------------") returned 23 [0070.793] lstrcpynA (in: lpString1=0x40a438, lpString2="------------------------", iMaxLength=1024 | out: lpString1="------------------------") returned="------------------------" [0070.793] lstrlenA (lpString="------------------------") returned 24 [0070.794] lstrcpynA (in: lpString1=0x432400, lpString2="------------------------", iMaxLength=1024 | out: lpString1="------------------------") returned="------------------------" [0070.794] lstrcpynA (in: lpString1=0x42e3c0, lpString2="23", iMaxLength=1024 | out: lpString1="23") returned="23" [0070.794] lstrlenA (lpString="23") returned 2 [0070.794] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="24") returned 2 [0070.794] lstrcpynA (in: lpString1=0x42e3c0, lpString2="24", iMaxLength=1024 | out: lpString1="24") returned="24" [0070.794] lstrlenA (lpString="24") returned 2 [0070.794] lstrcpynA (in: lpString1=0x40ac38, lpString2="24", iMaxLength=1024 | out: lpString1="24") returned="24" [0070.794] lstrcpynA (in: lpString1=0x40b038, lpString2="60000", iMaxLength=1024 | out: lpString1="60000") returned="60000" [0070.794] lstrcmpiA (lpString1="24", lpString2="60000") returned -1 [0070.794] lstrcpynA (in: lpString1=0x42e3c0, lpString2="------------------------", iMaxLength=1024 | out: lpString1="------------------------") returned="------------------------" [0070.794] lstrlenA (lpString="------------------------") returned 24 [0070.794] lstrcpynA (in: lpString1=0x40a438, lpString2="-------------------------", iMaxLength=1024 | out: lpString1="-------------------------") returned="-------------------------" [0070.794] lstrlenA (lpString="-------------------------") returned 25 [0070.794] lstrcpynA (in: lpString1=0x432400, lpString2="-------------------------", iMaxLength=1024 | out: lpString1="-------------------------") returned="-------------------------" [0070.794] lstrcpynA (in: lpString1=0x42e3c0, lpString2="24", iMaxLength=1024 | out: lpString1="24") returned="24" [0070.794] lstrlenA (lpString="24") returned 2 [0070.794] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="25") returned 2 [0070.794] lstrcpynA (in: lpString1=0x42e3c0, lpString2="25", iMaxLength=1024 | out: lpString1="25") returned="25" [0070.794] lstrlenA (lpString="25") returned 2 [0070.794] lstrcpynA (in: lpString1=0x40ac38, lpString2="25", iMaxLength=1024 | out: lpString1="25") returned="25" [0070.794] lstrcpynA (in: lpString1=0x40b038, lpString2="60000", iMaxLength=1024 | out: lpString1="60000") returned="60000" [0070.794] lstrcmpiA (lpString1="25", lpString2="60000") returned -1 [0070.794] lstrcpynA (in: lpString1=0x42e3c0, lpString2="-------------------------", iMaxLength=1024 | out: lpString1="-------------------------") returned="-------------------------" [0070.794] lstrlenA (lpString="-------------------------") returned 25 [0070.794] lstrcpynA (in: lpString1=0x40a438, lpString2="--------------------------", iMaxLength=1024 | out: lpString1="--------------------------") returned="--------------------------" [0070.794] lstrlenA (lpString="--------------------------") returned 26 [0070.794] lstrcpynA (in: lpString1=0x432400, lpString2="--------------------------", iMaxLength=1024 | out: lpString1="--------------------------") returned="--------------------------" [0070.794] lstrcpynA (in: lpString1=0x42e3c0, lpString2="25", iMaxLength=1024 | out: lpString1="25") returned="25" [0070.794] lstrlenA (lpString="25") returned 2 [0070.794] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="26") returned 2 [0070.794] lstrcpynA (in: lpString1=0x42e3c0, lpString2="26", iMaxLength=1024 | out: lpString1="26") returned="26" [0070.794] lstrlenA (lpString="26") returned 2 [0070.794] lstrcpynA (in: lpString1=0x40ac38, lpString2="26", iMaxLength=1024 | out: lpString1="26") returned="26" [0070.795] lstrcpynA (in: lpString1=0x40b038, lpString2="60000", iMaxLength=1024 | out: lpString1="60000") returned="60000" [0070.795] lstrcmpiA (lpString1="26", lpString2="60000") returned -1 [0070.795] lstrcpynA (in: lpString1=0x42e3c0, lpString2="--------------------------", iMaxLength=1024 | out: lpString1="--------------------------") returned="--------------------------" [0070.795] lstrlenA (lpString="--------------------------") returned 26 [0070.795] lstrcpynA (in: lpString1=0x40a438, lpString2="---------------------------", iMaxLength=1024 | out: lpString1="---------------------------") returned="---------------------------" [0070.795] lstrlenA (lpString="---------------------------") returned 27 [0070.795] lstrcpynA (in: lpString1=0x432400, lpString2="---------------------------", iMaxLength=1024 | out: lpString1="---------------------------") returned="---------------------------" [0070.795] lstrcpynA (in: lpString1=0x42e3c0, lpString2="26", iMaxLength=1024 | out: lpString1="26") returned="26" [0070.795] lstrlenA (lpString="26") returned 2 [0070.795] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="27") returned 2 [0070.795] lstrcpynA (in: lpString1=0x42e3c0, lpString2="27", iMaxLength=1024 | out: lpString1="27") returned="27" [0070.795] lstrlenA (lpString="27") returned 2 [0070.795] lstrcpynA (in: lpString1=0x40ac38, lpString2="27", iMaxLength=1024 | out: lpString1="27") returned="27" [0070.795] lstrcpynA (in: lpString1=0x40b038, lpString2="60000", iMaxLength=1024 | out: lpString1="60000") returned="60000" [0070.795] lstrcmpiA (lpString1="27", lpString2="60000") returned -1 [0070.795] lstrcpynA (in: lpString1=0x42e3c0, lpString2="---------------------------", iMaxLength=1024 | out: lpString1="---------------------------") returned="---------------------------" [0070.795] lstrlenA (lpString="---------------------------") returned 27 [0070.795] lstrcpynA (in: lpString1=0x40a438, lpString2="----------------------------", iMaxLength=1024 | out: lpString1="----------------------------") returned="----------------------------" [0070.795] lstrlenA (lpString="----------------------------") returned 28 [0070.795] lstrcpynA (in: lpString1=0x432400, lpString2="----------------------------", iMaxLength=1024 | out: lpString1="----------------------------") returned="----------------------------" [0070.795] lstrcpynA (in: lpString1=0x42e3c0, lpString2="27", iMaxLength=1024 | out: lpString1="27") returned="27" [0070.795] lstrlenA (lpString="27") returned 2 [0070.795] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="28") returned 2 [0070.795] lstrcpynA (in: lpString1=0x42e3c0, lpString2="28", iMaxLength=1024 | out: lpString1="28") returned="28" [0070.795] lstrlenA (lpString="28") returned 2 [0070.795] lstrcpynA (in: lpString1=0x40ac38, lpString2="28", iMaxLength=1024 | out: lpString1="28") returned="28" [0070.795] lstrcpynA (in: lpString1=0x40b038, lpString2="60000", iMaxLength=1024 | out: lpString1="60000") returned="60000" [0070.795] lstrcmpiA (lpString1="28", lpString2="60000") returned -1 [0070.795] lstrcpynA (in: lpString1=0x42e3c0, lpString2="----------------------------", iMaxLength=1024 | out: lpString1="----------------------------") returned="----------------------------" [0070.795] lstrlenA (lpString="----------------------------") returned 28 [0070.795] lstrcpynA (in: lpString1=0x40a438, lpString2="-----------------------------", iMaxLength=1024 | out: lpString1="-----------------------------") returned="-----------------------------" [0070.795] lstrlenA (lpString="-----------------------------") returned 29 [0070.795] lstrcpynA (in: lpString1=0x432400, lpString2="-----------------------------", iMaxLength=1024 | out: lpString1="-----------------------------") returned="-----------------------------" [0070.795] lstrcpynA (in: lpString1=0x42e3c0, lpString2="28", iMaxLength=1024 | out: lpString1="28") returned="28" [0070.796] lstrlenA (lpString="28") returned 2 [0070.796] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="29") returned 2 [0070.796] lstrcpynA (in: lpString1=0x42e3c0, lpString2="29", iMaxLength=1024 | out: lpString1="29") returned="29" [0070.796] lstrlenA (lpString="29") returned 2 [0070.796] lstrcpynA (in: lpString1=0x40ac38, lpString2="29", iMaxLength=1024 | out: lpString1="29") returned="29" [0070.796] lstrcpynA (in: lpString1=0x40b038, lpString2="60000", iMaxLength=1024 | out: lpString1="60000") returned="60000" [0070.796] lstrcmpiA (lpString1="29", lpString2="60000") returned -1 [0070.796] lstrcpynA (in: lpString1=0x42e3c0, lpString2="-----------------------------", iMaxLength=1024 | out: lpString1="-----------------------------") returned="-----------------------------" [0070.796] lstrlenA (lpString="-----------------------------") returned 29 [0070.796] lstrcpynA (in: lpString1=0x40a438, lpString2="------------------------------", iMaxLength=1024 | out: lpString1="------------------------------") returned="------------------------------" [0070.796] lstrlenA (lpString="------------------------------") returned 30 [0070.796] lstrcpynA (in: lpString1=0x432400, lpString2="------------------------------", iMaxLength=1024 | out: lpString1="------------------------------") returned="------------------------------" [0070.796] lstrcpynA (in: lpString1=0x42e3c0, lpString2="29", iMaxLength=1024 | out: lpString1="29") returned="29" [0070.796] lstrlenA (lpString="29") returned 2 [0070.796] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="30") returned 2 [0070.796] lstrcpynA (in: lpString1=0x42e3c0, lpString2="30", iMaxLength=1024 | out: lpString1="30") returned="30" [0070.796] lstrlenA (lpString="30") returned 2 [0070.796] lstrcpynA (in: lpString1=0x40ac38, lpString2="30", iMaxLength=1024 | out: lpString1="30") returned="30" [0070.796] lstrcpynA (in: lpString1=0x40b038, lpString2="60000", iMaxLength=1024 | out: lpString1="60000") returned="60000" [0070.796] lstrcmpiA (lpString1="30", lpString2="60000") returned -1 [0070.796] lstrcpynA (in: lpString1=0x42e3c0, lpString2="------------------------------", iMaxLength=1024 | out: lpString1="------------------------------") returned="------------------------------" [0070.796] lstrlenA (lpString="------------------------------") returned 30 [0070.796] lstrcpynA (in: lpString1=0x40a438, lpString2="-------------------------------", iMaxLength=1024 | out: lpString1="-------------------------------") returned="-------------------------------" [0070.796] lstrlenA (lpString="-------------------------------") returned 31 [0070.796] lstrcpynA (in: lpString1=0x432400, lpString2="-------------------------------", iMaxLength=1024 | out: lpString1="-------------------------------") returned="-------------------------------" [0070.796] lstrcpynA (in: lpString1=0x42e3c0, lpString2="30", iMaxLength=1024 | out: lpString1="30") returned="30" [0070.796] lstrlenA (lpString="30") returned 2 [0070.796] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="31") returned 2 [0070.796] lstrcpynA (in: lpString1=0x42e3c0, lpString2="31", iMaxLength=1024 | out: lpString1="31") returned="31" [0070.796] lstrlenA (lpString="31") returned 2 [0070.796] lstrcpynA (in: lpString1=0x40ac38, lpString2="31", iMaxLength=1024 | out: lpString1="31") returned="31" [0070.796] lstrcpynA (in: lpString1=0x40b038, lpString2="60000", iMaxLength=1024 | out: lpString1="60000") returned="60000" [0070.796] lstrcmpiA (lpString1="31", lpString2="60000") returned -1 [0070.796] lstrcpynA (in: lpString1=0x42e3c0, lpString2="-------------------------------", iMaxLength=1024 | out: lpString1="-------------------------------") returned="-------------------------------" [0070.797] lstrlenA (lpString="-------------------------------") returned 31 [0070.797] lstrcpynA (in: lpString1=0x40a438, lpString2="--------------------------------", iMaxLength=1024 | out: lpString1="--------------------------------") returned="--------------------------------" [0070.797] lstrlenA (lpString="--------------------------------") returned 32 [0070.797] lstrcpynA (in: lpString1=0x432400, lpString2="--------------------------------", iMaxLength=1024 | out: lpString1="--------------------------------") returned="--------------------------------" [0070.797] lstrcpynA (in: lpString1=0x42e3c0, lpString2="31", iMaxLength=1024 | out: lpString1="31") returned="31" [0070.797] lstrlenA (lpString="31") returned 2 [0070.797] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="32") returned 2 [0070.797] lstrcpynA (in: lpString1=0x42e3c0, lpString2="32", iMaxLength=1024 | out: lpString1="32") returned="32" [0070.797] lstrlenA (lpString="32") returned 2 [0070.797] lstrcpynA (in: lpString1=0x40ac38, lpString2="32", iMaxLength=1024 | out: lpString1="32") returned="32" [0070.797] lstrcpynA (in: lpString1=0x40b038, lpString2="60000", iMaxLength=1024 | out: lpString1="60000") returned="60000" [0070.797] lstrcmpiA (lpString1="32", lpString2="60000") returned -1 [0070.797] lstrcpynA (in: lpString1=0x42e3c0, lpString2="--------------------------------", iMaxLength=1024 | out: lpString1="--------------------------------") returned="--------------------------------" [0070.797] lstrlenA (lpString="--------------------------------") returned 32 [0070.797] lstrcpynA (in: lpString1=0x40a438, lpString2="---------------------------------", iMaxLength=1024 | out: lpString1="---------------------------------") returned="---------------------------------" [0070.797] lstrlenA (lpString="---------------------------------") returned 33 [0070.797] lstrcpynA (in: lpString1=0x432400, lpString2="---------------------------------", iMaxLength=1024 | out: lpString1="---------------------------------") returned="---------------------------------" [0070.797] lstrcpynA (in: lpString1=0x42e3c0, lpString2="32", iMaxLength=1024 | out: lpString1="32") returned="32" [0070.797] lstrlenA (lpString="32") returned 2 [0070.797] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="33") returned 2 [0070.797] lstrcpynA (in: lpString1=0x42e3c0, lpString2="33", iMaxLength=1024 | out: lpString1="33") returned="33" [0070.797] lstrlenA (lpString="33") returned 2 [0070.797] lstrcpynA (in: lpString1=0x40ac38, lpString2="33", iMaxLength=1024 | out: lpString1="33") returned="33" [0070.797] lstrcpynA (in: lpString1=0x40b038, lpString2="60000", iMaxLength=1024 | out: lpString1="60000") returned="60000" [0070.797] lstrcmpiA (lpString1="33", lpString2="60000") returned -1 [0070.797] lstrcpynA (in: lpString1=0x42e3c0, lpString2="---------------------------------", iMaxLength=1024 | out: lpString1="---------------------------------") returned="---------------------------------" [0070.797] lstrlenA (lpString="---------------------------------") returned 33 [0070.797] lstrcpynA (in: lpString1=0x40a438, lpString2="----------------------------------", iMaxLength=1024 | out: lpString1="----------------------------------") returned="----------------------------------" [0070.797] lstrlenA (lpString="----------------------------------") returned 34 [0070.797] lstrcpynA (in: lpString1=0x432400, lpString2="----------------------------------", iMaxLength=1024 | out: lpString1="----------------------------------") returned="----------------------------------" [0070.797] lstrcpynA (in: lpString1=0x42e3c0, lpString2="33", iMaxLength=1024 | out: lpString1="33") returned="33" [0070.797] lstrlenA (lpString="33") returned 2 [0070.797] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="34") returned 2 [0070.798] lstrcpynA (in: lpString1=0x42e3c0, lpString2="34", iMaxLength=1024 | out: lpString1="34") returned="34" [0070.798] lstrlenA (lpString="34") returned 2 [0070.798] lstrcpynA (in: lpString1=0x40ac38, lpString2="34", iMaxLength=1024 | out: lpString1="34") returned="34" [0070.798] lstrcpynA (in: lpString1=0x40b038, lpString2="60000", iMaxLength=1024 | out: lpString1="60000") returned="60000" [0070.798] lstrcmpiA (lpString1="34", lpString2="60000") returned -1 [0070.798] lstrcpynA (in: lpString1=0x42e3c0, lpString2="----------------------------------", iMaxLength=1024 | out: lpString1="----------------------------------") returned="----------------------------------" [0070.798] lstrlenA (lpString="----------------------------------") returned 34 [0070.798] lstrcpynA (in: lpString1=0x40a438, lpString2="-----------------------------------", iMaxLength=1024 | out: lpString1="-----------------------------------") returned="-----------------------------------" [0070.798] lstrlenA (lpString="-----------------------------------") returned 35 [0070.798] lstrlenA (lpString="34") returned 2 [0070.798] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="35") returned 2 [0070.798] lstrlenA (lpString="35") returned 2 [0070.798] lstrcmpiA (lpString1="35", lpString2="60000") returned -1 [0070.798] lstrlenA (lpString="-----------------------------------") returned 35 [0070.798] lstrlenA (lpString="------------------------------------") returned 36 [0070.798] lstrlenA (lpString="35") returned 2 [0070.798] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="36") returned 2 [0070.798] lstrlenA (lpString="36") returned 2 [0070.798] lstrcmpiA (lpString1="36", lpString2="60000") returned -1 [0070.798] lstrlenA (lpString="------------------------------------") returned 36 [0070.798] lstrlenA (lpString="-------------------------------------") returned 37 [0070.798] lstrlenA (lpString="36") returned 2 [0070.798] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="37") returned 2 [0070.798] lstrlenA (lpString="37") returned 2 [0070.798] lstrcmpiA (lpString1="37", lpString2="60000") returned -1 [0070.798] lstrlenA (lpString="-------------------------------------") returned 37 [0070.798] lstrlenA (lpString="--------------------------------------") returned 38 [0070.798] lstrlenA (lpString="37") returned 2 [0070.798] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="38") returned 2 [0070.799] lstrlenA (lpString="38") returned 2 [0070.799] lstrcmpiA (lpString1="38", lpString2="60000") returned -1 [0070.799] lstrlenA (lpString="--------------------------------------") returned 38 [0070.799] lstrlenA (lpString="---------------------------------------") returned 39 [0070.799] lstrlenA (lpString="38") returned 2 [0070.799] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="39") returned 2 [0070.799] lstrlenA (lpString="39") returned 2 [0070.799] lstrcmpiA (lpString1="39", lpString2="60000") returned -1 [0070.799] lstrlenA (lpString="---------------------------------------") returned 39 [0070.799] lstrlenA (lpString="----------------------------------------") returned 40 [0070.799] lstrlenA (lpString="39") returned 2 [0070.799] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="40") returned 2 [0070.799] lstrlenA (lpString="40") returned 2 [0070.799] lstrcmpiA (lpString1="40", lpString2="60000") returned -1 [0070.799] lstrlenA (lpString="----------------------------------------") returned 40 [0070.799] lstrlenA (lpString="-----------------------------------------") returned 41 [0070.799] lstrlenA (lpString="40") returned 2 [0070.799] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="41") returned 2 [0070.799] lstrlenA (lpString="41") returned 2 [0070.799] lstrcmpiA (lpString1="41", lpString2="60000") returned -1 [0070.799] lstrlenA (lpString="-----------------------------------------") returned 41 [0070.799] lstrlenA (lpString="------------------------------------------") returned 42 [0070.799] lstrlenA (lpString="41") returned 2 [0070.799] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="42") returned 2 [0070.799] lstrlenA (lpString="42") returned 2 [0070.799] lstrcmpiA (lpString1="42", lpString2="60000") returned -1 [0070.800] lstrlenA (lpString="------------------------------------------") returned 42 [0070.800] lstrlenA (lpString="-------------------------------------------") returned 43 [0070.800] lstrlenA (lpString="42") returned 2 [0070.800] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="43") returned 2 [0070.800] lstrlenA (lpString="43") returned 2 [0070.800] lstrcmpiA (lpString1="43", lpString2="60000") returned -1 [0070.800] lstrlenA (lpString="-------------------------------------------") returned 43 [0070.800] lstrlenA (lpString="--------------------------------------------") returned 44 [0070.800] lstrlenA (lpString="43") returned 2 [0070.800] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="44") returned 2 [0070.800] lstrlenA (lpString="44") returned 2 [0070.800] lstrcmpiA (lpString1="44", lpString2="60000") returned -1 [0070.800] lstrlenA (lpString="--------------------------------------------") returned 44 [0070.800] lstrlenA (lpString="---------------------------------------------") returned 45 [0070.800] lstrlenA (lpString="44") returned 2 [0070.800] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="45") returned 2 [0070.800] lstrlenA (lpString="45") returned 2 [0070.800] lstrcmpiA (lpString1="45", lpString2="60000") returned -1 [0070.800] lstrlenA (lpString="---------------------------------------------") returned 45 [0070.800] lstrlenA (lpString="----------------------------------------------") returned 46 [0070.800] lstrlenA (lpString="45") returned 2 [0070.800] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="46") returned 2 [0070.800] lstrlenA (lpString="46") returned 2 [0070.800] lstrcmpiA (lpString1="46", lpString2="60000") returned -1 [0070.800] lstrlenA (lpString="----------------------------------------------") returned 46 [0070.801] lstrlenA (lpString="-----------------------------------------------") returned 47 [0070.801] lstrlenA (lpString="46") returned 2 [0070.801] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="47") returned 2 [0070.801] lstrlenA (lpString="47") returned 2 [0070.801] lstrcmpiA (lpString1="47", lpString2="60000") returned -1 [0070.801] lstrlenA (lpString="-----------------------------------------------") returned 47 [0070.801] lstrlenA (lpString="------------------------------------------------") returned 48 [0070.801] lstrlenA (lpString="47") returned 2 [0070.801] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="48") returned 2 [0070.801] lstrlenA (lpString="48") returned 2 [0070.801] lstrcmpiA (lpString1="48", lpString2="60000") returned -1 [0070.801] lstrlenA (lpString="------------------------------------------------") returned 48 [0070.801] lstrlenA (lpString="-------------------------------------------------") returned 49 [0070.801] lstrlenA (lpString="48") returned 2 [0070.801] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="49") returned 2 [0070.801] lstrlenA (lpString="49") returned 2 [0070.801] lstrcmpiA (lpString1="49", lpString2="60000") returned -1 [0070.801] lstrlenA (lpString="-------------------------------------------------") returned 49 [0070.801] lstrlenA (lpString="--------------------------------------------------") returned 50 [0070.801] lstrlenA (lpString="49") returned 2 [0070.801] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="50") returned 2 [0070.801] lstrlenA (lpString="50") returned 2 [0070.801] lstrcmpiA (lpString1="50", lpString2="60000") returned -1 [0070.801] lstrlenA (lpString="--------------------------------------------------") returned 50 [0070.801] lstrlenA (lpString="---------------------------------------------------") returned 51 [0070.802] lstrlenA (lpString="50") returned 2 [0070.802] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="51") returned 2 [0070.802] lstrlenA (lpString="51") returned 2 [0070.802] lstrcmpiA (lpString1="51", lpString2="60000") returned -1 [0070.802] lstrlenA (lpString="---------------------------------------------------") returned 51 [0070.802] lstrlenA (lpString="----------------------------------------------------") returned 52 [0070.802] lstrlenA (lpString="51") returned 2 [0070.802] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="52") returned 2 [0070.802] lstrlenA (lpString="52") returned 2 [0070.802] lstrcmpiA (lpString1="52", lpString2="60000") returned -1 [0070.802] lstrlenA (lpString="----------------------------------------------------") returned 52 [0070.802] lstrlenA (lpString="-----------------------------------------------------") returned 53 [0070.802] lstrlenA (lpString="52") returned 2 [0070.802] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="53") returned 2 [0070.802] lstrlenA (lpString="53") returned 2 [0070.802] lstrcmpiA (lpString1="53", lpString2="60000") returned -1 [0070.802] lstrlenA (lpString="-----------------------------------------------------") returned 53 [0070.802] lstrlenA (lpString="------------------------------------------------------") returned 54 [0070.802] lstrlenA (lpString="53") returned 2 [0070.802] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="54") returned 2 [0070.802] lstrlenA (lpString="54") returned 2 [0070.802] lstrcmpiA (lpString1="54", lpString2="60000") returned -1 [0070.802] lstrlenA (lpString="------------------------------------------------------") returned 54 [0070.802] lstrlenA (lpString="-------------------------------------------------------") returned 55 [0070.802] lstrlenA (lpString="54") returned 2 [0070.802] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="55") returned 2 [0070.803] lstrlenA (lpString="55") returned 2 [0070.803] lstrcmpiA (lpString1="55", lpString2="60000") returned -1 [0070.803] lstrlenA (lpString="-------------------------------------------------------") returned 55 [0070.803] lstrlenA (lpString="--------------------------------------------------------") returned 56 [0070.803] lstrlenA (lpString="55") returned 2 [0070.803] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="56") returned 2 [0070.803] lstrlenA (lpString="56") returned 2 [0070.803] lstrcmpiA (lpString1="56", lpString2="60000") returned -1 [0070.803] lstrlenA (lpString="--------------------------------------------------------") returned 56 [0070.803] lstrlenA (lpString="---------------------------------------------------------") returned 57 [0070.803] lstrlenA (lpString="56") returned 2 [0070.803] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="57") returned 2 [0070.803] lstrlenA (lpString="57") returned 2 [0070.803] lstrcmpiA (lpString1="57", lpString2="60000") returned -1 [0070.803] lstrlenA (lpString="---------------------------------------------------------") returned 57 [0070.803] lstrlenA (lpString="----------------------------------------------------------") returned 58 [0070.803] lstrlenA (lpString="57") returned 2 [0070.803] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="58") returned 2 [0070.803] lstrlenA (lpString="58") returned 2 [0070.803] lstrcmpiA (lpString1="58", lpString2="60000") returned -1 [0070.803] lstrlenA (lpString="----------------------------------------------------------") returned 58 [0070.803] lstrlenA (lpString="-----------------------------------------------------------") returned 59 [0070.803] lstrlenA (lpString="58") returned 2 [0070.803] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="59") returned 2 [0070.803] lstrlenA (lpString="59") returned 2 [0070.804] lstrcmpiA (lpString1="59", lpString2="60000") returned -1 [0070.804] lstrlenA (lpString="-----------------------------------------------------------") returned 59 [0070.804] lstrlenA (lpString="------------------------------------------------------------") returned 60 [0070.804] lstrlenA (lpString="59") returned 2 [0070.804] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="60") returned 2 [0070.804] lstrlenA (lpString="60") returned 2 [0070.804] lstrcmpiA (lpString1="60", lpString2="60000") returned -1 [0070.804] lstrlenA (lpString="------------------------------------------------------------") returned 60 [0070.804] lstrlenA (lpString="-------------------------------------------------------------") returned 61 [0070.804] lstrlenA (lpString="60") returned 2 [0070.804] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="61") returned 2 [0070.804] lstrlenA (lpString="61") returned 2 [0070.804] lstrcmpiA (lpString1="61", lpString2="60000") returned 1 [0070.804] lstrlenA (lpString="-------------------------------------------------------------") returned 61 [0070.804] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="62") returned 2 [0070.804] lstrcmpiA (lpString1="62", lpString2="60000") returned 1 [0070.804] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="63") returned 2 [0070.804] lstrcmpiA (lpString1="63", lpString2="60000") returned 1 [0070.804] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="64") returned 2 [0070.804] lstrcmpiA (lpString1="64", lpString2="60000") returned 1 [0070.804] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="65") returned 2 [0070.804] lstrcmpiA (lpString1="65", lpString2="60000") returned 1 [0070.804] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="66") returned 2 [0070.805] lstrcmpiA (lpString1="66", lpString2="60000") returned 1 [0070.805] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="67") returned 2 [0070.805] lstrcmpiA (lpString1="67", lpString2="60000") returned 1 [0070.805] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="68") returned 2 [0070.805] lstrcmpiA (lpString1="68", lpString2="60000") returned 1 [0070.805] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="69") returned 2 [0070.805] lstrcmpiA (lpString1="69", lpString2="60000") returned 1 [0070.805] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="70") returned 2 [0070.805] lstrcmpiA (lpString1="70", lpString2="60000") returned 1 [0070.805] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="71") returned 2 [0070.805] lstrcmpiA (lpString1="71", lpString2="60000") returned 1 [0070.805] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="72") returned 2 [0070.805] lstrcmpiA (lpString1="72", lpString2="60000") returned 1 [0070.805] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="73") returned 2 [0070.805] lstrcmpiA (lpString1="73", lpString2="60000") returned 1 [0070.805] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="74") returned 2 [0070.805] lstrcmpiA (lpString1="74", lpString2="60000") returned 1 [0070.805] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="75") returned 2 [0070.805] lstrcmpiA (lpString1="75", lpString2="60000") returned 1 [0070.805] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="76") returned 2 [0070.805] lstrcmpiA (lpString1="76", lpString2="60000") returned 1 [0070.805] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="77") returned 2 [0070.806] lstrcmpiA (lpString1="77", lpString2="60000") returned 1 [0070.806] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="78") returned 2 [0070.806] lstrcmpiA (lpString1="78", lpString2="60000") returned 1 [0070.806] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="79") returned 2 [0070.806] lstrcmpiA (lpString1="79", lpString2="60000") returned 1 [0070.806] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="80") returned 2 [0070.806] lstrcmpiA (lpString1="80", lpString2="60000") returned 1 [0070.806] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="81") returned 2 [0070.806] lstrcmpiA (lpString1="81", lpString2="60000") returned 1 [0070.806] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="82") returned 2 [0070.806] lstrcmpiA (lpString1="82", lpString2="60000") returned 1 [0070.806] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="83") returned 2 [0070.806] lstrcmpiA (lpString1="83", lpString2="60000") returned 1 [0070.806] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="84") returned 2 [0070.806] lstrcmpiA (lpString1="84", lpString2="60000") returned 1 [0070.806] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="85") returned 2 [0070.806] lstrcmpiA (lpString1="85", lpString2="60000") returned 1 [0070.806] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="86") returned 2 [0070.806] lstrcmpiA (lpString1="86", lpString2="60000") returned 1 [0070.806] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="87") returned 2 [0070.806] lstrcmpiA (lpString1="87", lpString2="60000") returned 1 [0070.806] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="88") returned 2 [0070.807] lstrcmpiA (lpString1="88", lpString2="60000") returned 1 [0070.807] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="89") returned 2 [0070.807] lstrcmpiA (lpString1="89", lpString2="60000") returned 1 [0070.807] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="90") returned 2 [0070.807] lstrcmpiA (lpString1="90", lpString2="60000") returned 1 [0070.807] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="91") returned 2 [0070.807] lstrcmpiA (lpString1="91", lpString2="60000") returned 1 [0070.807] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="92") returned 2 [0070.807] lstrcmpiA (lpString1="92", lpString2="60000") returned 1 [0070.807] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="93") returned 2 [0070.807] lstrcmpiA (lpString1="93", lpString2="60000") returned 1 [0070.807] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="94") returned 2 [0070.807] lstrcmpiA (lpString1="94", lpString2="60000") returned 1 [0070.807] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="95") returned 2 [0070.807] lstrcmpiA (lpString1="95", lpString2="60000") returned 1 [0070.807] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="96") returned 2 [0070.807] lstrcmpiA (lpString1="96", lpString2="60000") returned 1 [0070.807] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="97") returned 2 [0070.807] lstrcmpiA (lpString1="97", lpString2="60000") returned 1 [0070.807] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="98") returned 2 [0070.807] lstrcmpiA (lpString1="98", lpString2="60000") returned 1 [0070.807] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="99") returned 2 [0070.807] lstrcmpiA (lpString1="99", lpString2="60000") returned 1 [0070.808] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="100") returned 3 [0070.808] lstrcmpiA (lpString1="100", lpString2="60000") returned -1 [0070.808] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="101") returned 3 [0070.808] lstrcmpiA (lpString1="101", lpString2="60000") returned -1 [0070.808] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="102") returned 3 [0070.808] lstrcmpiA (lpString1="102", lpString2="60000") returned -1 [0070.808] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="103") returned 3 [0070.808] lstrcmpiA (lpString1="103", lpString2="60000") returned -1 [0070.808] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="104") returned 3 [0070.808] lstrcmpiA (lpString1="104", lpString2="60000") returned -1 [0070.808] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="105") returned 3 [0070.808] lstrcmpiA (lpString1="105", lpString2="60000") returned -1 [0070.808] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="106") returned 3 [0070.808] lstrcmpiA (lpString1="106", lpString2="60000") returned -1 [0070.808] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="107") returned 3 [0070.808] lstrcmpiA (lpString1="107", lpString2="60000") returned -1 [0070.808] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="108") returned 3 [0070.809] lstrcmpiA (lpString1="108", lpString2="60000") returned -1 [0070.809] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="109") returned 3 [0070.809] lstrcmpiA (lpString1="109", lpString2="60000") returned -1 [0070.809] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="110") returned 3 [0070.809] lstrcmpiA (lpString1="110", lpString2="60000") returned -1 [0070.809] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="111") returned 3 [0070.809] lstrcmpiA (lpString1="111", lpString2="60000") returned -1 [0070.809] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="112") returned 3 [0070.809] lstrcmpiA (lpString1="112", lpString2="60000") returned -1 [0070.809] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="113") returned 3 [0070.809] lstrcmpiA (lpString1="113", lpString2="60000") returned -1 [0070.809] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="114") returned 3 [0070.810] lstrcmpiA (lpString1="114", lpString2="60000") returned -1 [0070.810] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="115") returned 3 [0070.810] lstrcmpiA (lpString1="115", lpString2="60000") returned -1 [0070.810] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="116") returned 3 [0070.810] lstrcmpiA (lpString1="116", lpString2="60000") returned -1 [0070.810] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="117") returned 3 [0070.810] lstrcmpiA (lpString1="117", lpString2="60000") returned -1 [0070.810] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="118") returned 3 [0070.810] lstrcmpiA (lpString1="118", lpString2="60000") returned -1 [0070.810] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="119") returned 3 [0070.810] lstrcmpiA (lpString1="119", lpString2="60000") returned -1 [0070.810] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="120") returned 3 [0070.810] lstrcmpiA (lpString1="120", lpString2="60000") returned -1 [0070.810] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="121") returned 3 [0070.810] lstrcmpiA (lpString1="121", lpString2="60000") returned -1 [0070.810] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="122") returned 3 [0070.810] lstrcmpiA (lpString1="122", lpString2="60000") returned -1 [0070.810] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="123") returned 3 [0070.810] lstrcmpiA (lpString1="123", lpString2="60000") returned -1 [0070.810] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="124") returned 3 [0070.810] lstrcmpiA (lpString1="124", lpString2="60000") returned -1 [0070.810] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="125") returned 3 [0070.810] lstrcmpiA (lpString1="125", lpString2="60000") returned -1 [0070.810] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="126") returned 3 [0070.811] lstrcmpiA (lpString1="126", lpString2="60000") returned -1 [0070.811] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="127") returned 3 [0070.811] lstrcmpiA (lpString1="127", lpString2="60000") returned -1 [0070.811] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="128") returned 3 [0070.811] lstrcmpiA (lpString1="128", lpString2="60000") returned -1 [0070.811] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="129") returned 3 [0070.811] lstrcmpiA (lpString1="129", lpString2="60000") returned -1 [0070.811] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="130") returned 3 [0070.811] lstrcmpiA (lpString1="130", lpString2="60000") returned -1 [0070.811] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="131") returned 3 [0070.811] lstrcmpiA (lpString1="131", lpString2="60000") returned -1 [0070.811] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="132") returned 3 [0070.811] lstrcmpiA (lpString1="132", lpString2="60000") returned -1 [0070.811] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="133") returned 3 [0070.811] lstrcmpiA (lpString1="133", lpString2="60000") returned -1 [0070.811] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="134") returned 3 [0070.811] lstrcmpiA (lpString1="134", lpString2="60000") returned -1 [0070.811] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="135") returned 3 [0070.811] lstrcmpiA (lpString1="135", lpString2="60000") returned -1 [0070.811] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="136") returned 3 [0070.811] lstrcmpiA (lpString1="136", lpString2="60000") returned -1 [0070.811] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="137") returned 3 [0070.811] lstrcmpiA (lpString1="137", lpString2="60000") returned -1 [0070.811] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="138") returned 3 [0070.811] lstrcmpiA (lpString1="138", lpString2="60000") returned -1 [0070.812] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="139") returned 3 [0070.812] lstrcmpiA (lpString1="139", lpString2="60000") returned -1 [0070.812] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="140") returned 3 [0070.812] lstrcmpiA (lpString1="140", lpString2="60000") returned -1 [0070.812] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="141") returned 3 [0070.812] lstrcmpiA (lpString1="141", lpString2="60000") returned -1 [0070.812] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="142") returned 3 [0070.812] lstrcmpiA (lpString1="142", lpString2="60000") returned -1 [0070.812] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="143") returned 3 [0070.812] lstrcmpiA (lpString1="143", lpString2="60000") returned -1 [0070.812] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="144") returned 3 [0070.812] lstrcmpiA (lpString1="144", lpString2="60000") returned -1 [0070.812] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="145") returned 3 [0070.812] lstrcmpiA (lpString1="145", lpString2="60000") returned -1 [0070.812] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="146") returned 3 [0070.812] lstrcmpiA (lpString1="146", lpString2="60000") returned -1 [0070.812] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="147") returned 3 [0070.812] lstrcmpiA (lpString1="147", lpString2="60000") returned -1 [0070.812] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="148") returned 3 [0070.812] lstrcmpiA (lpString1="148", lpString2="60000") returned -1 [0070.812] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="149") returned 3 [0070.812] lstrcmpiA (lpString1="149", lpString2="60000") returned -1 [0070.812] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="150") returned 3 [0070.812] lstrcmpiA (lpString1="150", lpString2="60000") returned -1 [0070.812] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="151") returned 3 [0070.813] lstrcmpiA (lpString1="151", lpString2="60000") returned -1 [0070.813] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="152") returned 3 [0070.813] lstrcmpiA (lpString1="152", lpString2="60000") returned -1 [0070.813] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="153") returned 3 [0070.813] lstrcmpiA (lpString1="153", lpString2="60000") returned -1 [0070.813] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="154") returned 3 [0070.813] lstrcmpiA (lpString1="154", lpString2="60000") returned -1 [0070.813] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="155") returned 3 [0070.813] lstrcmpiA (lpString1="155", lpString2="60000") returned -1 [0070.813] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="156") returned 3 [0070.813] lstrcmpiA (lpString1="156", lpString2="60000") returned -1 [0070.813] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="157") returned 3 [0070.813] lstrcmpiA (lpString1="157", lpString2="60000") returned -1 [0070.813] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="158") returned 3 [0070.813] lstrcmpiA (lpString1="158", lpString2="60000") returned -1 [0070.813] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="159") returned 3 [0070.813] lstrcmpiA (lpString1="159", lpString2="60000") returned -1 [0070.813] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="160") returned 3 [0070.813] lstrcmpiA (lpString1="160", lpString2="60000") returned -1 [0070.813] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="161") returned 3 [0070.813] lstrcmpiA (lpString1="161", lpString2="60000") returned -1 [0070.813] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="162") returned 3 [0070.813] lstrcmpiA (lpString1="162", lpString2="60000") returned -1 [0070.813] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="163") returned 3 [0070.813] lstrcmpiA (lpString1="163", lpString2="60000") returned -1 [0070.814] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="164") returned 3 [0070.814] lstrcmpiA (lpString1="164", lpString2="60000") returned -1 [0070.814] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="165") returned 3 [0070.814] lstrcmpiA (lpString1="165", lpString2="60000") returned -1 [0070.814] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="166") returned 3 [0070.814] lstrcmpiA (lpString1="166", lpString2="60000") returned -1 [0070.814] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="167") returned 3 [0070.814] lstrcmpiA (lpString1="167", lpString2="60000") returned -1 [0070.814] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="168") returned 3 [0070.814] lstrcmpiA (lpString1="168", lpString2="60000") returned -1 [0070.814] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="169") returned 3 [0070.814] lstrcmpiA (lpString1="169", lpString2="60000") returned -1 [0070.814] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="170") returned 3 [0070.814] lstrcmpiA (lpString1="170", lpString2="60000") returned -1 [0070.814] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="171") returned 3 [0070.814] lstrcmpiA (lpString1="171", lpString2="60000") returned -1 [0070.814] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="172") returned 3 [0070.814] lstrcmpiA (lpString1="172", lpString2="60000") returned -1 [0070.814] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="173") returned 3 [0070.814] lstrcmpiA (lpString1="173", lpString2="60000") returned -1 [0070.814] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="174") returned 3 [0070.814] lstrcmpiA (lpString1="174", lpString2="60000") returned -1 [0070.814] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="175") returned 3 [0070.814] lstrcmpiA (lpString1="175", lpString2="60000") returned -1 [0070.815] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="176") returned 3 [0070.815] lstrcmpiA (lpString1="176", lpString2="60000") returned -1 [0070.815] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="177") returned 3 [0070.815] lstrcmpiA (lpString1="177", lpString2="60000") returned -1 [0070.815] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="178") returned 3 [0070.815] lstrcmpiA (lpString1="178", lpString2="60000") returned -1 [0070.815] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="179") returned 3 [0070.815] lstrcmpiA (lpString1="179", lpString2="60000") returned -1 [0070.815] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="180") returned 3 [0070.815] lstrcmpiA (lpString1="180", lpString2="60000") returned -1 [0070.815] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="181") returned 3 [0070.815] lstrcmpiA (lpString1="181", lpString2="60000") returned -1 [0070.815] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="182") returned 3 [0070.815] lstrcmpiA (lpString1="182", lpString2="60000") returned -1 [0070.815] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="183") returned 3 [0070.815] lstrcmpiA (lpString1="183", lpString2="60000") returned -1 [0070.815] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="184") returned 3 [0070.815] lstrcmpiA (lpString1="184", lpString2="60000") returned -1 [0070.815] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="185") returned 3 [0070.815] lstrcmpiA (lpString1="185", lpString2="60000") returned -1 [0070.815] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="186") returned 3 [0070.815] lstrcmpiA (lpString1="186", lpString2="60000") returned -1 [0070.815] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="187") returned 3 [0070.815] lstrcmpiA (lpString1="187", lpString2="60000") returned -1 [0070.815] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="188") returned 3 [0070.816] lstrcmpiA (lpString1="188", lpString2="60000") returned -1 [0070.816] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="189") returned 3 [0070.816] lstrcmpiA (lpString1="189", lpString2="60000") returned -1 [0070.816] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="190") returned 3 [0070.816] lstrcmpiA (lpString1="190", lpString2="60000") returned -1 [0070.816] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="191") returned 3 [0070.816] lstrcmpiA (lpString1="191", lpString2="60000") returned -1 [0070.816] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="192") returned 3 [0070.816] lstrcmpiA (lpString1="192", lpString2="60000") returned -1 [0070.816] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="193") returned 3 [0070.816] lstrcmpiA (lpString1="193", lpString2="60000") returned -1 [0070.816] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="194") returned 3 [0070.816] lstrcmpiA (lpString1="194", lpString2="60000") returned -1 [0070.816] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="195") returned 3 [0070.816] lstrcmpiA (lpString1="195", lpString2="60000") returned -1 [0070.816] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="196") returned 3 [0070.816] lstrcmpiA (lpString1="196", lpString2="60000") returned -1 [0070.816] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="197") returned 3 [0070.816] lstrcmpiA (lpString1="197", lpString2="60000") returned -1 [0070.816] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="198") returned 3 [0070.816] lstrcmpiA (lpString1="198", lpString2="60000") returned -1 [0070.816] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="199") returned 3 [0070.816] lstrcmpiA (lpString1="199", lpString2="60000") returned -1 [0070.816] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="200") returned 3 [0070.817] lstrcmpiA (lpString1="200", lpString2="60000") returned -1 [0070.817] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="201") returned 3 [0070.817] lstrcmpiA (lpString1="201", lpString2="60000") returned -1 [0070.817] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="202") returned 3 [0070.817] lstrcmpiA (lpString1="202", lpString2="60000") returned -1 [0070.817] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="203") returned 3 [0070.817] lstrcmpiA (lpString1="203", lpString2="60000") returned -1 [0070.817] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="204") returned 3 [0070.817] lstrcmpiA (lpString1="204", lpString2="60000") returned -1 [0070.817] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="205") returned 3 [0070.817] lstrcmpiA (lpString1="205", lpString2="60000") returned -1 [0070.817] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="206") returned 3 [0070.817] lstrcmpiA (lpString1="206", lpString2="60000") returned -1 [0070.817] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="207") returned 3 [0070.817] lstrcmpiA (lpString1="207", lpString2="60000") returned -1 [0070.817] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="208") returned 3 [0070.817] lstrcmpiA (lpString1="208", lpString2="60000") returned -1 [0070.817] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="209") returned 3 [0070.817] lstrcmpiA (lpString1="209", lpString2="60000") returned -1 [0070.817] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="210") returned 3 [0070.817] lstrcmpiA (lpString1="210", lpString2="60000") returned -1 [0070.817] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="211") returned 3 [0070.817] lstrcmpiA (lpString1="211", lpString2="60000") returned -1 [0070.817] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="212") returned 3 [0070.817] lstrcmpiA (lpString1="212", lpString2="60000") returned -1 [0070.818] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="213") returned 3 [0070.818] lstrcmpiA (lpString1="213", lpString2="60000") returned -1 [0070.818] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="214") returned 3 [0070.818] lstrcmpiA (lpString1="214", lpString2="60000") returned -1 [0070.818] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="215") returned 3 [0070.818] lstrcmpiA (lpString1="215", lpString2="60000") returned -1 [0070.818] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="216") returned 3 [0070.818] lstrcmpiA (lpString1="216", lpString2="60000") returned -1 [0070.818] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="217") returned 3 [0070.818] lstrcmpiA (lpString1="217", lpString2="60000") returned -1 [0070.818] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="218") returned 3 [0070.818] lstrcmpiA (lpString1="218", lpString2="60000") returned -1 [0070.818] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="219") returned 3 [0070.818] lstrcmpiA (lpString1="219", lpString2="60000") returned -1 [0070.818] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="220") returned 3 [0070.818] lstrcmpiA (lpString1="220", lpString2="60000") returned -1 [0070.818] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="221") returned 3 [0070.818] lstrcmpiA (lpString1="221", lpString2="60000") returned -1 [0070.818] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="222") returned 3 [0070.818] lstrcmpiA (lpString1="222", lpString2="60000") returned -1 [0070.818] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="223") returned 3 [0070.818] lstrcmpiA (lpString1="223", lpString2="60000") returned -1 [0070.818] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="224") returned 3 [0070.818] lstrcmpiA (lpString1="224", lpString2="60000") returned -1 [0070.819] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="225") returned 3 [0070.819] lstrcmpiA (lpString1="225", lpString2="60000") returned -1 [0070.819] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="226") returned 3 [0070.819] lstrcmpiA (lpString1="226", lpString2="60000") returned -1 [0070.819] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="227") returned 3 [0070.819] lstrcmpiA (lpString1="227", lpString2="60000") returned -1 [0070.819] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="228") returned 3 [0070.819] lstrcmpiA (lpString1="228", lpString2="60000") returned -1 [0070.819] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="229") returned 3 [0070.819] lstrcmpiA (lpString1="229", lpString2="60000") returned -1 [0070.819] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="230") returned 3 [0070.819] lstrcmpiA (lpString1="230", lpString2="60000") returned -1 [0070.819] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="231") returned 3 [0070.819] lstrcmpiA (lpString1="231", lpString2="60000") returned -1 [0070.819] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="232") returned 3 [0070.819] lstrcmpiA (lpString1="232", lpString2="60000") returned -1 [0070.819] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="233") returned 3 [0070.819] lstrcmpiA (lpString1="233", lpString2="60000") returned -1 [0070.819] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="234") returned 3 [0070.819] lstrcmpiA (lpString1="234", lpString2="60000") returned -1 [0070.819] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="235") returned 3 [0070.819] lstrcmpiA (lpString1="235", lpString2="60000") returned -1 [0070.819] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="236") returned 3 [0070.819] lstrcmpiA (lpString1="236", lpString2="60000") returned -1 [0070.820] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="237") returned 3 [0070.820] lstrcmpiA (lpString1="237", lpString2="60000") returned -1 [0070.820] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="238") returned 3 [0070.820] lstrcmpiA (lpString1="238", lpString2="60000") returned -1 [0070.820] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="239") returned 3 [0070.820] lstrcmpiA (lpString1="239", lpString2="60000") returned -1 [0070.820] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="240") returned 3 [0070.820] lstrcmpiA (lpString1="240", lpString2="60000") returned -1 [0070.820] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="241") returned 3 [0070.820] lstrcmpiA (lpString1="241", lpString2="60000") returned -1 [0070.820] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="242") returned 3 [0070.820] lstrcmpiA (lpString1="242", lpString2="60000") returned -1 [0070.820] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="243") returned 3 [0070.820] lstrcmpiA (lpString1="243", lpString2="60000") returned -1 [0070.820] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="244") returned 3 [0070.820] lstrcmpiA (lpString1="244", lpString2="60000") returned -1 [0070.820] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="245") returned 3 [0070.820] lstrcmpiA (lpString1="245", lpString2="60000") returned -1 [0070.820] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="246") returned 3 [0070.820] lstrcmpiA (lpString1="246", lpString2="60000") returned -1 [0070.820] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="247") returned 3 [0070.820] lstrcmpiA (lpString1="247", lpString2="60000") returned -1 [0070.820] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="248") returned 3 [0070.820] lstrcmpiA (lpString1="248", lpString2="60000") returned -1 [0070.821] wsprintfA (in: param_1=0x432000, param_2="%d" | out: param_1="249") returned 3 [0070.821] lstrcmpiA (lpString1="249", lpString2="60000") returned -1 [0074.633] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", lpString2="\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0074.633] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="131083810" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\131083810") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\131083810" [0074.633] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\131083810" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\131083810")) returned 0x2020 [0074.634] SetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\131083810", dwFileAttributes=0x2020) returned 1 [0074.635] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\131083810" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\131083810")) returned 0x2020 [0074.635] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\131083810" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\131083810"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x160 [0074.637] SetFilePointer (in: hFile=0x184, lDistanceToMove=216143, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x34c4f [0074.637] ReadFile (in: hFile=0x184, lpBuffer=0x18fbd0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x18fb4c, lpOverlapped=0x0 | out: lpBuffer=0x18fbd0*, lpNumberOfBytesRead=0x18fb4c*=0x4, lpOverlapped=0x0) returned 1 [0074.637] GetTickCount () returned 0x11488ef [0074.637] ReadFile (in: hFile=0x184, lpBuffer=0x41d448, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18fb4c, lpOverlapped=0x0 | out: lpBuffer=0x41d448*, lpNumberOfBytesRead=0x18fb4c*=0x4000, lpOverlapped=0x0) returned 1 [0074.638] GetTickCount () returned 0x11488ef [0074.639] WriteFile (in: hFile=0x160, lpBuffer=0x421448*, nNumberOfBytesToWrite=0x3ffb, lpNumberOfBytesWritten=0x18fb58, lpOverlapped=0x0 | out: lpBuffer=0x421448*, lpNumberOfBytesWritten=0x18fb58*=0x3ffb, lpOverlapped=0x0) returned 1 [0074.640] GetTickCount () returned 0x11488ef [0074.640] ReadFile (in: hFile=0x184, lpBuffer=0x41d448, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18fb4c, lpOverlapped=0x0 | out: lpBuffer=0x41d448*, lpNumberOfBytesRead=0x18fb4c*=0x4000, lpOverlapped=0x0) returned 1 [0074.640] GetTickCount () returned 0x11488ef [0074.640] WriteFile (in: hFile=0x160, lpBuffer=0x421448*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x18fb58, lpOverlapped=0x0 | out: lpBuffer=0x421448*, lpNumberOfBytesWritten=0x18fb58*=0x4000, lpOverlapped=0x0) returned 1 [0074.641] GetTickCount () returned 0x11488ef [0074.641] ReadFile (in: hFile=0x184, lpBuffer=0x41d448, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18fb4c, lpOverlapped=0x0 | out: lpBuffer=0x41d448*, lpNumberOfBytesRead=0x18fb4c*=0x4000, lpOverlapped=0x0) returned 1 [0074.642] GetTickCount () returned 0x11488ef [0074.642] WriteFile (in: hFile=0x160, lpBuffer=0x421448*, nNumberOfBytesToWrite=0x40ac, lpNumberOfBytesWritten=0x18fb58, lpOverlapped=0x0 | out: lpBuffer=0x421448*, lpNumberOfBytesWritten=0x18fb58*=0x40ac, lpOverlapped=0x0) returned 1 [0074.643] GetTickCount () returned 0x11488ef [0074.643] ReadFile (in: hFile=0x184, lpBuffer=0x41d448, nNumberOfBytesToRead=0x23b4, lpNumberOfBytesRead=0x18fb4c, lpOverlapped=0x0 | out: lpBuffer=0x41d448*, lpNumberOfBytesRead=0x18fb4c*=0x23b4, lpOverlapped=0x0) returned 1 [0074.643] GetTickCount () returned 0x11488ef [0074.643] MulDiv (nNumber=58292, nNumerator=100, nDenominator=58292) returned 100 [0074.643] wsprintfA (in: param_1=0x18fb68, param_2="... %d%%" | out: param_1="... 100%") returned 8 [0074.643] WriteFile (in: hFile=0x160, lpBuffer=0x421448*, nNumberOfBytesToWrite=0x2dcb, lpNumberOfBytesWritten=0x18fb58, lpOverlapped=0x0 | out: lpBuffer=0x421448*, lpNumberOfBytesWritten=0x18fb58*=0x2dcb, lpOverlapped=0x0) returned 1 [0074.644] SetFileTime (hFile=0x160, lpCreationTime=0x18fd94, lpLastAccessTime=0x0, lpLastWriteTime=0x18fd94) returned 1 [0074.644] CloseHandle (hObject=0x160) returned 1 [0074.645] lstrcpynA (in: lpString1=0x42e3c0, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0074.645] lstrlenA (lpString="") returned 0 [0074.645] lstrcpynA (in: lpString1=0x40ac38, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0074.645] lstrcpynA (in: lpString1=0x40b038, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0074.645] lstrcmpiA (lpString1="", lpString2="") returned 0 [0074.645] lstrcpynA (in: lpString1=0x42e3c0, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0074.645] lstrlenA (lpString="") returned 0 [0074.645] lstrcpynA (in: lpString1=0x58146c, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0074.645] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\" [0074.645] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 36 [0074.645] lstrcpynA (in: lpString1=0x40a838, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp" [0074.645] GetTickCount () returned 0x11488ef [0074.645] GetTempFileNameA (in: lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", lpPrefixString="nsd", uUnique=0x0, lpTempFileName=0x430000 | out: lpTempFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsde08f.tmp")) returned 0xe08f [0074.671] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0074.671] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0074.671] lstrcpynA (in: lpString1=0x40a438, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0074.671] lstrcpynA (in: lpString1=0x42bc98, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0074.671] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0074.671] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", lpFindFileData=0x42c0e0 | out: lpFindFileData=0x42c0e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeb764710, ftCreationTime.dwHighDateTime=0x1d6eae2, ftLastAccessTime.dwLowDateTime=0xeb764710, ftLastAccessTime.dwHighDateTime=0x1d6eae2, ftLastWriteTime.dwLowDateTime=0xeb764710, ftLastWriteTime.dwHighDateTime=0x1d6eae2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x8, cFileName="nsdE08F.tmp", cAlternateFileName="")) returned 0x567788 [0074.672] FindClose (in: hFindFile=0x567788 | out: hFindFile=0x567788) returned 1 [0074.672] DeleteFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsde08f.tmp")) returned 1 [0074.672] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0074.672] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0074.672] lstrcpynA (in: lpString1=0x40a838, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0074.672] CreateDirectoryA (lpPathName="C:\\Users" (normalized: "c:\\users"), lpSecurityAttributes=0x0) returned 0 [0074.672] GetLastError () returned 0xb7 [0074.672] GetFileAttributesA (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0074.673] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1" (normalized: "c:\\users\\5p5nrg~1"), lpSecurityAttributes=0x0) returned 0 [0074.673] GetLastError () returned 0xb7 [0074.673] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1" (normalized: "c:\\users\\5p5nrg~1")) returned 0x10 [0074.673] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData" (normalized: "c:\\users\\5p5nrg~1\\appdata"), lpSecurityAttributes=0x0) returned 0 [0074.673] GetLastError () returned 0xb7 [0074.673] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData" (normalized: "c:\\users\\5p5nrg~1\\appdata")) returned 0x2012 [0074.673] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local"), lpSecurityAttributes=0x0) returned 0 [0074.673] GetLastError () returned 0xb7 [0074.673] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local")) returned 0x2010 [0074.673] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp"), lpSecurityAttributes=0x0) returned 0 [0074.673] GetLastError () returned 0xb7 [0074.673] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp")) returned 0x2010 [0074.673] GetModuleHandleA (lpModuleName="SHELL32") returned 0x759d0000 [0074.674] GetProcAddress (hModule=0x759d0000, lpProcName=0x2a8) returned 0x75a244f5 [0074.674] IsUserAnAdmin () returned 0 [0074.674] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsde08f.tmp"), lpSecurityAttributes=0x0) returned 1 [0074.675] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0074.675] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0074.675] lstrcpynA (in: lpString1=0x40a438, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0074.675] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0074.675] lstrcpynA (in: lpString1=0x436800, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0074.675] lstrcpynA (in: lpString1=0x430000, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0074.675] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0074.675] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0074.675] lstrcpynA (in: lpString1=0x40b038, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" [0074.675] lstrcpynA (in: lpString1=0x40a438, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" [0074.675] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsde08f.tmp\\system.dll")) returned 0xffffffff [0074.675] CreateFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsde08f.tmp\\system.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0074.676] SetFilePointer (in: hFile=0x184, lDistanceToMove=274439, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x43007 [0074.676] ReadFile (in: hFile=0x184, lpBuffer=0x18fbd0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x18fb4c, lpOverlapped=0x0 | out: lpBuffer=0x18fbd0*, lpNumberOfBytesRead=0x18fb4c*=0x4, lpOverlapped=0x0) returned 1 [0074.676] GetTickCount () returned 0x114890e [0074.676] ReadFile (in: hFile=0x184, lpBuffer=0x41d448, nNumberOfBytesToRead=0x1ace, lpNumberOfBytesRead=0x18fb4c, lpOverlapped=0x0 | out: lpBuffer=0x41d448*, lpNumberOfBytesRead=0x18fb4c*=0x1ace, lpOverlapped=0x0) returned 1 [0074.676] GetTickCount () returned 0x114890e [0074.676] MulDiv (nNumber=6862, nNumerator=100, nDenominator=6862) returned 100 [0074.676] wsprintfA (in: param_1=0x18fb68, param_2="... %d%%" | out: param_1="... 100%") returned 8 [0074.676] WriteFile (in: hFile=0x15c, lpBuffer=0x421448*, nNumberOfBytesToWrite=0x2e00, lpNumberOfBytesWritten=0x18fb58, lpOverlapped=0x0 | out: lpBuffer=0x421448*, lpNumberOfBytesWritten=0x18fb58*=0x2e00, lpOverlapped=0x0) returned 1 [0074.678] CloseHandle (hObject=0x15c) returned 1 [0074.678] lstrcpynA (in: lpString1=0x58146c, lpString2="\x09\x09\x09\x09\x09\x09*(&t256) \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09p \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09.r5", iMaxLength=1024 | out: lpString1="\x09\x09\x09\x09\x09\x09*(&t256) \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09p \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09.r5") returned="\x09\x09\x09\x09\x09\x09*(&t256) \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09p \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09.r5" [0074.678] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0074.678] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0074.678] lstrcpynA (in: lpString1=0x40a838, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" [0074.678] lstrcpynA (in: lpString1=0x40a438, lpString2="Call", iMaxLength=1024 | out: lpString1="Call") returned="Call" [0074.679] GetModuleHandleA (lpModuleName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned 0x0 [0074.679] LoadLibraryExA (lpLibFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll", hFile=0x0, dwFlags=0x8) returned 0x753e0000 [0075.342] VirtualProtect (in: lpAddress=0x753e404c, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x753e403c | out: lpflOldProtect=0x753e403c*=0x4) returned 1 [0075.343] GetProcAddress (hModule=0x753e0000, lpProcName="Call") returned 0x753e16db [0075.396] lstrcpyA (in: lpString1=0x5869a8, lpString2="" | out: lpString1="") returned="" [0075.396] lstrcpynA (in: lpString1=0x581468, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0075.397] lstrcpynA (in: lpString1=0x585d90, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0075.397] lstrcpynA (in: lpString1=0x586198, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0075.397] lstrcpynA (in: lpString1=0x586198, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0075.397] wsprintfA (in: param_1=0x586198, param_2="%d" | out: param_1="5729240") returned 7 [0075.397] lstrcpyA (in: lpString1=0x431400, lpString2="5729240" | out: lpString1="5729240") returned="5729240" [0075.397] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.397] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0075.397] lstrcpynA (in: lpString1=0x40ac38, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.397] lstrcpynA (in: lpString1=0x40b038, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0075.397] lstrcmpiA (lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", lpString2="") returned 1 [0075.397] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.397] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0075.397] lstrcpynA (in: lpString1=0x40b038, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" [0075.397] lstrcpynA (in: lpString1=0x40a438, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" [0075.398] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsde08f.tmp\\system.dll")) returned 0x2020 [0075.398] CreateFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsde08f.tmp\\system.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xffffffff [0075.398] lstrcpynA (in: lpString1=0x58146c, lpString2="user32::wsprintf(p \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09r5, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 t \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 '%s\\131083810', \x09\x09\x09\x09\x09\x09\x09 t \x09\x09\x09\x09\x09\x09 o)", iMaxLength=1024 | out: lpString1="user32::wsprintf(p \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09r5, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 t \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 '%s\\131083810', \x09\x09\x09\x09\x09\x09\x09 t \x09\x09\x09\x09\x09\x09 o)") returned="user32::wsprintf(p \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09r5, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 t \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 '%s\\131083810', \x09\x09\x09\x09\x09\x09\x09 t \x09\x09\x09\x09\x09\x09 o)" [0075.398] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.398] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0075.398] lstrcpynA (in: lpString1=0x40a838, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" [0075.398] lstrcpynA (in: lpString1=0x40a438, lpString2="Call", iMaxLength=1024 | out: lpString1="Call") returned="Call" [0075.398] GetModuleHandleA (lpModuleName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned 0x753e0000 [0075.399] GetProcAddress (hModule=0x753e0000, lpProcName="Call") returned 0x753e16db [0075.399] lstrcpyA (in: lpString1=0x586198, lpString2="user32" | out: lpString1="user32") returned="user32" [0075.399] lstrcpyA (in: lpString1=0x5865a8, lpString2="user32" | out: lpString1="user32") returned="user32" [0075.399] lstrcpyA (in: lpString1=0x5869a8, lpString2="wsprintf" | out: lpString1="wsprintf") returned="wsprintf" [0075.399] lstrcpynA (in: lpString1=0x587a50, lpString2="%s\\131083810", iMaxLength=1024 | out: lpString1="%s\\131083810") returned="%s\\131083810" [0075.399] GetModuleHandleA (lpModuleName="user32") returned 0x77130000 [0075.399] GetProcAddress (hModule=0x77130000, lpProcName="wsprintf") returned 0x0 [0075.399] lstrlenA (lpString="wsprintf") returned 8 [0075.399] GetProcAddress (hModule=0x77130000, lpProcName="wsprintfA") returned 0x7715ae5f [0075.400] lstrcpynA (in: lpString1=0x581468, lpString2="5729240", iMaxLength=1024 | out: lpString1="5729240") returned="5729240" [0075.400] lstrcpynA (in: lpString1=0x581468, lpString2="%s\\131083810", iMaxLength=1024 | out: lpString1="%s\\131083810") returned="%s\\131083810" [0075.400] lstrcpynA (in: lpString1=0x585d90, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", iMaxLength=1024 | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0075.400] lstrcpynA (in: lpString1=0x586198, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", iMaxLength=1024 | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0075.400] lstrcpynA (in: lpString1=0x585d90, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0075.400] wsprintfA (in: param_1=0x576bd8, param_2="%s\\131083810" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\131083810") returned 55 [0075.400] lstrcpynA (in: lpString1=0x585d90, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", iMaxLength=1024 | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0075.400] lstrcpynA (in: lpString1=0x585d90, lpString2="%s\\131083810", iMaxLength=1024 | out: lpString1="%s\\131083810") returned="%s\\131083810" [0075.400] wsprintfA (in: param_1=0x585d90, param_2="%d" | out: param_1="5729240") returned 7 [0075.400] FreeLibrary (hLibModule=0x581468) returned 0 [0075.400] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.400] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0075.400] lstrcpynA (in: lpString1=0x40ac38, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.400] lstrcpynA (in: lpString1=0x40b038, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0075.400] lstrcmpiA (lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", lpString2="") returned 1 [0075.401] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.401] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0075.401] lstrcpynA (in: lpString1=0x40b038, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" [0075.401] lstrcpynA (in: lpString1=0x40a438, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" [0075.401] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsde08f.tmp\\system.dll")) returned 0x2020 [0075.401] CreateFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsde08f.tmp\\system.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xffffffff [0075.401] lstrcpynA (in: lpString1=0x42e3d3, lpString2="e", iMaxLength=1024 | out: lpString1="e") returned="e" [0075.401] lstrlenA (lpString="e") returned 1 [0075.401] lstrcpynA (in: lpString1=0x58146c, lpString2="kernel32::CreateFile(p\x09 r5,\x09\x09 i \x09\x090x80000000,\x09 i\x09 0,\x09\x09 p\x09 0,\x09\x09\x09 i \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x093, i 0,\x09\x09\x09\x09\x09\x09 i\x09\x09\x09\x09\x09\x09\x09 0)\x09\x09\x09 i \x09\x09\x09\x09\x09\x09\x09\x09\x09.r10", iMaxLength=1024 | out: lpString1="kernel32::CreateFile(p\x09 r5,\x09\x09 i \x09\x090x80000000,\x09 i\x09 0,\x09\x09 p\x09 0,\x09\x09\x09 i \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x093, i 0,\x09\x09\x09\x09\x09\x09 i\x09\x09\x09\x09\x09\x09\x09 0)\x09\x09\x09 i \x09\x09\x09\x09\x09\x09\x09\x09\x09.r10") returned="kernel32::CreateFile(p\x09 r5,\x09\x09 i \x09\x090x80000000,\x09 i\x09 0,\x09\x09 p\x09 0,\x09\x09\x09 i \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x093, i 0,\x09\x09\x09\x09\x09\x09 i\x09\x09\x09\x09\x09\x09\x09 0)\x09\x09\x09 i \x09\x09\x09\x09\x09\x09\x09\x09\x09.r10" [0075.401] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.401] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0075.401] lstrcpynA (in: lpString1=0x40a838, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" [0075.401] lstrcpynA (in: lpString1=0x40a438, lpString2="Call", iMaxLength=1024 | out: lpString1="Call") returned="Call" [0075.402] GetModuleHandleA (lpModuleName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned 0x753e0000 [0075.402] GetProcAddress (hModule=0x753e0000, lpProcName="Call") returned 0x753e16db [0075.402] lstrcpyA (in: lpString1=0x586198, lpString2="kernel32" | out: lpString1="kernel32") returned="kernel32" [0075.402] lstrcpyA (in: lpString1=0x5865a8, lpString2="kernel32" | out: lpString1="kernel32") returned="kernel32" [0075.402] lstrcpyA (in: lpString1=0x5869a8, lpString2="CreateFile" | out: lpString1="CreateFile") returned="CreateFile" [0075.402] GetModuleHandleA (lpModuleName="kernel32") returned 0x76d30000 [0075.403] GetProcAddress (hModule=0x76d30000, lpProcName="CreateFile") returned 0x0 [0075.403] lstrlenA (lpString="CreateFile") returned 10 [0075.403] GetProcAddress (hModule=0x76d30000, lpProcName="CreateFileA") returned 0x76d453c6 [0075.403] lstrcpynA (in: lpString1=0x581468, lpString2="5729240", iMaxLength=1024 | out: lpString1="5729240") returned="5729240" [0075.403] lstrcpynA (in: lpString1=0x581468, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0075.403] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\131083810" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\131083810"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0075.403] wsprintfA (in: param_1=0x581468, param_2="%d" | out: param_1="0") returned 1 [0075.403] wsprintfA (in: param_1=0x581468, param_2="%d" | out: param_1="0") returned 1 [0075.403] wsprintfA (in: param_1=0x581468, param_2="%d" | out: param_1="3") returned 1 [0075.403] wsprintfA (in: param_1=0x581468, param_2="%d" | out: param_1="0") returned 1 [0075.403] wsprintfA (in: param_1=0x581468, param_2="%d" | out: param_1="0") returned 1 [0075.404] wsprintfA (in: param_1=0x581468, param_2="%d" | out: param_1="-2147483648") returned 11 [0075.404] wsprintfA (in: param_1=0x581468, param_2="%d" | out: param_1="5729240") returned 7 [0075.404] wsprintfA (in: param_1=0x581468, param_2="%d" | out: param_1="348") returned 3 [0075.404] lstrcpyA (in: lpString1=0x432800, lpString2="348" | out: lpString1="348") returned="348" [0075.404] lstrcpynA (in: lpString1=0x40a438, lpString2="*(i", iMaxLength=1024 | out: lpString1="*(i") returned="*(i" [0075.404] lstrlenA (lpString="*(i") returned 3 [0075.404] lstrcpynA (in: lpString1=0x430000, lpString2="*(i", iMaxLength=1024 | out: lpString1="*(i") returned="*(i" [0075.404] lstrcpynA (in: lpString1=0x40a438, lpString2="(&", iMaxLength=1024 | out: lpString1="(&") returned="(&" [0075.404] lstrlenA (lpString="(&") returned 2 [0075.404] lstrcpynA (in: lpString1=0x430c00, lpString2="(&", iMaxLength=1024 | out: lpString1="(&") returned="(&" [0075.404] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.404] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0075.404] lstrcpynA (in: lpString1=0x40ac38, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.404] lstrcpynA (in: lpString1=0x40b038, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0075.404] lstrcmpiA (lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", lpString2="") returned 1 [0075.404] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.404] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0075.404] lstrcpynA (in: lpString1=0x40b038, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" [0075.404] lstrcpynA (in: lpString1=0x40a438, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" [0075.404] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsde08f.tmp\\system.dll")) returned 0x2020 [0075.405] CreateFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsde08f.tmp\\system.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xffffffff [0075.405] lstrcpynA (in: lpString1=0x58146c, lpString2="*(i) \x09\x09\x09\x09\x09\x09\x09\x09\x09 p \x09\x09\x09\x09\x09\x09\x09\x09\x09 \x09 .r2", iMaxLength=1024 | out: lpString1="*(i) \x09\x09\x09\x09\x09\x09\x09\x09\x09 p \x09\x09\x09\x09\x09\x09\x09\x09\x09 \x09 .r2") returned="*(i) \x09\x09\x09\x09\x09\x09\x09\x09\x09 p \x09\x09\x09\x09\x09\x09\x09\x09\x09 \x09 .r2" [0075.405] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.405] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0075.405] lstrcpynA (in: lpString1=0x40a838, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" [0075.405] lstrcpynA (in: lpString1=0x40a438, lpString2="Call", iMaxLength=1024 | out: lpString1="Call") returned="Call" [0075.405] GetModuleHandleA (lpModuleName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned 0x753e0000 [0075.405] GetProcAddress (hModule=0x753e0000, lpProcName="Call") returned 0x753e16db [0075.405] lstrcpyA (in: lpString1=0x5869a8, lpString2="" | out: lpString1="") returned="" [0075.406] lstrcpynA (in: lpString1=0x581468, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0075.406] lstrcpynA (in: lpString1=0x581468, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0075.406] wsprintfA (in: param_1=0x581468, param_2="%d" | out: param_1="0") returned 1 [0075.406] wsprintfA (in: param_1=0x581468, param_2="%d" | out: param_1="5708688") returned 7 [0075.406] lstrcpyA (in: lpString1=0x430800, lpString2="5708688" | out: lpString1="5708688") returned="5708688" [0075.406] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.406] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0075.406] lstrcpynA (in: lpString1=0x40ac38, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.406] lstrcpynA (in: lpString1=0x40b038, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0075.406] lstrcmpiA (lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", lpString2="") returned 1 [0075.406] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.406] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0075.406] lstrcpynA (in: lpString1=0x40b038, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" [0075.406] lstrcpynA (in: lpString1=0x40a438, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" [0075.406] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsde08f.tmp\\system.dll")) returned 0x2020 [0075.406] CreateFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsde08f.tmp\\system.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xffffffff [0075.407] lstrcpynA (in: lpString1=0x58146c, lpString2="*(i \x09\x09\x09\x09\x09\x09 61042, \x09\x09\x09\x09\x09 \x09\x09 i \x09\x09\x09\x09\x09\x09\x09\x09 0) \x09\x09\x09\x09\x09\x09\x09 p \x09\x09\x09\x09\x09 .r1", iMaxLength=1024 | out: lpString1="*(i \x09\x09\x09\x09\x09\x09 61042, \x09\x09\x09\x09\x09 \x09\x09 i \x09\x09\x09\x09\x09\x09\x09\x09 0) \x09\x09\x09\x09\x09\x09\x09 p \x09\x09\x09\x09\x09 .r1") returned="*(i \x09\x09\x09\x09\x09\x09 61042, \x09\x09\x09\x09\x09 \x09\x09 i \x09\x09\x09\x09\x09\x09\x09\x09 0) \x09\x09\x09\x09\x09\x09\x09 p \x09\x09\x09\x09\x09 .r1" [0075.407] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.407] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0075.407] lstrcpynA (in: lpString1=0x40a838, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" [0075.407] lstrcpynA (in: lpString1=0x40a438, lpString2="Call", iMaxLength=1024 | out: lpString1="Call") returned="Call" [0075.407] GetModuleHandleA (lpModuleName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned 0x753e0000 [0075.407] GetProcAddress (hModule=0x753e0000, lpProcName="Call") returned 0x753e16db [0075.407] lstrcpyA (in: lpString1=0x5869a8, lpString2="" | out: lpString1="") returned="" [0075.408] lstrcpynA (in: lpString1=0x581468, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0075.408] wsprintfA (in: param_1=0x581468, param_2="%d" | out: param_1="0") returned 1 [0075.408] wsprintfA (in: param_1=0x581468, param_2="%d" | out: param_1="61042") returned 5 [0075.408] wsprintfA (in: param_1=0x581468, param_2="%d" | out: param_1="5708704") returned 7 [0075.408] lstrcpyA (in: lpString1=0x430400, lpString2="5708704" | out: lpString1="5708704") returned="5708704" [0075.408] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.408] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0075.408] lstrcpynA (in: lpString1=0x40ac38, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.408] lstrcpynA (in: lpString1=0x40b038, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0075.408] lstrcmpiA (lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", lpString2="") returned 1 [0075.408] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.408] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0075.408] lstrcpynA (in: lpString1=0x40b038, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" [0075.408] lstrcpynA (in: lpString1=0x40a438, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" [0075.408] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsde08f.tmp\\system.dll")) returned 0x2020 [0075.408] CreateFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsde08f.tmp\\system.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xffffffff [0075.409] lstrcpynA (in: lpString1=0x58146c, lpString2="*(&t255) \x09\x09 p \x09 .r5", iMaxLength=1024 | out: lpString1="*(&t255) \x09\x09 p \x09 .r5") returned="*(&t255) \x09\x09 p \x09 .r5" [0075.409] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.409] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0075.409] lstrcpynA (in: lpString1=0x40a838, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" [0075.409] lstrcpynA (in: lpString1=0x40a438, lpString2="Call", iMaxLength=1024 | out: lpString1="Call") returned="Call" [0075.409] GetModuleHandleA (lpModuleName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned 0x753e0000 [0075.409] GetProcAddress (hModule=0x753e0000, lpProcName="Call") returned 0x753e16db [0075.409] lstrcpyA (in: lpString1=0x5869a8, lpString2="" | out: lpString1="") returned="" [0075.409] lstrcpynA (in: lpString1=0x581468, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0075.409] lstrcpynA (in: lpString1=0x585d90, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0075.409] lstrcpynA (in: lpString1=0x586198, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0075.410] lstrcpynA (in: lpString1=0x586198, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0075.410] wsprintfA (in: param_1=0x586198, param_2="%d" | out: param_1="5729504") returned 7 [0075.410] lstrcpyA (in: lpString1=0x431400, lpString2="5729504" | out: lpString1="5729504") returned="5729504" [0075.410] lstrcpynA (in: lpString1=0x40a438, lpString2="NtCreateSection", iMaxLength=1024 | out: lpString1="NtCreateSection") returned="NtCreateSection" [0075.410] lstrlenA (lpString="NtCreateSection") returned 15 [0075.410] lstrcpynA (in: lpString1=0x430c00, lpString2="NtCreateSection", iMaxLength=1024 | out: lpString1="NtCreateSection") returned="NtCreateSection" [0075.410] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.410] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0075.410] lstrcpynA (in: lpString1=0x40ac38, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.410] lstrcpynA (in: lpString1=0x40b038, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0075.410] lstrcmpiA (lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", lpString2="") returned 1 [0075.410] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.410] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0075.410] lstrcpynA (in: lpString1=0x40b038, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" [0075.410] lstrcpynA (in: lpString1=0x40a438, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" [0075.410] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsde08f.tmp\\system.dll")) returned 0x2020 [0075.410] CreateFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsde08f.tmp\\system.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xffffffff [0075.411] lstrcpynA (in: lpString1=0x58146c, lpString2="user32::wsprintf(p \x09\x09\x09\x09\x09\x09\x09r5, \x09\x09\x09\x09\x09\x09\x09\x09t \x09\x09\x09\x09\x09\x09\x09\x09 '%s%s%s%s%s%i%s' , \x09\x09\x09\x09\x09\x09\x09\x09 t \x09 \x09\x09\x09\x09\x09\x09\x09\x09 'nt',\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 t\x09 \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09'dll::NtC',t \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 'reat', \x09\x09\x09\x09\x09\x09\x09 t \x09\x09\x09\x09\x09\x09\x09\x09\x09'NtCreateSection',t'ion(p \x09\x09\x09\x09\x09\x09\x09\x09\x09 r2,i ', \x09\x09\x09\x09\x09\x09\x09\x09\x09i \x09\x09\x09\x09\x09\x09\x09\x09\x09\x090xE,t \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 ',n,')", iMaxLength=1024 | out: lpString1="user32::wsprintf(p \x09\x09\x09\x09\x09\x09\x09r5, \x09\x09\x09\x09\x09\x09\x09\x09t \x09\x09\x09\x09\x09\x09\x09\x09 '%s%s%s%s%s%i%s' , \x09\x09\x09\x09\x09\x09\x09\x09 t \x09 \x09\x09\x09\x09\x09\x09\x09\x09 'nt',\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 t\x09 \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09'dll::NtC',t \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 'reat', \x09\x09\x09\x09\x09\x09\x09 t \x09\x09\x09\x09\x09\x09\x09\x09\x09'NtCreateSection',t'ion(p \x09\x09\x09\x09\x09\x09\x09\x09\x09 r2,i ', \x09\x09\x09\x09\x09\x09\x09\x09\x09i \x09\x09\x09\x09\x09\x09\x09\x09\x09\x090xE,t \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 ',n,')") returned="user32::wsprintf(p \x09\x09\x09\x09\x09\x09\x09r5, \x09\x09\x09\x09\x09\x09\x09\x09t \x09\x09\x09\x09\x09\x09\x09\x09 '%s%s%s%s%s%i%s' , \x09\x09\x09\x09\x09\x09\x09\x09 t \x09 \x09\x09\x09\x09\x09\x09\x09\x09 'nt',\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 t\x09 \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09'dll::NtC',t \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 'reat', \x09\x09\x09\x09\x09\x09\x09 t \x09\x09\x09\x09\x09\x09\x09\x09\x09'NtCreateSection',t'ion(p \x09\x09\x09\x09\x09\x09\x09\x09\x09 r2,i ', \x09\x09\x09\x09\x09\x09\x09\x09\x09i \x09\x09\x09\x09\x09\x09\x09\x09\x09\x090xE,t \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 ',n,')" [0075.411] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.411] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0075.411] lstrcpynA (in: lpString1=0x40a838, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" [0075.411] lstrcpynA (in: lpString1=0x40a438, lpString2="Call", iMaxLength=1024 | out: lpString1="Call") returned="Call" [0075.411] GetModuleHandleA (lpModuleName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned 0x753e0000 [0075.411] GetProcAddress (hModule=0x753e0000, lpProcName="Call") returned 0x753e16db [0075.411] lstrcpyA (in: lpString1=0x586198, lpString2="user32" | out: lpString1="user32") returned="user32" [0075.411] lstrcpyA (in: lpString1=0x5865a8, lpString2="user32" | out: lpString1="user32") returned="user32" [0075.411] lstrcpyA (in: lpString1=0x5869a8, lpString2="wsprintf" | out: lpString1="wsprintf") returned="wsprintf" [0075.411] lstrcpynA (in: lpString1=0x587a50, lpString2="%s%s%s%s%s%i%s", iMaxLength=1024 | out: lpString1="%s%s%s%s%s%i%s") returned="%s%s%s%s%s%i%s" [0075.411] lstrcpynA (in: lpString1=0x587e58, lpString2="nt", iMaxLength=1024 | out: lpString1="nt") returned="nt" [0075.411] lstrcpynA (in: lpString1=0x588260, lpString2="dll::NtC", iMaxLength=1024 | out: lpString1="dll::NtC") returned="dll::NtC" [0075.411] lstrcpynA (in: lpString1=0x588668, lpString2="reat", iMaxLength=1024 | out: lpString1="reat") returned="reat" [0075.412] lstrcpynA (in: lpString1=0x588a70, lpString2="NtCreateSection", iMaxLength=1024 | out: lpString1="NtCreateSection") returned="NtCreateSection" [0075.412] lstrcpynA (in: lpString1=0x588e78, lpString2="ion(p \x09\x09\x09\x09\x09\x09\x09\x09\x09 r2,i ", iMaxLength=1024 | out: lpString1="ion(p \x09\x09\x09\x09\x09\x09\x09\x09\x09 r2,i ") returned="ion(p \x09\x09\x09\x09\x09\x09\x09\x09\x09 r2,i " [0075.412] lstrcpynA (in: lpString1=0x589688, lpString2=",n,", iMaxLength=1024 | out: lpString1=",n,") returned=",n," [0075.412] GetModuleHandleA (lpModuleName="user32") returned 0x77130000 [0075.412] GetProcAddress (hModule=0x77130000, lpProcName="wsprintf") returned 0x0 [0075.412] lstrlenA (lpString="wsprintf") returned 8 [0075.412] GetProcAddress (hModule=0x77130000, lpProcName="wsprintfA") returned 0x7715ae5f [0075.412] lstrcpynA (in: lpString1=0x581468, lpString2="5729504", iMaxLength=1024 | out: lpString1="5729504") returned="5729504" [0075.412] lstrcpynA (in: lpString1=0x581468, lpString2="%s%s%s%s%s%i%s", iMaxLength=1024 | out: lpString1="%s%s%s%s%s%i%s") returned="%s%s%s%s%s%i%s" [0075.412] lstrcpynA (in: lpString1=0x587a50, lpString2="nt", iMaxLength=1024 | out: lpString1="nt") returned="nt" [0075.413] lstrcpynA (in: lpString1=0x587e58, lpString2="dll::NtC", iMaxLength=1024 | out: lpString1="dll::NtC") returned="dll::NtC" [0075.413] lstrcpynA (in: lpString1=0x588260, lpString2="reat", iMaxLength=1024 | out: lpString1="reat") returned="reat" [0075.413] lstrcpynA (in: lpString1=0x588668, lpString2="NtCreateSection", iMaxLength=1024 | out: lpString1="NtCreateSection") returned="NtCreateSection" [0075.413] lstrcpynA (in: lpString1=0x588a70, lpString2="ion(p \x09\x09\x09\x09\x09\x09\x09\x09\x09 r2,i ", iMaxLength=1024 | out: lpString1="ion(p \x09\x09\x09\x09\x09\x09\x09\x09\x09 r2,i ") returned="ion(p \x09\x09\x09\x09\x09\x09\x09\x09\x09 r2,i " [0075.413] lstrcpynA (in: lpString1=0x589a90, lpString2=",n,", iMaxLength=1024 | out: lpString1=",n,") returned=",n," [0075.413] lstrcpynA (in: lpString1=0x585d90, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0075.413] wsprintfA (in: param_1=0x576ce0, param_2="%s%s%s%s%s%i%s" | out: param_1="ntdll::NtCreatNtCreateSectionion(p \x09\x09\x09\x09\x09\x09\x09\x09\x09 r2,i 14,n,") returned 55 [0075.413] lstrcpynA (in: lpString1=0x585d90, lpString2=",n,", iMaxLength=1024 | out: lpString1=",n,") returned=",n," [0075.413] wsprintfA (in: param_1=0x585d90, param_2="%d" | out: param_1="14") returned 2 [0075.413] lstrcpynA (in: lpString1=0x585d90, lpString2="ion(p \x09\x09\x09\x09\x09\x09\x09\x09\x09 r2,i ", iMaxLength=1024 | out: lpString1="ion(p \x09\x09\x09\x09\x09\x09\x09\x09\x09 r2,i ") returned="ion(p \x09\x09\x09\x09\x09\x09\x09\x09\x09 r2,i " [0075.413] lstrcpynA (in: lpString1=0x585d90, lpString2="NtCreateSection", iMaxLength=1024 | out: lpString1="NtCreateSection") returned="NtCreateSection" [0075.413] lstrcpynA (in: lpString1=0x585d90, lpString2="reat", iMaxLength=1024 | out: lpString1="reat") returned="reat" [0075.413] lstrcpynA (in: lpString1=0x585d90, lpString2="dll::NtC", iMaxLength=1024 | out: lpString1="dll::NtC") returned="dll::NtC" [0075.414] lstrcpynA (in: lpString1=0x585d90, lpString2="nt", iMaxLength=1024 | out: lpString1="nt") returned="nt" [0075.414] lstrcpynA (in: lpString1=0x585d90, lpString2="%s%s%s%s%s%i%s", iMaxLength=1024 | out: lpString1="%s%s%s%s%s%i%s") returned="%s%s%s%s%s%i%s" [0075.414] wsprintfA (in: param_1=0x585d90, param_2="%d" | out: param_1="5729504") returned 7 [0075.414] FreeLibrary (hLibModule=0x581468) returned 0 [0075.414] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.414] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0075.414] lstrcpynA (in: lpString1=0x40ac38, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.414] lstrcpynA (in: lpString1=0x40b038, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0075.414] lstrcmpiA (lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", lpString2="") returned 1 [0075.414] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.414] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0075.414] lstrcpynA (in: lpString1=0x40b038, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" [0075.414] lstrcpynA (in: lpString1=0x40a438, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" [0075.414] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsde08f.tmp\\system.dll")) returned 0x2020 [0075.414] CreateFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsde08f.tmp\\system.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xffffffff [0075.415] lstrcpynA (in: lpString1=0x42e3c1, lpString2="5729504", iMaxLength=1024 | out: lpString1="5729504") returned="5729504" [0075.415] lstrlenA (lpString="5729504") returned 7 [0075.415] lstrcpynA (in: lpString1=0x42e3cf, lpString2="NtCreateSection", iMaxLength=1024 | out: lpString1="NtCreateSection") returned="NtCreateSection" [0075.415] lstrlenA (lpString="NtCreateSection") returned 15 [0075.415] lstrcpynA (in: lpString1=0x58146c, lpString2="*5729504ntdll::NtCreateSectiont255 \x09\x09\x09\x09\x09\x09\x09\x09 .r5)", iMaxLength=1024 | out: lpString1="*5729504ntdll::NtCreateSectiont255 \x09\x09\x09\x09\x09\x09\x09\x09 .r5)") returned="*5729504ntdll::NtCreateSectiont255 \x09\x09\x09\x09\x09\x09\x09\x09 .r5)" [0075.415] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.415] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0075.415] lstrcpynA (in: lpString1=0x40a838, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" [0075.415] lstrcpynA (in: lpString1=0x40a438, lpString2="Call", iMaxLength=1024 | out: lpString1="Call") returned="Call" [0075.415] GetModuleHandleA (lpModuleName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned 0x753e0000 [0075.415] GetProcAddress (hModule=0x753e0000, lpProcName="Call") returned 0x753e16db [0075.415] lstrcpyA (in: lpString1=0x586198, lpString2="5729504ntdll" | out: lpString1="5729504ntdll") returned="5729504ntdll" [0075.415] lstrcpyA (in: lpString1=0x5865a8, lpString2="5729504ntdll" | out: lpString1="5729504ntdll") returned="5729504ntdll" [0075.415] lstrcpyA (in: lpString1=0x5869a8, lpString2="NtCreateSectiont255 \x09\x09\x09\x09\x09\x09\x09\x09 .r5" | out: lpString1="NtCreateSectiont255 \x09\x09\x09\x09\x09\x09\x09\x09 .r5") returned="NtCreateSectiont255 \x09\x09\x09\x09\x09\x09\x09\x09 .r5" [0075.416] GetModuleHandleA (lpModuleName="5729504ntdll") returned 0x0 [0075.416] LoadLibraryA (lpLibFileName="5729504ntdll") returned 0x0 [0075.418] lstrcpynA (in: lpString1=0x581468, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0075.418] lstrcpyA (in: lpString1=0x18fb64, lpString2="error" | out: lpString1="error") returned="error" [0075.418] lstrcpynA (in: lpString1=0x581468, lpString2="error", iMaxLength=1024 | out: lpString1="error") returned="error" [0075.418] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.418] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0075.418] lstrcpynA (in: lpString1=0x40ac38, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.418] lstrcpynA (in: lpString1=0x40b038, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0075.418] lstrcmpiA (lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", lpString2="") returned 1 [0075.418] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.418] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0075.418] lstrcpynA (in: lpString1=0x40b038, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" [0075.418] lstrcpynA (in: lpString1=0x40a438, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" [0075.418] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsde08f.tmp\\system.dll")) returned 0x2020 [0075.418] CreateFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsde08f.tmp\\system.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xffffffff [0075.418] lstrcpynA (in: lpString1=0x42e3c7, lpString2="NtCreateSection", iMaxLength=1024 | out: lpString1="NtCreateSection") returned="NtCreateSection" [0075.419] lstrlenA (lpString="NtCreateSection") returned 15 [0075.419] lstrcpynA (in: lpString1=0x58146c, lpString2="ntdll::NtCreateSection(p \x09\x09r2, \x09\x09\x09i\x09\x09\x0914, \x09\x09\x09\x09n, \x09\x09p \x09\x09\x09r1, \x09\x09\x09\x09\x09 i \x09\x09 0x40, \x09 i \x09 0x8000000, \x09\x09\x09 n)", iMaxLength=1024 | out: lpString1="ntdll::NtCreateSection(p \x09\x09r2, \x09\x09\x09i\x09\x09\x0914, \x09\x09\x09\x09n, \x09\x09p \x09\x09\x09r1, \x09\x09\x09\x09\x09 i \x09\x09 0x40, \x09 i \x09 0x8000000, \x09\x09\x09 n)") returned="ntdll::NtCreateSection(p \x09\x09r2, \x09\x09\x09i\x09\x09\x0914, \x09\x09\x09\x09n, \x09\x09p \x09\x09\x09r1, \x09\x09\x09\x09\x09 i \x09\x09 0x40, \x09 i \x09 0x8000000, \x09\x09\x09 n)" [0075.419] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.419] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0075.419] lstrcpynA (in: lpString1=0x40a838, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" [0075.419] lstrcpynA (in: lpString1=0x40a438, lpString2="Call", iMaxLength=1024 | out: lpString1="Call") returned="Call" [0075.419] GetModuleHandleA (lpModuleName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned 0x753e0000 [0075.419] GetProcAddress (hModule=0x753e0000, lpProcName="Call") returned 0x753e16db [0075.419] lstrcpyA (in: lpString1=0x586198, lpString2="ntdll" | out: lpString1="ntdll") returned="ntdll" [0075.419] lstrcpyA (in: lpString1=0x5865a8, lpString2="ntdll" | out: lpString1="ntdll") returned="ntdll" [0075.419] lstrcpyA (in: lpString1=0x5869a8, lpString2="NtCreateSection" | out: lpString1="NtCreateSection") returned="NtCreateSection" [0075.420] GetModuleHandleA (lpModuleName="ntdll") returned 0x77c40000 [0075.420] GetProcAddress (hModule=0x77c40000, lpProcName="NtCreateSection") returned 0x77c5ff94 [0075.420] lstrcpynA (in: lpString1=0x581468, lpString2="5708688", iMaxLength=1024 | out: lpString1="5708688") returned="5708688" [0075.420] lstrcpynA (in: lpString1=0x587a50, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0075.420] lstrcpynA (in: lpString1=0x587a50, lpString2="5708704", iMaxLength=1024 | out: lpString1="5708704") returned="5708704" [0075.420] lstrcpynA (in: lpString1=0x581468, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0075.420] lstrcpynA (in: lpString1=0x581468, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0075.420] NtCreateSection (in: SectionHandle=0x571b90, DesiredAccess=0xe, ObjectAttributes=0x0, MaximumSize=0x571ba0, SectionPageProtection=0x40, AllocationAttributes=0x8000000, FileHandle=0x0 | out: SectionHandle=0x571b90*=0x160) returned 0x0 [0075.421] wsprintfA (in: param_1=0x581468, param_2="%d" | out: param_1="134217728") returned 9 [0075.421] wsprintfA (in: param_1=0x581468, param_2="%d" | out: param_1="64") returned 2 [0075.421] wsprintfA (in: param_1=0x581468, param_2="%d" | out: param_1="5708704") returned 7 [0075.421] wsprintfA (in: param_1=0x581468, param_2="%d" | out: param_1="14") returned 2 [0075.421] wsprintfA (in: param_1=0x581468, param_2="%d" | out: param_1="5708688") returned 7 [0075.421] lstrcpynA (in: lpString1=0x40a438, lpString2="(p", iMaxLength=1024 | out: lpString1="(p") returned="(p" [0075.421] lstrlenA (lpString="(p") returned 2 [0075.421] lstrcpynA (in: lpString1=0x431c00, lpString2="(p", iMaxLength=1024 | out: lpString1="(p") returned="(p" [0075.421] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.421] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0075.421] lstrcpynA (in: lpString1=0x40ac38, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.421] lstrcpynA (in: lpString1=0x40b038, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0075.421] lstrcmpiA (lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", lpString2="") returned 1 [0075.421] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.421] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0075.421] lstrcpynA (in: lpString1=0x40b038, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" [0075.421] lstrcpynA (in: lpString1=0x40a438, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" [0075.421] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsde08f.tmp\\system.dll")) returned 0x2020 [0075.422] CreateFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsde08f.tmp\\system.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xffffffff [0075.422] lstrcpynA (in: lpString1=0x58146c, lpString2="*(p \x09\x09 \x09\x09\x09\x09\x09\x09\x09\x09\x09 0) \x09 \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 p \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 .r3", iMaxLength=1024 | out: lpString1="*(p \x09\x09 \x09\x09\x09\x09\x09\x09\x09\x09\x09 0) \x09 \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 p \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 .r3") returned="*(p \x09\x09 \x09\x09\x09\x09\x09\x09\x09\x09\x09 0) \x09 \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 p \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 .r3" [0075.422] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.422] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0075.422] lstrcpynA (in: lpString1=0x40a838, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" [0075.422] lstrcpynA (in: lpString1=0x40a438, lpString2="Call", iMaxLength=1024 | out: lpString1="Call") returned="Call" [0075.422] GetModuleHandleA (lpModuleName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned 0x753e0000 [0075.422] GetProcAddress (hModule=0x753e0000, lpProcName="Call") returned 0x753e16db [0075.422] lstrcpyA (in: lpString1=0x5869a8, lpString2="" | out: lpString1="") returned="" [0075.423] lstrcpynA (in: lpString1=0x581468, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0075.423] wsprintfA (in: param_1=0x581468, param_2="%d" | out: param_1="0") returned 1 [0075.423] wsprintfA (in: param_1=0x581468, param_2="%d" | out: param_1="5708720") returned 7 [0075.423] lstrcpyA (in: lpString1=0x430c00, lpString2="5708720" | out: lpString1="5708720") returned="5708720" [0075.423] lstrcpynA (in: lpString1=0x40a438, lpString2="(", iMaxLength=1024 | out: lpString1="(") returned="(" [0075.423] lstrlenA (lpString="(") returned 1 [0075.423] lstrcpynA (in: lpString1=0x432400, lpString2="(", iMaxLength=1024 | out: lpString1="(") returned="(" [0075.423] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.423] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0075.423] lstrcpynA (in: lpString1=0x40ac38, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.423] lstrcpynA (in: lpString1=0x40b038, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0075.423] lstrcmpiA (lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", lpString2="") returned 1 [0075.423] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.423] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0075.423] lstrcpynA (in: lpString1=0x40b038, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" [0075.423] lstrcpynA (in: lpString1=0x40a438, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" [0075.423] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsde08f.tmp\\system.dll")) returned 0x2020 [0075.424] CreateFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsde08f.tmp\\system.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xffffffff [0075.424] lstrcpynA (in: lpString1=0x58146c, lpString2="*(i \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 0) \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 \x09p \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09.r4", iMaxLength=1024 | out: lpString1="*(i \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 0) \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 \x09p \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09.r4") returned="*(i \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 0) \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 \x09p \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09.r4" [0075.424] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.424] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0075.424] lstrcpynA (in: lpString1=0x40a838, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" [0075.424] lstrcpynA (in: lpString1=0x40a438, lpString2="Call", iMaxLength=1024 | out: lpString1="Call") returned="Call" [0075.424] GetModuleHandleA (lpModuleName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned 0x753e0000 [0075.424] GetProcAddress (hModule=0x753e0000, lpProcName="Call") returned 0x753e16db [0075.424] lstrcpyA (in: lpString1=0x5869a8, lpString2="" | out: lpString1="") returned="" [0075.425] lstrcpynA (in: lpString1=0x581468, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0075.425] wsprintfA (in: param_1=0x581468, param_2="%d" | out: param_1="0") returned 1 [0075.425] wsprintfA (in: param_1=0x581468, param_2="%d" | out: param_1="5708736") returned 7 [0075.425] lstrcpyA (in: lpString1=0x431000, lpString2="5708736" | out: lpString1="5708736") returned="5708736" [0075.425] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.425] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0075.425] lstrcpynA (in: lpString1=0x40ac38, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.425] lstrcpynA (in: lpString1=0x40b038, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0075.425] lstrcmpiA (lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", lpString2="") returned 1 [0075.425] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.425] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0075.425] lstrcpynA (in: lpString1=0x40b038, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" [0075.425] lstrcpynA (in: lpString1=0x40a438, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" [0075.425] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsde08f.tmp\\system.dll")) returned 0x2020 [0075.426] CreateFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsde08f.tmp\\system.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xffffffff [0075.426] lstrcpynA (in: lpString1=0x42e3c1, lpString2="5708688", iMaxLength=1024 | out: lpString1="5708688") returned="5708688" [0075.426] lstrlenA (lpString="5708688") returned 7 [0075.426] lstrcpynA (in: lpString1=0x58146c, lpString2="*5708688(p \x09\x09\x09 .r2)", iMaxLength=1024 | out: lpString1="*5708688(p \x09\x09\x09 .r2)") returned="*5708688(p \x09\x09\x09 .r2)" [0075.426] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.426] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0075.426] lstrcpynA (in: lpString1=0x40a838, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" [0075.426] lstrcpynA (in: lpString1=0x40a438, lpString2="Call", iMaxLength=1024 | out: lpString1="Call") returned="Call" [0075.427] GetModuleHandleA (lpModuleName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned 0x753e0000 [0075.427] GetProcAddress (hModule=0x753e0000, lpProcName="Call") returned 0x753e16db [0075.427] lstrcpyA (in: lpString1=0x5869a8, lpString2="5708688" | out: lpString1="5708688") returned="5708688" [0075.427] lstrcpynA (in: lpString1=0x581468, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0075.427] lstrcpynA (in: lpString1=0x581468, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0075.427] wsprintfA (in: param_1=0x581468, param_2="%d" | out: param_1="352") returned 3 [0075.427] lstrcpyA (in: lpString1=0x430800, lpString2="352" | out: lpString1="352") returned="352" [0075.427] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.427] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0075.427] lstrcpynA (in: lpString1=0x40ac38, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.427] lstrcpynA (in: lpString1=0x40b038, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0075.427] lstrcmpiA (lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", lpString2="") returned 1 [0075.428] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.428] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0075.428] lstrcpynA (in: lpString1=0x40b038, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" [0075.428] lstrcpynA (in: lpString1=0x40a438, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" [0075.428] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsde08f.tmp\\system.dll")) returned 0x2020 [0075.428] CreateFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsde08f.tmp\\system.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xffffffff [0075.428] lstrcpynA (in: lpString1=0x42e3c1, lpString2="352", iMaxLength=1024 | out: lpString1="352") returned="352" [0075.428] lstrlenA (lpString="352") returned 3 [0075.428] lstrcpynA (in: lpString1=0x58146c, lpString2="*352t255) \x09\x09\x09 p \x09 \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 .r5", iMaxLength=1024 | out: lpString1="*352t255) \x09\x09\x09 p \x09 \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 .r5") returned="*352t255) \x09\x09\x09 p \x09 \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 .r5" [0075.428] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.428] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0075.428] lstrcpynA (in: lpString1=0x40a838, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" [0075.428] lstrcpynA (in: lpString1=0x40a438, lpString2="Call", iMaxLength=1024 | out: lpString1="Call") returned="Call" [0075.429] GetModuleHandleA (lpModuleName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned 0x753e0000 [0075.429] GetProcAddress (hModule=0x753e0000, lpProcName="Call") returned 0x753e16db [0075.429] lstrcpyA (in: lpString1=0x5869a8, lpString2="352t255" | out: lpString1="352t255") returned="352t255" [0075.429] lstrcpynA (in: lpString1=0x581468, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0075.429] GlobalSize (hMem=0x160) returned 0x0 [0075.466] wsprintfA (in: param_1=0x581468, param_2="%d" | out: param_1="352") returned 3 [0075.466] lstrcpyA (in: lpString1=0x431400, lpString2="352" | out: lpString1="352") returned="352" [0075.466] lstrcpynA (in: lpString1=0x40a438, lpString2="OfSection", iMaxLength=1024 | out: lpString1="OfSection") returned="OfSection" [0075.466] lstrlenA (lpString="OfSection") returned 9 [0075.466] lstrcpynA (in: lpString1=0x431800, lpString2="OfSection", iMaxLength=1024 | out: lpString1="OfSection") returned="OfSection" [0075.466] lstrcpynA (in: lpString1=0x40a438, lpString2="ntdll::NtMapViewOfSection", iMaxLength=1024 | out: lpString1="ntdll::NtMapViewOfSection") returned="ntdll::NtMapViewOfSection" [0075.466] lstrlenA (lpString="ntdll::NtMapViewOfSection") returned 25 [0075.466] lstrcpynA (in: lpString1=0x431800, lpString2="ntdll::NtMapViewOfSection", iMaxLength=1024 | out: lpString1="ntdll::NtMapViewOfSection") returned="ntdll::NtMapViewOfSection" [0075.466] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.467] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0075.467] lstrcpynA (in: lpString1=0x40ac38, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.467] lstrcpynA (in: lpString1=0x40b038, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0075.467] lstrcmpiA (lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", lpString2="") returned 1 [0075.467] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.467] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0075.467] lstrcpynA (in: lpString1=0x40b038, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" [0075.467] lstrcpynA (in: lpString1=0x40a438, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" [0075.467] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsde08f.tmp\\system.dll")) returned 0x2020 [0075.467] CreateFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsde08f.tmp\\system.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xffffffff [0075.467] lstrcpynA (in: lpString1=0x58146c, lpString2="ntdll::NtMapViewOfSection(p \x09\x09\x09\x09\x09\x09 r2, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 \x09\x09 i\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 -1, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09p \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 r3, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09p \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x090, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 p \x09\x09\x09\x09\x09\x09\x09\x09\x09\x090, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09p\x09\x09\x09\x09\x09\x09\x09 0, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 p \x09\x09\x09\x09\x09\x09\x09\x09\x09 r4, \x09\x09\x09\x09\x09\x09\x09\x09\x09 i \x09\x092, \x09\x09\x09 p \x09\x09\x09\x09\x09\x09\x09 0, \x09\x09\x09\x09\x09\x09\x09\x09 i \x09\x09\x09\x09\x09\x09\x09 0x40)", iMaxLength=1024 | out: lpString1="ntdll::NtMapViewOfSection(p \x09\x09\x09\x09\x09\x09 r2, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 \x09\x09 i\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 -1, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09p \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 r3, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09p \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x090, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 p \x09\x09\x09\x09\x09\x09\x09\x09\x09\x090, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09p\x09\x09\x09\x09\x09\x09\x09 0, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 p \x09\x09\x09\x09\x09\x09\x09\x09\x09 r4, \x09\x09\x09\x09\x09\x09\x09\x09\x09 i \x09\x092, \x09\x09\x09 p \x09\x09\x09\x09\x09\x09\x09 0, \x09\x09\x09\x09\x09\x09\x09\x09 i \x09\x09\x09\x09\x09\x09\x09 0x40)") returned="ntdll::NtMapViewOfSection(p \x09\x09\x09\x09\x09\x09 r2, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 \x09\x09 i\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 -1, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09p \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 r3, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09p \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x090, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 p \x09\x09\x09\x09\x09\x09\x09\x09\x09\x090, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09p\x09\x09\x09\x09\x09\x09\x09 0, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 p \x09\x09\x09\x09\x09\x09\x09\x09\x09 r4, \x09\x09\x09\x09\x09\x09\x09\x09\x09 i \x09\x092, \x09\x09\x09 p \x09\x09\x09\x09\x09\x09\x09 0, \x09\x09\x09\x09\x09\x09\x09\x09 i \x09\x09\x09\x09\x09\x09\x09 0x40)" [0075.467] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.467] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0075.468] lstrcpynA (in: lpString1=0x40a838, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" [0075.468] lstrcpynA (in: lpString1=0x40a438, lpString2="Call", iMaxLength=1024 | out: lpString1="Call") returned="Call" [0075.468] GetModuleHandleA (lpModuleName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned 0x753e0000 [0075.468] GetProcAddress (hModule=0x753e0000, lpProcName="Call") returned 0x753e16db [0075.468] lstrcpyA (in: lpString1=0x586198, lpString2="ntdll" | out: lpString1="ntdll") returned="ntdll" [0075.468] lstrcpyA (in: lpString1=0x5865a8, lpString2="ntdll" | out: lpString1="ntdll") returned="ntdll" [0075.468] lstrcpyA (in: lpString1=0x5869a8, lpString2="NtMapViewOfSection" | out: lpString1="NtMapViewOfSection") returned="NtMapViewOfSection" [0075.469] GetModuleHandleA (lpModuleName="ntdll") returned 0x77c40000 [0075.469] GetProcAddress (hModule=0x77c40000, lpProcName="NtMapViewOfSection") returned 0x77c5fc40 [0075.469] lstrcpynA (in: lpString1=0x581468, lpString2="352", iMaxLength=1024 | out: lpString1="352") returned="352" [0075.469] lstrcpynA (in: lpString1=0x587a50, lpString2="5708720", iMaxLength=1024 | out: lpString1="5708720") returned="5708720" [0075.469] lstrcpynA (in: lpString1=0x581468, lpString2="5708736", iMaxLength=1024 | out: lpString1="5708736") returned="5708736" [0075.470] lstrcpynA (in: lpString1=0x581468, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0075.470] NtMapViewOfSection (in: SectionHandle=0x160, ProcessHandle=0xffffffff, BaseAddress=0x571bb0*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x571bc0*=0x0, InheritDisposition=0x2, AllocationType=0x0, AccessProtection=0x40 | out: BaseAddress=0x571bb0*=0x360000, SectionOffset=0x0, ViewSize=0x571bc0*=0xf000) returned 0x0 [0075.471] wsprintfA (in: param_1=0x581468, param_2="%d" | out: param_1="64") returned 2 [0075.471] wsprintfA (in: param_1=0x581468, param_2="%d" | out: param_1="0") returned 1 [0075.471] wsprintfA (in: param_1=0x581468, param_2="%d" | out: param_1="2") returned 1 [0075.471] wsprintfA (in: param_1=0x581468, param_2="%d" | out: param_1="5708736") returned 7 [0075.471] wsprintfA (in: param_1=0x581468, param_2="%d" | out: param_1="0") returned 1 [0075.471] wsprintfA (in: param_1=0x581468, param_2="%d" | out: param_1="0") returned 1 [0075.471] wsprintfA (in: param_1=0x581468, param_2="%d" | out: param_1="0") returned 1 [0075.471] wsprintfA (in: param_1=0x581468, param_2="%d" | out: param_1="5708720") returned 7 [0075.471] wsprintfA (in: param_1=0x581468, param_2="%d" | out: param_1="-1") returned 2 [0075.471] wsprintfA (in: param_1=0x581468, param_2="%d" | out: param_1="352") returned 3 [0075.471] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.471] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0075.471] lstrcpynA (in: lpString1=0x40ac38, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.471] lstrcpynA (in: lpString1=0x40b038, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0075.471] lstrcmpiA (lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", lpString2="") returned 1 [0075.471] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.471] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0075.471] lstrcpynA (in: lpString1=0x40b038, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" [0075.471] lstrcpynA (in: lpString1=0x40a438, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" [0075.472] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsde08f.tmp\\system.dll")) returned 0x2020 [0075.472] CreateFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsde08f.tmp\\system.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xffffffff [0075.472] lstrcpynA (in: lpString1=0x42e3c1, lpString2="5708720", iMaxLength=1024 | out: lpString1="5708720") returned="5708720" [0075.472] lstrlenA (lpString="5708720") returned 7 [0075.472] lstrcpynA (in: lpString1=0x58146c, lpString2="*5708720\x09\x09\x09\x09\x09\x09\x09\x09\x09 (p \x09\x09\x09\x09\x09\x09\x09\x09 .r11)", iMaxLength=1024 | out: lpString1="*5708720\x09\x09\x09\x09\x09\x09\x09\x09\x09 (p \x09\x09\x09\x09\x09\x09\x09\x09 .r11)") returned="*5708720\x09\x09\x09\x09\x09\x09\x09\x09\x09 (p \x09\x09\x09\x09\x09\x09\x09\x09 .r11)" [0075.472] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.472] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0075.472] lstrcpynA (in: lpString1=0x40a838, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" [0075.472] lstrcpynA (in: lpString1=0x40a438, lpString2="Call", iMaxLength=1024 | out: lpString1="Call") returned="Call" [0075.472] GetModuleHandleA (lpModuleName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned 0x753e0000 [0075.473] GetProcAddress (hModule=0x753e0000, lpProcName="Call") returned 0x753e16db [0075.473] lstrcpyA (in: lpString1=0x5869a8, lpString2="5708720\x09\x09\x09\x09\x09\x09\x09\x09\x09 " | out: lpString1="5708720\x09\x09\x09\x09\x09\x09\x09\x09\x09 ") returned="5708720\x09\x09\x09\x09\x09\x09\x09\x09\x09 " [0075.473] lstrcpynA (in: lpString1=0x581468, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0075.473] lstrcpynA (in: lpString1=0x581468, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0075.473] wsprintfA (in: param_1=0x581468, param_2="%d" | out: param_1="3538944") returned 7 [0075.473] lstrcpyA (in: lpString1=0x432c00, lpString2="3538944" | out: lpString1="3538944") returned="3538944" [0075.473] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.473] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0075.473] lstrcpynA (in: lpString1=0x40ac38, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.474] lstrcpynA (in: lpString1=0x40b038, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0075.474] lstrcmpiA (lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", lpString2="") returned 1 [0075.474] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.474] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0075.474] lstrcpynA (in: lpString1=0x40b038, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" [0075.474] lstrcpynA (in: lpString1=0x40a438, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" [0075.474] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsde08f.tmp\\system.dll")) returned 0x2020 [0075.474] CreateFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsde08f.tmp\\system.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xffffffff [0075.474] lstrcpynA (in: lpString1=0x58146c, lpString2="kernel32::ReadFile(i \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 r10, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 p \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 r11, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 i \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 61042, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 \x09\x09\x09\x09\x09\x09\x09\x09 t., \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 n)", iMaxLength=1024 | out: lpString1="kernel32::ReadFile(i \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 r10, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 p \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 r11, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 i \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 61042, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 \x09\x09\x09\x09\x09\x09\x09\x09 t., \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 n)") returned="kernel32::ReadFile(i \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 r10, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 p \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 r11, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 i \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 61042, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 \x09\x09\x09\x09\x09\x09\x09\x09 t., \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 n)" [0075.474] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.474] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0075.474] lstrcpynA (in: lpString1=0x40a838, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" [0075.474] lstrcpynA (in: lpString1=0x40a438, lpString2="Call", iMaxLength=1024 | out: lpString1="Call") returned="Call" [0075.475] GetModuleHandleA (lpModuleName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned 0x753e0000 [0075.475] GetProcAddress (hModule=0x753e0000, lpProcName="Call") returned 0x753e16db [0075.475] lstrcpyA (in: lpString1=0x586198, lpString2="kernel32" | out: lpString1="kernel32") returned="kernel32" [0075.475] lstrcpyA (in: lpString1=0x5865a8, lpString2="kernel32" | out: lpString1="kernel32") returned="kernel32" [0075.475] lstrcpyA (in: lpString1=0x5869a8, lpString2="ReadFile" | out: lpString1="ReadFile") returned="ReadFile" [0075.475] GetModuleHandleA (lpModuleName="kernel32") returned 0x76d30000 [0075.475] GetProcAddress (hModule=0x76d30000, lpProcName="ReadFile") returned 0x76d43ed3 [0075.475] lstrlenA (lpString="ReadFile") returned 8 [0075.476] GetProcAddress (hModule=0x76d30000, lpProcName="ReadFileA") returned 0x0 [0075.476] lstrcpynA (in: lpString1=0x581468, lpString2="348", iMaxLength=1024 | out: lpString1="348") returned="348" [0075.476] lstrcpynA (in: lpString1=0x581468, lpString2="3538944", iMaxLength=1024 | out: lpString1="3538944") returned="3538944" [0075.476] lstrcpynA (in: lpString1=0x581468, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0075.476] lstrcpynA (in: lpString1=0x585d90, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0075.476] lstrcpynA (in: lpString1=0x586198, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0075.476] lstrcpynA (in: lpString1=0x586198, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0075.476] ReadFile (in: hFile=0x15c, lpBuffer=0x360000, nNumberOfBytesToRead=0xee72, lpNumberOfBytesRead=0x585d90, lpOverlapped=0x0 | out: lpBuffer=0x360000*, lpNumberOfBytesRead=0x585d90*=0xee72, lpOverlapped=0x0) returned 1 [0075.477] lstrcpynA (in: lpString1=0x586198, lpString2="rî", iMaxLength=1024 | out: lpString1="rî") returned="rî" [0075.477] wsprintfA (in: param_1=0x586198, param_2="%d" | out: param_1="61042") returned 5 [0075.477] wsprintfA (in: param_1=0x586198, param_2="%d" | out: param_1="3538944") returned 7 [0075.477] wsprintfA (in: param_1=0x586198, param_2="%d" | out: param_1="348") returned 3 [0075.477] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.477] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0075.478] lstrcpynA (in: lpString1=0x40ac38, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.478] lstrcpynA (in: lpString1=0x40b038, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0075.478] lstrcmpiA (lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", lpString2="") returned 1 [0075.478] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.478] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0075.478] lstrcpynA (in: lpString1=0x40b038, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" [0075.478] lstrcpynA (in: lpString1=0x40a438, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" [0075.478] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsde08f.tmp\\system.dll")) returned 0x2020 [0075.478] CreateFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsde08f.tmp\\system.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xffffffff [0075.478] lstrcpynA (in: lpString1=0x58146c, lpString2="kernel32::CloseHandle(i \x09\x09\x09\x09\x09\x09 \x09 r10)", iMaxLength=1024 | out: lpString1="kernel32::CloseHandle(i \x09\x09\x09\x09\x09\x09 \x09 r10)") returned="kernel32::CloseHandle(i \x09\x09\x09\x09\x09\x09 \x09 r10)" [0075.478] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.478] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0075.478] lstrcpynA (in: lpString1=0x40a838, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" [0075.478] lstrcpynA (in: lpString1=0x40a438, lpString2="Call", iMaxLength=1024 | out: lpString1="Call") returned="Call" [0075.479] GetModuleHandleA (lpModuleName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned 0x753e0000 [0075.479] GetProcAddress (hModule=0x753e0000, lpProcName="Call") returned 0x753e16db [0075.479] lstrcpyA (in: lpString1=0x586198, lpString2="kernel32" | out: lpString1="kernel32") returned="kernel32" [0075.479] lstrcpyA (in: lpString1=0x5865a8, lpString2="kernel32" | out: lpString1="kernel32") returned="kernel32" [0075.479] lstrcpyA (in: lpString1=0x5869a8, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0075.479] GetModuleHandleA (lpModuleName="kernel32") returned 0x76d30000 [0075.479] GetProcAddress (hModule=0x76d30000, lpProcName="CloseHandle") returned 0x76d41410 [0075.479] lstrcpynA (in: lpString1=0x581468, lpString2="348", iMaxLength=1024 | out: lpString1="348") returned="348" [0075.479] lstrcpynA (in: lpString1=0x581468, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0075.480] CloseHandle (hObject=0x15c) returned 1 [0075.480] wsprintfA (in: param_1=0x581468, param_2="%d" | out: param_1="348") returned 3 [0075.480] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.480] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0075.480] lstrcpynA (in: lpString1=0x40ac38, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.480] lstrcpynA (in: lpString1=0x40b038, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0075.480] lstrcmpiA (lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", lpString2="") returned 1 [0075.480] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.480] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0075.480] lstrcpynA (in: lpString1=0x40b038, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" [0075.480] lstrcpynA (in: lpString1=0x40a438, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" [0075.480] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsde08f.tmp\\system.dll")) returned 0x2020 [0075.481] CreateFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsde08f.tmp\\system.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xffffffff [0075.481] lstrcpynA (in: lpString1=0x58146c, lpString2="47183", iMaxLength=1024 | out: lpString1="47183") returned="47183" [0075.481] lstrcpynA (in: lpString1=0x585d94, lpString2="+", iMaxLength=1024 | out: lpString1="+") returned="+" [0075.481] lstrcpynA (in: lpString1=0x42e3c0, lpString2="3538944", iMaxLength=1024 | out: lpString1="3538944") returned="3538944" [0075.481] lstrlenA (lpString="3538944") returned 7 [0075.481] lstrcpynA (in: lpString1=0x5861a4, lpString2="3538944", iMaxLength=1024 | out: lpString1="3538944") returned="3538944" [0075.481] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.481] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0075.481] lstrcpynA (in: lpString1=0x40a838, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" [0075.481] lstrcpynA (in: lpString1=0x40a438, lpString2="Int64Op", iMaxLength=1024 | out: lpString1="Int64Op") returned="Int64Op" [0075.481] GetModuleHandleA (lpModuleName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned 0x753e0000 [0075.481] GetProcAddress (hModule=0x753e0000, lpProcName="Int64Op") returned 0x753e1837 [0075.482] lstrcpynA (in: lpString1=0x58146c, lpString2="3586127", iMaxLength=1024 | out: lpString1="3586127") returned="3586127" [0075.482] lstrcpynA (in: lpString1=0x433000, lpString2="3586127", iMaxLength=1024 | out: lpString1="3586127") returned="3586127" [0075.482] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.482] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0075.482] lstrcpynA (in: lpString1=0x40ac38, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.482] lstrcpynA (in: lpString1=0x40b038, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0075.482] lstrcmpiA (lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", lpString2="") returned 1 [0075.482] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.482] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0075.482] lstrcpynA (in: lpString1=0x40b038, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" [0075.482] lstrcpynA (in: lpString1=0x40a438, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" [0075.482] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsde08f.tmp\\system.dll")) returned 0x2020 [0075.483] CreateFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsde08f.tmp\\system.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xffffffff [0075.483] lstrcpynA (in: lpString1=0x58146c, lpString2="2853", iMaxLength=1024 | out: lpString1="2853") returned="2853" [0075.483] lstrcpynA (in: lpString1=0x585d94, lpString2="+", iMaxLength=1024 | out: lpString1="+") returned="+" [0075.483] lstrcpynA (in: lpString1=0x42e3c0, lpString2="3538944", iMaxLength=1024 | out: lpString1="3538944") returned="3538944" [0075.483] lstrlenA (lpString="3538944") returned 7 [0075.483] lstrcpynA (in: lpString1=0x5861a4, lpString2="3538944", iMaxLength=1024 | out: lpString1="3538944") returned="3538944" [0075.483] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.483] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0075.483] lstrcpynA (in: lpString1=0x40a838, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" [0075.483] lstrcpynA (in: lpString1=0x40a438, lpString2="Int64Op", iMaxLength=1024 | out: lpString1="Int64Op") returned="Int64Op" [0075.483] GetModuleHandleA (lpModuleName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned 0x753e0000 [0075.483] GetProcAddress (hModule=0x753e0000, lpProcName="Int64Op") returned 0x753e1837 [0075.484] lstrcpynA (in: lpString1=0x58146c, lpString2="3541797", iMaxLength=1024 | out: lpString1="3541797") returned="3541797" [0075.484] lstrcpynA (in: lpString1=0x433400, lpString2="3541797", iMaxLength=1024 | out: lpString1="3541797") returned="3541797" [0075.484] lstrcpynA (in: lpString1=0x40a438, lpString2="(", iMaxLength=1024 | out: lpString1="(") returned="(" [0075.484] lstrlenA (lpString="(") returned 1 [0075.484] lstrcpynA (in: lpString1=0x431800, lpString2="(", iMaxLength=1024 | out: lpString1="(") returned="(" [0075.484] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.484] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0075.484] lstrcpynA (in: lpString1=0x40ac38, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.484] lstrcpynA (in: lpString1=0x40b038, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0075.484] lstrcmpiA (lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", lpString2="") returned 1 [0075.484] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.484] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0075.484] lstrcpynA (in: lpString1=0x40b038, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" [0075.484] lstrcpynA (in: lpString1=0x40a438, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" [0075.484] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsde08f.tmp\\system.dll")) returned 0x2020 [0075.485] CreateFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsde08f.tmp\\system.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xffffffff [0075.485] lstrcpynA (in: lpString1=0x58146c, lpString2="*(&t255) \x09\x09\x09\x09\x09\x09\x09\x09 p \x09\x09\x09\x09\x09\x09\x09.r5", iMaxLength=1024 | out: lpString1="*(&t255) \x09\x09\x09\x09\x09\x09\x09\x09 p \x09\x09\x09\x09\x09\x09\x09.r5") returned="*(&t255) \x09\x09\x09\x09\x09\x09\x09\x09 p \x09\x09\x09\x09\x09\x09\x09.r5" [0075.485] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.485] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0075.485] lstrcpynA (in: lpString1=0x40a838, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" [0075.485] lstrcpynA (in: lpString1=0x40a438, lpString2="Call", iMaxLength=1024 | out: lpString1="Call") returned="Call" [0075.485] GetModuleHandleA (lpModuleName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned 0x753e0000 [0075.485] GetProcAddress (hModule=0x753e0000, lpProcName="Call") returned 0x753e16db [0075.485] lstrcpyA (in: lpString1=0x5869a8, lpString2="" | out: lpString1="") returned="" [0075.486] lstrcpynA (in: lpString1=0x581468, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0075.486] lstrcpynA (in: lpString1=0x585d90, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0075.486] lstrcpynA (in: lpString1=0x586198, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0075.486] lstrcpynA (in: lpString1=0x581468, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0075.486] wsprintfA (in: param_1=0x581468, param_2="%d" | out: param_1="5792152") returned 7 [0075.486] lstrcpyA (in: lpString1=0x431400, lpString2="5792152" | out: lpString1="5792152") returned="5792152" [0075.486] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.486] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0075.486] lstrcpynA (in: lpString1=0x40ac38, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.486] lstrcpynA (in: lpString1=0x40b038, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0075.486] lstrcmpiA (lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", lpString2="") returned 1 [0075.486] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.486] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0075.486] lstrcpynA (in: lpString1=0x40b038, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" [0075.487] lstrcpynA (in: lpString1=0x40a438, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" [0075.487] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsde08f.tmp\\system.dll")) returned 0x2020 [0075.487] CreateFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsde08f.tmp\\system.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xffffffff [0075.487] lstrcpynA (in: lpString1=0x58146c, lpString2="user32::wsprintf(p \x09\x09\x09\x09 \x09\x09\x09\x09\x09\x09\x09\x09r5, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09t '::%d%s' , \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 \x09\x09\x09i \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 \x09\x09\x09\x09\x09 r12, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 \x09 t \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09'(')", iMaxLength=1024 | out: lpString1="user32::wsprintf(p \x09\x09\x09\x09 \x09\x09\x09\x09\x09\x09\x09\x09r5, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09t '::%d%s' , \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 \x09\x09\x09i \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 \x09\x09\x09\x09\x09 r12, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 \x09 t \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09'(')") returned="user32::wsprintf(p \x09\x09\x09\x09 \x09\x09\x09\x09\x09\x09\x09\x09r5, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09t '::%d%s' , \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 \x09\x09\x09i \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 \x09\x09\x09\x09\x09 r12, \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09 \x09 t \x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09'(')" [0075.487] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.487] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0075.487] lstrcpynA (in: lpString1=0x40a838, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" [0075.487] lstrcpynA (in: lpString1=0x40a438, lpString2="Call", iMaxLength=1024 | out: lpString1="Call") returned="Call" [0075.487] GetModuleHandleA (lpModuleName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned 0x753e0000 [0075.487] GetProcAddress (hModule=0x753e0000, lpProcName="Call") returned 0x753e16db [0075.488] lstrcpyA (in: lpString1=0x5862a0, lpString2="user32" | out: lpString1="user32") returned="user32" [0075.488] lstrcpyA (in: lpString1=0x5866b0, lpString2="user32" | out: lpString1="user32") returned="user32" [0075.488] lstrcpyA (in: lpString1=0x586ab0, lpString2="wsprintf" | out: lpString1="wsprintf") returned="wsprintf" [0075.488] lstrcpynA (in: lpString1=0x587b58, lpString2="::%d%s", iMaxLength=1024 | out: lpString1="::%d%s") returned="::%d%s" [0075.488] lstrcpynA (in: lpString1=0x587f60, lpString2="(", iMaxLength=1024 | out: lpString1="(") returned="(" [0075.488] GetModuleHandleA (lpModuleName="user32") returned 0x77130000 [0075.488] GetProcAddress (hModule=0x77130000, lpProcName="wsprintf") returned 0x0 [0075.489] lstrlenA (lpString="wsprintf") returned 8 [0075.489] GetProcAddress (hModule=0x77130000, lpProcName="wsprintfA") returned 0x7715ae5f [0075.489] lstrcpynA (in: lpString1=0x5862a0, lpString2="5792152", iMaxLength=1024 | out: lpString1="5792152") returned="5792152" [0075.489] lstrcpynA (in: lpString1=0x5862a0, lpString2="::%d%s", iMaxLength=1024 | out: lpString1="::%d%s") returned="::%d%s" [0075.490] lstrcpynA (in: lpString1=0x587b58, lpString2="3586127", iMaxLength=1024 | out: lpString1="3586127") returned="3586127" [0075.490] lstrcpynA (in: lpString1=0x587b58, lpString2="(", iMaxLength=1024 | out: lpString1="(") returned="(" [0075.490] lstrcpynA (in: lpString1=0x585d90, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0075.490] wsprintfA (in: param_1=0x586198, param_2="::%d%s" | out: param_1="::3586127(") returned 10 [0075.490] lstrcpynA (in: lpString1=0x585d90, lpString2="(", iMaxLength=1024 | out: lpString1="(") returned="(" [0075.490] wsprintfA (in: param_1=0x585d90, param_2="%d" | out: param_1="3586127") returned 7 [0075.490] lstrcpynA (in: lpString1=0x585d90, lpString2="::%d%s", iMaxLength=1024 | out: lpString1="::%d%s") returned="::%d%s" [0075.490] wsprintfA (in: param_1=0x585d90, param_2="%d" | out: param_1="5792152") returned 7 [0075.490] FreeLibrary (hLibModule=0x5862a0) returned 0 [0075.490] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.490] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0075.490] lstrcpynA (in: lpString1=0x40ac38, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.490] lstrcpynA (in: lpString1=0x40b038, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0075.490] lstrcmpiA (lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", lpString2="") returned 1 [0075.490] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.491] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0075.491] lstrcpynA (in: lpString1=0x40b038, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" [0075.491] lstrcpynA (in: lpString1=0x40a438, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" [0075.491] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsde08f.tmp\\system.dll")) returned 0x2020 [0075.491] CreateFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsde08f.tmp\\system.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xffffffff [0075.491] lstrcpynA (in: lpString1=0x42e3c1, lpString2="5792152", iMaxLength=1024 | out: lpString1="5792152") returned="5792152" [0075.491] lstrlenA (lpString="5792152") returned 7 [0075.491] lstrcpynA (in: lpString1=0x58146c, lpString2="*5792152(&t255 \x09\x09\x09\x09\x09\x09\x09.r5)", iMaxLength=1024 | out: lpString1="*5792152(&t255 \x09\x09\x09\x09\x09\x09\x09.r5)") returned="*5792152(&t255 \x09\x09\x09\x09\x09\x09\x09.r5)" [0075.491] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.491] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0075.491] lstrcpynA (in: lpString1=0x40a838, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" [0075.491] lstrcpynA (in: lpString1=0x40a438, lpString2="Call", iMaxLength=1024 | out: lpString1="Call") returned="Call" [0075.491] GetModuleHandleA (lpModuleName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned 0x753e0000 [0075.492] GetProcAddress (hModule=0x753e0000, lpProcName="Call") returned 0x753e16db [0075.492] lstrcpyA (in: lpString1=0x586ab0, lpString2="5792152" | out: lpString1="5792152") returned="5792152" [0075.492] lstrcpynA (in: lpString1=0x5862a0, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0075.492] lstrcpynA (in: lpString1=0x585d90, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0075.492] lstrcpynA (in: lpString1=0x5862a0, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0075.492] lstrcpynA (in: lpString1=0x5862a0, lpString2="::3586127(", iMaxLength=1024 | out: lpString1="::3586127(") returned="::3586127(" [0075.492] lstrcpyA (in: lpString1=0x431400, lpString2="::3586127(" | out: lpString1="::3586127(") returned="::3586127(" [0075.492] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.492] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0075.492] lstrcpynA (in: lpString1=0x40ac38, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.492] lstrcpynA (in: lpString1=0x40b038, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0075.493] lstrcmpiA (lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", lpString2="") returned 1 [0075.493] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.493] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0075.493] lstrcpynA (in: lpString1=0x40b038, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" [0075.493] lstrcpynA (in: lpString1=0x40a438, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" [0075.493] GetFileAttributesA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsde08f.tmp\\system.dll")) returned 0x2020 [0075.493] CreateFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\nsde08f.tmp\\system.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xffffffff [0075.493] lstrcpynA (in: lpString1=0x42e3c2, lpString2="3586127", iMaxLength=1024 | out: lpString1="3586127") returned="3586127" [0075.493] lstrlenA (lpString="3586127") returned 7 [0075.493] lstrcpynA (in: lpString1=0x58146c, lpString2="::3586127(p\x09\x09\x09\x09\x09\x09\x09\x09 r13,\x09\x09\x09\x09\x09\x09\x09 i \x09\x09\x09\x09\x09\x09\x09\x0942512)", iMaxLength=1024 | out: lpString1="::3586127(p\x09\x09\x09\x09\x09\x09\x09\x09 r13,\x09\x09\x09\x09\x09\x09\x09 i \x09\x09\x09\x09\x09\x09\x09\x0942512)") returned="::3586127(p\x09\x09\x09\x09\x09\x09\x09\x09 r13,\x09\x09\x09\x09\x09\x09\x09 i \x09\x09\x09\x09\x09\x09\x09\x0942512)" [0075.493] lstrcpynA (in: lpString1=0x42e3c0, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp" [0075.493] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp") returned 48 [0075.493] lstrcpynA (in: lpString1=0x40a838, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll", iMaxLength=1024 | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll" [0075.493] lstrcpynA (in: lpString1=0x40a438, lpString2="Call", iMaxLength=1024 | out: lpString1="Call") returned="Call" [0075.494] GetModuleHandleA (lpModuleName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\nsdE08F.tmp\\System.dll") returned 0x753e0000 [0075.495] GetProcAddress (hModule=0x753e0000, lpProcName="Call") returned 0x753e16db [0075.496] lstrcpyA (in: lpString1=0x5866b0, lpString2="" | out: lpString1="") returned="" [0075.496] lstrcpyA (in: lpString1=0x586ab0, lpString2="3586127" | out: lpString1="3586127") returned="3586127" [0075.496] lstrcpynA (in: lpString1=0x5862a0, lpString2="3541797", iMaxLength=1024 | out: lpString1="3541797") returned="3541797" [0075.496] lstrcpynA (in: lpString1=0x5862a0, lpString2="", iMaxLength=1024 | out: lpString1="") returned="" [0099.047] LoadLibraryW (lpLibFileName="advapi32.dll") returned 0x77710000 [0099.051] LoadLibraryW (lpLibFileName="advapi32.dll") returned 0x77710000 [0099.052] CryptAcquireContextW (in: phProv=0x18f9ec, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x18f9ec*=0x5769b0) returned 1 [0099.066] CryptCreateHash (in: hProv=0x5769b0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x18f9f0 | out: phHash=0x18f9f0) returned 1 [0099.066] CryptHashData (hHash=0x584da8, pbData=0x18fb24, dwDataLen=0x10, dwFlags=0x1) returned 1 [0099.066] CryptDeriveKey (in: hProv=0x5769b0, Algid=0x6610, hBaseData=0x584da8, dwFlags=0x1, phKey=0x18f9e8 | out: phKey=0x18f9e8*=0x584e68) returned 1 [0099.067] CryptDestroyHash (hHash=0x584da8) returned 1 [0099.067] VirtualAlloc (lpAddress=0x0, dwSize=0xa9f8, flAllocationType=0x3000, flProtect=0x4) returned 0x3f0000 [0099.067] CryptDecrypt (in: hKey=0x584e68, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3f0000, pdwDataLen=0x18fb40 | out: pbData=0x3f0000, pdwDataLen=0x18fb40) returned 1 [0099.068] CryptDestroyKey (hKey=0x584e68) returned 1 [0099.068] CryptReleaseContext (hProv=0x5769b0, dwFlags=0x0) returned 1 [0099.068] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18f400, nSize=0x103 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QDgotnX2VapbkvCb.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qdgotnx2vapbkvcb.exe")) returned 0x3a [0099.068] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QDgotnX2VapbkvCb.exe\" n656" [0099.068] CreateProcessW (in: lpApplicationName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QDgotnX2VapbkvCb.exe", lpCommandLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QDgotnX2VapbkvCb.exe\" n656", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000004, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18f8d4*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18f94c | out: lpCommandLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QDgotnX2VapbkvCb.exe\" n656", lpProcessInformation=0x18f94c*(hProcess=0x188, hThread=0x15c, dwProcessId=0x9cc, dwThreadId=0x9d0)) returned 1 [0099.076] GetThreadContext (in: hThread=0x15c, lpContext=0x18f608 | out: lpContext=0x18f608*(ContextFlags=0x10007, Dr0=0x8, Dr1=0x573cb0, Dr2=0x18f624, Dr3=0x7505605c, Dr6=0x573cb0, Dr7=0x0, FloatSave.ControlWord=0x18f634, FloatSave.StatusWord=0x7505600e, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x573cb0, FloatSave.ErrorSelector=0x18f84c, FloatSave.DataOffset=0x75078684, FloatSave.DataSelector=0xe30d0cfc, FloatSave.RegisterArea=([0]=0x2c, [1]=0xb, [2]=0xd, [3]=0xe3, [4]=0xe8, [5]=0xf9, [6]=0x18, [7]=0x0, [8]=0x68, [9]=0x4e, [10]=0x58, [11]=0x0, [12]=0xc6, [13]=0x86, [14]=0x7, [15]=0x75, [16]=0xe8, [17]=0xf9, [18]=0x18, [19]=0x0, [20]=0x10, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x1, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x30, [33]=0x64, [34]=0x58, [35]=0x0, [36]=0x10, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x10, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0xb8, [45]=0x65, [46]=0x58, [47]=0x0, [48]=0x20, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x4a, [53]=0x54, [54]=0x6, [55]=0x75, [56]=0xc4, [57]=0x5d, [58]=0x58, [59]=0x0, [60]=0xaa, [61]=0xdc, [62]=0x7, [63]=0x75, [64]=0x0, [65]=0xa6, [66]=0x3f, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x7efde000, Edx=0x0, Ecx=0x0, Eax=0x403348, Ebp=0x0, Eip=0x77c501c4, SegCs=0x23, EFlags=0x202, Esp=0x18fff0, SegSs=0x2b, ExtendedRegisters=([0]=0xc6, [1]=0xf7, [2]=0x18, [3]=0x0, [4]=0x29, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x9, [11]=0x75, [12]=0xcc, [13]=0x26, [14]=0xa, [15]=0x75, [16]=0x9b, [17]=0x1, [18]=0xc7, [19]=0x77, [20]=0xe9, [21]=0xa, [22]=0xcd, [23]=0x77, [24]=0xc4, [25]=0xf7, [26]=0x18, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x55, [35]=0x0, [36]=0x28, [37]=0x64, [38]=0x58, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x55, [43]=0x0, [44]=0xa8, [45]=0x69, [46]=0x57, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x2, [53]=0x0, [54]=0x0, [55]=0x2, [56]=0xb0, [57]=0x3c, [58]=0x57, [59]=0x0, [60]=0x38, [61]=0x6a, [62]=0x57, [63]=0x0, [64]=0xb0, [65]=0x23, [66]=0x57, [67]=0x0, [68]=0xc4, [69]=0x0, [70]=0x55, [71]=0x0, [72]=0x10, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x55, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x8, [83]=0x0, [84]=0xa8, [85]=0x69, [86]=0x57, [87]=0x0, [88]=0x1c, [89]=0xf8, [90]=0x18, [91]=0x0, [92]=0x9e, [93]=0x38, [94]=0xc7, [95]=0x77, [96]=0x38, [97]=0x1, [98]=0x55, [99]=0x0, [100]=0x7a, [101]=0x38, [102]=0xc7, [103]=0x77, [104]=0x91, [105]=0x5, [106]=0xcd, [107]=0x77, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x55, [115]=0x0, [116]=0xb0, [117]=0x69, [118]=0x57, [119]=0x0, [120]=0xe8, [121]=0xf6, [122]=0x18, [123]=0x0, [124]=0xc4, [125]=0xf7, [126]=0x18, [127]=0x0, [128]=0x10, [129]=0xf8, [130]=0x18, [131]=0x0, [132]=0xcd, [133]=0x1e, [134]=0xcb, [135]=0x77, [136]=0x90, [137]=0x5d, [138]=0x58, [139]=0x0, [140]=0x50, [141]=0x1, [142]=0x55, [143]=0x0, [144]=0xb0, [145]=0x3c, [146]=0x57, [147]=0x0, [148]=0x50, [149]=0x1, [150]=0x55, [151]=0x0, [152]=0x50, [153]=0x1, [154]=0x55, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x55, [159]=0x0, [160]=0x50, [161]=0x1, [162]=0x55, [163]=0x0, [164]=0x50, [165]=0x1, [166]=0x55, [167]=0x0, [168]=0x2, [169]=0x0, [170]=0x0, [171]=0x2, [172]=0x50, [173]=0x1, [174]=0x55, [175]=0x0, [176]=0x2, [177]=0x0, [178]=0x0, [179]=0x2, [180]=0x4f, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x1e, [185]=0x0, [186]=0x0, [187]=0x1e, [188]=0x13, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x3, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0xfc, [197]=0x39, [198]=0x78, [199]=0x77, [200]=0x3, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x1, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x13, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x1e, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x4f, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x92, [221]=0x4, [222]=0x0, [223]=0x96, [224]=0x13, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0xc4, [229]=0xf7, [230]=0x18, [231]=0x0, [232]=0x58, [233]=0x7b, [234]=0x58, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x3c, [241]=0x36, [242]=0x55, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x74, [249]=0x1, [250]=0x55, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x50, [257]=0x1, [258]=0x55, [259]=0x0, [260]=0x30, [261]=0x64, [262]=0x58, [263]=0x0, [264]=0x90, [265]=0x5d, [266]=0x58, [267]=0x0, [268]=0xb0, [269]=0x69, [270]=0x57, [271]=0x0, [272]=0xb0, [273]=0x3c, [274]=0x57, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x13, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0xd0, [289]=0x1b, [290]=0x0, [291]=0x1, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x98, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x28, [301]=0x0, [302]=0x1, [303]=0x1, [304]=0x3c, [305]=0xf7, [306]=0x18, [307]=0x0, [308]=0xcd, [309]=0x1e, [310]=0xcb, [311]=0x77, [312]=0x74, [313]=0xf8, [314]=0x18, [315]=0x0, [316]=0xcd, [317]=0x1e, [318]=0xcb, [319]=0x77, [320]=0xcd, [321]=0x35, [322]=0x13, [323]=0x0, [324]=0xfe, [325]=0xff, [326]=0xff, [327]=0xff, [328]=0x7a, [329]=0x38, [330]=0xc7, [331]=0x77, [332]=0x72, [333]=0x34, [334]=0xc7, [335]=0x77, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0xb0, [341]=0x69, [342]=0x57, [343]=0x0, [344]=0xb0, [345]=0x69, [346]=0x57, [347]=0x0, [348]=0x1, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0xa8, [357]=0x69, [358]=0x57, [359]=0x0, [360]=0x84, [361]=0xf8, [362]=0x18, [363]=0x0, [364]=0x88, [365]=0x3e, [366]=0xc2, [367]=0x76, [368]=0x0, [369]=0x0, [370]=0x55, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x9f, [377]=0x3f, [378]=0xc2, [379]=0x76, [380]=0x54, [381]=0xc5, [382]=0x25, [383]=0xcd, [384]=0x1, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0xb0, [389]=0x69, [390]=0x57, [391]=0x0, [392]=0x28, [393]=0x6a, [394]=0x57, [395]=0x0, [396]=0x6c, [397]=0xf8, [398]=0x18, [399]=0x0, [400]=0x0, [401]=0x15, [402]=0x5, [403]=0x75, [404]=0xd0, [405]=0x1b, [406]=0x57, [407]=0x0, [408]=0x50, [409]=0xf8, [410]=0x18, [411]=0x0, [412]=0x4a, [413]=0x5a, [414]=0x5, [415]=0x75, [416]=0xb0, [417]=0xf8, [418]=0x18, [419]=0x0, [420]=0xe0, [421]=0x5e, [422]=0xc4, [423]=0x76, [424]=0xe8, [425]=0x44, [426]=0xf9, [427]=0xbb, [428]=0xfe, [429]=0xff, [430]=0xff, [431]=0xff, [432]=0x9f, [433]=0x3f, [434]=0xc2, [435]=0x76, [436]=0x6c, [437]=0x2f, [438]=0x9, [439]=0x75, [440]=0xb3, [441]=0x2f, [442]=0x9, [443]=0x75, [444]=0x39, [445]=0x5d, [446]=0xe0, [447]=0x39, [448]=0xe8, [449]=0xf9, [450]=0x18, [451]=0x0, [452]=0x60, [453]=0xf9, [454]=0x18, [455]=0x0, [456]=0xc, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x1, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x90, [469]=0xf8, [470]=0x18, [471]=0x0, [472]=0xf8, [473]=0xf9, [474]=0x18, [475]=0x0, [476]=0xc4, [477]=0xff, [478]=0x18, [479]=0x0, [480]=0xa0, [481]=0x89, [482]=0x9, [483]=0x75, [484]=0x11, [485]=0xb0, [486]=0xf2, [487]=0x4c, [488]=0xfe, [489]=0xff, [490]=0xff, [491]=0xff, [492]=0xb3, [493]=0x2f, [494]=0x9, [495]=0x75, [496]=0x38, [497]=0xc9, [498]=0x36, [499]=0x0, [500]=0xb0, [501]=0x69, [502]=0x57, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x24, [509]=0xfb, [510]=0x18, [511]=0x0))) returned 1 [0099.587] ReadProcessMemory (in: hProcess=0x188, lpBaseAddress=0x7efde008, lpBuffer=0x18f948, nSize=0x4, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x18f948*, lpNumberOfBytesRead=0x0) returned 1 [0099.987] LoadLibraryW (lpLibFileName="advapi32.dll") returned 0x77710000 [0099.988] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x18f2a4 | out: Wow64Process=0x18f2a4) returned 1 [0099.991] LoadLibraryW (lpLibFileName="advapi32.dll") returned 0x77710000 [0099.992] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0099.992] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13b740 [0099.992] VirtualAlloc (lpAddress=0x0, dwSize=0x13b740, flAllocationType=0x3000, flProtect=0x4) returned 0x2740000 [0099.992] ReadFile (in: hFile=0x190, lpBuffer=0x2740000, nNumberOfBytesToRead=0x13b740, lpNumberOfBytesRead=0x18f2e0, lpOverlapped=0x0 | out: lpBuffer=0x2740000*, lpNumberOfBytesRead=0x18f2e0*=0x13b740, lpOverlapped=0x0) returned 1 [0100.037] VirtualAlloc (lpAddress=0x0, dwSize=0x180000, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0100.055] CloseHandle (hObject=0x190) returned 1 [0100.055] VirtualFree (lpAddress=0x2740000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.055] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.055] NtUnmapViewOfSection (ProcessHandle=0x188, BaseAddress=0x400000) returned 0x0 [0100.059] LoadLibraryW (lpLibFileName="advapi32.dll") returned 0x77710000 [0100.060] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x18f260 | out: Wow64Process=0x18f260) returned 1 [0100.063] LoadLibraryW (lpLibFileName="advapi32.dll") returned 0x77710000 [0100.063] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0100.063] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13b740 [0100.063] VirtualAlloc (lpAddress=0x0, dwSize=0x13b740, flAllocationType=0x3000, flProtect=0x4) returned 0x2740000 [0100.063] ReadFile (in: hFile=0x190, lpBuffer=0x2740000, nNumberOfBytesToRead=0x13b740, lpNumberOfBytesRead=0x18f29c, lpOverlapped=0x0 | out: lpBuffer=0x2740000*, lpNumberOfBytesRead=0x18f29c*=0x13b740, lpOverlapped=0x0) returned 1 [0100.080] VirtualAlloc (lpAddress=0x0, dwSize=0x180000, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0100.102] CloseHandle (hObject=0x190) returned 1 [0100.102] VirtualFree (lpAddress=0x2740000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.103] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.103] NtCreateSection (in: SectionHandle=0x18f3c4, DesiredAccess=0xe, ObjectAttributes=0x0, MaximumSize=0x18f918, SectionPageProtection=0x40, AllocationAttributes=0x8000000, FileHandle=0x0 | out: SectionHandle=0x18f3c4*=0x190) returned 0x0 [0100.106] LoadLibraryW (lpLibFileName="advapi32.dll") returned 0x77710000 [0100.106] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x18f234 | out: Wow64Process=0x18f234) returned 1 [0100.109] LoadLibraryW (lpLibFileName="advapi32.dll") returned 0x77710000 [0100.110] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24 [0100.110] GetFileSize (in: hFile=0x24, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13b740 [0100.110] VirtualAlloc (lpAddress=0x0, dwSize=0x13b740, flAllocationType=0x3000, flProtect=0x4) returned 0x2740000 [0100.110] ReadFile (in: hFile=0x24, lpBuffer=0x2740000, nNumberOfBytesToRead=0x13b740, lpNumberOfBytesRead=0x18f270, lpOverlapped=0x0 | out: lpBuffer=0x2740000*, lpNumberOfBytesRead=0x18f270*=0x13b740, lpOverlapped=0x0) returned 1 [0100.121] VirtualAlloc (lpAddress=0x0, dwSize=0x180000, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0100.133] CloseHandle (hObject=0x24) returned 1 [0100.133] VirtualFree (lpAddress=0x2740000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.133] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.134] NtMapViewOfSection (in: SectionHandle=0x190, ProcessHandle=0x188, BaseAddress=0x18f3b8*=0x400000, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x18f3b0*=0x0, InheritDisposition=0x2, AllocationType=0x0, AccessProtection=0x40 | out: BaseAddress=0x18f3b8*=0x400000, SectionOffset=0x0, ViewSize=0x18f3b0*=0x1e000) returned 0x0 [0100.137] LoadLibraryW (lpLibFileName="advapi32.dll") returned 0x77710000 [0100.138] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x18f234 | out: Wow64Process=0x18f234) returned 1 [0100.150] LoadLibraryW (lpLibFileName="advapi32.dll") returned 0x77710000 [0100.151] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24 [0100.151] GetFileSize (in: hFile=0x24, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13b740 [0100.151] VirtualAlloc (lpAddress=0x0, dwSize=0x13b740, flAllocationType=0x3000, flProtect=0x4) returned 0x2740000 [0100.151] ReadFile (in: hFile=0x24, lpBuffer=0x2740000, nNumberOfBytesToRead=0x13b740, lpNumberOfBytesRead=0x18f270, lpOverlapped=0x0 | out: lpBuffer=0x2740000*, lpNumberOfBytesRead=0x18f270*=0x13b740, lpOverlapped=0x0) returned 1 [0100.162] VirtualAlloc (lpAddress=0x0, dwSize=0x180000, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0100.173] CloseHandle (hObject=0x24) returned 1 [0100.173] VirtualFree (lpAddress=0x2740000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.174] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.174] NtMapViewOfSection (in: SectionHandle=0x190, ProcessHandle=0xffffffffffffffff, BaseAddress=0x18f3b8*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x18f3b0*=0x1e000, InheritDisposition=0x2, AllocationType=0x0, AccessProtection=0x40 | out: BaseAddress=0x18f3b8*=0x1e70000, SectionOffset=0x0, ViewSize=0x18f3b0*=0x1e000) returned 0x0 [0100.178] LoadLibraryW (lpLibFileName="advapi32.dll") returned 0x77710000 [0100.178] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x18f274 | out: Wow64Process=0x18f274) returned 1 [0100.181] LoadLibraryW (lpLibFileName="advapi32.dll") returned 0x77710000 [0100.182] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24 [0100.182] GetFileSize (in: hFile=0x24, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13b740 [0100.182] VirtualAlloc (lpAddress=0x0, dwSize=0x13b740, flAllocationType=0x3000, flProtect=0x4) returned 0x2740000 [0100.182] ReadFile (in: hFile=0x24, lpBuffer=0x2740000, nNumberOfBytesToRead=0x13b740, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2740000*, lpNumberOfBytesRead=0x18f2b0*=0x13b740, lpOverlapped=0x0) returned 1 [0100.193] VirtualAlloc (lpAddress=0x0, dwSize=0x180000, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0100.204] CloseHandle (hObject=0x24) returned 1 [0100.204] VirtualFree (lpAddress=0x2740000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.204] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.205] NtWriteVirtualMemory (in: ProcessHandle=0x188, BaseAddress=0x7efde008, Buffer=0x18f960*, NumberOfBytesToWrite=0x4, NumberOfBytesWritten=0x18f3c8 | out: Buffer=0x18f960*, NumberOfBytesWritten=0x18f3c8*=0x4) returned 0x0 [0100.205] SetThreadContext (hThread=0x15c, lpContext=0x18f608*(ContextFlags=0x10007, Dr0=0x8, Dr1=0x573cb0, Dr2=0x18f624, Dr3=0x7505605c, Dr6=0x573cb0, Dr7=0x0, FloatSave.ControlWord=0x18f634, FloatSave.StatusWord=0x7505600e, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x573cb0, FloatSave.ErrorSelector=0x18f84c, FloatSave.DataOffset=0x75078684, FloatSave.DataSelector=0xe30d0cfc, FloatSave.RegisterArea=([0]=0x2c, [1]=0xb, [2]=0xd, [3]=0xe3, [4]=0xe8, [5]=0xf9, [6]=0x18, [7]=0x0, [8]=0x68, [9]=0x4e, [10]=0x58, [11]=0x0, [12]=0xc6, [13]=0x86, [14]=0x7, [15]=0x75, [16]=0xe8, [17]=0xf9, [18]=0x18, [19]=0x0, [20]=0x10, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x1, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x30, [33]=0x64, [34]=0x58, [35]=0x0, [36]=0x10, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x10, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0xb8, [45]=0x65, [46]=0x58, [47]=0x0, [48]=0x20, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x4a, [53]=0x54, [54]=0x6, [55]=0x75, [56]=0xc4, [57]=0x5d, [58]=0x58, [59]=0x0, [60]=0xaa, [61]=0xdc, [62]=0x7, [63]=0x75, [64]=0x0, [65]=0xa6, [66]=0x3f, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x7efde000, Edx=0x0, Ecx=0x0, Eax=0x405a20, Ebp=0x0, Eip=0x77c501c4, SegCs=0x23, EFlags=0x202, Esp=0x18fff0, SegSs=0x2b, ExtendedRegisters=([0]=0xc6, [1]=0xf7, [2]=0x18, [3]=0x0, [4]=0x29, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x9, [11]=0x75, [12]=0xcc, [13]=0x26, [14]=0xa, [15]=0x75, [16]=0x9b, [17]=0x1, [18]=0xc7, [19]=0x77, [20]=0xe9, [21]=0xa, [22]=0xcd, [23]=0x77, [24]=0xc4, [25]=0xf7, [26]=0x18, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x55, [35]=0x0, [36]=0x28, [37]=0x64, [38]=0x58, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x55, [43]=0x0, [44]=0xa8, [45]=0x69, [46]=0x57, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x2, [53]=0x0, [54]=0x0, [55]=0x2, [56]=0xb0, [57]=0x3c, [58]=0x57, [59]=0x0, [60]=0x38, [61]=0x6a, [62]=0x57, [63]=0x0, [64]=0xb0, [65]=0x23, [66]=0x57, [67]=0x0, [68]=0xc4, [69]=0x0, [70]=0x55, [71]=0x0, [72]=0x10, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x55, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x8, [83]=0x0, [84]=0xa8, [85]=0x69, [86]=0x57, [87]=0x0, [88]=0x1c, [89]=0xf8, [90]=0x18, [91]=0x0, [92]=0x9e, [93]=0x38, [94]=0xc7, [95]=0x77, [96]=0x38, [97]=0x1, [98]=0x55, [99]=0x0, [100]=0x7a, [101]=0x38, [102]=0xc7, [103]=0x77, [104]=0x91, [105]=0x5, [106]=0xcd, [107]=0x77, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x55, [115]=0x0, [116]=0xb0, [117]=0x69, [118]=0x57, [119]=0x0, [120]=0xe8, [121]=0xf6, [122]=0x18, [123]=0x0, [124]=0xc4, [125]=0xf7, [126]=0x18, [127]=0x0, [128]=0x10, [129]=0xf8, [130]=0x18, [131]=0x0, [132]=0xcd, [133]=0x1e, [134]=0xcb, [135]=0x77, [136]=0x90, [137]=0x5d, [138]=0x58, [139]=0x0, [140]=0x50, [141]=0x1, [142]=0x55, [143]=0x0, [144]=0xb0, [145]=0x3c, [146]=0x57, [147]=0x0, [148]=0x50, [149]=0x1, [150]=0x55, [151]=0x0, [152]=0x50, [153]=0x1, [154]=0x55, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x55, [159]=0x0, [160]=0x50, [161]=0x1, [162]=0x55, [163]=0x0, [164]=0x50, [165]=0x1, [166]=0x55, [167]=0x0, [168]=0x2, [169]=0x0, [170]=0x0, [171]=0x2, [172]=0x50, [173]=0x1, [174]=0x55, [175]=0x0, [176]=0x2, [177]=0x0, [178]=0x0, [179]=0x2, [180]=0x4f, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x1e, [185]=0x0, [186]=0x0, [187]=0x1e, [188]=0x13, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x3, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0xfc, [197]=0x39, [198]=0x78, [199]=0x77, [200]=0x3, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x1, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x13, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x1e, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x4f, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x92, [221]=0x4, [222]=0x0, [223]=0x96, [224]=0x13, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0xc4, [229]=0xf7, [230]=0x18, [231]=0x0, [232]=0x58, [233]=0x7b, [234]=0x58, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x3c, [241]=0x36, [242]=0x55, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x74, [249]=0x1, [250]=0x55, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x50, [257]=0x1, [258]=0x55, [259]=0x0, [260]=0x30, [261]=0x64, [262]=0x58, [263]=0x0, [264]=0x90, [265]=0x5d, [266]=0x58, [267]=0x0, [268]=0xb0, [269]=0x69, [270]=0x57, [271]=0x0, [272]=0xb0, [273]=0x3c, [274]=0x57, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x13, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0xd0, [289]=0x1b, [290]=0x0, [291]=0x1, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x98, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x28, [301]=0x0, [302]=0x1, [303]=0x1, [304]=0x3c, [305]=0xf7, [306]=0x18, [307]=0x0, [308]=0xcd, [309]=0x1e, [310]=0xcb, [311]=0x77, [312]=0x74, [313]=0xf8, [314]=0x18, [315]=0x0, [316]=0xcd, [317]=0x1e, [318]=0xcb, [319]=0x77, [320]=0xcd, [321]=0x35, [322]=0x13, [323]=0x0, [324]=0xfe, [325]=0xff, [326]=0xff, [327]=0xff, [328]=0x7a, [329]=0x38, [330]=0xc7, [331]=0x77, [332]=0x72, [333]=0x34, [334]=0xc7, [335]=0x77, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0xb0, [341]=0x69, [342]=0x57, [343]=0x0, [344]=0xb0, [345]=0x69, [346]=0x57, [347]=0x0, [348]=0x1, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0xa8, [357]=0x69, [358]=0x57, [359]=0x0, [360]=0x84, [361]=0xf8, [362]=0x18, [363]=0x0, [364]=0x88, [365]=0x3e, [366]=0xc2, [367]=0x76, [368]=0x0, [369]=0x0, [370]=0x55, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x9f, [377]=0x3f, [378]=0xc2, [379]=0x76, [380]=0x54, [381]=0xc5, [382]=0x25, [383]=0xcd, [384]=0x1, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0xb0, [389]=0x69, [390]=0x57, [391]=0x0, [392]=0x28, [393]=0x6a, [394]=0x57, [395]=0x0, [396]=0x6c, [397]=0xf8, [398]=0x18, [399]=0x0, [400]=0x0, [401]=0x15, [402]=0x5, [403]=0x75, [404]=0xd0, [405]=0x1b, [406]=0x57, [407]=0x0, [408]=0x50, [409]=0xf8, [410]=0x18, [411]=0x0, [412]=0x4a, [413]=0x5a, [414]=0x5, [415]=0x75, [416]=0xb0, [417]=0xf8, [418]=0x18, [419]=0x0, [420]=0xe0, [421]=0x5e, [422]=0xc4, [423]=0x76, [424]=0xe8, [425]=0x44, [426]=0xf9, [427]=0xbb, [428]=0xfe, [429]=0xff, [430]=0xff, [431]=0xff, [432]=0x9f, [433]=0x3f, [434]=0xc2, [435]=0x76, [436]=0x6c, [437]=0x2f, [438]=0x9, [439]=0x75, [440]=0xb3, [441]=0x2f, [442]=0x9, [443]=0x75, [444]=0x39, [445]=0x5d, [446]=0xe0, [447]=0x39, [448]=0xe8, [449]=0xf9, [450]=0x18, [451]=0x0, [452]=0x60, [453]=0xf9, [454]=0x18, [455]=0x0, [456]=0xc, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x1, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x90, [469]=0xf8, [470]=0x18, [471]=0x0, [472]=0xf8, [473]=0xf9, [474]=0x18, [475]=0x0, [476]=0xc4, [477]=0xff, [478]=0x18, [479]=0x0, [480]=0xa0, [481]=0x89, [482]=0x9, [483]=0x75, [484]=0x11, [485]=0xb0, [486]=0xf2, [487]=0x4c, [488]=0xfe, [489]=0xff, [490]=0xff, [491]=0xff, [492]=0xb3, [493]=0x2f, [494]=0x9, [495]=0x75, [496]=0x38, [497]=0xc9, [498]=0x36, [499]=0x0, [500]=0xb0, [501]=0x69, [502]=0x57, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x24, [509]=0xfb, [510]=0x18, [511]=0x0))) returned 1 [0100.208] LoadLibraryW (lpLibFileName="advapi32.dll") returned 0x77710000 [0100.209] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x18f29c | out: Wow64Process=0x18f29c) returned 1 [0100.211] LoadLibraryW (lpLibFileName="advapi32.dll") returned 0x77710000 [0100.212] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24 [0100.212] GetFileSize (in: hFile=0x24, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13b740 [0100.212] VirtualAlloc (lpAddress=0x0, dwSize=0x13b740, flAllocationType=0x3000, flProtect=0x4) returned 0x2740000 [0100.212] ReadFile (in: hFile=0x24, lpBuffer=0x2740000, nNumberOfBytesToRead=0x13b740, lpNumberOfBytesRead=0x18f2d8, lpOverlapped=0x0 | out: lpBuffer=0x2740000*, lpNumberOfBytesRead=0x18f2d8*=0x13b740, lpOverlapped=0x0) returned 1 [0100.222] VirtualAlloc (lpAddress=0x0, dwSize=0x180000, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0100.249] CloseHandle (hObject=0x24) returned 1 [0100.250] VirtualFree (lpAddress=0x2740000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.250] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.250] NtResumeThread (in: ThreadHandle=0x15c, SuspendCount=0x18f3d8 | out: SuspendCount=0x18f3d8*=0x1) returned 0x0 [0100.293] CloseHandle (hObject=0x188) returned 1 [0100.293] CloseHandle (hObject=0x15c) returned 1 [0100.293] CloseHandle (hObject=0x190) returned 1 [0100.296] LoadLibraryW (lpLibFileName="advapi32.dll") returned 0x77710000 [0100.296] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x18f2a4 | out: Wow64Process=0x18f2a4) returned 1 [0100.299] LoadLibraryW (lpLibFileName="advapi32.dll") returned 0x77710000 [0100.299] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0100.300] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13b740 [0100.300] VirtualAlloc (lpAddress=0x0, dwSize=0x13b740, flAllocationType=0x3000, flProtect=0x4) returned 0x2740000 [0100.300] ReadFile (in: hFile=0x190, lpBuffer=0x2740000, nNumberOfBytesToRead=0x13b740, lpNumberOfBytesRead=0x18f2e0, lpOverlapped=0x0 | out: lpBuffer=0x2740000*, lpNumberOfBytesRead=0x18f2e0*=0x13b740, lpOverlapped=0x0) returned 1 [0100.315] VirtualAlloc (lpAddress=0x0, dwSize=0x180000, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0100.328] CloseHandle (hObject=0x190) returned 1 [0100.328] VirtualFree (lpAddress=0x2740000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.329] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.329] NtUnmapViewOfSection (ProcessHandle=0xffffffffffffffff, BaseAddress=0x1e70000) returned 0x0 [0100.331] ExitProcess (uExitCode=0x0) Thread: id = 7 os_tid = 0x304 Thread: id = 8 os_tid = 0x7a0 Process: id = "4" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x411f8000" os_pid = "0x5dc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x290" cmd_line = "\"C:\\Windows\\system32\\cmd.exe\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 9 os_tid = 0x7c4 [0075.390] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x30fab0 | out: lpSystemTimeAsFileTime=0x30fab0*(dwLowDateTime=0xeb907630, dwHighDateTime=0x1d6eae2)) [0075.390] GetCurrentProcessId () returned 0x5dc [0075.390] GetCurrentThreadId () returned 0x7c4 [0075.390] GetTickCount () returned 0x11489b9 [0075.390] QueryPerformanceCounter (in: lpPerformanceCount=0x30fab8 | out: lpPerformanceCount=0x30fab8*=18294736047) returned 1 [0075.392] GetModuleHandleW (lpModuleName=0x0) returned 0x4a0a0000 [0075.392] __set_app_type (_Type=0x1) [0075.392] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a0c7810) returned 0x0 [0075.392] __getmainargs (in: _Argc=0x4a0ea608, _Argv=0x4a0ea618, _Env=0x4a0ea610, _DoWildCard=0, _StartInfo=0x4a0ce0f4 | out: _Argc=0x4a0ea608, _Argv=0x4a0ea618, _Env=0x4a0ea610) returned 0 [0075.392] GetCurrentThreadId () returned 0x7c4 [0075.392] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x7c4) returned 0x3c [0075.393] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77940000 [0075.393] GetProcAddress (hModule=0x77940000, lpProcName="SetThreadUILanguage") returned 0x77956d40 [0075.393] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0075.394] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0075.394] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x30fa48 | out: phkResult=0x30fa48*=0x0) returned 0x2 [0075.394] VirtualQuery (in: lpAddress=0x30fa30, lpBuffer=0x30f9b0, dwLength=0x30 | out: lpBuffer=0x30f9b0*(BaseAddress=0x30f000, AllocationBase=0x210000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0075.394] VirtualQuery (in: lpAddress=0x210000, lpBuffer=0x30f9b0, dwLength=0x30 | out: lpBuffer=0x30f9b0*(BaseAddress=0x210000, AllocationBase=0x210000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0075.394] VirtualQuery (in: lpAddress=0x211000, lpBuffer=0x30f9b0, dwLength=0x30 | out: lpBuffer=0x30f9b0*(BaseAddress=0x211000, AllocationBase=0x210000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0075.394] VirtualQuery (in: lpAddress=0x214000, lpBuffer=0x30f9b0, dwLength=0x30 | out: lpBuffer=0x30f9b0*(BaseAddress=0x214000, AllocationBase=0x210000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0075.394] VirtualQuery (in: lpAddress=0x310000, lpBuffer=0x30f9b0, dwLength=0x30 | out: lpBuffer=0x30f9b0*(BaseAddress=0x310000, AllocationBase=0x310000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xe000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0075.394] GetConsoleOutputCP () returned 0x1b5 [0075.394] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a0dbfe0 | out: lpCPInfo=0x4a0dbfe0) returned 1 [0075.395] SetConsoleCtrlHandler (HandlerRoutine=0x4a0c3184, Add=1) returned 1 [0075.395] _get_osfhandle (_FileHandle=1) returned 0x10c [0075.395] SetConsoleMode (hConsoleHandle=0x10c, dwMode=0x0) returned 0 [0075.395] _get_osfhandle (_FileHandle=1) returned 0x10c [0075.395] GetConsoleMode (in: hConsoleHandle=0x10c, lpMode=0x4a0ce194 | out: lpMode=0x4a0ce194) returned 0 [0075.430] _get_osfhandle (_FileHandle=0) returned 0xa4 [0075.431] GetConsoleMode (in: hConsoleHandle=0xa4, lpMode=0x4a0ce198 | out: lpMode=0x4a0ce198) returned 0 [0075.431] GetEnvironmentStringsW () returned 0x4d8a60* [0075.431] GetProcessHeap () returned 0x4c0000 [0075.431] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0xa7c) returned 0x4d94f0 [0075.431] FreeEnvironmentStringsW (penv=0x4d8a60) returned 1 [0075.431] GetProcessHeap () returned 0x4c0000 [0075.431] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x8) returned 0x4d88e0 [0075.431] GetEnvironmentStringsW () returned 0x4d8a60* [0075.431] GetProcessHeap () returned 0x4c0000 [0075.431] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0xa7c) returned 0x4d9f80 [0075.432] FreeEnvironmentStringsW (penv=0x4d8a60) returned 1 [0075.432] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x30e908 | out: phkResult=0x30e908*=0x44) returned 0x0 [0075.432] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x30e900, lpData=0x30e920, lpcbData=0x30e904*=0x1000 | out: lpType=0x30e900*=0x0, lpData=0x30e920*=0x18, lpcbData=0x30e904*=0x1000) returned 0x2 [0075.432] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x30e900, lpData=0x30e920, lpcbData=0x30e904*=0x1000 | out: lpType=0x30e900*=0x4, lpData=0x30e920*=0x1, lpcbData=0x30e904*=0x4) returned 0x0 [0075.432] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x30e900, lpData=0x30e920, lpcbData=0x30e904*=0x1000 | out: lpType=0x30e900*=0x0, lpData=0x30e920*=0x1, lpcbData=0x30e904*=0x1000) returned 0x2 [0075.432] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x30e900, lpData=0x30e920, lpcbData=0x30e904*=0x1000 | out: lpType=0x30e900*=0x4, lpData=0x30e920*=0x0, lpcbData=0x30e904*=0x4) returned 0x0 [0075.432] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x30e900, lpData=0x30e920, lpcbData=0x30e904*=0x1000 | out: lpType=0x30e900*=0x4, lpData=0x30e920*=0x40, lpcbData=0x30e904*=0x4) returned 0x0 [0075.432] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x30e900, lpData=0x30e920, lpcbData=0x30e904*=0x1000 | out: lpType=0x30e900*=0x4, lpData=0x30e920*=0x40, lpcbData=0x30e904*=0x4) returned 0x0 [0075.432] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x30e900, lpData=0x30e920, lpcbData=0x30e904*=0x1000 | out: lpType=0x30e900*=0x0, lpData=0x30e920*=0x40, lpcbData=0x30e904*=0x1000) returned 0x2 [0075.432] RegCloseKey (hKey=0x44) returned 0x0 [0075.432] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x30e908 | out: phkResult=0x30e908*=0x44) returned 0x0 [0075.432] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x30e900, lpData=0x30e920, lpcbData=0x30e904*=0x1000 | out: lpType=0x30e900*=0x0, lpData=0x30e920*=0x40, lpcbData=0x30e904*=0x1000) returned 0x2 [0075.433] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x30e900, lpData=0x30e920, lpcbData=0x30e904*=0x1000 | out: lpType=0x30e900*=0x4, lpData=0x30e920*=0x1, lpcbData=0x30e904*=0x4) returned 0x0 [0075.433] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x30e900, lpData=0x30e920, lpcbData=0x30e904*=0x1000 | out: lpType=0x30e900*=0x0, lpData=0x30e920*=0x1, lpcbData=0x30e904*=0x1000) returned 0x2 [0075.433] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x30e900, lpData=0x30e920, lpcbData=0x30e904*=0x1000 | out: lpType=0x30e900*=0x4, lpData=0x30e920*=0x0, lpcbData=0x30e904*=0x4) returned 0x0 [0075.433] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x30e900, lpData=0x30e920, lpcbData=0x30e904*=0x1000 | out: lpType=0x30e900*=0x4, lpData=0x30e920*=0x9, lpcbData=0x30e904*=0x4) returned 0x0 [0075.433] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x30e900, lpData=0x30e920, lpcbData=0x30e904*=0x1000 | out: lpType=0x30e900*=0x4, lpData=0x30e920*=0x9, lpcbData=0x30e904*=0x4) returned 0x0 [0075.433] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x30e900, lpData=0x30e920, lpcbData=0x30e904*=0x1000 | out: lpType=0x30e900*=0x0, lpData=0x30e920*=0x9, lpcbData=0x30e904*=0x1000) returned 0x2 [0075.433] RegCloseKey (hKey=0x44) returned 0x0 [0075.433] time (in: timer=0x0 | out: timer=0x0) returned 0x6000f873 [0075.433] srand (_Seed=0x6000f873) [0075.433] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0075.433] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0075.433] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a0dc0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0075.434] GetProcessHeap () returned 0x4c0000 [0075.434] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x218) returned 0x4daa10 [0075.434] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x4daa20, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0075.434] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a0cf360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0075.434] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a0cf360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0075.434] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a0cf360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0075.434] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0075.434] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0075.434] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0075.434] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0075.434] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0075.434] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0075.434] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0075.434] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0075.434] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0075.434] GetProcessHeap () returned 0x4c0000 [0075.434] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4d94f0 | out: hHeap=0x4c0000) returned 1 [0075.434] GetEnvironmentStringsW () returned 0x4d8a60* [0075.434] GetProcessHeap () returned 0x4c0000 [0075.434] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0xa94) returned 0x4dac30 [0075.435] FreeEnvironmentStringsW (penv=0x4d8a60) returned 1 [0075.435] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a0cf360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0075.435] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a0cf360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0075.435] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0075.435] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0075.435] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0075.435] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0075.435] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0075.435] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0075.435] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0075.435] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0075.435] GetProcessHeap () returned 0x4c0000 [0075.435] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x6c) returned 0x4db6d0 [0075.435] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x30f710 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0075.435] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", nBufferLength=0x104, lpBuffer=0x30f710, lpFilePart=0x30f6f0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", lpFilePart=0x30f6f0*="Roaming") returned 0x2d [0075.435] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming")) returned 0x2010 [0075.436] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x30f420 | out: lpFindFileData=0x30f420*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Users", cAlternateFileName="")) returned 0x4db750 [0075.436] FindClose (in: hFindFile=0x4db750 | out: hFindFile=0x4db750) returned 1 [0075.436] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x30f420 | out: lpFindFileData=0x30f420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x4db750 [0075.436] FindClose (in: hFindFile=0x4db750 | out: hFindFile=0x4db750) returned 1 [0075.436] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0075.436] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData", lpFindFileData=0x30f420 | out: lpFindFileData=0x30f420*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="AppData", cAlternateFileName="")) returned 0x4db750 [0075.436] FindClose (in: hFindFile=0x4db750 | out: hFindFile=0x4db750) returned 1 [0075.436] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", lpFindFileData=0x30f420 | out: lpFindFileData=0x30f420*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe5070f90, ftLastAccessTime.dwHighDateTime=0x1d6eae2, ftLastWriteTime.dwLowDateTime=0xe5070f90, ftLastWriteTime.dwHighDateTime=0x1d6eae2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Roaming", cAlternateFileName="")) returned 0x4db750 [0075.436] FindClose (in: hFindFile=0x4db750 | out: hFindFile=0x4db750) returned 1 [0075.437] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming")) returned 0x2010 [0075.437] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming")) returned 1 [0075.437] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 1 [0075.437] GetProcessHeap () returned 0x4c0000 [0075.437] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4dac30 | out: hHeap=0x4c0000) returned 1 [0075.437] GetEnvironmentStringsW () returned 0x4db750* [0075.437] GetProcessHeap () returned 0x4c0000 [0075.437] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0xaf8) returned 0x4dc250 [0075.437] FreeEnvironmentStringsW (penv=0x4db750) returned 1 [0075.437] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a0dc0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0075.437] GetProcessHeap () returned 0x4c0000 [0075.437] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4db6d0 | out: hHeap=0x4c0000) returned 1 [0075.437] GetProcessHeap () returned 0x4c0000 [0075.437] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x4016) returned 0x4dcd50 [0075.438] GetProcessHeap () returned 0x4c0000 [0075.438] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4dcd50 | out: hHeap=0x4c0000) returned 1 [0075.438] GetConsoleOutputCP () returned 0x1b5 [0075.438] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a0dbfe0 | out: lpCPInfo=0x4a0dbfe0) returned 1 [0075.438] GetUserDefaultLCID () returned 0x409 [0075.438] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a0d7b50, cchData=8 | out: lpLCData=":") returned 2 [0075.439] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x30f820, cchData=128 | out: lpLCData="0") returned 2 [0075.439] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x30f820, cchData=128 | out: lpLCData="0") returned 2 [0075.439] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x30f820, cchData=128 | out: lpLCData="1") returned 2 [0075.439] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a0ea740, cchData=8 | out: lpLCData="/") returned 2 [0075.439] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a0ea4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0075.439] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a0ea460, cchData=32 | out: lpLCData="Tue") returned 4 [0075.439] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a0ea420, cchData=32 | out: lpLCData="Wed") returned 4 [0075.439] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a0ea3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0075.439] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a0ea3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0075.439] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a0ea360, cchData=32 | out: lpLCData="Sat") returned 4 [0075.439] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a0ea700, cchData=32 | out: lpLCData="Sun") returned 4 [0075.439] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a0d7b40, cchData=8 | out: lpLCData=".") returned 2 [0075.439] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a0ea4e0, cchData=8 | out: lpLCData=",") returned 2 [0075.439] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0075.440] GetProcessHeap () returned 0x4c0000 [0075.440] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x20c) returned 0x4d95d0 [0075.440] GetConsoleTitleW (in: lpConsoleTitle=0x4d95d0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0075.440] _get_osfhandle (_FileHandle=1) returned 0x10c [0075.440] GetFileType (hFile=0x10c) returned 0x3 [0075.440] BrandingFormatString () returned 0x4d97f0 [0075.444] GetVersion () returned 0x1db10106 [0075.444] _vsnwprintf (in: _Buffer=0x30f990, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x30f928 | out: _Buffer="6.1.7601") returned 8 [0075.444] _get_osfhandle (_FileHandle=1) returned 0x10c [0075.444] GetFileType (hFile=0x10c) returned 0x3 [0075.444] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a0e6340, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0075.444] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a0e6340, nSize=0x2000, Arguments=0x30f930 | out: lpBuffer="Microsoft Windows [Version 6.1.7601]") returned 0x24 [0075.444] _get_osfhandle (_FileHandle=1) returned 0x10c [0075.445] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 6.1.7601]", cchWideChar=-1, lpMultiByteStr=0x4a0dc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 6.1.7601]", lpUsedDefaultChar=0x0) returned 37 [0075.445] WriteFile (in: hFile=0x10c, lpBuffer=0x4a0dc320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x30f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesWritten=0x30f8b8*=0x24, lpOverlapped=0x0) returned 1 [0075.445] _vsnwprintf (in: _Buffer=0x4a0e6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x30f958 | out: _Buffer="\r\n") returned 2 [0075.445] _get_osfhandle (_FileHandle=1) returned 0x10c [0075.445] GetFileType (hFile=0x10c) returned 0x3 [0075.445] _get_osfhandle (_FileHandle=1) returned 0x10c [0075.445] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0dc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0075.445] WriteFile (in: hFile=0x10c, lpBuffer=0x4a0dc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x30f928, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesWritten=0x30f928*=0x2, lpOverlapped=0x0) returned 1 [0075.445] _vsnwprintf (in: _Buffer=0x4a0e6340, _BufferCount=0x1fff, _Format="%s", _ArgList=0x30f958 | out: _Buffer="Copyright (c) 2009 Microsoft Corporation. All rights reserved.") returned 63 [0075.445] _get_osfhandle (_FileHandle=1) returned 0x10c [0075.445] GetFileType (hFile=0x10c) returned 0x3 [0075.445] _get_osfhandle (_FileHandle=1) returned 0x10c [0075.445] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x4a0dc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 64 [0075.445] WriteFile (in: hFile=0x10c, lpBuffer=0x4a0dc320*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0x30f928, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesWritten=0x30f928*=0x3f, lpOverlapped=0x0) returned 1 [0075.445] _vsnwprintf (in: _Buffer=0x4a0e6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x30f958 | out: _Buffer="\r\n") returned 2 [0075.445] _get_osfhandle (_FileHandle=1) returned 0x10c [0075.445] GetFileType (hFile=0x10c) returned 0x3 [0075.445] _get_osfhandle (_FileHandle=1) returned 0x10c [0075.446] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0dc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0075.446] WriteFile (in: hFile=0x10c, lpBuffer=0x4a0dc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x30f928, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesWritten=0x30f928*=0x2, lpOverlapped=0x0) returned 1 [0075.446] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77940000 [0075.446] GetProcAddress (hModule=0x77940000, lpProcName="CopyFileExW") returned 0x779523d0 [0075.446] GetProcAddress (hModule=0x77940000, lpProcName="IsDebuggerPresent") returned 0x77948290 [0075.446] GetProcAddress (hModule=0x77940000, lpProcName="SetConsoleInputExeNameW") returned 0x779517e0 [0075.446] _get_osfhandle (_FileHandle=0) returned 0xa4 [0075.446] GetFileType (hFile=0xa4) returned 0x3 [0075.447] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0075.447] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x30f780 | out: TokenHandle=0x30f780*=0x0) returned 0xc000007c [0075.447] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x30f780 | out: TokenHandle=0x30f780*=0x50) returned 0x0 [0075.447] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x12, TokenInformation=0x30f790, TokenInformationLength=0x4, ReturnLength=0x30f798 | out: TokenInformation=0x30f790, ReturnLength=0x30f798) returned 0x0 [0075.447] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x1a, TokenInformation=0x30f798, TokenInformationLength=0x4, ReturnLength=0x30f790 | out: TokenInformation=0x30f798, ReturnLength=0x30f790) returned 0x0 [0075.447] NtClose (Handle=0x50) returned 0x0 [0075.447] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x30f760, nSize=0x0, Arguments=0x30f768 | out: lpBuffer="韰M") returned 0xf [0075.447] GetProcessHeap () returned 0x4c0000 [0075.447] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x218) returned 0x4c1ab0 [0075.447] GetConsoleTitleW (in: lpConsoleTitle=0x30f7b0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0075.447] wcsstr (_Str="C:\\Windows\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0075.448] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0075.448] GetProcessHeap () returned 0x4c0000 [0075.448] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4c1ab0 | out: hHeap=0x4c0000) returned 1 [0075.448] LocalFree (hMem=0x4d97f0) returned 0x0 [0075.449] GetProcessHeap () returned 0x4c0000 [0075.449] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4daa10 | out: hHeap=0x4c0000) returned 1 [0075.449] _vsnwprintf (in: _Buffer=0x4a0e6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x30f498 | out: _Buffer="\r\n") returned 2 [0075.449] _get_osfhandle (_FileHandle=1) returned 0x10c [0075.449] GetFileType (hFile=0x10c) returned 0x3 [0075.449] _get_osfhandle (_FileHandle=1) returned 0x10c [0075.449] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0dc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0075.449] WriteFile (in: hFile=0x10c, lpBuffer=0x4a0dc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x30f468, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesWritten=0x30f468*=0x2, lpOverlapped=0x0) returned 1 [0075.449] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a0cf360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0075.449] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a0dc0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0075.449] _vsnwprintf (in: _Buffer=0x4a0ceb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x30f4a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 45 [0075.449] _vsnwprintf (in: _Buffer=0x4a0cebba, _BufferCount=0x3d1, _Format="%c", _ArgList=0x30f4a8 | out: _Buffer=">") returned 1 [0075.450] _get_osfhandle (_FileHandle=1) returned 0x10c [0075.450] GetFileType (hFile=0x10c) returned 0x3 [0075.450] _get_osfhandle (_FileHandle=1) returned 0x10c [0075.450] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming>", cchWideChar=-1, lpMultiByteStr=0x4a0dc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming>", lpUsedDefaultChar=0x0) returned 47 [0075.450] WriteFile (in: hFile=0x10c, lpBuffer=0x4a0dc320*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x30f498, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesWritten=0x30f498*=0x2e, lpOverlapped=0x0) returned 1 [0075.450] _get_osfhandle (_FileHandle=0) returned 0xa4 [0075.450] GetFileType (hFile=0xa4) returned 0x3 [0075.450] _get_osfhandle (_FileHandle=0) returned 0xa4 [0075.450] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.450] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0075.450] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de320, cchWideChar=1 | out: lpWideCharStr="v") returned 1 [0075.451] _get_osfhandle (_FileHandle=0) returned 0xa4 [0075.451] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.451] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0075.451] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de322, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0075.451] _get_osfhandle (_FileHandle=0) returned 0xa4 [0075.452] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.452] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0075.452] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de324, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0075.452] _get_osfhandle (_FileHandle=0) returned 0xa4 [0075.452] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.452] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0075.452] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de326, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0075.452] _get_osfhandle (_FileHandle=0) returned 0xa4 [0075.452] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.452] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0075.452] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de328, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0075.452] _get_osfhandle (_FileHandle=0) returned 0xa4 [0075.452] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.452] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0075.452] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de32a, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0075.452] _get_osfhandle (_FileHandle=0) returned 0xa4 [0075.452] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.452] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0075.452] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de32c, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0075.452] _get_osfhandle (_FileHandle=0) returned 0xa4 [0075.453] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.453] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0075.453] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de32e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0075.453] _get_osfhandle (_FileHandle=0) returned 0xa4 [0075.453] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.453] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0075.453] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de330, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0075.453] _get_osfhandle (_FileHandle=0) returned 0xa4 [0075.453] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.453] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0075.453] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de332, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0075.453] _get_osfhandle (_FileHandle=0) returned 0xa4 [0075.453] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.453] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0075.453] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de334, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0075.453] _get_osfhandle (_FileHandle=0) returned 0xa4 [0075.453] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.453] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0075.453] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de336, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0075.453] _get_osfhandle (_FileHandle=0) returned 0xa4 [0075.454] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.454] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0075.454] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de338, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0075.454] _get_osfhandle (_FileHandle=0) returned 0xa4 [0075.454] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.454] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0075.454] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de33a, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0075.454] _get_osfhandle (_FileHandle=0) returned 0xa4 [0075.454] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.454] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0075.454] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de33c, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0075.454] _get_osfhandle (_FileHandle=0) returned 0xa4 [0075.454] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.454] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0075.454] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de33e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0075.454] _get_osfhandle (_FileHandle=0) returned 0xa4 [0075.454] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.454] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0075.454] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de340, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0075.454] _get_osfhandle (_FileHandle=0) returned 0xa4 [0075.455] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.455] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0075.455] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de342, cchWideChar=1 | out: lpWideCharStr="h") returned 1 [0075.455] _get_osfhandle (_FileHandle=0) returned 0xa4 [0075.455] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.455] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0075.455] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de344, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0075.455] _get_osfhandle (_FileHandle=0) returned 0xa4 [0075.455] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.455] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0075.455] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de346, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0075.455] _get_osfhandle (_FileHandle=0) returned 0xa4 [0075.455] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.455] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0075.455] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de348, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0075.455] _get_osfhandle (_FileHandle=0) returned 0xa4 [0075.455] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.455] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0075.455] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de34a, cchWideChar=1 | out: lpWideCharStr="w") returned 1 [0075.455] _get_osfhandle (_FileHandle=0) returned 0xa4 [0075.456] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.456] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0075.456] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de34c, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0075.456] _get_osfhandle (_FileHandle=0) returned 0xa4 [0075.456] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.456] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0075.456] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de34e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0075.456] _get_osfhandle (_FileHandle=0) returned 0xa4 [0075.456] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.456] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0075.456] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de350, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0075.456] _get_osfhandle (_FileHandle=0) returned 0xa4 [0075.456] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.456] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0075.456] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de352, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0075.456] _get_osfhandle (_FileHandle=0) returned 0xa4 [0075.456] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.456] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0075.456] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de354, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0075.456] _get_osfhandle (_FileHandle=0) returned 0xa4 [0075.457] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.457] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0075.457] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de356, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0075.457] _get_osfhandle (_FileHandle=0) returned 0xa4 [0075.457] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.457] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0075.457] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de358, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0075.457] _get_osfhandle (_FileHandle=0) returned 0xa4 [0075.457] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.457] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0075.457] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de35a, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0075.458] _get_osfhandle (_FileHandle=0) returned 0xa4 [0075.458] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.458] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0075.458] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de35c, cchWideChar=1 | out: lpWideCharStr="q") returned 1 [0075.458] _get_osfhandle (_FileHandle=0) returned 0xa4 [0075.458] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.458] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0075.458] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de35e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0075.458] _get_osfhandle (_FileHandle=0) returned 0xa4 [0075.458] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.458] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0075.458] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de360, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0075.458] _get_osfhandle (_FileHandle=0) returned 0xa4 [0075.458] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.458] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0075.458] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de362, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0075.458] _get_osfhandle (_FileHandle=0) returned 0xa4 [0075.458] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.458] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0075.459] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de364, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0075.459] _get_osfhandle (_FileHandle=0) returned 0xa4 [0075.459] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.459] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0075.459] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de366, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0075.460] _get_osfhandle (_FileHandle=0) returned 0xa4 [0075.460] GetFileType (hFile=0xa4) returned 0x3 [0075.460] _get_osfhandle (_FileHandle=0) returned 0xa4 [0075.460] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.460] _get_osfhandle (_FileHandle=1) returned 0x10c [0075.460] GetFileType (hFile=0x10c) returned 0x3 [0075.460] _get_osfhandle (_FileHandle=1) returned 0x10c [0075.460] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x4a0dc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37 [0075.460] WriteFile (in: hFile=0x10c, lpBuffer=0x4a0dc320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x30f778, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesWritten=0x30f778*=0x24, lpOverlapped=0x0) returned 1 [0075.461] GetProcessHeap () returned 0x4c0000 [0075.461] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x4012) returned 0x4dcd50 [0075.461] GetProcessHeap () returned 0x4c0000 [0075.461] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4dcd50 | out: hHeap=0x4c0000) returned 1 [0075.462] _wcsicmp (_String1="vssadmin", _String2=")") returned 77 [0075.462] _wcsicmp (_String1="FOR", _String2="vssadmin") returned -16 [0075.462] _wcsicmp (_String1="FOR/?", _String2="vssadmin") returned -16 [0075.462] _wcsicmp (_String1="IF", _String2="vssadmin") returned -13 [0075.462] _wcsicmp (_String1="IF/?", _String2="vssadmin") returned -13 [0075.462] _wcsicmp (_String1="REM", _String2="vssadmin") returned -4 [0075.462] _wcsicmp (_String1="REM/?", _String2="vssadmin") returned -4 [0075.462] GetProcessHeap () returned 0x4c0000 [0075.462] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0xb0) returned 0x4d97f0 [0075.462] GetProcessHeap () returned 0x4c0000 [0075.462] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x22) returned 0x4d4610 [0075.463] GetProcessHeap () returned 0x4c0000 [0075.463] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x48) returned 0x4d98b0 [0075.464] GetConsoleOutputCP () returned 0x1b5 [0075.504] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a0dbfe0 | out: lpCPInfo=0x4a0dbfe0) returned 1 [0075.504] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0075.504] GetConsoleTitleW (in: lpConsoleTitle=0x30f730, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0075.506] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0075.506] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0075.506] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0075.506] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0075.506] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0075.506] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0075.506] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0075.506] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0075.506] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0075.506] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0075.506] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0075.506] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0075.506] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0075.506] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0075.506] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0075.506] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0075.506] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0075.507] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0075.507] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0075.507] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0075.507] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0075.507] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0075.507] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0075.507] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0075.507] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0075.507] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0075.507] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0075.507] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0075.507] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0075.507] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0075.507] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0075.507] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0075.507] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0075.507] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0075.507] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0075.507] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0075.507] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0075.507] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0075.507] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0075.507] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0075.507] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0075.508] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0075.508] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0075.508] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0075.508] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0075.508] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0075.508] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0075.508] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0075.508] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0075.508] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0075.508] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0075.508] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0075.508] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0075.508] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0075.508] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0075.508] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0075.508] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0075.508] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0075.508] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0075.508] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0075.508] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0075.508] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0075.508] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0075.508] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0075.508] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0075.508] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0075.508] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0075.508] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0075.509] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0075.509] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0075.509] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0075.509] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0075.509] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0075.509] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0075.509] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0075.509] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0075.509] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0075.509] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0075.509] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0075.509] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0075.509] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0075.509] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0075.509] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0075.509] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0075.509] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16 [0075.509] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13 [0075.509] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4 [0075.510] GetProcessHeap () returned 0x4c0000 [0075.510] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x218) returned 0x4c1ab0 [0075.510] GetProcessHeap () returned 0x4c0000 [0075.510] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x5a) returned 0x4c1cd0 [0075.510] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19 [0075.510] GetProcessHeap () returned 0x4c0000 [0075.510] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x420) returned 0x4d9a90 [0075.510] SetErrorMode (uMode=0x0) returned 0x1 [0075.510] SetErrorMode (uMode=0x1) returned 0x0 [0075.511] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4d9aa0, lpFilePart=0x30efc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", lpFilePart=0x30efc0*="Roaming") returned 0x2d [0075.511] SetErrorMode (uMode=0x1) returned 0x1 [0075.511] GetProcessHeap () returned 0x4c0000 [0075.511] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4d9a90, Size=0x7e) returned 0x4d9a90 [0075.511] GetProcessHeap () returned 0x4c0000 [0075.511] RtlSizeHeap (HeapHandle=0x4c0000, Flags=0x0, MemoryPointer=0x4d9a90) returned 0x7e [0075.512] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a0cf360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0075.512] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0075.512] GetProcessHeap () returned 0x4c0000 [0075.512] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x138) returned 0x4d5b70 [0075.512] GetProcessHeap () returned 0x4c0000 [0075.512] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x260) returned 0x4d9b20 [0075.518] GetProcessHeap () returned 0x4c0000 [0075.518] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4d9b20, Size=0x13a) returned 0x4d9b20 [0075.518] GetProcessHeap () returned 0x4c0000 [0075.518] RtlSizeHeap (HeapHandle=0x4c0000, Flags=0x0, MemoryPointer=0x4d9b20) returned 0x13a [0075.519] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a0cf360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0075.519] GetProcessHeap () returned 0x4c0000 [0075.519] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0xe8) returned 0x4d9c70 [0075.519] GetProcessHeap () returned 0x4c0000 [0075.519] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4d9c70, Size=0x7e) returned 0x4d9c70 [0075.519] GetProcessHeap () returned 0x4c0000 [0075.519] RtlSizeHeap (HeapHandle=0x4c0000, Flags=0x0, MemoryPointer=0x4d9c70) returned 0x7e [0075.521] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0075.521] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x30ed30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x30ed30) returned 0xffffffffffffffff [0075.521] GetLastError () returned 0x2 [0075.521] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\vssadmin", fInfoLevelId=0x1, lpFindFileData=0x30ed30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x30ed30) returned 0xffffffffffffffff [0075.521] GetLastError () returned 0x2 [0075.522] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0075.522] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x30ed30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x30ed30) returned 0x4c1d40 [0075.522] GetProcessHeap () returned 0x4c0000 [0075.522] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x28) returned 0x4d4640 [0075.522] FindClose (in: hFindFile=0x4c1d40 | out: hFindFile=0x4c1d40) returned 1 [0075.522] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x30ed30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x30ed30) returned 0xffffffffffffffff [0075.522] GetLastError () returned 0x2 [0075.522] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x30ed30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x30ed30) returned 0x4c1d40 [0075.522] GetProcessHeap () returned 0x4c0000 [0075.522] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4d4640, Size=0x8) returned 0x4d9900 [0075.522] FindClose (in: hFindFile=0x4c1d40 | out: hFindFile=0x4c1d40) returned 1 [0075.522] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0075.523] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0075.523] GetConsoleTitleW (in: lpConsoleTitle=0x30f280, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0075.523] GetProcessHeap () returned 0x4c0000 [0075.523] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x21c) returned 0x4d9d00 [0075.523] GetConsoleTitleW (in: lpConsoleTitle=0x4d9d10, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0075.523] GetProcessHeap () returned 0x4c0000 [0075.523] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4d9d00, Size=0xc0) returned 0x4d9d00 [0075.523] GetProcessHeap () returned 0x4c0000 [0075.523] RtlSizeHeap (HeapHandle=0x4c0000, Flags=0x0, MemoryPointer=0x4d9d00) returned 0xc0 [0075.523] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - vssadmin delete shadows /all /quiet") returned 1 [0075.524] GetProcessHeap () returned 0x4c0000 [0075.524] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4d9d00 | out: hHeap=0x4c0000) returned 1 [0075.524] InitializeProcThreadAttributeList (in: lpAttributeList=0x30f038, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x30eff8 | out: lpAttributeList=0x30f038, lpSize=0x30eff8) returned 1 [0075.524] UpdateProcThreadAttribute (in: lpAttributeList=0x30f038, dwFlags=0x0, Attribute=0x60001, lpValue=0x30efe8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x30f038, lpPreviousValue=0x0) returned 1 [0075.524] GetStartupInfoW (in: lpStartupInfo=0x30f150 | out: lpStartupInfo=0x30f150*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xa4, hStdOutput=0x10c, hStdError=0x10c)) [0075.524] GetProcessHeap () returned 0x4c0000 [0075.524] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x20) returned 0x4d4640 [0075.524] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0075.524] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0075.524] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0075.524] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0075.524] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0075.524] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0075.525] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0075.525] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0075.525] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0075.525] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0075.525] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0075.525] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0075.525] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0075.525] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0075.525] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0075.525] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0075.525] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0075.525] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0075.525] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0075.525] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0075.525] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0075.526] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0075.526] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0075.526] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0075.526] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0075.526] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0075.526] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0075.526] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0075.526] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0075.526] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0075.526] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0075.526] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0075.526] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0075.526] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0075.526] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0075.526] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0075.526] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0075.526] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0075.527] GetProcessHeap () returned 0x4c0000 [0075.527] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4d4640 | out: hHeap=0x4c0000) returned 1 [0075.527] GetProcessHeap () returned 0x4c0000 [0075.527] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x12) returned 0x4d8900 [0075.527] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\vssadmin.exe", lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", lpStartupInfo=0x30f070*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x30f020 | out: lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessInformation=0x30f020*(hProcess=0x54, hThread=0x50, dwProcessId=0x544, dwThreadId=0x664)) returned 1 [0075.539] CloseHandle (hObject=0x50) returned 1 [0075.539] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0075.539] GetProcessHeap () returned 0x4c0000 [0075.539] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4dc250 | out: hHeap=0x4c0000) returned 1 [0075.539] GetEnvironmentStringsW () returned 0x4daa10* [0075.539] GetProcessHeap () returned 0x4c0000 [0075.539] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0xaf8) returned 0x4db510 [0075.539] FreeEnvironmentStringsW (penv=0x4daa10) returned 1 [0075.540] LoadLibraryW (lpLibFileName="NTDLL.DLL") returned 0x77a60000 [0075.540] GetProcAddress (hModule=0x77a60000, lpProcName="NtQueryInformationProcess") returned 0x77ab14a0 [0075.540] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x30e928, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x30e928, ReturnLength=0x0) returned 0x0 [0075.540] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdb000, lpBuffer=0x30e960, nSize=0x380, lpNumberOfBytesRead=0x30e920 | out: lpBuffer=0x30e960*, lpNumberOfBytesRead=0x30e920*=0x380) returned 1 [0075.540] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0116.165] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x30ef68 | out: lpExitCode=0x30ef68*=0x0) returned 1 [0116.165] CloseHandle (hObject=0x54) returned 1 [0116.166] _vsnwprintf (in: _Buffer=0x30f1d8, _BufferCount=0x13, _Format="%08X", _ArgList=0x30ef78 | out: _Buffer="00000000") returned 8 [0116.166] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0116.166] GetProcessHeap () returned 0x4c0000 [0116.166] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4db510 | out: hHeap=0x4c0000) returned 1 [0116.166] GetEnvironmentStringsW () returned 0x4daa10* [0116.167] GetProcessHeap () returned 0x4c0000 [0116.167] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0xb1e) returned 0x4deb40 [0116.167] FreeEnvironmentStringsW (penv=0x4daa10) returned 1 [0116.167] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0116.167] GetProcessHeap () returned 0x4c0000 [0116.167] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4deb40 | out: hHeap=0x4c0000) returned 1 [0116.167] GetEnvironmentStringsW () returned 0x4daa10* [0116.167] GetProcessHeap () returned 0x4c0000 [0116.167] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0xb1e) returned 0x4deb40 [0116.167] FreeEnvironmentStringsW (penv=0x4daa10) returned 1 [0116.167] GetProcessHeap () returned 0x4c0000 [0116.167] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4d8900 | out: hHeap=0x4c0000) returned 1 [0116.167] DeleteProcThreadAttributeList (in: lpAttributeList=0x30f038 | out: lpAttributeList=0x30f038) [0116.169] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0116.170] _get_osfhandle (_FileHandle=1) returned 0x10c [0116.170] SetConsoleMode (hConsoleHandle=0x10c, dwMode=0x0) returned 0 [0116.170] _get_osfhandle (_FileHandle=1) returned 0x10c [0116.170] GetConsoleMode (in: hConsoleHandle=0x10c, lpMode=0x4a0ce194 | out: lpMode=0x4a0ce194) returned 0 [0116.170] _get_osfhandle (_FileHandle=0) returned 0xa4 [0116.170] GetConsoleMode (in: hConsoleHandle=0xa4, lpMode=0x4a0ce198 | out: lpMode=0x4a0ce198) returned 0 [0116.170] GetConsoleOutputCP () returned 0x1b5 [0116.171] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a0dbfe0 | out: lpCPInfo=0x4a0dbfe0) returned 1 [0116.171] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0116.171] GetProcessHeap () returned 0x4c0000 [0116.171] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4d9c70 | out: hHeap=0x4c0000) returned 1 [0116.171] GetProcessHeap () returned 0x4c0000 [0116.171] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4d9b20 | out: hHeap=0x4c0000) returned 1 [0116.171] GetProcessHeap () returned 0x4c0000 [0116.171] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4d5b70 | out: hHeap=0x4c0000) returned 1 [0116.171] GetProcessHeap () returned 0x4c0000 [0116.171] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4d9a90 | out: hHeap=0x4c0000) returned 1 [0116.171] GetProcessHeap () returned 0x4c0000 [0116.171] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4c1cd0 | out: hHeap=0x4c0000) returned 1 [0116.171] GetProcessHeap () returned 0x4c0000 [0116.171] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4c1ab0 | out: hHeap=0x4c0000) returned 1 [0116.171] GetProcessHeap () returned 0x4c0000 [0116.171] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4d98b0 | out: hHeap=0x4c0000) returned 1 [0116.171] GetProcessHeap () returned 0x4c0000 [0116.171] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4d4610 | out: hHeap=0x4c0000) returned 1 [0116.171] GetProcessHeap () returned 0x4c0000 [0116.171] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4d97f0 | out: hHeap=0x4c0000) returned 1 [0116.172] _vsnwprintf (in: _Buffer=0x4a0e6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x30f498 | out: _Buffer="\r\n") returned 2 [0116.172] _get_osfhandle (_FileHandle=1) returned 0x10c [0116.172] GetFileType (hFile=0x10c) returned 0x3 [0116.172] _get_osfhandle (_FileHandle=1) returned 0x10c [0116.172] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0dc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0116.172] WriteFile (in: hFile=0x10c, lpBuffer=0x4a0dc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x30f468, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesWritten=0x30f468*=0x2, lpOverlapped=0x0) returned 1 [0116.172] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a0cf360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0116.172] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a0dc0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0116.172] _vsnwprintf (in: _Buffer=0x4a0ceb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x30f4a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 45 [0116.172] _vsnwprintf (in: _Buffer=0x4a0cebba, _BufferCount=0x3d1, _Format="%c", _ArgList=0x30f4a8 | out: _Buffer=">") returned 1 [0116.172] _get_osfhandle (_FileHandle=1) returned 0x10c [0116.172] GetFileType (hFile=0x10c) returned 0x3 [0116.172] _get_osfhandle (_FileHandle=1) returned 0x10c [0116.172] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming>", cchWideChar=-1, lpMultiByteStr=0x4a0dc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming>", lpUsedDefaultChar=0x0) returned 47 [0116.173] WriteFile (in: hFile=0x10c, lpBuffer=0x4a0dc320*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x30f498, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesWritten=0x30f498*=0x2e, lpOverlapped=0x0) returned 1 [0116.173] _get_osfhandle (_FileHandle=0) returned 0xa4 [0116.173] GetFileType (hFile=0xa4) returned 0x3 [0116.173] _get_osfhandle (_FileHandle=0) returned 0xa4 [0116.173] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0116.173] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0116.173] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de320, cchWideChar=1 | out: lpWideCharStr="wssadmin delete shadows /all /quiet\n") returned 1 [0116.173] _get_osfhandle (_FileHandle=0) returned 0xa4 [0116.173] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0116.173] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0116.173] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de322, cchWideChar=1 | out: lpWideCharStr="bsadmin delete shadows /all /quiet\n") returned 1 [0116.173] _get_osfhandle (_FileHandle=0) returned 0xa4 [0116.173] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0116.173] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0116.174] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de324, cchWideChar=1 | out: lpWideCharStr="aadmin delete shadows /all /quiet\n") returned 1 [0116.174] _get_osfhandle (_FileHandle=0) returned 0xa4 [0116.174] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0116.174] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0116.174] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de326, cchWideChar=1 | out: lpWideCharStr="ddmin delete shadows /all /quiet\n") returned 1 [0116.174] _get_osfhandle (_FileHandle=0) returned 0xa4 [0116.174] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0116.174] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0116.174] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de328, cchWideChar=1 | out: lpWideCharStr="mmin delete shadows /all /quiet\n") returned 1 [0116.174] _get_osfhandle (_FileHandle=0) returned 0xa4 [0116.174] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0116.174] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0116.174] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de32a, cchWideChar=1 | out: lpWideCharStr="iin delete shadows /all /quiet\n") returned 1 [0116.174] _get_osfhandle (_FileHandle=0) returned 0xa4 [0116.174] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0116.174] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0116.174] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de32c, cchWideChar=1 | out: lpWideCharStr="nn delete shadows /all /quiet\n") returned 1 [0116.174] _get_osfhandle (_FileHandle=0) returned 0xa4 [0116.174] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0116.174] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0116.174] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de32e, cchWideChar=1 | out: lpWideCharStr=" delete shadows /all /quiet\n") returned 1 [0116.174] _get_osfhandle (_FileHandle=0) returned 0xa4 [0116.174] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0116.174] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0116.174] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de330, cchWideChar=1 | out: lpWideCharStr="ddelete shadows /all /quiet\n") returned 1 [0116.174] _get_osfhandle (_FileHandle=0) returned 0xa4 [0116.174] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0116.175] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0116.175] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de332, cchWideChar=1 | out: lpWideCharStr="eelete shadows /all /quiet\n") returned 1 [0116.175] _get_osfhandle (_FileHandle=0) returned 0xa4 [0116.175] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0116.175] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0116.175] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de334, cchWideChar=1 | out: lpWideCharStr="llete shadows /all /quiet\n") returned 1 [0116.175] _get_osfhandle (_FileHandle=0) returned 0xa4 [0116.175] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0116.175] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0116.175] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de336, cchWideChar=1 | out: lpWideCharStr="eete shadows /all /quiet\n") returned 1 [0116.175] _get_osfhandle (_FileHandle=0) returned 0xa4 [0116.175] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0116.175] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0116.175] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de338, cchWideChar=1 | out: lpWideCharStr="tte shadows /all /quiet\n") returned 1 [0116.175] _get_osfhandle (_FileHandle=0) returned 0xa4 [0116.175] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0116.175] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0116.175] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de33a, cchWideChar=1 | out: lpWideCharStr="ee shadows /all /quiet\n") returned 1 [0116.175] _get_osfhandle (_FileHandle=0) returned 0xa4 [0116.175] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0116.175] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0116.175] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de33c, cchWideChar=1 | out: lpWideCharStr=" shadows /all /quiet\n") returned 1 [0116.175] _get_osfhandle (_FileHandle=0) returned 0xa4 [0116.175] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0116.175] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0116.176] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de33e, cchWideChar=1 | out: lpWideCharStr="cshadows /all /quiet\n") returned 1 [0116.176] _get_osfhandle (_FileHandle=0) returned 0xa4 [0116.176] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0116.176] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0116.176] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de340, cchWideChar=1 | out: lpWideCharStr="ahadows /all /quiet\n") returned 1 [0116.176] _get_osfhandle (_FileHandle=0) returned 0xa4 [0116.176] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0116.176] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0116.176] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de342, cchWideChar=1 | out: lpWideCharStr="tadows /all /quiet\n") returned 1 [0116.176] _get_osfhandle (_FileHandle=0) returned 0xa4 [0116.176] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0116.176] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0116.176] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de344, cchWideChar=1 | out: lpWideCharStr="adows /all /quiet\n") returned 1 [0116.176] _get_osfhandle (_FileHandle=0) returned 0xa4 [0116.176] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0116.176] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0116.176] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de346, cchWideChar=1 | out: lpWideCharStr="lows /all /quiet\n") returned 1 [0116.176] _get_osfhandle (_FileHandle=0) returned 0xa4 [0116.176] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0116.176] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0116.176] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de348, cchWideChar=1 | out: lpWideCharStr="ows /all /quiet\n") returned 1 [0116.176] _get_osfhandle (_FileHandle=0) returned 0xa4 [0116.176] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0116.176] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0116.177] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de34a, cchWideChar=1 | out: lpWideCharStr="gs /all /quiet\n") returned 1 [0116.177] _get_osfhandle (_FileHandle=0) returned 0xa4 [0116.177] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0116.177] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0116.177] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de34c, cchWideChar=1 | out: lpWideCharStr=" /all /quiet\n") returned 1 [0116.177] _get_osfhandle (_FileHandle=0) returned 0xa4 [0116.177] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0116.177] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0116.177] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de34e, cchWideChar=1 | out: lpWideCharStr="-/all /quiet\n") returned 1 [0116.177] _get_osfhandle (_FileHandle=0) returned 0xa4 [0116.177] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0116.177] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0116.177] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de350, cchWideChar=1 | out: lpWideCharStr="qall /quiet\n") returned 1 [0116.177] _get_osfhandle (_FileHandle=0) returned 0xa4 [0116.177] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0116.177] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0116.177] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de352, cchWideChar=1 | out: lpWideCharStr="ull /quiet\n") returned 1 [0116.177] _get_osfhandle (_FileHandle=0) returned 0xa4 [0116.177] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0116.177] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0116.177] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de354, cchWideChar=1 | out: lpWideCharStr="il /quiet\n") returned 1 [0116.177] _get_osfhandle (_FileHandle=0) returned 0xa4 [0116.177] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0116.177] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0116.177] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de356, cchWideChar=1 | out: lpWideCharStr="e /quiet\n") returned 1 [0116.177] _get_osfhandle (_FileHandle=0) returned 0xa4 [0116.177] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0116.177] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0116.178] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de358, cchWideChar=1 | out: lpWideCharStr="t/quiet\n") returned 1 [0116.178] _get_osfhandle (_FileHandle=0) returned 0xa4 [0116.178] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0116.178] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0116.178] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de35a, cchWideChar=1 | out: lpWideCharStr="\nquiet\n") returned 1 [0116.178] _get_osfhandle (_FileHandle=0) returned 0xa4 [0116.178] GetFileType (hFile=0xa4) returned 0x3 [0116.178] _get_osfhandle (_FileHandle=0) returned 0xa4 [0116.178] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0116.178] _get_osfhandle (_FileHandle=1) returned 0x10c [0116.178] GetFileType (hFile=0x10c) returned 0x3 [0116.178] _get_osfhandle (_FileHandle=1) returned 0x10c [0116.178] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="wbadmin delete catalog -quiet\n", cchWideChar=-1, lpMultiByteStr=0x4a0dc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wbadmin delete catalog -quiet\n", lpUsedDefaultChar=0x0) returned 31 [0116.178] WriteFile (in: hFile=0x10c, lpBuffer=0x4a0dc320*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x30f778, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesWritten=0x30f778*=0x1e, lpOverlapped=0x0) returned 1 [0116.178] GetProcessHeap () returned 0x4c0000 [0116.178] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x4012) returned 0x4df670 [0116.178] GetProcessHeap () returned 0x4c0000 [0116.178] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4df670 | out: hHeap=0x4c0000) returned 1 [0116.178] GetProcessHeap () returned 0x4c0000 [0116.179] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0xb0) returned 0x4d97f0 [0116.179] GetProcessHeap () returned 0x4c0000 [0116.179] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x20) returned 0x4d4610 [0116.179] GetProcessHeap () returned 0x4c0000 [0116.179] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x3e) returned 0x4daa40 [0116.179] GetConsoleOutputCP () returned 0x1b5 [0116.179] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a0dbfe0 | out: lpCPInfo=0x4a0dbfe0) returned 1 [0116.179] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0116.180] GetConsoleTitleW (in: lpConsoleTitle=0x30f730, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0116.180] GetProcessHeap () returned 0x4c0000 [0116.180] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x218) returned 0x4c1ab0 [0116.180] GetProcessHeap () returned 0x4c0000 [0116.180] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x4e) returned 0x4c1cd0 [0116.180] GetProcessHeap () returned 0x4c0000 [0116.180] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x420) returned 0x4dba10 [0116.180] SetErrorMode (uMode=0x0) returned 0x1 [0116.180] SetErrorMode (uMode=0x1) returned 0x0 [0116.180] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4dba20, lpFilePart=0x30efc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", lpFilePart=0x30efc0*="Roaming") returned 0x2d [0116.180] SetErrorMode (uMode=0x1) returned 0x1 [0116.180] GetProcessHeap () returned 0x4c0000 [0116.180] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4dba10, Size=0x7c) returned 0x4dba10 [0116.180] GetProcessHeap () returned 0x4c0000 [0116.180] RtlSizeHeap (HeapHandle=0x4c0000, Flags=0x0, MemoryPointer=0x4dba10) returned 0x7c [0116.180] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a0cf360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0116.180] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0116.180] GetProcessHeap () returned 0x4c0000 [0116.180] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x138) returned 0x4d5b70 [0116.180] GetProcessHeap () returned 0x4c0000 [0116.180] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x260) returned 0x4d9920 [0116.180] GetProcessHeap () returned 0x4c0000 [0116.180] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4d9920, Size=0x13a) returned 0x4d9920 [0116.181] GetProcessHeap () returned 0x4c0000 [0116.181] RtlSizeHeap (HeapHandle=0x4c0000, Flags=0x0, MemoryPointer=0x4d9920) returned 0x13a [0116.181] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a0cf360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0116.181] GetProcessHeap () returned 0x4c0000 [0116.181] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0xe8) returned 0x4d9a70 [0116.181] GetProcessHeap () returned 0x4c0000 [0116.181] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4d9a70, Size=0x7e) returned 0x4d9a70 [0116.181] GetProcessHeap () returned 0x4c0000 [0116.181] RtlSizeHeap (HeapHandle=0x4c0000, Flags=0x0, MemoryPointer=0x4d9a70) returned 0x7e [0116.181] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0116.181] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\wbadmin.*", fInfoLevelId=0x1, lpFindFileData=0x30ed30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x30ed30) returned 0xffffffffffffffff [0116.181] GetLastError () returned 0x2 [0116.181] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\wbadmin", fInfoLevelId=0x1, lpFindFileData=0x30ed30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x30ed30) returned 0xffffffffffffffff [0116.182] GetLastError () returned 0x2 [0116.182] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0116.182] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\wbadmin.*", fInfoLevelId=0x1, lpFindFileData=0x30ed30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x30ed30) returned 0x4c1d30 [0116.182] FindClose (in: hFindFile=0x4c1d30 | out: hFindFile=0x4c1d30) returned 1 [0116.182] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\wbadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x30ed30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x30ed30) returned 0xffffffffffffffff [0116.182] GetLastError () returned 0x2 [0116.182] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\wbadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x30ed30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x30ed30) returned 0x4c1d30 [0116.182] FindClose (in: hFindFile=0x4c1d30 | out: hFindFile=0x4c1d30) returned 1 [0116.182] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0116.182] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0116.182] GetConsoleTitleW (in: lpConsoleTitle=0x30f280, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0116.182] GetProcessHeap () returned 0x4c0000 [0116.182] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x21c) returned 0x4dbaa0 [0116.183] GetConsoleTitleW (in: lpConsoleTitle=0x4dbab0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0116.183] GetProcessHeap () returned 0x4c0000 [0116.183] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4dbaa0, Size=0xb4) returned 0x4dbaa0 [0116.183] GetProcessHeap () returned 0x4c0000 [0116.183] RtlSizeHeap (HeapHandle=0x4c0000, Flags=0x0, MemoryPointer=0x4dbaa0) returned 0xb4 [0116.183] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - wbadmin delete catalog -quiet") returned 1 [0116.183] GetProcessHeap () returned 0x4c0000 [0116.183] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4dbaa0 | out: hHeap=0x4c0000) returned 1 [0116.183] InitializeProcThreadAttributeList (in: lpAttributeList=0x30f038, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x30eff8 | out: lpAttributeList=0x30f038, lpSize=0x30eff8) returned 1 [0116.183] UpdateProcThreadAttribute (in: lpAttributeList=0x30f038, dwFlags=0x0, Attribute=0x60001, lpValue=0x30efe8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x30f038, lpPreviousValue=0x0) returned 1 [0116.183] GetStartupInfoW (in: lpStartupInfo=0x30f150 | out: lpStartupInfo=0x30f150*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xa4, hStdOutput=0x10c, hStdError=0x10c)) [0116.183] GetProcessHeap () returned 0x4c0000 [0116.183] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x20) returned 0x4d4640 [0116.184] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0116.184] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0116.184] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0116.184] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0116.184] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0116.184] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0116.184] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0116.184] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0116.184] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0116.184] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0116.184] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0116.184] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0116.184] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0116.184] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0116.184] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0116.184] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0116.184] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0116.184] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0116.184] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0116.184] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0116.184] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0116.184] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0116.184] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0116.184] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0116.184] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0116.184] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0116.184] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0116.184] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0116.184] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0116.184] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0116.184] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0116.184] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0116.184] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0116.184] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0116.185] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0116.185] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0116.185] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0116.185] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0116.185] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0116.185] GetProcessHeap () returned 0x4c0000 [0116.185] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4d4640 | out: hHeap=0x4c0000) returned 1 [0116.185] GetProcessHeap () returned 0x4c0000 [0116.185] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x12) returned 0x4d8900 [0116.185] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\wbadmin.exe", lpCommandLine="wbadmin delete catalog -quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", lpStartupInfo=0x30f070*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="wbadmin delete catalog -quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x30f020 | out: lpCommandLine="wbadmin delete catalog -quiet", lpProcessInformation=0x30f020*(hProcess=0x50, hThread=0x54, dwProcessId=0xae8, dwThreadId=0xad4)) returned 1 [0116.445] CloseHandle (hObject=0x54) returned 1 [0116.445] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0116.445] GetProcessHeap () returned 0x4c0000 [0116.445] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4deb40 | out: hHeap=0x4c0000) returned 1 [0116.445] GetEnvironmentStringsW () returned 0x4deb40* [0116.445] GetProcessHeap () returned 0x4c0000 [0116.445] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0xb1e) returned 0x4d8980 [0116.445] FreeEnvironmentStringsW (penv=0x4deb40) returned 1 [0116.445] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x30e928, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x30e928, ReturnLength=0x0) returned 0x0 [0116.445] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffdd000, lpBuffer=0x30e960, nSize=0x380, lpNumberOfBytesRead=0x30e920 | out: lpBuffer=0x30e960*, lpNumberOfBytesRead=0x30e920*=0x380) returned 1 [0116.446] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0117.615] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x30ef68 | out: lpExitCode=0x30ef68*=0x0) returned 1 [0117.615] CloseHandle (hObject=0x50) returned 1 [0117.615] _vsnwprintf (in: _Buffer=0x30f1d8, _BufferCount=0x13, _Format="%08X", _ArgList=0x30ef78 | out: _Buffer="00000000") returned 8 [0117.615] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0117.615] GetProcessHeap () returned 0x4c0000 [0117.615] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4d8980 | out: hHeap=0x4c0000) returned 1 [0117.615] GetEnvironmentStringsW () returned 0x4deb40* [0117.615] GetProcessHeap () returned 0x4c0000 [0117.616] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0xb1e) returned 0x4d8980 [0117.616] FreeEnvironmentStringsW (penv=0x4deb40) returned 1 [0117.616] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0117.616] GetProcessHeap () returned 0x4c0000 [0117.616] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4d8980 | out: hHeap=0x4c0000) returned 1 [0117.616] GetEnvironmentStringsW () returned 0x4deb40* [0117.616] GetProcessHeap () returned 0x4c0000 [0117.616] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0xb1e) returned 0x4d8980 [0117.616] FreeEnvironmentStringsW (penv=0x4deb40) returned 1 [0117.616] GetProcessHeap () returned 0x4c0000 [0117.616] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4d8900 | out: hHeap=0x4c0000) returned 1 [0117.616] DeleteProcThreadAttributeList (in: lpAttributeList=0x30f038 | out: lpAttributeList=0x30f038) [0117.616] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0117.618] _get_osfhandle (_FileHandle=1) returned 0x10c [0117.618] SetConsoleMode (hConsoleHandle=0x10c, dwMode=0x0) returned 0 [0117.618] _get_osfhandle (_FileHandle=1) returned 0x10c [0117.618] GetConsoleMode (in: hConsoleHandle=0x10c, lpMode=0x4a0ce194 | out: lpMode=0x4a0ce194) returned 0 [0117.618] _get_osfhandle (_FileHandle=0) returned 0xa4 [0117.618] GetConsoleMode (in: hConsoleHandle=0xa4, lpMode=0x4a0ce198 | out: lpMode=0x4a0ce198) returned 0 [0117.619] GetConsoleOutputCP () returned 0x1b5 [0117.619] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a0dbfe0 | out: lpCPInfo=0x4a0dbfe0) returned 1 [0117.619] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0117.619] GetProcessHeap () returned 0x4c0000 [0117.619] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4d9a70 | out: hHeap=0x4c0000) returned 1 [0117.619] GetProcessHeap () returned 0x4c0000 [0117.619] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4d9920 | out: hHeap=0x4c0000) returned 1 [0117.619] GetProcessHeap () returned 0x4c0000 [0117.619] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4d5b70 | out: hHeap=0x4c0000) returned 1 [0117.619] GetProcessHeap () returned 0x4c0000 [0117.619] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4dba10 | out: hHeap=0x4c0000) returned 1 [0117.620] GetProcessHeap () returned 0x4c0000 [0117.620] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4c1cd0 | out: hHeap=0x4c0000) returned 1 [0117.620] GetProcessHeap () returned 0x4c0000 [0117.620] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4c1ab0 | out: hHeap=0x4c0000) returned 1 [0117.620] GetProcessHeap () returned 0x4c0000 [0117.620] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4daa40 | out: hHeap=0x4c0000) returned 1 [0117.620] GetProcessHeap () returned 0x4c0000 [0117.620] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4d4610 | out: hHeap=0x4c0000) returned 1 [0117.620] GetProcessHeap () returned 0x4c0000 [0117.620] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4d97f0 | out: hHeap=0x4c0000) returned 1 [0117.620] _vsnwprintf (in: _Buffer=0x4a0e6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x30f498 | out: _Buffer="\r\n") returned 2 [0117.620] _get_osfhandle (_FileHandle=1) returned 0x10c [0117.620] GetFileType (hFile=0x10c) returned 0x3 [0117.620] _get_osfhandle (_FileHandle=1) returned 0x10c [0117.620] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0dc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0117.620] WriteFile (in: hFile=0x10c, lpBuffer=0x4a0dc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x30f468, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesWritten=0x30f468*=0x2, lpOverlapped=0x0) returned 1 [0117.620] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a0cf360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0117.620] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a0dc0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0117.620] _vsnwprintf (in: _Buffer=0x4a0ceb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x30f4a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 45 [0117.621] _vsnwprintf (in: _Buffer=0x4a0cebba, _BufferCount=0x3d1, _Format="%c", _ArgList=0x30f4a8 | out: _Buffer=">") returned 1 [0117.621] _get_osfhandle (_FileHandle=1) returned 0x10c [0117.621] GetFileType (hFile=0x10c) returned 0x3 [0117.621] _get_osfhandle (_FileHandle=1) returned 0x10c [0117.621] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming>", cchWideChar=-1, lpMultiByteStr=0x4a0dc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming>", lpUsedDefaultChar=0x0) returned 47 [0117.621] WriteFile (in: hFile=0x10c, lpBuffer=0x4a0dc320*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x30f498, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesWritten=0x30f498*=0x2e, lpOverlapped=0x0) returned 1 [0117.621] _get_osfhandle (_FileHandle=0) returned 0xa4 [0117.621] GetFileType (hFile=0xa4) returned 0x3 [0117.621] _get_osfhandle (_FileHandle=0) returned 0xa4 [0117.621] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.621] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0117.621] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de320, cchWideChar=1 | out: lpWideCharStr="wbadmin delete catalog -quiet\nquiet\n") returned 1 [0117.621] _get_osfhandle (_FileHandle=0) returned 0xa4 [0117.621] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.621] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0117.621] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de322, cchWideChar=1 | out: lpWideCharStr="madmin delete catalog -quiet\nquiet\n") returned 1 [0117.621] _get_osfhandle (_FileHandle=0) returned 0xa4 [0117.621] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.622] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0117.622] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de324, cchWideChar=1 | out: lpWideCharStr="idmin delete catalog -quiet\nquiet\n") returned 1 [0117.622] _get_osfhandle (_FileHandle=0) returned 0xa4 [0117.622] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.622] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0117.622] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de326, cchWideChar=1 | out: lpWideCharStr="cmin delete catalog -quiet\nquiet\n") returned 1 [0117.622] _get_osfhandle (_FileHandle=0) returned 0xa4 [0117.622] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.622] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0117.622] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de328, cchWideChar=1 | out: lpWideCharStr=" in delete catalog -quiet\nquiet\n") returned 1 [0117.622] _get_osfhandle (_FileHandle=0) returned 0xa4 [0117.622] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.622] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0117.622] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de32a, cchWideChar=1 | out: lpWideCharStr="sn delete catalog -quiet\nquiet\n") returned 1 [0117.622] _get_osfhandle (_FileHandle=0) returned 0xa4 [0117.622] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.622] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0117.622] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de32c, cchWideChar=1 | out: lpWideCharStr="h delete catalog -quiet\nquiet\n") returned 1 [0117.622] _get_osfhandle (_FileHandle=0) returned 0xa4 [0117.622] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.622] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0117.622] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de32e, cchWideChar=1 | out: lpWideCharStr="adelete catalog -quiet\nquiet\n") returned 1 [0117.623] _get_osfhandle (_FileHandle=0) returned 0xa4 [0117.623] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.623] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0117.623] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de330, cchWideChar=1 | out: lpWideCharStr="delete catalog -quiet\nquiet\n") returned 1 [0117.623] _get_osfhandle (_FileHandle=0) returned 0xa4 [0117.623] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.623] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0117.623] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de332, cchWideChar=1 | out: lpWideCharStr="olete catalog -quiet\nquiet\n") returned 1 [0117.623] _get_osfhandle (_FileHandle=0) returned 0xa4 [0117.623] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.623] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0117.623] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de334, cchWideChar=1 | out: lpWideCharStr="wete catalog -quiet\nquiet\n") returned 1 [0117.623] _get_osfhandle (_FileHandle=0) returned 0xa4 [0117.623] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.623] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0117.623] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de336, cchWideChar=1 | out: lpWideCharStr="cte catalog -quiet\nquiet\n") returned 1 [0117.623] _get_osfhandle (_FileHandle=0) returned 0xa4 [0117.623] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.623] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0117.623] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de338, cchWideChar=1 | out: lpWideCharStr="oe catalog -quiet\nquiet\n") returned 1 [0117.624] _get_osfhandle (_FileHandle=0) returned 0xa4 [0117.624] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.624] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0117.624] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de33a, cchWideChar=1 | out: lpWideCharStr="p catalog -quiet\nquiet\n") returned 1 [0117.624] _get_osfhandle (_FileHandle=0) returned 0xa4 [0117.624] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.624] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0117.624] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de33c, cchWideChar=1 | out: lpWideCharStr="ycatalog -quiet\nquiet\n") returned 1 [0117.624] _get_osfhandle (_FileHandle=0) returned 0xa4 [0117.624] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.624] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0117.624] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de33e, cchWideChar=1 | out: lpWideCharStr=" atalog -quiet\nquiet\n") returned 1 [0117.624] _get_osfhandle (_FileHandle=0) returned 0xa4 [0117.624] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.624] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0117.624] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de340, cchWideChar=1 | out: lpWideCharStr="dtalog -quiet\nquiet\n") returned 1 [0117.625] _get_osfhandle (_FileHandle=0) returned 0xa4 [0117.625] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.625] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0117.625] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de342, cchWideChar=1 | out: lpWideCharStr="ealog -quiet\nquiet\n") returned 1 [0117.625] _get_osfhandle (_FileHandle=0) returned 0xa4 [0117.625] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.625] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0117.625] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de344, cchWideChar=1 | out: lpWideCharStr="llog -quiet\nquiet\n") returned 1 [0117.625] _get_osfhandle (_FileHandle=0) returned 0xa4 [0117.625] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.625] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0117.625] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de346, cchWideChar=1 | out: lpWideCharStr="eog -quiet\nquiet\n") returned 1 [0117.625] _get_osfhandle (_FileHandle=0) returned 0xa4 [0117.625] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.625] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0117.625] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de348, cchWideChar=1 | out: lpWideCharStr="tg -quiet\nquiet\n") returned 1 [0117.625] _get_osfhandle (_FileHandle=0) returned 0xa4 [0117.625] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.625] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0117.625] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de34a, cchWideChar=1 | out: lpWideCharStr="e -quiet\nquiet\n") returned 1 [0117.626] _get_osfhandle (_FileHandle=0) returned 0xa4 [0117.626] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.626] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0117.626] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de34c, cchWideChar=1 | out: lpWideCharStr="\n-quiet\nquiet\n") returned 1 [0117.626] _get_osfhandle (_FileHandle=0) returned 0xa4 [0117.626] GetFileType (hFile=0xa4) returned 0x3 [0117.626] _get_osfhandle (_FileHandle=0) returned 0xa4 [0117.626] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.626] _get_osfhandle (_FileHandle=1) returned 0x10c [0117.626] GetFileType (hFile=0x10c) returned 0x3 [0117.626] _get_osfhandle (_FileHandle=1) returned 0x10c [0117.626] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="wmic shadowcopy delete\n", cchWideChar=-1, lpMultiByteStr=0x4a0dc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmic shadowcopy delete\n", lpUsedDefaultChar=0x0) returned 24 [0117.626] WriteFile (in: hFile=0x10c, lpBuffer=0x4a0dc320*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x30f778, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesWritten=0x30f778*=0x17, lpOverlapped=0x0) returned 1 [0117.626] GetProcessHeap () returned 0x4c0000 [0117.626] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x4012) returned 0x4e1670 [0117.626] GetProcessHeap () returned 0x4c0000 [0117.626] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4e1670 | out: hHeap=0x4c0000) returned 1 [0117.626] GetProcessHeap () returned 0x4c0000 [0117.626] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0xb0) returned 0x4df6a0 [0117.626] GetProcessHeap () returned 0x4c0000 [0117.626] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4d4610 [0117.627] GetProcessHeap () returned 0x4c0000 [0117.627] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x36) returned 0x4d6510 [0117.627] GetConsoleOutputCP () returned 0x1b5 [0117.627] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a0dbfe0 | out: lpCPInfo=0x4a0dbfe0) returned 1 [0117.627] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0117.627] GetConsoleTitleW (in: lpConsoleTitle=0x30f730, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0117.627] GetProcessHeap () returned 0x4c0000 [0117.627] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x218) returned 0x4c1ab0 [0117.627] GetProcessHeap () returned 0x4c0000 [0117.627] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x40) returned 0x4daa40 [0117.628] GetProcessHeap () returned 0x4c0000 [0117.628] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x420) returned 0x4dba10 [0117.628] SetErrorMode (uMode=0x0) returned 0x1 [0117.628] SetErrorMode (uMode=0x1) returned 0x0 [0117.628] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4dba20, lpFilePart=0x30efc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", lpFilePart=0x30efc0*="Roaming") returned 0x2d [0117.628] SetErrorMode (uMode=0x1) returned 0x1 [0117.628] GetProcessHeap () returned 0x4c0000 [0117.628] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4dba10, Size=0x76) returned 0x4dba10 [0117.628] GetProcessHeap () returned 0x4c0000 [0117.628] RtlSizeHeap (HeapHandle=0x4c0000, Flags=0x0, MemoryPointer=0x4dba10) returned 0x76 [0117.628] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a0cf360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0117.628] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0117.628] GetProcessHeap () returned 0x4c0000 [0117.628] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x138) returned 0x4d5b70 [0117.628] GetProcessHeap () returned 0x4c0000 [0117.628] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x260) returned 0x4d9920 [0117.628] GetProcessHeap () returned 0x4c0000 [0117.628] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4d9920, Size=0x13a) returned 0x4d9920 [0117.628] GetProcessHeap () returned 0x4c0000 [0117.628] RtlSizeHeap (HeapHandle=0x4c0000, Flags=0x0, MemoryPointer=0x4d9920) returned 0x13a [0117.628] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a0cf360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0117.628] GetProcessHeap () returned 0x4c0000 [0117.628] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0xe8) returned 0x4d97f0 [0117.628] GetProcessHeap () returned 0x4c0000 [0117.628] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4d97f0, Size=0x7e) returned 0x4d97f0 [0117.628] GetProcessHeap () returned 0x4c0000 [0117.628] RtlSizeHeap (HeapHandle=0x4c0000, Flags=0x0, MemoryPointer=0x4d97f0) returned 0x7e [0117.628] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0117.629] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0x30ed30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x30ed30) returned 0xffffffffffffffff [0117.629] GetLastError () returned 0x2 [0117.629] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\wmic", fInfoLevelId=0x1, lpFindFileData=0x30ed30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x30ed30) returned 0xffffffffffffffff [0117.629] GetLastError () returned 0x2 [0117.629] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0117.629] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0x30ed30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x30ed30) returned 0xffffffffffffffff [0117.629] GetLastError () returned 0x2 [0117.629] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\wmic", fInfoLevelId=0x1, lpFindFileData=0x30ed30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x30ed30) returned 0xffffffffffffffff [0117.629] GetLastError () returned 0x2 [0117.629] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0117.630] FindFirstFileExW (in: lpFileName="C:\\Windows\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0x30ed30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x30ed30) returned 0xffffffffffffffff [0117.630] GetLastError () returned 0x2 [0117.630] FindFirstFileExW (in: lpFileName="C:\\Windows\\wmic", fInfoLevelId=0x1, lpFindFileData=0x30ed30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x30ed30) returned 0xffffffffffffffff [0117.630] GetLastError () returned 0x2 [0117.630] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0117.630] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0x30ed30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x30ed30) returned 0x4d9880 [0117.630] FindClose (in: hFindFile=0x4d9880 | out: hFindFile=0x4d9880) returned 1 [0117.630] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\WMIC.COM", fInfoLevelId=0x1, lpFindFileData=0x30ed30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x30ed30) returned 0xffffffffffffffff [0117.630] GetLastError () returned 0x2 [0117.630] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\WMIC.EXE", fInfoLevelId=0x1, lpFindFileData=0x30ed30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x30ed30) returned 0x4d9880 [0117.630] FindClose (in: hFindFile=0x4d9880 | out: hFindFile=0x4d9880) returned 1 [0117.631] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0117.631] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0117.631] GetConsoleTitleW (in: lpConsoleTitle=0x30f280, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0117.631] GetProcessHeap () returned 0x4c0000 [0117.631] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x21c) returned 0x4d9a70 [0117.631] GetConsoleTitleW (in: lpConsoleTitle=0x4d9a80, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0117.631] GetProcessHeap () returned 0x4c0000 [0117.631] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4d9a70, Size=0xa6) returned 0x4d9a70 [0117.631] GetProcessHeap () returned 0x4c0000 [0117.631] RtlSizeHeap (HeapHandle=0x4c0000, Flags=0x0, MemoryPointer=0x4d9a70) returned 0xa6 [0117.631] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - wmic shadowcopy delete") returned 1 [0117.632] GetProcessHeap () returned 0x4c0000 [0117.632] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4d9a70 | out: hHeap=0x4c0000) returned 1 [0117.632] InitializeProcThreadAttributeList (in: lpAttributeList=0x30f038, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x30eff8 | out: lpAttributeList=0x30f038, lpSize=0x30eff8) returned 1 [0117.632] UpdateProcThreadAttribute (in: lpAttributeList=0x30f038, dwFlags=0x0, Attribute=0x60001, lpValue=0x30efe8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x30f038, lpPreviousValue=0x0) returned 1 [0117.632] GetStartupInfoW (in: lpStartupInfo=0x30f150 | out: lpStartupInfo=0x30f150*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xa4, hStdOutput=0x10c, hStdError=0x10c)) [0117.632] GetProcessHeap () returned 0x4c0000 [0117.632] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x20) returned 0x4d4640 [0117.632] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0117.632] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0117.632] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0117.632] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0117.632] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0117.632] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0117.632] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0117.632] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0117.632] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0117.632] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0117.632] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0117.632] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0117.632] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0117.632] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0117.632] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0117.632] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0117.632] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0117.632] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0117.632] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0117.632] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0117.632] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0117.632] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0117.632] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0117.632] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0117.632] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0117.633] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0117.633] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0117.633] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0117.633] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0117.633] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0117.633] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0117.633] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0117.633] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0117.633] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0117.633] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0117.633] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0117.633] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0117.633] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0117.633] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0117.633] GetProcessHeap () returned 0x4c0000 [0117.633] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4d4640 | out: hHeap=0x4c0000) returned 1 [0117.633] GetProcessHeap () returned 0x4c0000 [0117.633] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x12) returned 0x4d8900 [0117.633] CreateProcessW (in: lpApplicationName="C:\\Windows\\System32\\Wbem\\WMIC.exe", lpCommandLine="wmic shadowcopy delete", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", lpStartupInfo=0x30f070*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="wmic shadowcopy delete", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x30f020 | out: lpCommandLine="wmic shadowcopy delete", lpProcessInformation=0x30f020*(hProcess=0x54, hThread=0x50, dwProcessId=0xa1c, dwThreadId=0x9e8)) returned 1 [0117.646] CloseHandle (hObject=0x50) returned 1 [0117.646] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0117.646] GetProcessHeap () returned 0x4c0000 [0117.646] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4d8980 | out: hHeap=0x4c0000) returned 1 [0117.646] GetEnvironmentStringsW () returned 0x4deb40* [0117.647] GetProcessHeap () returned 0x4c0000 [0117.647] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0xb1e) returned 0x4d8980 [0117.647] FreeEnvironmentStringsW (penv=0x4deb40) returned 1 [0117.647] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x30e928, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x30e928, ReturnLength=0x0) returned 0x0 [0117.647] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffd7000, lpBuffer=0x30e960, nSize=0x380, lpNumberOfBytesRead=0x30e920 | out: lpBuffer=0x30e960*, lpNumberOfBytesRead=0x30e920*=0x380) returned 1 [0117.647] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0131.063] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x30ef68 | out: lpExitCode=0x30ef68*=0x0) returned 1 [0131.064] CloseHandle (hObject=0x54) returned 1 [0131.064] _vsnwprintf (in: _Buffer=0x30f1d8, _BufferCount=0x13, _Format="%08X", _ArgList=0x30ef78 | out: _Buffer="00000000") returned 8 [0131.064] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0131.064] GetProcessHeap () returned 0x4c0000 [0131.064] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4d8980 | out: hHeap=0x4c0000) returned 1 [0131.064] GetEnvironmentStringsW () returned 0x4deb40* [0131.064] GetProcessHeap () returned 0x4c0000 [0131.064] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0xb1e) returned 0x4d8980 [0131.064] FreeEnvironmentStringsW (penv=0x4deb40) returned 1 [0131.064] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0131.064] GetProcessHeap () returned 0x4c0000 [0131.064] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4d8980 | out: hHeap=0x4c0000) returned 1 [0131.064] GetEnvironmentStringsW () returned 0x4deb40* [0131.064] GetProcessHeap () returned 0x4c0000 [0131.064] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0xb1e) returned 0x4d8980 [0131.064] FreeEnvironmentStringsW (penv=0x4deb40) returned 1 [0131.064] GetProcessHeap () returned 0x4c0000 [0131.065] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4d8900 | out: hHeap=0x4c0000) returned 1 [0131.065] DeleteProcThreadAttributeList (in: lpAttributeList=0x30f038 | out: lpAttributeList=0x30f038) [0131.065] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0131.065] _get_osfhandle (_FileHandle=1) returned 0x10c [0131.066] SetConsoleMode (hConsoleHandle=0x10c, dwMode=0x0) returned 0 [0131.066] _get_osfhandle (_FileHandle=1) returned 0x10c [0131.066] GetConsoleMode (in: hConsoleHandle=0x10c, lpMode=0x4a0ce194 | out: lpMode=0x4a0ce194) returned 0 [0131.066] _get_osfhandle (_FileHandle=0) returned 0xa4 [0131.066] GetConsoleMode (in: hConsoleHandle=0xa4, lpMode=0x4a0ce198 | out: lpMode=0x4a0ce198) returned 0 [0131.066] GetConsoleOutputCP () returned 0x1b5 [0131.066] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a0dbfe0 | out: lpCPInfo=0x4a0dbfe0) returned 1 [0131.066] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0131.066] GetProcessHeap () returned 0x4c0000 [0131.066] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4d97f0 | out: hHeap=0x4c0000) returned 1 [0131.066] GetProcessHeap () returned 0x4c0000 [0131.066] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4d9920 | out: hHeap=0x4c0000) returned 1 [0131.066] GetProcessHeap () returned 0x4c0000 [0131.066] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4d5b70 | out: hHeap=0x4c0000) returned 1 [0131.067] GetProcessHeap () returned 0x4c0000 [0131.067] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4dba10 | out: hHeap=0x4c0000) returned 1 [0131.067] GetProcessHeap () returned 0x4c0000 [0131.067] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4daa40 | out: hHeap=0x4c0000) returned 1 [0131.067] GetProcessHeap () returned 0x4c0000 [0131.067] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4c1ab0 | out: hHeap=0x4c0000) returned 1 [0131.067] GetProcessHeap () returned 0x4c0000 [0131.067] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4d6510 | out: hHeap=0x4c0000) returned 1 [0131.067] GetProcessHeap () returned 0x4c0000 [0131.067] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4d4610 | out: hHeap=0x4c0000) returned 1 [0131.067] GetProcessHeap () returned 0x4c0000 [0131.067] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4df6a0 | out: hHeap=0x4c0000) returned 1 [0131.067] _vsnwprintf (in: _Buffer=0x4a0e6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x30f498 | out: _Buffer="\r\n") returned 2 [0131.067] _get_osfhandle (_FileHandle=1) returned 0x10c [0131.067] GetFileType (hFile=0x10c) returned 0x3 [0131.067] _get_osfhandle (_FileHandle=1) returned 0x10c [0131.067] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0dc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0131.067] WriteFile (in: hFile=0x10c, lpBuffer=0x4a0dc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x30f468, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesWritten=0x30f468*=0x2, lpOverlapped=0x0) returned 1 [0131.067] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a0cf360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0131.067] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a0dc0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0131.067] _vsnwprintf (in: _Buffer=0x4a0ceb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x30f4a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 45 [0131.067] _vsnwprintf (in: _Buffer=0x4a0cebba, _BufferCount=0x3d1, _Format="%c", _ArgList=0x30f4a8 | out: _Buffer=">") returned 1 [0131.067] _get_osfhandle (_FileHandle=1) returned 0x10c [0131.068] GetFileType (hFile=0x10c) returned 0x3 [0131.068] _get_osfhandle (_FileHandle=1) returned 0x10c [0131.068] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming>", cchWideChar=-1, lpMultiByteStr=0x4a0dc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming>", lpUsedDefaultChar=0x0) returned 47 [0131.068] WriteFile (in: hFile=0x10c, lpBuffer=0x4a0dc320*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x30f498, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesWritten=0x30f498*=0x2e, lpOverlapped=0x0) returned 1 [0131.068] _get_osfhandle (_FileHandle=0) returned 0xa4 [0131.068] GetFileType (hFile=0xa4) returned 0x3 [0131.068] _get_osfhandle (_FileHandle=0) returned 0xa4 [0131.068] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.068] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0131.068] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de320, cchWideChar=1 | out: lpWideCharStr="emic shadowcopy delete\n-quiet\nquiet\n") returned 1 [0131.068] _get_osfhandle (_FileHandle=0) returned 0xa4 [0131.068] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.068] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0131.068] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de322, cchWideChar=1 | out: lpWideCharStr="xic shadowcopy delete\n-quiet\nquiet\n") returned 1 [0131.068] _get_osfhandle (_FileHandle=0) returned 0xa4 [0131.068] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.068] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0131.068] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de324, cchWideChar=1 | out: lpWideCharStr="ic shadowcopy delete\n-quiet\nquiet\n") returned 1 [0131.068] _get_osfhandle (_FileHandle=0) returned 0xa4 [0131.068] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.068] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0131.068] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de326, cchWideChar=1 | out: lpWideCharStr="t shadowcopy delete\n-quiet\nquiet\n") returned 1 [0131.068] _get_osfhandle (_FileHandle=0) returned 0xa4 [0131.069] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.069] ReadFile (in: hFile=0xa4, lpBuffer=0x4a0dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f798, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesRead=0x30f798*=0x1, lpOverlapped=0x0) returned 1 [0131.069] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0dc320, cbMultiByte=1, lpWideCharStr=0x4a0de328, cchWideChar=1 | out: lpWideCharStr="\nshadowcopy delete\n-quiet\nquiet\n") returned 1 [0131.069] _get_osfhandle (_FileHandle=0) returned 0xa4 [0131.069] GetFileType (hFile=0xa4) returned 0x3 [0131.069] _get_osfhandle (_FileHandle=0) returned 0xa4 [0131.069] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.069] _get_osfhandle (_FileHandle=1) returned 0x10c [0131.069] GetFileType (hFile=0x10c) returned 0x3 [0131.069] _get_osfhandle (_FileHandle=1) returned 0x10c [0131.069] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="exit\n", cchWideChar=-1, lpMultiByteStr=0x4a0dc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="exit\n", lpUsedDefaultChar=0x0) returned 6 [0131.069] WriteFile (in: hFile=0x10c, lpBuffer=0x4a0dc320*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x30f778, lpOverlapped=0x0 | out: lpBuffer=0x4a0dc320*, lpNumberOfBytesWritten=0x30f778*=0x5, lpOverlapped=0x0) returned 1 [0131.069] GetProcessHeap () returned 0x4c0000 [0131.069] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x4012) returned 0x4e1670 [0131.069] GetProcessHeap () returned 0x4c0000 [0131.069] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4e1670 | out: hHeap=0x4c0000) returned 1 [0131.069] GetProcessHeap () returned 0x4c0000 [0131.069] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0xb0) returned 0x4df6a0 [0131.069] GetProcessHeap () returned 0x4c0000 [0131.069] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4d4610 [0131.069] GetConsoleOutputCP () returned 0x1b5 [0131.070] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a0dbfe0 | out: lpCPInfo=0x4a0dbfe0) returned 1 [0131.070] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0131.070] GetConsoleTitleW (in: lpConsoleTitle=0x30f730, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0131.070] GetProcessHeap () returned 0x4c0000 [0131.070] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x14) returned 0x4d8900 [0131.070] GetProcessHeap () returned 0x4c0000 [0131.070] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4d4640 [0131.070] GetProcessHeap () returned 0x4c0000 [0131.070] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x21c) returned 0x4c1ab0 [0131.070] GetConsoleTitleW (in: lpConsoleTitle=0x4c1ac0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0131.070] GetProcessHeap () returned 0x4c0000 [0131.070] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4c1ab0, Size=0x80) returned 0x4c1ab0 [0131.070] GetProcessHeap () returned 0x4c0000 [0131.070] RtlSizeHeap (HeapHandle=0x4c0000, Flags=0x0, MemoryPointer=0x4c1ab0) returned 0x80 [0131.070] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - exit") returned 1 [0131.071] GetProcessHeap () returned 0x4c0000 [0131.071] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4c1ab0 | out: hHeap=0x4c0000) returned 1 [0131.071] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 1 [0131.072] exit (_Code=0) Process: id = "5" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x4075c000" os_pid = "0x544" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "4" os_parent_pid = "0x5dc" cmd_line = "vssadmin delete shadows /all /quiet" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 10 os_tid = 0x664 Thread: id = 11 os_tid = 0x644 Thread: id = 12 os_tid = 0x124 Thread: id = 13 os_tid = 0x7d0 Thread: id = 14 os_tid = 0x7e4 Process: id = "6" image_name = "vssvc.exe" filename = "c:\\windows\\system32\\vssvc.exe" page_root = "0x41020000" os_pid = "0x410" os_integrity_level = "0x4000" os_privileges = "0xe60b7e890" monitor_reason = "rpc_server" parent_id = "5" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\system32\\vssvc.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\VSS" [0xe], "NT AUTHORITY\\Logon Session 00000000:0005b555" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 15 os_tid = 0x7f4 Thread: id = 16 os_tid = 0x490 Thread: id = 17 os_tid = 0x600 Thread: id = 18 os_tid = 0x208 [0081.747] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xdbdae0 | out: lpSystemTimeAsFileTime=0xdbdae0*(dwLowDateTime=0xed0d5230, dwHighDateTime=0x1d6eae2)) [0081.747] GetCurrentProcessId () returned 0x410 [0081.747] GetCurrentThreadId () returned 0x208 [0081.747] GetTickCount () returned 0x114937a [0081.747] QueryPerformanceCounter (in: lpPerformanceCount=0xdbdae8 | out: lpPerformanceCount=0xdbdae8*=18930437969) returned 1 [0081.747] malloc (_Size=0x100) returned 0x128e80 Thread: id = 19 os_tid = 0x598 Thread: id = 20 os_tid = 0x71c Thread: id = 21 os_tid = 0x25c Thread: id = 22 os_tid = 0x15c Thread: id = 35 os_tid = 0xb08 Thread: id = 41 os_tid = 0xab4 Process: id = "7" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x41625000" os_pid = "0x6a8" os_integrity_level = "0x4000" os_privileges = "0x60814080" monitor_reason = "rpc_server" parent_id = "6" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\System32\\svchost.exe -k swprv" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\swprv" [0xe], "NT AUTHORITY\\Logon Session 00000000:0005b9fa" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 23 os_tid = 0x83c Thread: id = 24 os_tid = 0x82c Thread: id = 25 os_tid = 0x81c Thread: id = 26 os_tid = 0x80c Thread: id = 27 os_tid = 0x434 Thread: id = 28 os_tid = 0x51c Thread: id = 36 os_tid = 0xaf8 Thread: id = 40 os_tid = 0xab0 Process: id = "8" image_name = "qdgotnx2vapbkvcb.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qdgotnx2vapbkvcb.exe" page_root = "0x3ca61000" os_pid = "0x9cc" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x244" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QDgotnX2VapbkvCb.exe\" n656" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 29 os_tid = 0x9d0 [0100.273] GetProcessHeap () returned 0x540000 [0100.273] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1) returned 0x543438 [0100.273] GetProcessHeap () returned 0x540000 [0100.273] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5501c0 [0100.274] CryptAcquireContextW (in: phProv=0x5501c0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x5501c0*=0x5505a0) returned 1 [0100.286] GetProcessHeap () returned 0x540000 [0100.286] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x54fcf8 [0100.286] CryptImportKey (in: hProv=0x5505a0, pbData=0x18fee0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x5501c4 | out: phKey=0x5501c4*=0x550458) returned 1 [0100.286] CryptDecrypt (in: hKey=0x550458, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x54fcf8, pdwDataLen=0x18ff44 | out: pbData=0x54fcf8, pdwDataLen=0x18ff44) returned 1 [0100.286] CryptDestroyKey (hKey=0x550458) returned 1 [0100.287] GetProcessHeap () returned 0x540000 [0100.287] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x550668 [0100.287] GetProcessHeap () returned 0x540000 [0100.287] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd) returned 0x54e1c0 [0100.287] GetProcessHeap () returned 0x540000 [0100.287] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x11) returned 0x550458 [0100.287] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x77710000 [0100.287] GetProcAddress (hModule=0x77710000, lpProcName="CryptSetKeyParam") returned 0x777377b3 [0100.287] GetProcessHeap () returned 0x540000 [0100.287] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x54fcf8 | out: hHeap=0x540000) returned 1 [0100.287] GetProcessHeap () returned 0x540000 [0100.287] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa0) returned 0x550e58 [0100.287] CryptImportKey (in: hProv=0x5505a0, pbData=0x18fee0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x5501c4 | out: phKey=0x5501c4*=0x5501f8) returned 1 [0100.287] CryptDecrypt (in: hKey=0x5501f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x550e58, pdwDataLen=0x5501e8 | out: pbData=0x550e58, pdwDataLen=0x5501e8) returned 1 [0100.287] CryptDestroyKey (hKey=0x5501f8) returned 1 [0100.287] GetProcessHeap () returned 0x540000 [0100.287] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x54e1c0 | out: hHeap=0x540000) returned 1 [0100.287] GetProcessHeap () returned 0x540000 [0100.287] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x550458 | out: hHeap=0x540000) returned 1 [0100.287] GetProcessHeap () returned 0x540000 [0100.287] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x550668 | out: hHeap=0x540000) returned 1 [0100.287] GetProcessHeap () returned 0x540000 [0100.287] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x550668 [0100.287] GetProcessHeap () returned 0x540000 [0100.287] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x54e1c0 [0100.288] GetProcessHeap () returned 0x540000 [0100.288] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x54fcf8 [0100.288] CryptImportKey (in: hProv=0x5505a0, pbData=0x18fef0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x5501c4 | out: phKey=0x5501c4*=0x550458) returned 1 [0100.288] CryptDecrypt (in: hKey=0x550458, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x54fcf8, pdwDataLen=0x18ff4c | out: pbData=0x54fcf8, pdwDataLen=0x18ff4c) returned 1 [0100.288] CryptDestroyKey (hKey=0x550458) returned 1 [0100.288] GetProcessHeap () returned 0x540000 [0100.288] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x54fed8 [0100.288] CryptImportKey (in: hProv=0x5505a0, pbData=0x18fef0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x5501c4 | out: phKey=0x5501c4*=0x550458) returned 1 [0100.288] CryptDecrypt (in: hKey=0x550458, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x54fed8, pdwDataLen=0x18ff4c | out: pbData=0x54fed8, pdwDataLen=0x18ff4c) returned 1 [0100.288] CryptDestroyKey (hKey=0x550458) returned 1 [0100.288] GetProcessHeap () returned 0x540000 [0100.288] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x5501f8 [0100.288] CryptImportKey (in: hProv=0x5505a0, pbData=0x18fef0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x5501c4 | out: phKey=0x5501c4*=0x550458) returned 1 [0100.288] CryptDecrypt (in: hKey=0x550458, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5501f8, pdwDataLen=0x18ff4c | out: pbData=0x5501f8, pdwDataLen=0x18ff4c) returned 1 [0100.288] CryptDestroyKey (hKey=0x550458) returned 1 [0100.288] GetProcessHeap () returned 0x540000 [0100.288] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x550240 [0100.288] GetProcessHeap () returned 0x540000 [0100.288] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc0) returned 0x550f00 [0100.288] CryptImportKey (in: hProv=0x5505a0, pbData=0x18ff04, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x5501c4 | out: phKey=0x5501c4*=0x550458) returned 1 [0100.288] CryptDecrypt (in: hKey=0x550458, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x550f00, pdwDataLen=0x18ff6c | out: pbData=0x550f00, pdwDataLen=0x18ff6c) returned 1 [0100.288] CryptDestroyKey (hKey=0x550458) returned 1 [0100.288] GetProcessHeap () returned 0x540000 [0100.288] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x54ff00 [0100.288] GetProcessHeap () returned 0x540000 [0100.288] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd) returned 0x54e1d8 [0100.288] GetProcessHeap () returned 0x540000 [0100.288] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1f) returned 0x54ff28 [0100.288] GetProcessHeap () returned 0x540000 [0100.288] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1e) returned 0x54ff50 [0100.288] GetProcessHeap () returned 0x540000 [0100.289] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd) returned 0x54e1f0 [0100.289] GetProcessHeap () returned 0x540000 [0100.289] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x18) returned 0x550250 [0100.289] GetProcessHeap () returned 0x540000 [0100.289] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x54e208 [0100.289] GetProcessHeap () returned 0x540000 [0100.289] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13) returned 0x550458 [0100.289] GetProcessHeap () returned 0x540000 [0100.289] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x18) returned 0x550478 [0100.289] GetModuleHandleA (lpModuleName="Kernel32.dll") returned 0x76d30000 [0100.289] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0100.289] GetModuleHandleA (lpModuleName="Kernel32.dll") returned 0x76d30000 [0100.289] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x76d5d668 [0100.289] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x77710000 [0100.289] GetProcAddress (hModule=0x77710000, lpProcName="CreateProcessWithTokenW") returned 0x7775531f [0100.289] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x759d0000 [0101.453] GetProcAddress (hModule=0x759d0000, lpProcName="CommandLineToArgvW") returned 0x759e9ee8 [0101.453] GetProcAddress (hModule=0x759d0000, lpProcName="SHGetSpecialFolderPathW") returned 0x759f0468 [0101.453] GetProcAddress (hModule=0x759d0000, lpProcName=0x2a8) returned 0x75a244f5 [0101.453] GetProcessHeap () returned 0x540000 [0101.453] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x550f00 | out: hHeap=0x540000) returned 1 [0101.453] GetProcessHeap () returned 0x540000 [0101.453] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x54e1d8 | out: hHeap=0x540000) returned 1 [0101.453] GetProcessHeap () returned 0x540000 [0101.453] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x54ff28 | out: hHeap=0x540000) returned 1 [0101.453] GetProcessHeap () returned 0x540000 [0101.453] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x54ff50 | out: hHeap=0x540000) returned 1 [0101.453] GetProcessHeap () returned 0x540000 [0101.453] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x54e1f0 | out: hHeap=0x540000) returned 1 [0101.453] GetProcessHeap () returned 0x540000 [0101.453] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x550250 | out: hHeap=0x540000) returned 1 [0101.453] GetProcessHeap () returned 0x540000 [0101.453] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x54e208 | out: hHeap=0x540000) returned 1 [0101.453] GetProcessHeap () returned 0x540000 [0101.453] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x550458 | out: hHeap=0x540000) returned 1 [0101.453] GetProcessHeap () returned 0x540000 [0101.453] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x550478 | out: hHeap=0x540000) returned 1 [0101.453] GetProcessHeap () returned 0x540000 [0101.454] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x54ff00 | out: hHeap=0x540000) returned 1 [0101.454] GetProcessHeap () returned 0x540000 [0101.454] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x550240 | out: hHeap=0x540000) returned 1 [0101.471] GetSystemWindowsDirectoryW (in: lpBuffer=0x419030, uSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa [0101.471] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x419238, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QDgotnX2VapbkvCb.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qdgotnx2vapbkvcb.exe")) returned 0x3a [0101.471] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x419648, csidl=0, fCreate=0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0101.482] GetVersion () returned 0x1db10106 [0101.482] GetCurrentProcess () returned 0xffffffff [0101.482] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0xf01ff, TokenHandle=0x18ff6c | out: TokenHandle=0x18ff6c*=0xa8) returned 1 [0101.482] GetTokenInformation (in: TokenHandle=0xa8, TokenInformationClass=0x14, TokenInformation=0x18ff70, TokenInformationLength=0x4, ReturnLength=0x18ff74 | out: TokenInformation=0x18ff70, ReturnLength=0x18ff74) returned 1 [0101.482] CloseHandle (hObject=0xa8) returned 1 [0101.482] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QDgotnX2VapbkvCb.exe\" n656" [0101.482] CommandLineToArgvW (in: lpCmdLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QDgotnX2VapbkvCb.exe\" n656", pNumArgs=0x18ff74 | out: pNumArgs=0x18ff74) returned 0x555a90*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QDgotnX2VapbkvCb.exe" [0101.486] GetLocaleInfoW (in: Locale=0x800, LCType=0x58, lpLCData=0x18ff50, cchData=32 | out: lpLCData="\x03") returned 16 [0101.486] GetProcessHeap () returned 0x540000 [0101.486] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x550488 [0101.486] GetProcessHeap () returned 0x540000 [0101.486] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa0) returned 0x555b28 [0101.486] CryptImportKey (in: hProv=0x5505a0, pbData=0x18fed0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x5501c4 | out: phKey=0x5501c4*=0x555898) returned 1 [0101.486] CryptDecrypt (in: hKey=0x555898, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x555b28, pdwDataLen=0x18ff3c | out: pbData=0x555b28, pdwDataLen=0x18ff3c) returned 1 [0101.487] CryptDestroyKey (hKey=0x555898) returned 1 [0101.487] GetProcessHeap () returned 0x540000 [0101.487] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x555898 [0101.487] GetProcessHeap () returned 0x540000 [0101.487] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x12) returned 0x5558a8 [0101.487] GetProcessHeap () returned 0x540000 [0101.487] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x5558c8 [0101.487] GetProcessHeap () returned 0x540000 [0101.487] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1a) returned 0x554298 [0101.487] GetProcessHeap () returned 0x540000 [0101.487] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x555bd0 [0101.487] GetProcessHeap () returned 0x540000 [0101.487] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x551788 [0101.487] GetProcessHeap () returned 0x540000 [0101.487] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x555be0 [0101.487] GetProcessHeap () returned 0x540000 [0101.487] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1a) returned 0x5542c0 [0101.487] GetProcessHeap () returned 0x540000 [0101.487] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x555bf0 [0101.487] GetProcessHeap () returned 0x540000 [0101.487] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe) returned 0x5517a0 [0101.487] GetProcessHeap () returned 0x540000 [0101.487] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x555c00 [0101.487] GetProcessHeap () returned 0x540000 [0101.487] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x26) returned 0x555c10 [0101.487] GetProcessHeap () returned 0x540000 [0101.487] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x555c40 [0101.487] GetProcessHeap () returned 0x540000 [0101.487] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x18) returned 0x555c50 [0101.487] GetProcessHeap () returned 0x540000 [0101.487] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555b28 | out: hHeap=0x540000) returned 1 [0101.488] GetProcessHeap () returned 0x540000 [0101.488] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x555c88 [0101.488] GetProcessHeap () returned 0x540000 [0101.488] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x555b28 [0101.488] CryptImportKey (in: hProv=0x5505a0, pbData=0x18fed0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x5501c4 | out: phKey=0x5501c4*=0x555b90) returned 1 [0101.488] CryptDecrypt (in: hKey=0x555b90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x555b28, pdwDataLen=0x18ff3c | out: pbData=0x555b28, pdwDataLen=0x18ff3c) returned 1 [0101.488] CryptDestroyKey (hKey=0x555b90) returned 1 [0101.488] GetProcessHeap () returned 0x540000 [0101.488] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x555b90 [0101.488] GetProcessHeap () returned 0x540000 [0101.488] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb) returned 0x556088 [0101.488] GetProcessHeap () returned 0x540000 [0101.488] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5560a0 [0101.488] GetProcessHeap () returned 0x540000 [0101.488] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5560b8 [0101.489] GetProcessHeap () returned 0x540000 [0101.489] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xf) returned 0x5560d0 [0101.489] GetProcessHeap () returned 0x540000 [0101.489] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x19) returned 0x5542e8 [0101.489] LoadLibraryA (lpLibFileName="user32.dll") returned 0x77130000 [0101.489] GetProcAddress (hModule=0x77130000, lpProcName="wsprintfA") returned 0x7715ae5f [0101.489] GetProcAddress (hModule=0x77130000, lpProcName="wsprintfW") returned 0x7716e061 [0101.489] GetProcAddress (hModule=0x77130000, lpProcName="GetShellWindow") returned 0x7716e8a8 [0101.489] GetProcAddress (hModule=0x77130000, lpProcName="GetWindowThreadProcessId") returned 0x771491b4 [0101.489] GetProcessHeap () returned 0x540000 [0101.489] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555b28 | out: hHeap=0x540000) returned 1 [0101.489] GetProcessHeap () returned 0x540000 [0101.489] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556088 | out: hHeap=0x540000) returned 1 [0101.489] GetProcessHeap () returned 0x540000 [0101.489] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5560a0 | out: hHeap=0x540000) returned 1 [0101.489] GetProcessHeap () returned 0x540000 [0101.489] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5560b8 | out: hHeap=0x540000) returned 1 [0101.489] GetProcessHeap () returned 0x540000 [0101.489] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5560d0 | out: hHeap=0x540000) returned 1 [0101.490] GetProcessHeap () returned 0x540000 [0101.490] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5542e8 | out: hHeap=0x540000) returned 1 [0101.490] GetProcessHeap () returned 0x540000 [0101.490] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555b90 | out: hHeap=0x540000) returned 1 [0101.490] GetProcessHeap () returned 0x540000 [0101.490] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555c88 | out: hHeap=0x540000) returned 1 [0101.490] GetProcessHeap () returned 0x540000 [0101.490] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x555c88 [0101.490] GetProcessHeap () returned 0x540000 [0101.490] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x555b28 [0101.490] CryptImportKey (in: hProv=0x5505a0, pbData=0x18fed0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x5501c4 | out: phKey=0x5501c4*=0x555b90) returned 1 [0101.490] CryptDecrypt (in: hKey=0x555b90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x555b28, pdwDataLen=0x18ff3c | out: pbData=0x555b28, pdwDataLen=0x18ff3c) returned 1 [0101.490] CryptDestroyKey (hKey=0x555b90) returned 1 [0101.490] GetProcessHeap () returned 0x540000 [0101.490] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x555c98 [0101.490] GetProcessHeap () returned 0x540000 [0101.490] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe) returned 0x556088 [0101.490] GetProcessHeap () returned 0x540000 [0101.490] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x555ca8 [0101.490] GetProcessHeap () returned 0x540000 [0101.490] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x5542e8 [0101.490] GetProcessHeap () returned 0x540000 [0101.490] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x555cb8 [0101.490] GetProcessHeap () returned 0x540000 [0101.490] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x555b90 [0101.490] GetProcessHeap () returned 0x540000 [0101.490] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555b28 | out: hHeap=0x540000) returned 1 [0101.490] GetProcessHeap () returned 0x540000 [0101.490] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x555cc8 [0101.490] GetProcessHeap () returned 0x540000 [0101.491] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x554310 [0101.491] CryptImportKey (in: hProv=0x5505a0, pbData=0x18fed0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x5501c4 | out: phKey=0x5501c4*=0x555b28) returned 1 [0101.491] CryptDecrypt (in: hKey=0x555b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x554310, pdwDataLen=0x18ff3c | out: pbData=0x554310, pdwDataLen=0x18ff3c) returned 1 [0101.491] CryptDestroyKey (hKey=0x555b28) returned 1 [0101.491] GetProcessHeap () returned 0x540000 [0101.491] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x555cd8 [0101.491] GetProcessHeap () returned 0x540000 [0101.491] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1a) returned 0x554338 [0101.491] GetProcessHeap () returned 0x540000 [0101.491] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x554310 | out: hHeap=0x540000) returned 1 [0101.491] GetProcessHeap () returned 0x540000 [0101.491] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x555ce8 [0101.491] GetProcessHeap () returned 0x540000 [0101.491] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1a0) returned 0x556470 [0101.491] CryptImportKey (in: hProv=0x5505a0, pbData=0x18fed0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x5501c4 | out: phKey=0x5501c4*=0x555b28) returned 1 [0101.491] CryptDecrypt (in: hKey=0x555b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x556470, pdwDataLen=0x18ff3c | out: pbData=0x556470, pdwDataLen=0x18ff3c) returned 1 [0101.491] CryptDestroyKey (hKey=0x555b28) returned 1 [0101.491] GetProcessHeap () returned 0x540000 [0101.491] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x555cf8 [0101.491] GetProcessHeap () returned 0x540000 [0101.491] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x555d08 [0101.491] GetProcessHeap () returned 0x540000 [0101.491] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x555d18 [0101.491] GetProcessHeap () returned 0x540000 [0101.491] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x555d28 [0101.492] GetProcessHeap () returned 0x540000 [0101.492] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x555d38 [0101.492] GetProcessHeap () returned 0x540000 [0101.492] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x555d48 [0101.492] GetProcessHeap () returned 0x540000 [0101.492] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x555d58 [0101.492] GetProcessHeap () returned 0x540000 [0101.492] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x555d68 [0101.492] GetProcessHeap () returned 0x540000 [0101.492] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x555d78 [0101.492] GetProcessHeap () returned 0x540000 [0101.492] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x5560a0 [0101.492] GetProcessHeap () returned 0x540000 [0101.492] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x555d88 [0101.492] GetProcessHeap () returned 0x540000 [0101.492] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x5560b8 [0101.492] GetProcessHeap () returned 0x540000 [0101.492] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x555d98 [0101.492] GetProcessHeap () returned 0x540000 [0101.492] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x5560d0 [0101.492] GetProcessHeap () returned 0x540000 [0101.492] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x555da8 [0101.492] GetProcessHeap () returned 0x540000 [0101.492] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x555db8 [0101.492] GetProcessHeap () returned 0x540000 [0101.492] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x555dc8 [0101.492] GetProcessHeap () returned 0x540000 [0101.493] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x555dd8 [0101.493] GetProcessHeap () returned 0x540000 [0101.493] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x555de8 [0101.493] GetProcessHeap () returned 0x540000 [0101.493] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x555df8 [0101.493] GetProcessHeap () returned 0x540000 [0101.493] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x555e08 [0101.493] GetProcessHeap () returned 0x540000 [0101.493] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x555e18 [0101.493] GetProcessHeap () returned 0x540000 [0101.493] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x555e28 [0101.493] GetProcessHeap () returned 0x540000 [0101.493] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x16) returned 0x555b28 [0101.493] GetProcessHeap () returned 0x540000 [0101.493] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x555e38 [0101.493] GetProcessHeap () returned 0x540000 [0101.493] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe) returned 0x5560e8 [0101.493] GetProcessHeap () returned 0x540000 [0101.493] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x555e48 [0101.493] GetProcessHeap () returned 0x540000 [0101.493] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe) returned 0x556100 [0101.493] GetProcessHeap () returned 0x540000 [0101.493] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x555e58 [0101.493] GetProcessHeap () returned 0x540000 [0101.493] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x555e68 [0101.493] GetProcessHeap () returned 0x540000 [0101.493] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x555e78 [0101.493] GetProcessHeap () returned 0x540000 [0101.493] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x555e88 [0101.516] GetProcessHeap () returned 0x540000 [0101.516] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x555e98 [0101.516] GetProcessHeap () returned 0x540000 [0101.516] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x555ea8 [0101.516] GetProcessHeap () returned 0x540000 [0101.516] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x555eb8 [0101.516] GetProcessHeap () returned 0x540000 [0101.516] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x555ec8 [0101.516] GetProcessHeap () returned 0x540000 [0101.516] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x555ed8 [0101.516] GetProcessHeap () returned 0x540000 [0101.516] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x555ee8 [0101.516] GetProcessHeap () returned 0x540000 [0101.516] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x555ef8 [0101.516] GetProcessHeap () returned 0x540000 [0101.516] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x555f08 [0101.516] GetProcessHeap () returned 0x540000 [0101.516] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x555f18 [0101.516] GetProcessHeap () returned 0x540000 [0101.516] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x555f28 [0101.517] GetProcessHeap () returned 0x540000 [0101.517] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x555f38 [0101.517] GetProcessHeap () returned 0x540000 [0101.517] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x555f48 [0101.517] GetProcessHeap () returned 0x540000 [0101.517] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x555f58 [0101.517] GetProcessHeap () returned 0x540000 [0101.517] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x555f68 [0101.517] GetProcessHeap () returned 0x540000 [0101.517] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x555f78 [0101.517] GetProcessHeap () returned 0x540000 [0101.517] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x556118 [0101.517] GetProcessHeap () returned 0x540000 [0101.517] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x555f88 [0101.517] GetProcessHeap () returned 0x540000 [0101.517] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x555f98 [0101.517] GetProcessHeap () returned 0x540000 [0101.517] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x555fa8 [0101.517] GetProcessHeap () returned 0x540000 [0101.517] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x555fb8 [0101.517] GetProcessHeap () returned 0x540000 [0101.517] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x555fc8 [0101.517] GetProcessHeap () returned 0x540000 [0101.517] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x555fd8 [0101.517] GetProcessHeap () returned 0x540000 [0101.517] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x555fe8 [0101.517] GetProcessHeap () returned 0x540000 [0101.517] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x556130 [0101.517] GetProcessHeap () returned 0x540000 [0101.517] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x555ff8 [0101.518] GetProcessHeap () returned 0x540000 [0101.518] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x556008 [0101.518] GetProcessHeap () returned 0x540000 [0101.518] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x556018 [0101.518] GetProcessHeap () returned 0x540000 [0101.518] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x556028 [0101.518] GetProcessHeap () returned 0x540000 [0101.518] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x556038 [0101.518] GetProcessHeap () returned 0x540000 [0101.518] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x556048 [0101.518] GetProcessHeap () returned 0x540000 [0101.518] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x556058 [0101.518] GetProcessHeap () returned 0x540000 [0101.518] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x556630 [0101.518] GetProcessHeap () returned 0x540000 [0101.518] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x556640 [0101.518] GetProcessHeap () returned 0x540000 [0101.518] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x556650 [0101.518] GetProcessHeap () returned 0x540000 [0101.518] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x556660 [0101.518] GetProcessHeap () returned 0x540000 [0101.518] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x556670 [0101.518] GetProcessHeap () returned 0x540000 [0101.518] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x556680 [0101.518] GetProcessHeap () returned 0x540000 [0101.518] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x556690 [0101.518] GetProcessHeap () returned 0x540000 [0101.518] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x5566a0 [0101.518] GetProcessHeap () returned 0x540000 [0101.518] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x556148 [0101.518] GetProcessHeap () returned 0x540000 [0101.519] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x5566b0 [0101.519] GetProcessHeap () returned 0x540000 [0101.519] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x5566c0 [0101.519] GetProcessHeap () returned 0x540000 [0101.519] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x5566d0 [0101.519] GetProcessHeap () returned 0x540000 [0101.519] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x12) returned 0x555b48 [0101.519] GetProcessHeap () returned 0x540000 [0101.519] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x5566e0 [0101.519] GetProcessHeap () returned 0x540000 [0101.519] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x556160 [0101.519] GetProcessHeap () returned 0x540000 [0101.519] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x5566f0 [0101.519] GetProcessHeap () returned 0x540000 [0101.519] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe) returned 0x556178 [0101.519] GetProcessHeap () returned 0x540000 [0101.519] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x556700 [0101.519] GetProcessHeap () returned 0x540000 [0101.519] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x556710 [0101.519] GetProcessHeap () returned 0x540000 [0101.519] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x556720 [0101.519] GetProcessHeap () returned 0x540000 [0101.519] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x556190 [0101.519] GetProcessHeap () returned 0x540000 [0101.519] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x556730 [0101.519] GetProcessHeap () returned 0x540000 [0101.519] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5561a8 [0101.519] GetProcessHeap () returned 0x540000 [0101.519] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556470 | out: hHeap=0x540000) returned 1 [0101.519] GetProcessHeap () returned 0x540000 [0101.519] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x556740 [0101.520] GetProcessHeap () returned 0x540000 [0101.520] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x180) returned 0x556470 [0101.520] CryptImportKey (in: hProv=0x5505a0, pbData=0x18fed0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x5501c4 | out: phKey=0x5501c4*=0x556a18) returned 1 [0101.520] CryptDecrypt (in: hKey=0x556a18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x556470, pdwDataLen=0x18ff3c | out: pbData=0x556470, pdwDataLen=0x18ff3c) returned 1 [0101.520] CryptDestroyKey (hKey=0x556a18) returned 1 [0101.520] GetProcessHeap () returned 0x540000 [0101.520] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x556750 [0101.520] GetProcessHeap () returned 0x540000 [0101.520] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x5561c0 [0101.520] GetProcessHeap () returned 0x540000 [0101.520] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x556760 [0101.520] GetProcessHeap () returned 0x540000 [0101.520] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe) returned 0x5561d8 [0101.520] GetProcessHeap () returned 0x540000 [0101.520] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x556770 [0101.520] GetProcessHeap () returned 0x540000 [0101.520] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x5565f8 [0101.520] GetProcessHeap () returned 0x540000 [0101.520] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x556780 [0101.520] GetProcessHeap () returned 0x540000 [0101.520] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x16) returned 0x555b68 [0101.520] GetProcessHeap () returned 0x540000 [0101.520] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x556790 [0101.520] GetProcessHeap () returned 0x540000 [0101.520] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x554310 [0101.520] GetProcessHeap () returned 0x540000 [0101.520] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x5567a0 [0101.521] GetProcessHeap () returned 0x540000 [0101.521] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x22) returned 0x556a18 [0101.521] GetProcessHeap () returned 0x540000 [0101.521] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x5567b0 [0101.521] GetProcessHeap () returned 0x540000 [0101.521] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x5567c0 [0101.521] GetProcessHeap () returned 0x540000 [0101.521] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x5567d0 [0101.521] GetProcessHeap () returned 0x540000 [0101.521] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1a) returned 0x554360 [0101.521] GetProcessHeap () returned 0x540000 [0101.521] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x5567e0 [0101.521] GetProcessHeap () returned 0x540000 [0101.521] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5561f0 [0101.521] GetProcessHeap () returned 0x540000 [0101.521] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x5567f0 [0101.521] GetProcessHeap () returned 0x540000 [0101.521] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x556208 [0101.521] GetProcessHeap () returned 0x540000 [0101.521] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x556800 [0101.521] GetProcessHeap () returned 0x540000 [0101.521] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x556220 [0101.521] GetProcessHeap () returned 0x540000 [0101.521] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x556810 [0101.521] GetProcessHeap () returned 0x540000 [0101.521] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x556820 [0101.521] GetProcessHeap () returned 0x540000 [0101.521] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x556830 [0101.521] GetProcessHeap () returned 0x540000 [0101.521] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe) returned 0x556238 [0101.522] GetProcessHeap () returned 0x540000 [0101.522] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x556840 [0101.522] GetProcessHeap () returned 0x540000 [0101.522] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x556850 [0101.522] GetProcessHeap () returned 0x540000 [0101.522] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x556860 [0101.522] GetProcessHeap () returned 0x540000 [0101.522] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x556250 [0101.522] GetProcessHeap () returned 0x540000 [0101.522] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x556870 [0101.522] GetProcessHeap () returned 0x540000 [0101.522] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x556268 [0101.522] GetProcessHeap () returned 0x540000 [0101.522] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x556880 [0101.522] GetProcessHeap () returned 0x540000 [0101.522] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x556890 [0101.522] GetProcessHeap () returned 0x540000 [0101.522] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x5568a0 [0101.522] GetProcessHeap () returned 0x540000 [0101.522] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x556280 [0101.522] GetProcessHeap () returned 0x540000 [0101.522] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x5568b0 [0101.522] GetProcessHeap () returned 0x540000 [0101.522] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x556298 [0101.522] GetProcessHeap () returned 0x540000 [0101.522] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x5568c0 [0101.522] GetProcessHeap () returned 0x540000 [0101.522] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x5562b0 [0101.522] GetProcessHeap () returned 0x540000 [0101.522] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x5568d0 [0101.522] GetProcessHeap () returned 0x540000 [0101.523] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5562c8 [0101.523] GetProcessHeap () returned 0x540000 [0101.523] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x5568e0 [0101.523] GetProcessHeap () returned 0x540000 [0101.523] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x5568f0 [0101.523] GetProcessHeap () returned 0x540000 [0101.523] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x556900 [0101.523] GetProcessHeap () returned 0x540000 [0101.523] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5562e0 [0101.523] GetProcessHeap () returned 0x540000 [0101.523] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x556910 [0101.523] GetProcessHeap () returned 0x540000 [0101.523] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe) returned 0x5562f8 [0101.523] GetProcessHeap () returned 0x540000 [0101.523] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x556920 [0101.523] GetProcessHeap () returned 0x540000 [0101.523] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x556930 [0101.523] GetProcessHeap () returned 0x540000 [0101.523] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x556940 [0101.523] GetProcessHeap () returned 0x540000 [0101.523] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x556950 [0101.523] GetProcessHeap () returned 0x540000 [0101.523] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556470 | out: hHeap=0x540000) returned 1 [0101.523] GetProcessHeap () returned 0x540000 [0101.523] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x556470 [0101.523] GetProcessHeap () returned 0x540000 [0101.523] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x556960 [0101.523] GetProcessHeap () returned 0x540000 [0101.523] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x5564a0 [0101.524] CryptImportKey (in: hProv=0x5505a0, pbData=0x18fed0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x5501c4 | out: phKey=0x5501c4*=0x556508) returned 1 [0101.524] CryptDecrypt (in: hKey=0x556508, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5564a0, pdwDataLen=0x18ff3c | out: pbData=0x5564a0, pdwDataLen=0x18ff3c) returned 1 [0101.524] CryptDestroyKey (hKey=0x556508) returned 1 [0101.524] GetProcessHeap () returned 0x540000 [0101.524] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x556310 [0101.524] GetProcessHeap () returned 0x540000 [0101.524] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x556328 [0101.524] GetProcessHeap () returned 0x540000 [0101.524] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x556340 [0101.524] GetProcessHeap () returned 0x540000 [0101.524] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x556508 [0101.524] GetProcessHeap () returned 0x540000 [0101.524] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1a) returned 0x5543b0 [0101.524] GetProcessHeap () returned 0x540000 [0101.524] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5564a0 | out: hHeap=0x540000) returned 1 [0101.524] GetProcessHeap () returned 0x540000 [0101.524] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x556970 [0101.524] GetProcessHeap () returned 0x540000 [0101.524] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x556a60 [0101.524] CryptImportKey (in: hProv=0x5505a0, pbData=0x18fed0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x5501c4 | out: phKey=0x5501c4*=0x5564a0) returned 1 [0101.525] CryptDecrypt (in: hKey=0x5564a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x556a60, pdwDataLen=0x18ff3c | out: pbData=0x556a60, pdwDataLen=0x18ff3c) returned 1 [0101.525] CryptDestroyKey (hKey=0x5564a0) returned 1 [0101.525] GetProcessHeap () returned 0x540000 [0101.525] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x556980 [0101.525] GetProcessHeap () returned 0x540000 [0101.525] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x12) returned 0x5564a0 [0101.525] GetProcessHeap () returned 0x540000 [0101.525] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1a) returned 0x5543d8 [0101.526] GetProcessHeap () returned 0x540000 [0101.526] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556a60 | out: hHeap=0x540000) returned 1 [0101.526] GetShellWindow () returned 0x100f2 [0101.526] GetWindowThreadProcessId (in: hWnd=0x100f2, lpdwProcessId=0x41989c | out: lpdwProcessId=0x41989c) returned 0x458 [0101.532] GetProcessHeap () returned 0x540000 [0101.532] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x554400 [0101.532] CryptImportKey (in: hProv=0x5505a0, pbData=0x18fed0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x5501c4 | out: phKey=0x5501c4*=0x5564c0) returned 1 [0101.532] CryptDecrypt (in: hKey=0x5564c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x554400, pdwDataLen=0x18ff3c | out: pbData=0x554400, pdwDataLen=0x18ff3c) returned 1 [0101.532] CryptDestroyKey (hKey=0x5564c0) returned 1 [0101.532] GetProcessHeap () returned 0x540000 [0101.532] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x554428 [0101.532] CryptImportKey (in: hProv=0x5505a0, pbData=0x18fed0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x5501c4 | out: phKey=0x5501c4*=0x5564c0) returned 1 [0101.533] CryptDecrypt (in: hKey=0x5564c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x554428, pdwDataLen=0x18ff3c | out: pbData=0x554428, pdwDataLen=0x18ff3c) returned 1 [0101.533] CryptDestroyKey (hKey=0x5564c0) returned 1 [0101.533] GetProcessHeap () returned 0x540000 [0101.533] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x554450 [0101.533] CryptImportKey (in: hProv=0x5505a0, pbData=0x18fed0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x5501c4 | out: phKey=0x5501c4*=0x5564c0) returned 1 [0101.533] CryptDecrypt (in: hKey=0x5564c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x554450, pdwDataLen=0x18ff3c | out: pbData=0x554450, pdwDataLen=0x18ff3c) returned 1 [0101.533] CryptDestroyKey (hKey=0x5564c0) returned 1 [0101.533] GetProcessHeap () returned 0x540000 [0101.533] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x557a60 [0101.533] CryptImportKey (in: hProv=0x5505a0, pbData=0x18fca8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x5501c4 | out: phKey=0x5501c4*=0x5564c0) returned 1 [0101.533] CryptDecrypt (in: hKey=0x5564c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x557a60, pdwDataLen=0x18fd14 | out: pbData=0x557a60, pdwDataLen=0x18fd14) returned 1 [0101.533] CryptDestroyKey (hKey=0x5564c0) returned 1 [0101.533] GetProcessHeap () returned 0x540000 [0101.533] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x556528 [0101.533] CryptImportKey (in: hProv=0x5505a0, pbData=0x18fca8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x5501c4 | out: phKey=0x5501c4*=0x5564c0) returned 1 [0101.533] CryptDecrypt (in: hKey=0x5564c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x556528, pdwDataLen=0x18fd14 | out: pbData=0x556528, pdwDataLen=0x18fd14) returned 1 [0101.533] CryptDestroyKey (hKey=0x5564c0) returned 1 [0101.534] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x18fd18, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0101.537] GetProcessHeap () returned 0x540000 [0101.537] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x557a60 | out: hHeap=0x540000) returned 1 [0101.537] GetProcessHeap () returned 0x540000 [0101.537] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x557a60 [0101.537] CryptImportKey (in: hProv=0x5505a0, pbData=0x18fca8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x5501c4 | out: phKey=0x5501c4*=0x5564c0) returned 1 [0101.537] CryptDecrypt (in: hKey=0x5564c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x557a60, pdwDataLen=0x18fd14 | out: pbData=0x557a60, pdwDataLen=0x18fd14) returned 1 [0101.537] CryptDestroyKey (hKey=0x5564c0) returned 1 [0101.537] GetProcessHeap () returned 0x540000 [0101.537] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x556590 [0101.537] CryptImportKey (in: hProv=0x5505a0, pbData=0x18fca8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x5501c4 | out: phKey=0x5501c4*=0x5564c0) returned 1 [0101.537] CryptDecrypt (in: hKey=0x5564c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x556590, pdwDataLen=0x18fd14 | out: pbData=0x556590, pdwDataLen=0x18fd14) returned 1 [0101.537] CryptDestroyKey (hKey=0x5564c0) returned 1 [0101.537] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x18fd18, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0101.538] GetProcessHeap () returned 0x540000 [0101.538] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x557a60 | out: hHeap=0x540000) returned 1 [0101.538] GetProcessHeap () returned 0x540000 [0101.538] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1e) returned 0x557a60 [0101.538] GetProcessHeap () returned 0x540000 [0101.538] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x12) returned 0x5564c0 [0101.538] GetProcessHeap () returned 0x540000 [0101.538] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x556990 [0101.538] GetProcessHeap () returned 0x540000 [0101.538] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x556a60 [0101.538] GetProcessHeap () returned 0x540000 [0101.538] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x558248 [0101.538] CryptImportKey (in: hProv=0x5505a0, pbData=0x18fed8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x5501c4 | out: phKey=0x5501c4*=0x5582d0) returned 1 [0101.538] CryptDecrypt (in: hKey=0x5582d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x558248, pdwDataLen=0x18ff40 | out: pbData=0x558248, pdwDataLen=0x18ff40) returned 1 [0101.538] CryptDestroyKey (hKey=0x5582d0) returned 1 [0101.538] GetProcessHeap () returned 0x540000 [0101.538] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5582d0 [0101.538] CryptImportKey (in: hProv=0x5505a0, pbData=0x18fed8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x5501c4 | out: phKey=0x5501c4*=0x558358) returned 1 [0101.538] CryptDecrypt (in: hKey=0x558358, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5582d0, pdwDataLen=0x18ff40 | out: pbData=0x5582d0, pdwDataLen=0x18ff40) returned 1 [0101.538] CryptDestroyKey (hKey=0x558358) returned 1 [0101.538] SetErrorMode (uMode=0x1) returned 0x8001 [0101.539] GetLogicalDrives () returned 0x4 [0101.539] GetProcessHeap () returned 0x540000 [0101.539] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x556aa8 [0101.539] CryptImportKey (in: hProv=0x5505a0, pbData=0x18fa48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x5501c4 | out: phKey=0x5501c4*=0x558358) returned 1 [0101.539] CryptDecrypt (in: hKey=0x558358, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x556aa8, pdwDataLen=0x18fab8 | out: pbData=0x556aa8, pdwDataLen=0x18fab8) returned 1 [0101.539] CryptDestroyKey (hKey=0x558358) returned 1 [0101.539] GetProcessHeap () returned 0x540000 [0101.539] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x557ad8 [0101.539] CryptImportKey (in: hProv=0x5505a0, pbData=0x18fa48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x5501c4 | out: phKey=0x5501c4*=0x558358) returned 1 [0101.539] CryptDecrypt (in: hKey=0x558358, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x557ad8, pdwDataLen=0x18fab8 | out: pbData=0x557ad8, pdwDataLen=0x18fab8) returned 1 [0101.539] CryptDestroyKey (hKey=0x558358) returned 1 [0101.539] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fab4 | out: phkResult=0x18fab4*=0xa8) returned 0x0 [0101.539] RegQueryValueExA (in: hKey=0xa8, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x18fac0, lpcbData=0x18fabc*=0x400 | out: lpType=0x0, lpData=0x18fac0*=0x30, lpcbData=0x18fabc*=0x18) returned 0x0 [0101.540] RegCloseKey (hKey=0xa8) returned 0x0 [0101.540] GetProcessHeap () returned 0x540000 [0101.540] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556aa8 | out: hHeap=0x540000) returned 1 [0101.540] GetProcessHeap () returned 0x540000 [0101.540] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x557ad8 | out: hHeap=0x540000) returned 1 [0101.540] GetProcessHeap () returned 0x540000 [0101.540] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x557ad8 [0101.540] CryptImportKey (in: hProv=0x5505a0, pbData=0x18f828, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x5501c4 | out: phKey=0x5501c4*=0x558358) returned 1 [0101.540] CryptDecrypt (in: hKey=0x558358, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x557ad8, pdwDataLen=0x18f88c | out: pbData=0x557ad8, pdwDataLen=0x18f88c) returned 1 [0101.540] CryptDestroyKey (hKey=0x558358) returned 1 [0101.540] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x18f890, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0101.540] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x18f888, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18f888*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0101.541] GetProcessHeap () returned 0x540000 [0101.541] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x557ad8 | out: hHeap=0x540000) returned 1 [0101.541] wsprintfA (in: param_1=0x18fad7, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0101.541] wsprintfW (in: param_1=0x18fee8, param_2="\\\\.\\%c:" | out: param_1="\\\\.\\C:") returned 6 [0101.542] wsprintfW (in: param_1=0x18fef8, param_2="%c:\\" | out: param_1="C:\\") returned 3 [0101.542] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0101.542] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x18fed8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fed8*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0101.542] GetProcessHeap () returned 0x540000 [0101.542] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x34) returned 0x558358 [0101.542] GetProcessHeap () returned 0x540000 [0101.542] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x5569a0 [0101.542] GetProcessHeap () returned 0x540000 [0101.542] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x558398 [0101.542] CryptGenRandom (in: hProv=0x5505a0, dwLen=0x20, pbBuffer=0x5583a4 | out: pbBuffer=0x5583a4) returned 1 [0101.542] GetProcessHeap () returned 0x540000 [0101.542] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5583d0 [0101.542] CryptGenRandom (in: hProv=0x5505a0, dwLen=0x20, pbBuffer=0x5583dc | out: pbBuffer=0x5583dc) returned 1 [0101.542] GetProcessHeap () returned 0x540000 [0101.542] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x557ad8 [0101.542] CryptImportKey (in: hProv=0x5505a0, pbData=0x18fec8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x5501c4 | out: phKey=0x5501c4*=0x558408) returned 1 [0101.542] CryptDecrypt (in: hKey=0x558408, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x557ad8, pdwDataLen=0x18ff30 | out: pbData=0x557ad8, pdwDataLen=0x18ff30) returned 1 [0101.542] CryptDestroyKey (hKey=0x558408) returned 1 [0101.543] GetProcessHeap () returned 0x540000 [0101.543] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x558408 [0101.543] GetProcessHeap () returned 0x540000 [0101.543] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x558490 [0101.543] CryptImportKey (in: hProv=0x5505a0, pbData=0x550e58, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x18ff10 | out: phKey=0x18ff10*=0x558518) returned 1 [0101.543] CryptEncrypt (in: hKey=0x558518, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x558408*, pdwDataLen=0x18ff14*=0x75, dwBufLen=0x80 | out: pbData=0x558408*, pdwDataLen=0x18ff14*=0x80) returned 1 [0101.543] CryptDestroyKey (hKey=0x558518) returned 1 [0101.543] CryptImportKey (in: hProv=0x5505a0, pbData=0x550e58, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x18ff10 | out: phKey=0x18ff10*=0x558518) returned 1 [0101.543] CryptEncrypt (in: hKey=0x558518, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x558490*, pdwDataLen=0x18ff14*=0x75, dwBufLen=0x80 | out: pbData=0x558490*, pdwDataLen=0x18ff14*=0x80) returned 1 [0101.543] CryptDestroyKey (hKey=0x558518) returned 1 [0101.543] GetProcessHeap () returned 0x540000 [0101.543] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x557ad8 | out: hHeap=0x540000) returned 1 [0101.543] GetProcessHeap () returned 0x540000 [0101.543] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa0) returned 0x558518 [0101.543] CryptImportKey (in: hProv=0x5505a0, pbData=0x18feb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x5501c4 | out: phKey=0x5501c4*=0x5585c0) returned 1 [0101.543] CryptDecrypt (in: hKey=0x5585c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x558518, pdwDataLen=0x18ff20 | out: pbData=0x558518, pdwDataLen=0x18ff20) returned 1 [0101.543] CryptDestroyKey (hKey=0x5585c0) returned 1 [0101.543] GetProcessHeap () returned 0x540000 [0101.543] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1c) returned 0x557ad8 [0101.543] GetProcessHeap () returned 0x540000 [0101.544] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x556358 [0101.544] GetProcessHeap () returned 0x540000 [0101.544] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe) returned 0x556370 [0101.544] GetProcessHeap () returned 0x540000 [0101.544] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x19) returned 0x557b00 [0101.544] GetProcessHeap () returned 0x540000 [0101.544] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe) returned 0x556388 [0101.544] GetProcessHeap () returned 0x540000 [0101.544] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd) returned 0x5563a0 [0101.544] GetProcessHeap () returned 0x540000 [0101.544] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1a) returned 0x557b28 [0101.544] GetProcessHeap () returned 0x540000 [0101.544] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1b) returned 0x557b50 [0101.544] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77c40000 [0101.544] GetProcAddress (hModule=0x77c40000, lpProcName="NtQueryObject") returned 0x77c5f9e8 [0101.544] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77c40000 [0101.544] GetProcAddress (hModule=0x77c40000, lpProcName="NtQuerySystemInformation") returned 0x77c5fda0 [0101.544] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77c40000 [0101.545] GetProcAddress (hModule=0x77c40000, lpProcName="RtlGetVersion") returned 0x77c7873a [0101.545] GetModuleHandleA (lpModuleName="Kernel32.dll") returned 0x76d30000 [0101.545] GetProcAddress (hModule=0x76d30000, lpProcName="GetFinalPathNameByHandleW") returned 0x76d60a25 [0101.545] GetModuleHandleA (lpModuleName="Kernel32.dll") returned 0x76d30000 [0101.545] GetProcAddress (hModule=0x76d30000, lpProcName="QueryFullProcessImageNameW") returned 0x76d515f7 [0101.545] GetProcessHeap () returned 0x540000 [0101.545] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x558518 | out: hHeap=0x540000) returned 1 [0101.545] GetProcessHeap () returned 0x540000 [0101.545] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556358 | out: hHeap=0x540000) returned 1 [0101.545] GetProcessHeap () returned 0x540000 [0101.545] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556370 | out: hHeap=0x540000) returned 1 [0101.545] GetProcessHeap () returned 0x540000 [0101.545] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x557b00 | out: hHeap=0x540000) returned 1 [0101.545] GetProcessHeap () returned 0x540000 [0101.545] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556388 | out: hHeap=0x540000) returned 1 [0101.545] GetProcessHeap () returned 0x540000 [0101.545] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5563a0 | out: hHeap=0x540000) returned 1 [0101.545] GetProcessHeap () returned 0x540000 [0101.545] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x557b28 | out: hHeap=0x540000) returned 1 [0101.546] GetProcessHeap () returned 0x540000 [0101.546] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x557b50 | out: hHeap=0x540000) returned 1 [0101.546] GetProcessHeap () returned 0x540000 [0101.546] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x557ad8 | out: hHeap=0x540000) returned 1 [0101.546] GetProcessHeap () returned 0x540000 [0101.546] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x558dc0 [0101.546] NtQueryObject (in: Handle=0x0, ObjectInformationClass=0x3, ObjectInformation=0x558dc0, ObjectInformationLength=0x1000, ReturnLength=0x18ff04 | out: ObjectInformation=0x558dc0, ReturnLength=0x18ff04) returned 0xc0000004 [0101.546] GetProcessHeap () returned 0x540000 [0101.546] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x558dc0 | out: hHeap=0x540000) returned 1 [0101.546] GetProcessHeap () returned 0x540000 [0101.546] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2000) returned 0x558dc0 [0101.546] NtQueryObject (in: Handle=0x0, ObjectInformationClass=0x3, ObjectInformation=0x558dc0, ObjectInformationLength=0x2000, ReturnLength=0x18ff04 | out: ObjectInformation=0x558dc0, ReturnLength=0x18ff04) returned 0x0 [0101.546] RtlGetVersion (in: lpVersionInformation=0x18fdf0 | out: lpVersionInformation=0x18fdf0*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 0x0 [0101.546] GetProcessHeap () returned 0x540000 [0101.546] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x558dc0 | out: hHeap=0x540000) returned 1 [0101.546] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4058b0, lpParameter=0x550668, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa8 [0101.547] WaitForSingleObject (hHandle=0xa8, dwMilliseconds=0xffffffff) returned 0x0 [0146.542] CloseHandle (hObject=0xa8) returned 1 [0146.542] GetProcessHeap () returned 0x540000 [0146.542] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x558408 | out: hHeap=0x540000) returned 1 [0146.543] GetProcessHeap () returned 0x540000 [0146.543] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x558490 | out: hHeap=0x540000) returned 1 [0146.543] GetProcessHeap () returned 0x540000 [0146.543] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x558398 | out: hHeap=0x540000) returned 1 [0146.543] GetProcessHeap () returned 0x540000 [0146.543] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5583d0 | out: hHeap=0x540000) returned 1 [0146.543] GetProcessHeap () returned 0x540000 [0146.543] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x558358 | out: hHeap=0x540000) returned 1 [0146.543] GetProcessHeap () returned 0x540000 [0146.543] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5569a0 | out: hHeap=0x540000) returned 1 [0146.543] GetProcessHeap () returned 0x540000 [0146.543] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x550668 | out: hHeap=0x540000) returned 1 [0146.543] GetProcessHeap () returned 0x540000 [0146.543] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x5569a0 [0146.543] GetProcessHeap () returned 0x540000 [0146.543] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556528 | out: hHeap=0x540000) returned 1 [0146.543] GetProcessHeap () returned 0x540000 [0146.543] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556590 | out: hHeap=0x540000) returned 1 [0146.543] GetProcessHeap () returned 0x540000 [0146.543] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x557a60 | out: hHeap=0x540000) returned 1 [0146.543] GetProcessHeap () returned 0x540000 [0146.543] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5564c0 | out: hHeap=0x540000) returned 1 [0146.546] GetProcessHeap () returned 0x540000 [0146.546] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x558248 | out: hHeap=0x540000) returned 1 [0146.546] GetProcessHeap () returned 0x540000 [0146.546] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5582d0 | out: hHeap=0x540000) returned 1 [0146.546] GetProcessHeap () returned 0x540000 [0146.546] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556a60 | out: hHeap=0x540000) returned 1 [0146.546] GetProcessHeap () returned 0x540000 [0146.546] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556990 | out: hHeap=0x540000) returned 1 [0146.546] GetProcessHeap () returned 0x540000 [0146.546] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x54fcf8 | out: hHeap=0x540000) returned 1 [0146.546] GetProcessHeap () returned 0x540000 [0146.546] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x54fed8 | out: hHeap=0x540000) returned 1 [0146.546] GetProcessHeap () returned 0x540000 [0146.546] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5501f8 | out: hHeap=0x540000) returned 1 [0146.546] GetProcessHeap () returned 0x540000 [0146.546] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x54e1c0 | out: hHeap=0x540000) returned 1 [0146.546] GetProcessHeap () returned 0x540000 [0146.546] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x554400 | out: hHeap=0x540000) returned 1 [0146.546] GetProcessHeap () returned 0x540000 [0146.546] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x554450 | out: hHeap=0x540000) returned 1 [0146.546] GetProcessHeap () returned 0x540000 [0146.546] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x554428 | out: hHeap=0x540000) returned 1 [0146.546] GetProcessHeap () returned 0x540000 [0146.546] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5558a8 | out: hHeap=0x540000) returned 1 [0146.546] GetProcessHeap () returned 0x540000 [0146.546] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555898 | out: hHeap=0x540000) returned 1 [0146.546] GetProcessHeap () returned 0x540000 [0146.546] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x554298 | out: hHeap=0x540000) returned 1 [0146.546] GetProcessHeap () returned 0x540000 [0146.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5558c8 | out: hHeap=0x540000) returned 1 [0146.547] GetProcessHeap () returned 0x540000 [0146.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x551788 | out: hHeap=0x540000) returned 1 [0146.547] GetProcessHeap () returned 0x540000 [0146.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555bd0 | out: hHeap=0x540000) returned 1 [0146.547] GetProcessHeap () returned 0x540000 [0146.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5542c0 | out: hHeap=0x540000) returned 1 [0146.547] GetProcessHeap () returned 0x540000 [0146.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555be0 | out: hHeap=0x540000) returned 1 [0146.547] GetProcessHeap () returned 0x540000 [0146.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5517a0 | out: hHeap=0x540000) returned 1 [0146.547] GetProcessHeap () returned 0x540000 [0146.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555bf0 | out: hHeap=0x540000) returned 1 [0146.547] GetProcessHeap () returned 0x540000 [0146.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555c10 | out: hHeap=0x540000) returned 1 [0146.547] GetProcessHeap () returned 0x540000 [0146.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555c00 | out: hHeap=0x540000) returned 1 [0146.547] GetProcessHeap () returned 0x540000 [0146.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555c50 | out: hHeap=0x540000) returned 1 [0146.547] GetProcessHeap () returned 0x540000 [0146.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555c40 | out: hHeap=0x540000) returned 1 [0146.547] GetProcessHeap () returned 0x540000 [0146.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x550488 | out: hHeap=0x540000) returned 1 [0146.547] GetProcessHeap () returned 0x540000 [0146.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556088 | out: hHeap=0x540000) returned 1 [0146.547] GetProcessHeap () returned 0x540000 [0146.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555c98 | out: hHeap=0x540000) returned 1 [0146.547] GetProcessHeap () returned 0x540000 [0146.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5542e8 | out: hHeap=0x540000) returned 1 [0146.547] GetProcessHeap () returned 0x540000 [0146.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555ca8 | out: hHeap=0x540000) returned 1 [0146.547] GetProcessHeap () returned 0x540000 [0146.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555b90 | out: hHeap=0x540000) returned 1 [0146.547] GetProcessHeap () returned 0x540000 [0146.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555cb8 | out: hHeap=0x540000) returned 1 [0146.547] GetProcessHeap () returned 0x540000 [0146.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555c88 | out: hHeap=0x540000) returned 1 [0146.547] GetProcessHeap () returned 0x540000 [0146.548] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x554338 | out: hHeap=0x540000) returned 1 [0146.548] GetProcessHeap () returned 0x540000 [0146.548] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555cd8 | out: hHeap=0x540000) returned 1 [0146.548] GetProcessHeap () returned 0x540000 [0146.548] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555cc8 | out: hHeap=0x540000) returned 1 [0146.548] GetProcessHeap () returned 0x540000 [0146.548] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555d08 | out: hHeap=0x540000) returned 1 [0146.548] GetProcessHeap () returned 0x540000 [0146.548] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555cf8 | out: hHeap=0x540000) returned 1 [0146.548] GetProcessHeap () returned 0x540000 [0146.548] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555d28 | out: hHeap=0x540000) returned 1 [0146.548] GetProcessHeap () returned 0x540000 [0146.548] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555d18 | out: hHeap=0x540000) returned 1 [0146.548] GetProcessHeap () returned 0x540000 [0146.548] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555d48 | out: hHeap=0x540000) returned 1 [0146.548] GetProcessHeap () returned 0x540000 [0146.548] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555d38 | out: hHeap=0x540000) returned 1 [0146.548] GetProcessHeap () returned 0x540000 [0146.548] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555d68 | out: hHeap=0x540000) returned 1 [0146.548] GetProcessHeap () returned 0x540000 [0146.548] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555d58 | out: hHeap=0x540000) returned 1 [0146.548] GetProcessHeap () returned 0x540000 [0146.548] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5560a0 | out: hHeap=0x540000) returned 1 [0146.548] GetProcessHeap () returned 0x540000 [0146.548] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555d78 | out: hHeap=0x540000) returned 1 [0146.548] GetProcessHeap () returned 0x540000 [0146.548] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5560b8 | out: hHeap=0x540000) returned 1 [0146.548] GetProcessHeap () returned 0x540000 [0146.548] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555d88 | out: hHeap=0x540000) returned 1 [0146.548] GetProcessHeap () returned 0x540000 [0146.548] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5560d0 | out: hHeap=0x540000) returned 1 [0146.548] GetProcessHeap () returned 0x540000 [0146.548] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555d98 | out: hHeap=0x540000) returned 1 [0146.548] GetProcessHeap () returned 0x540000 [0146.548] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555db8 | out: hHeap=0x540000) returned 1 [0146.548] GetProcessHeap () returned 0x540000 [0146.548] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555da8 | out: hHeap=0x540000) returned 1 [0146.548] GetProcessHeap () returned 0x540000 [0146.548] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555dd8 | out: hHeap=0x540000) returned 1 [0146.549] GetProcessHeap () returned 0x540000 [0146.549] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555dc8 | out: hHeap=0x540000) returned 1 [0146.549] GetProcessHeap () returned 0x540000 [0146.549] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555df8 | out: hHeap=0x540000) returned 1 [0146.549] GetProcessHeap () returned 0x540000 [0146.549] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555de8 | out: hHeap=0x540000) returned 1 [0146.549] GetProcessHeap () returned 0x540000 [0146.549] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555e18 | out: hHeap=0x540000) returned 1 [0146.549] GetProcessHeap () returned 0x540000 [0146.549] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555e08 | out: hHeap=0x540000) returned 1 [0146.549] GetProcessHeap () returned 0x540000 [0146.549] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555b28 | out: hHeap=0x540000) returned 1 [0146.549] GetProcessHeap () returned 0x540000 [0146.549] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555e28 | out: hHeap=0x540000) returned 1 [0146.549] GetProcessHeap () returned 0x540000 [0146.549] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5560e8 | out: hHeap=0x540000) returned 1 [0146.549] GetProcessHeap () returned 0x540000 [0146.549] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555e38 | out: hHeap=0x540000) returned 1 [0146.549] GetProcessHeap () returned 0x540000 [0146.549] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556100 | out: hHeap=0x540000) returned 1 [0146.549] GetProcessHeap () returned 0x540000 [0146.549] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555e48 | out: hHeap=0x540000) returned 1 [0146.549] GetProcessHeap () returned 0x540000 [0146.549] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555e68 | out: hHeap=0x540000) returned 1 [0146.549] GetProcessHeap () returned 0x540000 [0146.549] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555e58 | out: hHeap=0x540000) returned 1 [0146.549] GetProcessHeap () returned 0x540000 [0146.549] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555e88 | out: hHeap=0x540000) returned 1 [0146.549] GetProcessHeap () returned 0x540000 [0146.549] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555e78 | out: hHeap=0x540000) returned 1 [0146.549] GetProcessHeap () returned 0x540000 [0146.549] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555ea8 | out: hHeap=0x540000) returned 1 [0146.549] GetProcessHeap () returned 0x540000 [0146.549] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555e98 | out: hHeap=0x540000) returned 1 [0146.549] GetProcessHeap () returned 0x540000 [0146.549] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555ec8 | out: hHeap=0x540000) returned 1 [0146.549] GetProcessHeap () returned 0x540000 [0146.549] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555eb8 | out: hHeap=0x540000) returned 1 [0146.549] GetProcessHeap () returned 0x540000 [0146.549] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555ee8 | out: hHeap=0x540000) returned 1 [0146.550] GetProcessHeap () returned 0x540000 [0146.550] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555ed8 | out: hHeap=0x540000) returned 1 [0146.550] GetProcessHeap () returned 0x540000 [0146.550] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555f08 | out: hHeap=0x540000) returned 1 [0146.550] GetProcessHeap () returned 0x540000 [0146.550] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555ef8 | out: hHeap=0x540000) returned 1 [0146.550] GetProcessHeap () returned 0x540000 [0146.550] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555f28 | out: hHeap=0x540000) returned 1 [0146.550] GetProcessHeap () returned 0x540000 [0146.550] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555f18 | out: hHeap=0x540000) returned 1 [0146.550] GetProcessHeap () returned 0x540000 [0146.550] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555f48 | out: hHeap=0x540000) returned 1 [0146.550] GetProcessHeap () returned 0x540000 [0146.550] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555f38 | out: hHeap=0x540000) returned 1 [0146.550] GetProcessHeap () returned 0x540000 [0146.550] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555f68 | out: hHeap=0x540000) returned 1 [0146.550] GetProcessHeap () returned 0x540000 [0146.550] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555f58 | out: hHeap=0x540000) returned 1 [0146.550] GetProcessHeap () returned 0x540000 [0146.550] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556118 | out: hHeap=0x540000) returned 1 [0146.550] GetProcessHeap () returned 0x540000 [0146.550] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555f78 | out: hHeap=0x540000) returned 1 [0146.550] GetProcessHeap () returned 0x540000 [0146.550] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555f98 | out: hHeap=0x540000) returned 1 [0146.550] GetProcessHeap () returned 0x540000 [0146.550] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555f88 | out: hHeap=0x540000) returned 1 [0146.550] GetProcessHeap () returned 0x540000 [0146.550] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555fb8 | out: hHeap=0x540000) returned 1 [0146.550] GetProcessHeap () returned 0x540000 [0146.550] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555fa8 | out: hHeap=0x540000) returned 1 [0146.550] GetProcessHeap () returned 0x540000 [0146.550] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555fd8 | out: hHeap=0x540000) returned 1 [0146.550] GetProcessHeap () returned 0x540000 [0146.550] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555fc8 | out: hHeap=0x540000) returned 1 [0146.550] GetProcessHeap () returned 0x540000 [0146.550] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556130 | out: hHeap=0x540000) returned 1 [0146.550] GetProcessHeap () returned 0x540000 [0146.550] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555fe8 | out: hHeap=0x540000) returned 1 [0146.550] GetProcessHeap () returned 0x540000 [0146.550] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556008 | out: hHeap=0x540000) returned 1 [0146.551] GetProcessHeap () returned 0x540000 [0146.551] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555ff8 | out: hHeap=0x540000) returned 1 [0146.551] GetProcessHeap () returned 0x540000 [0146.551] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556028 | out: hHeap=0x540000) returned 1 [0146.551] GetProcessHeap () returned 0x540000 [0146.551] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556018 | out: hHeap=0x540000) returned 1 [0146.551] GetProcessHeap () returned 0x540000 [0146.551] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556048 | out: hHeap=0x540000) returned 1 [0146.551] GetProcessHeap () returned 0x540000 [0146.551] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556038 | out: hHeap=0x540000) returned 1 [0146.551] GetProcessHeap () returned 0x540000 [0146.551] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556630 | out: hHeap=0x540000) returned 1 [0146.551] GetProcessHeap () returned 0x540000 [0146.551] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556058 | out: hHeap=0x540000) returned 1 [0146.551] GetProcessHeap () returned 0x540000 [0146.551] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556650 | out: hHeap=0x540000) returned 1 [0146.551] GetProcessHeap () returned 0x540000 [0146.551] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556640 | out: hHeap=0x540000) returned 1 [0146.551] GetProcessHeap () returned 0x540000 [0146.551] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556670 | out: hHeap=0x540000) returned 1 [0146.551] GetProcessHeap () returned 0x540000 [0146.551] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556660 | out: hHeap=0x540000) returned 1 [0146.551] GetProcessHeap () returned 0x540000 [0146.551] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556690 | out: hHeap=0x540000) returned 1 [0146.551] GetProcessHeap () returned 0x540000 [0146.551] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556680 | out: hHeap=0x540000) returned 1 [0146.551] GetProcessHeap () returned 0x540000 [0146.551] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556148 | out: hHeap=0x540000) returned 1 [0146.551] GetProcessHeap () returned 0x540000 [0146.551] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5566a0 | out: hHeap=0x540000) returned 1 [0146.551] GetProcessHeap () returned 0x540000 [0146.551] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5566c0 | out: hHeap=0x540000) returned 1 [0146.551] GetProcessHeap () returned 0x540000 [0146.551] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5566b0 | out: hHeap=0x540000) returned 1 [0146.551] GetProcessHeap () returned 0x540000 [0146.551] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555b48 | out: hHeap=0x540000) returned 1 [0146.551] GetProcessHeap () returned 0x540000 [0146.551] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5566d0 | out: hHeap=0x540000) returned 1 [0146.551] GetProcessHeap () returned 0x540000 [0146.551] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556160 | out: hHeap=0x540000) returned 1 [0146.551] GetProcessHeap () returned 0x540000 [0146.552] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5566e0 | out: hHeap=0x540000) returned 1 [0146.552] GetProcessHeap () returned 0x540000 [0146.552] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556178 | out: hHeap=0x540000) returned 1 [0146.552] GetProcessHeap () returned 0x540000 [0146.552] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5566f0 | out: hHeap=0x540000) returned 1 [0146.552] GetProcessHeap () returned 0x540000 [0146.552] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556710 | out: hHeap=0x540000) returned 1 [0146.552] GetProcessHeap () returned 0x540000 [0146.552] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556700 | out: hHeap=0x540000) returned 1 [0146.552] GetProcessHeap () returned 0x540000 [0146.552] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556190 | out: hHeap=0x540000) returned 1 [0146.552] GetProcessHeap () returned 0x540000 [0146.552] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556720 | out: hHeap=0x540000) returned 1 [0146.552] GetProcessHeap () returned 0x540000 [0146.552] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5561a8 | out: hHeap=0x540000) returned 1 [0146.552] GetProcessHeap () returned 0x540000 [0146.552] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556730 | out: hHeap=0x540000) returned 1 [0146.552] GetProcessHeap () returned 0x540000 [0146.552] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555ce8 | out: hHeap=0x540000) returned 1 [0146.552] GetProcessHeap () returned 0x540000 [0146.552] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5561c0 | out: hHeap=0x540000) returned 1 [0146.552] GetProcessHeap () returned 0x540000 [0146.552] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556750 | out: hHeap=0x540000) returned 1 [0146.552] GetProcessHeap () returned 0x540000 [0146.552] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5561d8 | out: hHeap=0x540000) returned 1 [0146.552] GetProcessHeap () returned 0x540000 [0146.552] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556760 | out: hHeap=0x540000) returned 1 [0146.552] GetProcessHeap () returned 0x540000 [0146.552] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5565f8 | out: hHeap=0x540000) returned 1 [0146.552] GetProcessHeap () returned 0x540000 [0146.552] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556770 | out: hHeap=0x540000) returned 1 [0146.552] GetProcessHeap () returned 0x540000 [0146.552] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555b68 | out: hHeap=0x540000) returned 1 [0146.552] GetProcessHeap () returned 0x540000 [0146.552] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556780 | out: hHeap=0x540000) returned 1 [0146.552] GetProcessHeap () returned 0x540000 [0146.552] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x554310 | out: hHeap=0x540000) returned 1 [0146.552] GetProcessHeap () returned 0x540000 [0146.552] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556790 | out: hHeap=0x540000) returned 1 [0146.552] GetProcessHeap () returned 0x540000 [0146.552] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556a18 | out: hHeap=0x540000) returned 1 [0146.553] GetProcessHeap () returned 0x540000 [0146.553] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5567a0 | out: hHeap=0x540000) returned 1 [0146.553] GetProcessHeap () returned 0x540000 [0146.553] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5567c0 | out: hHeap=0x540000) returned 1 [0146.553] GetProcessHeap () returned 0x540000 [0146.553] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5567b0 | out: hHeap=0x540000) returned 1 [0146.553] GetProcessHeap () returned 0x540000 [0146.553] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x554360 | out: hHeap=0x540000) returned 1 [0146.553] GetProcessHeap () returned 0x540000 [0146.553] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5567d0 | out: hHeap=0x540000) returned 1 [0146.553] GetProcessHeap () returned 0x540000 [0146.553] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5561f0 | out: hHeap=0x540000) returned 1 [0146.553] GetProcessHeap () returned 0x540000 [0146.553] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5567e0 | out: hHeap=0x540000) returned 1 [0146.553] GetProcessHeap () returned 0x540000 [0146.553] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556208 | out: hHeap=0x540000) returned 1 [0146.553] GetProcessHeap () returned 0x540000 [0146.553] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5567f0 | out: hHeap=0x540000) returned 1 [0146.553] GetProcessHeap () returned 0x540000 [0146.553] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556220 | out: hHeap=0x540000) returned 1 [0146.553] GetProcessHeap () returned 0x540000 [0146.553] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556800 | out: hHeap=0x540000) returned 1 [0146.553] GetProcessHeap () returned 0x540000 [0146.553] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556820 | out: hHeap=0x540000) returned 1 [0146.553] GetProcessHeap () returned 0x540000 [0146.553] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556810 | out: hHeap=0x540000) returned 1 [0146.553] GetProcessHeap () returned 0x540000 [0146.553] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556238 | out: hHeap=0x540000) returned 1 [0146.553] GetProcessHeap () returned 0x540000 [0146.553] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556830 | out: hHeap=0x540000) returned 1 [0146.553] GetProcessHeap () returned 0x540000 [0146.553] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556850 | out: hHeap=0x540000) returned 1 [0146.553] GetProcessHeap () returned 0x540000 [0146.553] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556840 | out: hHeap=0x540000) returned 1 [0146.553] GetProcessHeap () returned 0x540000 [0146.553] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556250 | out: hHeap=0x540000) returned 1 [0146.553] GetProcessHeap () returned 0x540000 [0146.553] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556860 | out: hHeap=0x540000) returned 1 [0146.553] GetProcessHeap () returned 0x540000 [0146.553] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556268 | out: hHeap=0x540000) returned 1 [0146.553] GetProcessHeap () returned 0x540000 [0146.554] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556870 | out: hHeap=0x540000) returned 1 [0146.554] GetProcessHeap () returned 0x540000 [0146.554] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556890 | out: hHeap=0x540000) returned 1 [0146.554] GetProcessHeap () returned 0x540000 [0146.554] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556880 | out: hHeap=0x540000) returned 1 [0146.554] GetProcessHeap () returned 0x540000 [0146.554] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556280 | out: hHeap=0x540000) returned 1 [0146.554] GetProcessHeap () returned 0x540000 [0146.554] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5568a0 | out: hHeap=0x540000) returned 1 [0146.554] GetProcessHeap () returned 0x540000 [0146.554] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556298 | out: hHeap=0x540000) returned 1 [0146.554] GetProcessHeap () returned 0x540000 [0146.554] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5568b0 | out: hHeap=0x540000) returned 1 [0146.554] GetProcessHeap () returned 0x540000 [0146.554] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5562b0 | out: hHeap=0x540000) returned 1 [0146.554] GetProcessHeap () returned 0x540000 [0146.554] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5568c0 | out: hHeap=0x540000) returned 1 [0146.554] GetProcessHeap () returned 0x540000 [0146.554] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5562c8 | out: hHeap=0x540000) returned 1 [0146.554] GetProcessHeap () returned 0x540000 [0146.554] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5568d0 | out: hHeap=0x540000) returned 1 [0146.554] GetProcessHeap () returned 0x540000 [0146.554] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5568f0 | out: hHeap=0x540000) returned 1 [0146.554] GetProcessHeap () returned 0x540000 [0146.554] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5568e0 | out: hHeap=0x540000) returned 1 [0146.554] GetProcessHeap () returned 0x540000 [0146.554] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5562e0 | out: hHeap=0x540000) returned 1 [0146.554] GetProcessHeap () returned 0x540000 [0146.554] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556900 | out: hHeap=0x540000) returned 1 [0146.554] GetProcessHeap () returned 0x540000 [0146.554] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5562f8 | out: hHeap=0x540000) returned 1 [0146.554] GetProcessHeap () returned 0x540000 [0146.554] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556910 | out: hHeap=0x540000) returned 1 [0146.554] GetProcessHeap () returned 0x540000 [0146.554] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556930 | out: hHeap=0x540000) returned 1 [0146.554] GetProcessHeap () returned 0x540000 [0146.554] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556920 | out: hHeap=0x540000) returned 1 [0146.554] GetProcessHeap () returned 0x540000 [0146.554] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556950 | out: hHeap=0x540000) returned 1 [0146.554] GetProcessHeap () returned 0x540000 [0146.554] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556940 | out: hHeap=0x540000) returned 1 [0146.554] GetProcessHeap () returned 0x540000 [0146.554] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556740 | out: hHeap=0x540000) returned 1 [0146.555] GetProcessHeap () returned 0x540000 [0146.555] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556470 | out: hHeap=0x540000) returned 1 [0146.555] GetProcessHeap () returned 0x540000 [0146.555] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556328 | out: hHeap=0x540000) returned 1 [0146.555] GetProcessHeap () returned 0x540000 [0146.555] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556340 | out: hHeap=0x540000) returned 1 [0146.555] GetProcessHeap () returned 0x540000 [0146.555] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556508 | out: hHeap=0x540000) returned 1 [0146.555] GetProcessHeap () returned 0x540000 [0146.555] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5543b0 | out: hHeap=0x540000) returned 1 [0146.555] GetProcessHeap () returned 0x540000 [0146.555] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556310 | out: hHeap=0x540000) returned 1 [0146.555] GetProcessHeap () returned 0x540000 [0146.555] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556960 | out: hHeap=0x540000) returned 1 [0146.555] GetProcessHeap () returned 0x540000 [0146.555] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5564a0 | out: hHeap=0x540000) returned 1 [0146.555] GetProcessHeap () returned 0x540000 [0146.555] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5543d8 | out: hHeap=0x540000) returned 1 [0146.555] GetProcessHeap () returned 0x540000 [0146.555] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556980 | out: hHeap=0x540000) returned 1 [0146.555] GetProcessHeap () returned 0x540000 [0146.555] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556970 | out: hHeap=0x540000) returned 1 [0146.555] GetProcessHeap () returned 0x540000 [0146.555] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5569a0 | out: hHeap=0x540000) returned 1 [0146.555] GetProcessHeap () returned 0x540000 [0146.555] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x550e58 | out: hHeap=0x540000) returned 1 [0146.555] CryptReleaseContext (hProv=0x5505a0, dwFlags=0x0) returned 1 [0146.555] GetProcessHeap () returned 0x540000 [0146.555] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5501c0 | out: hHeap=0x540000) returned 1 [0146.555] GetProcessHeap () returned 0x540000 [0146.555] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x543438 | out: hHeap=0x540000) returned 1 [0146.555] ExitProcess (uExitCode=0x0) Thread: id = 30 os_tid = 0x4e4 [0101.599] GetProcessHeap () returned 0x540000 [0101.599] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x556aa8 [0101.600] CryptImportKey (in: hProv=0x5505a0, pbData=0x212ff00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x5501c4 | out: phKey=0x5501c4*=0x558518) returned 1 [0101.600] CryptDecrypt (in: hKey=0x558518, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x556aa8, pdwDataLen=0x212ff64 | out: pbData=0x556aa8, pdwDataLen=0x212ff64) returned 1 [0101.600] CryptDestroyKey (hKey=0x558518) returned 1 [0101.600] GetProcessHeap () returned 0x540000 [0101.600] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5563a0 [0101.600] GetProcessHeap () returned 0x540000 [0101.600] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x5569b0 [0101.600] GetProcessHeap () returned 0x540000 [0101.600] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x12) returned 0x5585f8 [0101.600] GetProcessHeap () returned 0x540000 [0101.600] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe) returned 0x556388 [0101.600] GetProcessHeap () returned 0x540000 [0101.600] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe) returned 0x556370 [0101.600] LoadLibraryA (lpLibFileName="MPR.dll") returned 0x75660000 [0102.925] GetProcAddress (hModule=0x75660000, lpProcName="WNetEnumResourceW") returned 0x75663058 [0102.925] GetProcAddress (hModule=0x75660000, lpProcName="WNetOpenEnumW") returned 0x75662f06 [0102.925] GetProcAddress (hModule=0x75660000, lpProcName="WNetCloseEnum") returned 0x75662dd6 [0102.925] GetProcessHeap () returned 0x540000 [0102.925] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556aa8 | out: hHeap=0x540000) returned 1 [0102.927] GetProcessHeap () returned 0x540000 [0102.927] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5569b0 | out: hHeap=0x540000) returned 1 [0102.927] GetProcessHeap () returned 0x540000 [0102.927] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5585f8 | out: hHeap=0x540000) returned 1 [0102.927] GetProcessHeap () returned 0x540000 [0102.927] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556388 | out: hHeap=0x540000) returned 1 [0102.927] GetProcessHeap () returned 0x540000 [0102.927] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556370 | out: hHeap=0x540000) returned 1 [0102.927] GetProcessHeap () returned 0x540000 [0102.928] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5563a0 | out: hHeap=0x540000) returned 1 [0102.928] GetProcessHeap () returned 0x540000 [0102.928] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4000) returned 0x559238 [0102.928] WNetOpenEnumW (in: dwScope=0x1, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x212ff38 | out: lphEnum=0x212ff38*=0x55dff0) returned 0x0 [0108.693] WNetEnumResourceW (in: hEnum=0x55dff0, lpcCount=0x212ff34, lpBuffer=0x559238, lpBufferSize=0x212ff3c | out: lpcCount=0x212ff34, lpBuffer=0x559238, lpBufferSize=0x212ff3c) returned 0x103 [0108.694] WNetCloseEnum (hEnum=0x55dff0) returned 0x0 [0108.694] GetProcessHeap () returned 0x540000 [0108.694] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x559238 | out: hHeap=0x540000) returned 1 [0108.694] GetProcessHeap () returned 0x540000 [0108.694] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4000) returned 0x559238 [0108.694] WNetOpenEnumW (in: dwScope=0x4, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x212ff38 | out: lphEnum=0x212ff38*=0x558818) returned 0x0 [0108.694] WNetEnumResourceW (in: hEnum=0x558818, lpcCount=0x212ff34, lpBuffer=0x559238, lpBufferSize=0x212ff3c | out: lpcCount=0x212ff34, lpBuffer=0x559238, lpBufferSize=0x212ff3c) returned 0x103 [0108.695] WNetCloseEnum (hEnum=0x558818) returned 0x0 [0108.695] GetProcessHeap () returned 0x540000 [0108.695] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x559238 | out: hHeap=0x540000) returned 1 [0108.695] GetProcessHeap () returned 0x540000 [0108.695] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4000) returned 0x559238 [0108.695] WNetOpenEnumW (in: dwScope=0x5, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x212ff38 | out: lphEnum=0x212ff38*=0x55dff0) returned 0x0 [0133.911] WNetEnumResourceW (in: hEnum=0x55dff0, lpcCount=0x212ff34, lpBuffer=0x559238, lpBufferSize=0x212ff3c | out: lpcCount=0x212ff34, lpBuffer=0x559238, lpBufferSize=0x212ff3c) returned 0x0 [0133.912] WNetEnumResourceW (in: hEnum=0x55dff0, lpcCount=0x212ff34, lpBuffer=0x559238, lpBufferSize=0x212ff3c | out: lpcCount=0x212ff34, lpBuffer=0x559238, lpBufferSize=0x212ff3c) returned 0x103 [0133.912] WNetCloseEnum (hEnum=0x55dff0) returned 0x0 [0133.912] GetProcessHeap () returned 0x540000 [0133.912] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x559238 | out: hHeap=0x540000) returned 1 [0133.912] GetProcessHeap () returned 0x540000 [0133.912] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4000) returned 0x559238 [0133.912] WNetOpenEnumW (in: dwScope=0x3, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x212ff38 | out: lphEnum=0x212ff38*=0x558838) returned 0x0 [0133.913] WNetEnumResourceW (in: hEnum=0x558838, lpcCount=0x212ff34, lpBuffer=0x559238, lpBufferSize=0x212ff3c | out: lpcCount=0x212ff34, lpBuffer=0x559238, lpBufferSize=0x212ff3c) returned 0x103 [0133.913] WNetCloseEnum (hEnum=0x558838) returned 0x0 [0133.913] GetProcessHeap () returned 0x540000 [0133.913] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x559238 | out: hHeap=0x540000) returned 1 [0133.913] GetProcessHeap () returned 0x540000 [0133.913] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4000) returned 0x559238 [0133.913] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x212ff38 | out: lphEnum=0x212ff38*=0x5655f0) returned 0x0 [0133.913] WNetEnumResourceW (in: hEnum=0x5655f0, lpcCount=0x212ff34, lpBuffer=0x559238, lpBufferSize=0x212ff3c | out: lpcCount=0x212ff34, lpBuffer=0x559238, lpBufferSize=0x212ff3c) returned 0x0 [0133.913] GetProcessHeap () returned 0x540000 [0133.913] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4000) returned 0x5680b8 [0133.913] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x559238, lphEnum=0x212ff00 | out: lphEnum=0x212ff00*=0x558838) returned 0x0 [0133.926] WNetEnumResourceW (in: hEnum=0x558838, lpcCount=0x212fefc, lpBuffer=0x5680b8, lpBufferSize=0x212ff04 | out: lpcCount=0x212fefc, lpBuffer=0x5680b8, lpBufferSize=0x212ff04) returned 0x103 [0133.926] WNetCloseEnum (hEnum=0x558838) returned 0x0 [0133.926] GetProcessHeap () returned 0x540000 [0133.926] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5680b8 | out: hHeap=0x540000) returned 1 [0133.926] GetProcessHeap () returned 0x540000 [0133.926] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4000) returned 0x5680b8 [0133.926] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x559258, lphEnum=0x212ff00 | out: lphEnum=0x212ff00*=0x0) returned 0x4b8 [0146.532] GetProcessHeap () returned 0x540000 [0146.532] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5680b8 | out: hHeap=0x540000) returned 1 [0146.532] GetProcessHeap () returned 0x540000 [0146.532] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4000) returned 0x5680b8 [0146.532] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x559278, lphEnum=0x212ff00 | out: lphEnum=0x212ff00*=0x0) returned 0x4c6 [0146.534] GetProcessHeap () returned 0x540000 [0146.534] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5680b8 | out: hHeap=0x540000) returned 1 [0146.535] WNetEnumResourceW (in: hEnum=0x5655f0, lpcCount=0x212ff34, lpBuffer=0x559238, lpBufferSize=0x212ff3c | out: lpcCount=0x212ff34, lpBuffer=0x559238, lpBufferSize=0x212ff3c) returned 0x103 [0146.535] WNetCloseEnum (hEnum=0x5655f0) returned 0x0 [0146.535] GetProcessHeap () returned 0x540000 [0146.535] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x559238 | out: hHeap=0x540000) returned 1 Thread: id = 31 os_tid = 0xabc Thread: id = 32 os_tid = 0x5f4 Process: id = "9" image_name = "wbadmin.exe" filename = "c:\\windows\\system32\\wbadmin.exe" page_root = "0x3336d000" os_pid = "0xae8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "4" os_parent_pid = "0x5dc" cmd_line = "wbadmin delete catalog -quiet" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 37 os_tid = 0xad4 Thread: id = 38 os_tid = 0xb3c Thread: id = 39 os_tid = 0xaf4 Thread: id = 42 os_tid = 0xa98 Thread: id = 43 os_tid = 0xba0 Thread: id = 44 os_tid = 0xac0 Process: id = "10" image_name = "wbengine.exe" filename = "c:\\windows\\system32\\wbengine.exe" page_root = "0x35542000" os_pid = "0xa88" os_integrity_level = "0x4000" os_privileges = "0x20860100" monitor_reason = "rpc_server" parent_id = "9" os_parent_pid = "0x1d8" cmd_line = "\"C:\\Windows\\system32\\wbengine.exe\"" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\wbengine" [0xe], "NT AUTHORITY\\Logon Session 00000000:0005f3ba" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 45 os_tid = 0x34c Thread: id = 46 os_tid = 0x348 Thread: id = 47 os_tid = 0x3a4 Thread: id = 48 os_tid = 0x314 Thread: id = 49 os_tid = 0xa30 Thread: id = 50 os_tid = 0x310 Thread: id = 51 os_tid = 0xa8c Thread: id = 66 os_tid = 0x318 Process: id = "11" image_name = "vdsldr.exe" filename = "c:\\windows\\system32\\vdsldr.exe" page_root = "0x34894000" os_pid = "0x6c8" os_integrity_level = "0x4000" os_privileges = "0x20860100" monitor_reason = "rpc_server" parent_id = "10" os_parent_pid = "0x250" cmd_line = "C:\\Windows\\System32\\vdsldr.exe -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\wbengine" [0xe], "NT AUTHORITY\\Logon Session 00000000:0005f3ba" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 52 os_tid = 0xb4c Thread: id = 53 os_tid = 0xb98 Thread: id = 54 os_tid = 0xb24 Thread: id = 55 os_tid = 0xb20 Thread: id = 56 os_tid = 0xa2c Thread: id = 57 os_tid = 0xb88 Process: id = "12" image_name = "vds.exe" filename = "c:\\windows\\system32\\vds.exe" page_root = "0x33b48000" os_pid = "0xb54" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "11" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\System32\\vds.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\vds" [0xe], "NT AUTHORITY\\Logon Session 00000000:0005f813" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 58 os_tid = 0xa94 Thread: id = 59 os_tid = 0xa90 Thread: id = 60 os_tid = 0xa84 Thread: id = 61 os_tid = 0xb58 Thread: id = 62 os_tid = 0x324 Thread: id = 63 os_tid = 0xab8 Thread: id = 64 os_tid = 0xb9c Thread: id = 65 os_tid = 0x1c0 Thread: id = 67 os_tid = 0x7f4 Thread: id = 68 os_tid = 0x15c Thread: id = 75 os_tid = 0xa18 Thread: id = 112 os_tid = 0xa14 Thread: id = 113 os_tid = 0x87c Thread: id = 114 os_tid = 0x8ac Thread: id = 115 os_tid = 0x72c Thread: id = 131 os_tid = 0x748 Thread: id = 137 os_tid = 0x97c Thread: id = 141 os_tid = 0x304 Process: id = "13" image_name = "wmic.exe" filename = "c:\\windows\\system32\\wbem\\wmic.exe" page_root = "0x32d75000" os_pid = "0xa1c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "4" os_parent_pid = "0x5dc" cmd_line = "wmic shadowcopy delete" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 69 os_tid = 0x9e8 [0118.380] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xafc90 | out: lpSystemTimeAsFileTime=0xafc90*(dwLowDateTime=0x160cff0, dwHighDateTime=0x1d6eae3)) [0118.380] GetCurrentProcessId () returned 0xa1c [0118.380] GetCurrentThreadId () returned 0x9e8 [0118.381] GetTickCount () returned 0x11518af [0118.381] QueryPerformanceCounter (in: lpPerformanceCount=0xafc98 | out: lpPerformanceCount=0xafc98*=22593765623) returned 1 [0118.382] GetModuleHandleW (lpModuleName=0x0) returned 0xff890000 [0118.382] __set_app_type (_Type=0x1) [0118.382] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff8dced0) returned 0x0 [0118.383] __wgetmainargs (in: _Argc=0xff902380, _Argv=0xff902390, _Env=0xff902388, _DoWildCard=0, _StartInfo=0xff90239c | out: _Argc=0xff902380, _Argv=0xff902390, _Env=0xff902388) returned 0 [0118.418] ??0CHString@@QEAA@XZ () returned 0xff902ab0 [0118.420] malloc (_Size=0x30) returned 0x465a80 [0118.424] malloc (_Size=0x70) returned 0x467ae0 [0118.424] malloc (_Size=0x50) returned 0x465ac0 [0118.424] malloc (_Size=0x30) returned 0x467b60 [0118.424] malloc (_Size=0x48) returned 0x467ba0 [0118.424] malloc (_Size=0x30) returned 0x467bf0 [0118.424] malloc (_Size=0x30) returned 0x467c30 [0118.424] ??0CHString@@QEAA@XZ () returned 0xff902f58 [0118.424] malloc (_Size=0x30) returned 0x467c70 [0118.424] ?Empty@CHString@@QEAAXXZ () returned 0x7fef4af482c [0118.424] SetConsoleCtrlHandler (HandlerRoutine=0xff8d5724, Add=1) returned 1 [0118.425] _onexit (_Func=0xff8ef378) returned 0xff8ef378 [0118.425] _onexit (_Func=0xff8ef490) returned 0xff8ef490 [0118.425] _onexit (_Func=0xff8ef4d0) returned 0xff8ef4d0 [0118.425] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0118.425] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0118.430] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0118.444] CoCreateInstance (in: rclsid=0xff8973a0*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0xff897370*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0xff902940 | out: ppv=0xff902940*=0x1f11390) returned 0x0 [0118.881] GetCurrentProcess () returned 0xffffffffffffffff [0118.881] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x28, TokenHandle=0xafa60 | out: TokenHandle=0xafa60*=0x100) returned 1 [0118.881] GetTokenInformation (in: TokenHandle=0x100, TokenInformationClass=0x3, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xafa58 | out: TokenInformation=0x0, ReturnLength=0xafa58) returned 0 [0118.881] malloc (_Size=0x118) returned 0x4664f0 [0118.881] GetTokenInformation (in: TokenHandle=0x100, TokenInformationClass=0x3, TokenInformation=0x4664f0, TokenInformationLength=0x118, ReturnLength=0xafa58 | out: TokenInformation=0x4664f0, ReturnLength=0xafa58) returned 1 [0118.881] AdjustTokenPrivileges (in: TokenHandle=0x100, DisableAllPrivileges=0, NewState=0x4664f0*(PrivilegesCount=0x17, Privileges=((Luid.LowPart=0x5, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x9), (Luid.LowPart=0x2, Luid.HighPart=10, Attributes=0x0), (Luid.LowPart=0xb, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0xd), (Luid.LowPart=0x2, Luid.HighPart=14, Attributes=0x0), (Luid.LowPart=0xf, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x12), (Luid.LowPart=0x2, Luid.HighPart=19, Attributes=0x0), (Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x17), (Luid.LowPart=0x3, Luid.HighPart=24, Attributes=0x0), (Luid.LowPart=0x19, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x1d), (Luid.LowPart=0x3, Luid.HighPart=30, Attributes=0x0), (Luid.LowPart=0x21, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x23), (Luid.LowPart=0x2, Luid.HighPart=-891678874, Attributes=0x179), (Luid.LowPart=0x0, Luid.HighPart=4619984, Attributes=0x0), (Luid.LowPart=0x6d0061, Luid.HighPart=4587552, Attributes=0x6c0069), (Luid.LowPart=0x43005c, Luid.HighPart=7143535, Attributes=0x6f006d), (Luid.LowPart=0x690046, Luid.HighPart=6619244, Attributes=0x73), (Luid.LowPart=0x50004d, Luid.HighPart=5505109, Attributes=0x520045))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0118.881] free (_Block=0x4664f0) [0118.881] CloseHandle (hObject=0x100) returned 1 [0118.883] malloc (_Size=0x40) returned 0x467ed0 [0118.883] malloc (_Size=0x40) returned 0x467f20 [0118.883] malloc (_Size=0x40) returned 0x467f70 [0118.883] malloc (_Size=0x20a) returned 0x4664f0 [0118.883] GetSystemDirectoryW (in: lpBuffer=0x4664f0, uSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0118.883] free (_Block=0x4664f0) [0118.883] malloc (_Size=0x18) returned 0x30dfb0 [0118.883] malloc (_Size=0x18) returned 0x4664f0 [0118.883] malloc (_Size=0x18) returned 0x466510 [0118.883] SysStringLen (param_1="C:\\Windows\\system32") returned 0x13 [0118.884] SysStringLen (param_1="\\kernel32.dll") returned 0xd [0118.884] free (_Block=0x30dfb0) [0118.884] free (_Block=0x4664f0) [0118.884] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\kernel32.dll") returned 0x77940000 [0118.884] GetProcAddress (hModule=0x77940000, lpProcName="SetThreadUILanguage") returned 0x77956d40 [0118.884] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0118.884] FreeLibrary (hLibModule=0x77940000) returned 1 [0118.884] free (_Block=0x466510) [0118.884] _vsnwprintf (in: _Buffer=0x467f70, _BufferCount=0x1f, _Format="ms_%x", _ArgList=0xaf688 | out: _Buffer="ms_409") returned 6 [0118.884] malloc (_Size=0x20) returned 0x4664f0 [0118.884] GetComputerNameW (in: lpBuffer=0x4664f0, nSize=0xafa60 | out: lpBuffer="XDUWTFONO", nSize=0xafa60) returned 1 [0118.885] lstrlenW (lpString="XDUWTFONO") returned 9 [0118.885] malloc (_Size=0x14) returned 0x30dfb0 [0118.885] lstrlenW (lpString="XDUWTFONO") returned 9 [0118.885] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x0, nSize=0xafa58 | out: lpNameBuffer=0x0, nSize=0xafa58) returned 0x7fffffde000 [0118.886] GetLastError () returned 0xea [0118.886] malloc (_Size=0x40) returned 0x466520 [0118.886] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x466520, nSize=0xafa58 | out: lpNameBuffer="XDUWTFONO\\5p5NrGJn0jS HALPmcxz", nSize=0xafa58) returned 0x1 [0119.036] lstrlenW (lpString="") returned 0 [0119.036] lstrlenW (lpString="XDUWTFONO") returned 9 [0119.036] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="", cchCount2=0) returned 3 [0119.038] lstrlenW (lpString=".") returned 1 [0119.038] lstrlenW (lpString="XDUWTFONO") returned 9 [0119.038] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2=".", cchCount2=1) returned 3 [0119.038] lstrlenW (lpString="LOCALHOST") returned 9 [0119.038] lstrlenW (lpString="XDUWTFONO") returned 9 [0119.038] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="LOCALHOST", cchCount2=9) returned 3 [0119.038] lstrlenW (lpString="XDUWTFONO") returned 9 [0119.038] lstrlenW (lpString="XDUWTFONO") returned 9 [0119.038] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="XDUWTFONO", cchCount2=9) returned 2 [0119.038] free (_Block=0x30dfb0) [0119.038] lstrlenW (lpString="XDUWTFONO") returned 9 [0119.038] malloc (_Size=0x14) returned 0x30dfb0 [0119.038] lstrlenW (lpString="XDUWTFONO") returned 9 [0119.038] lstrlenW (lpString="XDUWTFONO") returned 9 [0119.038] malloc (_Size=0x14) returned 0x466570 [0119.038] lstrlenW (lpString="XDUWTFONO") returned 9 [0119.038] malloc (_Size=0x8) returned 0x466590 [0119.038] malloc (_Size=0x18) returned 0x4665b0 [0119.038] malloc (_Size=0x30) returned 0x4665d0 [0119.038] malloc (_Size=0x18) returned 0x466610 [0119.038] SysStringLen (param_1="IDENTIFY") returned 0x8 [0119.039] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0119.039] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0119.039] SysStringLen (param_1="IDENTIFY") returned 0x8 [0119.039] malloc (_Size=0x30) returned 0x466630 [0119.039] malloc (_Size=0x18) returned 0x466670 [0119.039] SysStringLen (param_1="IMPERSONATE") returned 0xb [0119.039] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0119.039] SysStringLen (param_1="IMPERSONATE") returned 0xb [0119.039] SysStringLen (param_1="IDENTIFY") returned 0x8 [0119.039] SysStringLen (param_1="IDENTIFY") returned 0x8 [0119.039] SysStringLen (param_1="IMPERSONATE") returned 0xb [0119.039] malloc (_Size=0x30) returned 0x466690 [0119.039] malloc (_Size=0x18) returned 0x4666d0 [0119.039] SysStringLen (param_1="DELEGATE") returned 0x8 [0119.039] SysStringLen (param_1="IDENTIFY") returned 0x8 [0119.039] SysStringLen (param_1="DELEGATE") returned 0x8 [0119.039] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0119.039] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0119.039] SysStringLen (param_1="DELEGATE") returned 0x8 [0119.039] malloc (_Size=0x30) returned 0x4666f0 [0119.039] malloc (_Size=0x18) returned 0x466730 [0119.039] malloc (_Size=0x30) returned 0x466750 [0119.039] malloc (_Size=0x18) returned 0x466790 [0119.039] SysStringLen (param_1="NONE") returned 0x4 [0119.039] SysStringLen (param_1="DEFAULT") returned 0x7 [0119.039] SysStringLen (param_1="DEFAULT") returned 0x7 [0119.039] SysStringLen (param_1="NONE") returned 0x4 [0119.039] malloc (_Size=0x30) returned 0x4667b0 [0119.039] malloc (_Size=0x18) returned 0x4667f0 [0119.039] SysStringLen (param_1="CONNECT") returned 0x7 [0119.039] SysStringLen (param_1="DEFAULT") returned 0x7 [0119.039] malloc (_Size=0x30) returned 0x466810 [0119.039] malloc (_Size=0x18) returned 0x466850 [0119.040] SysStringLen (param_1="CALL") returned 0x4 [0119.040] SysStringLen (param_1="DEFAULT") returned 0x7 [0119.040] SysStringLen (param_1="CALL") returned 0x4 [0119.040] SysStringLen (param_1="CONNECT") returned 0x7 [0119.040] malloc (_Size=0x30) returned 0x466870 [0119.040] malloc (_Size=0x18) returned 0x4668b0 [0119.040] SysStringLen (param_1="PKT") returned 0x3 [0119.040] SysStringLen (param_1="DEFAULT") returned 0x7 [0119.040] SysStringLen (param_1="PKT") returned 0x3 [0119.040] SysStringLen (param_1="NONE") returned 0x4 [0119.040] SysStringLen (param_1="NONE") returned 0x4 [0119.040] SysStringLen (param_1="PKT") returned 0x3 [0119.040] malloc (_Size=0x30) returned 0x4668d0 [0119.040] malloc (_Size=0x18) returned 0x466910 [0119.040] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0119.040] SysStringLen (param_1="DEFAULT") returned 0x7 [0119.040] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0119.040] SysStringLen (param_1="NONE") returned 0x4 [0119.040] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0119.040] SysStringLen (param_1="PKT") returned 0x3 [0119.040] SysStringLen (param_1="PKT") returned 0x3 [0119.040] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0119.040] malloc (_Size=0x30) returned 0x468000 [0119.041] malloc (_Size=0x18) returned 0x466d30 [0119.041] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0119.041] SysStringLen (param_1="DEFAULT") returned 0x7 [0119.041] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0119.041] SysStringLen (param_1="PKT") returned 0x3 [0119.041] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0119.041] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0119.041] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0119.041] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0119.041] malloc (_Size=0x30) returned 0x468040 [0119.041] malloc (_Size=0x40) returned 0x466d50 [0119.041] malloc (_Size=0x20a) returned 0x468fd0 [0119.041] GetSystemDirectoryW (in: lpBuffer=0x468fd0, uSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0119.041] free (_Block=0x468fd0) [0119.041] malloc (_Size=0x18) returned 0x466da0 [0119.041] malloc (_Size=0x18) returned 0x466dc0 [0119.041] malloc (_Size=0x18) returned 0x466de0 [0119.041] SysStringLen (param_1="C:\\Windows\\system32") returned 0x13 [0119.041] SysStringLen (param_1="\\wbem\\") returned 0x6 [0119.042] free (_Block=0x466da0) [0119.042] free (_Block=0x466dc0) [0119.042] SysStringByteLen (bstr="C:\\Windows\\system32\\wbem\\") returned 0x32 [0119.042] free (_Block=0x466de0) [0119.042] malloc (_Size=0x18) returned 0x466da0 [0119.042] malloc (_Size=0x18) returned 0x466dc0 [0119.042] malloc (_Size=0x18) returned 0x466de0 [0119.042] SysStringLen (param_1="C:\\Windows\\system32\\wbem\\") returned 0x19 [0119.042] SysStringLen (param_1="XSL-Mappings.xml") returned 0x10 [0119.042] free (_Block=0x466da0) [0119.042] free (_Block=0x466dc0) [0119.042] GetCurrentThreadId () returned 0x9e8 [0119.042] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\Wbem\\CIMOM", ulOptions=0x0, samDesired=0x1, phkResult=0xaf360 | out: phkResult=0xaf360*=0x104) returned 0x0 [0119.042] RegQueryValueExW (in: hKey=0x104, lpValueName="Logging", lpReserved=0x0, lpType=0x0, lpData=0xaf3b0, lpcbData=0xaf350*=0x400 | out: lpType=0x0, lpData=0xaf3b0*=0x30, lpcbData=0xaf350*=0x4) returned 0x0 [0119.042] _wcsicmp (_String1="0", _String2="1") returned -1 [0119.042] _wcsicmp (_String1="0", _String2="2") returned -2 [0119.042] RegQueryValueExW (in: hKey=0x104, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0xaf350*=0x4 | out: lpType=0x0, lpData=0x0, lpcbData=0xaf350*=0x42) returned 0x0 [0119.043] malloc (_Size=0x86) returned 0x466e00 [0119.043] RegQueryValueExW (in: hKey=0x104, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0x466e00, lpcbData=0xaf350*=0x42 | out: lpType=0x0, lpData=0x466e00*=0x25, lpcbData=0xaf350*=0x42) returned 0x0 [0119.043] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32 [0119.043] malloc (_Size=0x42) returned 0x466e90 [0119.043] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32 [0119.043] RegQueryValueExW (in: hKey=0x104, lpValueName="Log File Max Size", lpReserved=0x0, lpType=0x0, lpData=0xaf3b0, lpcbData=0xaf350*=0x400 | out: lpType=0x0, lpData=0xaf3b0*=0x36, lpcbData=0xaf350*=0xc) returned 0x0 [0119.043] _wtol (_String="65536") returned 65536 [0119.043] free (_Block=0x466e00) [0119.043] RegCloseKey (hKey=0x0) returned 0x6 [0119.043] CoCreateInstance (in: rclsid=0xff897410*(Data1=0xf6d90f12, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4)), pUnkOuter=0x0, dwClsContext=0x1, riid=0xff8973f0*(Data1=0x2933bf95, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppv=0xaf858 | out: ppv=0xaf858*=0x23d71d0) returned 0x0 [0119.401] FreeThreadedDOMDocument:IXMLDOMDocument:Load (in: This=0x23d71d0, xmlSource=0xaf9a0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\system32\\wbem\\XSL-Mappings.xml", varVal2=0x466da0), isSuccessful=0xafa10 | out: isSuccessful=0xafa10*=0xffff) returned 0x0 [0128.192] FreeThreadedDOMDocument:IXMLDOMDocument:get_documentElement (in: This=0x23d71d0, DOMElement=0xaf850 | out: DOMElement=0xaf850) returned 0x0 [0128.192] malloc (_Size=0x18) returned 0x46c270 [0128.202] free (_Block=0x46c270) [0128.205] malloc (_Size=0x18) returned 0x46c270 [0128.206] free (_Block=0x46c270) [0128.206] malloc (_Size=0x18) returned 0x46c270 [0128.206] malloc (_Size=0x18) returned 0x46c290 [0128.206] malloc (_Size=0x30) returned 0x468080 [0128.206] malloc (_Size=0x18) returned 0x46c2b0 [0128.206] free (_Block=0x46c2b0) [0128.206] malloc (_Size=0x18) returned 0x46c2b0 [0128.206] malloc (_Size=0x18) returned 0x46c2d0 [0128.206] SysStringLen (param_1="VALUE") returned 0x5 [0128.206] SysStringLen (param_1="TABLE") returned 0x5 [0128.206] SysStringLen (param_1="TABLE") returned 0x5 [0128.206] SysStringLen (param_1="VALUE") returned 0x5 [0128.206] malloc (_Size=0x30) returned 0x4680c0 [0128.207] malloc (_Size=0x18) returned 0x46c2f0 [0128.207] free (_Block=0x46c2f0) [0128.207] malloc (_Size=0x18) returned 0x46c2f0 [0128.207] malloc (_Size=0x18) returned 0x46c310 [0128.207] SysStringLen (param_1="LIST") returned 0x4 [0128.207] SysStringLen (param_1="TABLE") returned 0x5 [0128.207] malloc (_Size=0x30) returned 0x468100 [0128.207] malloc (_Size=0x18) returned 0x46c330 [0128.207] free (_Block=0x46c330) [0128.207] malloc (_Size=0x18) returned 0x46c330 [0128.207] malloc (_Size=0x18) returned 0x46c350 [0128.207] SysStringLen (param_1="RAWXML") returned 0x6 [0128.207] SysStringLen (param_1="TABLE") returned 0x5 [0128.207] SysStringLen (param_1="RAWXML") returned 0x6 [0128.207] SysStringLen (param_1="LIST") returned 0x4 [0128.207] SysStringLen (param_1="LIST") returned 0x4 [0128.207] SysStringLen (param_1="RAWXML") returned 0x6 [0128.208] malloc (_Size=0x30) returned 0x468140 [0128.208] malloc (_Size=0x18) returned 0x46c370 [0128.208] free (_Block=0x46c370) [0128.208] malloc (_Size=0x18) returned 0x46c370 [0128.208] malloc (_Size=0x18) returned 0x46c390 [0128.208] SysStringLen (param_1="HTABLE") returned 0x6 [0128.208] SysStringLen (param_1="TABLE") returned 0x5 [0128.208] SysStringLen (param_1="HTABLE") returned 0x6 [0128.208] SysStringLen (param_1="LIST") returned 0x4 [0128.208] malloc (_Size=0x30) returned 0x468180 [0128.208] malloc (_Size=0x18) returned 0x46c3b0 [0128.208] free (_Block=0x46c3b0) [0128.208] malloc (_Size=0x18) returned 0x46c3b0 [0128.208] malloc (_Size=0x18) returned 0x46c3d0 [0128.208] SysStringLen (param_1="HFORM") returned 0x5 [0128.208] SysStringLen (param_1="TABLE") returned 0x5 [0128.209] SysStringLen (param_1="HFORM") returned 0x5 [0128.209] SysStringLen (param_1="LIST") returned 0x4 [0128.209] SysStringLen (param_1="HFORM") returned 0x5 [0128.209] SysStringLen (param_1="HTABLE") returned 0x6 [0128.209] malloc (_Size=0x30) returned 0x4681c0 [0128.209] malloc (_Size=0x18) returned 0x46c3f0 [0128.209] free (_Block=0x46c3f0) [0128.209] malloc (_Size=0x18) returned 0x46c3f0 [0128.209] malloc (_Size=0x18) returned 0x46c410 [0128.209] SysStringLen (param_1="XML") returned 0x3 [0128.209] SysStringLen (param_1="TABLE") returned 0x5 [0128.209] SysStringLen (param_1="XML") returned 0x3 [0128.209] SysStringLen (param_1="VALUE") returned 0x5 [0128.209] SysStringLen (param_1="VALUE") returned 0x5 [0128.209] SysStringLen (param_1="XML") returned 0x3 [0128.209] malloc (_Size=0x30) returned 0x468200 [0128.209] malloc (_Size=0x18) returned 0x46c430 [0128.209] free (_Block=0x46c430) [0128.210] malloc (_Size=0x18) returned 0x46c430 [0128.210] malloc (_Size=0x18) returned 0x46c450 [0128.210] SysStringLen (param_1="MOF") returned 0x3 [0128.210] SysStringLen (param_1="TABLE") returned 0x5 [0128.210] SysStringLen (param_1="MOF") returned 0x3 [0128.210] SysStringLen (param_1="LIST") returned 0x4 [0128.210] SysStringLen (param_1="MOF") returned 0x3 [0128.210] SysStringLen (param_1="RAWXML") returned 0x6 [0128.210] SysStringLen (param_1="LIST") returned 0x4 [0128.210] SysStringLen (param_1="MOF") returned 0x3 [0128.210] malloc (_Size=0x30) returned 0x468240 [0128.210] malloc (_Size=0x18) returned 0x46c470 [0128.210] free (_Block=0x46c470) [0128.210] malloc (_Size=0x18) returned 0x46c470 [0128.210] malloc (_Size=0x18) returned 0x46c490 [0128.210] SysStringLen (param_1="CSV") returned 0x3 [0128.210] SysStringLen (param_1="TABLE") returned 0x5 [0128.210] SysStringLen (param_1="CSV") returned 0x3 [0128.210] SysStringLen (param_1="LIST") returned 0x4 [0128.210] SysStringLen (param_1="CSV") returned 0x3 [0128.210] SysStringLen (param_1="HTABLE") returned 0x6 [0128.210] SysStringLen (param_1="CSV") returned 0x3 [0128.210] SysStringLen (param_1="HFORM") returned 0x5 [0128.210] malloc (_Size=0x30) returned 0x468280 [0128.211] malloc (_Size=0x18) returned 0x46c4b0 [0128.211] free (_Block=0x46c4b0) [0128.211] malloc (_Size=0x18) returned 0x46c4b0 [0128.211] malloc (_Size=0x18) returned 0x46c4d0 [0128.211] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0128.211] SysStringLen (param_1="TABLE") returned 0x5 [0128.211] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0128.211] SysStringLen (param_1="VALUE") returned 0x5 [0128.211] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0128.211] SysStringLen (param_1="XML") returned 0x3 [0128.211] SysStringLen (param_1="XML") returned 0x3 [0128.211] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0128.211] malloc (_Size=0x30) returned 0x4682c0 [0128.211] malloc (_Size=0x18) returned 0x46c4f0 [0128.211] free (_Block=0x46c4f0) [0128.211] malloc (_Size=0x18) returned 0x46c4f0 [0128.211] malloc (_Size=0x18) returned 0x46c510 [0128.212] SysStringLen (param_1="texttablewsys") returned 0xd [0128.212] SysStringLen (param_1="TABLE") returned 0x5 [0128.212] SysStringLen (param_1="texttablewsys") returned 0xd [0128.212] SysStringLen (param_1="XML") returned 0x3 [0128.212] SysStringLen (param_1="texttablewsys") returned 0xd [0128.212] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0128.212] SysStringLen (param_1="XML") returned 0x3 [0128.212] SysStringLen (param_1="texttablewsys") returned 0xd [0128.212] malloc (_Size=0x30) returned 0x468300 [0128.212] malloc (_Size=0x18) returned 0x46c530 [0128.212] free (_Block=0x46c530) [0128.212] malloc (_Size=0x18) returned 0x46c530 [0128.212] malloc (_Size=0x18) returned 0x46c550 [0128.212] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0128.212] SysStringLen (param_1="TABLE") returned 0x5 [0128.212] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0128.212] SysStringLen (param_1="XML") returned 0x3 [0128.212] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0128.212] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0128.212] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0128.212] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0128.212] malloc (_Size=0x30) returned 0x468340 [0128.213] malloc (_Size=0x18) returned 0x46c570 [0128.213] free (_Block=0x46c570) [0128.213] malloc (_Size=0x18) returned 0x46c570 [0128.213] malloc (_Size=0x18) returned 0x46c590 [0128.213] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0128.213] SysStringLen (param_1="TABLE") returned 0x5 [0128.213] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0128.213] SysStringLen (param_1="XML") returned 0x3 [0128.213] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0128.213] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0128.213] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0128.213] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0128.213] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0128.213] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0128.213] malloc (_Size=0x30) returned 0x468380 [0128.213] malloc (_Size=0x18) returned 0x46c5b0 [0128.213] free (_Block=0x46c5b0) [0128.213] malloc (_Size=0x18) returned 0x46c5b0 [0128.213] malloc (_Size=0x18) returned 0x46c5d0 [0128.214] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0128.214] SysStringLen (param_1="TABLE") returned 0x5 [0128.214] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0128.214] SysStringLen (param_1="XML") returned 0x3 [0128.214] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0128.214] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0128.214] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0128.214] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0128.214] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0128.214] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0128.214] malloc (_Size=0x30) returned 0x4683c0 [0128.214] malloc (_Size=0x18) returned 0x46c5f0 [0128.214] free (_Block=0x46c5f0) [0128.214] malloc (_Size=0x18) returned 0x46c5f0 [0128.214] malloc (_Size=0x18) returned 0x46c610 [0128.214] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0128.214] SysStringLen (param_1="TABLE") returned 0x5 [0128.214] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0128.214] SysStringLen (param_1="XML") returned 0x3 [0128.214] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0128.214] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0128.214] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0128.214] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0128.214] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0128.214] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0128.214] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0128.214] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0128.214] malloc (_Size=0x30) returned 0x468400 [0128.215] malloc (_Size=0x18) returned 0x46c630 [0128.215] free (_Block=0x46c630) [0128.215] malloc (_Size=0x18) returned 0x46c630 [0128.215] malloc (_Size=0x18) returned 0x46c650 [0128.215] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0128.215] SysStringLen (param_1="TABLE") returned 0x5 [0128.215] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0128.215] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0128.215] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0128.215] SysStringLen (param_1="XML") returned 0x3 [0128.215] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0128.215] SysStringLen (param_1="texttablewsys") returned 0xd [0128.215] SysStringLen (param_1="XML") returned 0x3 [0128.215] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0128.215] malloc (_Size=0x30) returned 0x468440 [0128.215] malloc (_Size=0x18) returned 0x46c670 [0128.215] free (_Block=0x46c670) [0128.215] malloc (_Size=0x18) returned 0x46c670 [0128.216] malloc (_Size=0x18) returned 0x46c690 [0128.216] SysStringLen (param_1="htable-sortby") returned 0xd [0128.216] SysStringLen (param_1="TABLE") returned 0x5 [0128.216] SysStringLen (param_1="htable-sortby") returned 0xd [0128.216] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0128.216] SysStringLen (param_1="htable-sortby") returned 0xd [0128.216] SysStringLen (param_1="XML") returned 0x3 [0128.216] SysStringLen (param_1="htable-sortby") returned 0xd [0128.216] SysStringLen (param_1="texttablewsys") returned 0xd [0128.216] SysStringLen (param_1="htable-sortby") returned 0xd [0128.216] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0128.216] SysStringLen (param_1="XML") returned 0x3 [0128.216] SysStringLen (param_1="htable-sortby") returned 0xd [0128.216] malloc (_Size=0x30) returned 0x468480 [0128.216] malloc (_Size=0x18) returned 0x46c6b0 [0128.216] free (_Block=0x46c6b0) [0128.216] malloc (_Size=0x18) returned 0x46c6b0 [0128.216] malloc (_Size=0x18) returned 0x46c6d0 [0128.216] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0128.216] SysStringLen (param_1="TABLE") returned 0x5 [0128.216] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0128.216] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0128.216] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0128.217] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0128.217] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0128.217] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0128.217] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0128.217] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0128.217] malloc (_Size=0x30) returned 0x4684c0 [0128.217] malloc (_Size=0x18) returned 0x46c6f0 [0128.217] free (_Block=0x46c6f0) [0128.217] malloc (_Size=0x18) returned 0x46c6f0 [0128.217] malloc (_Size=0x18) returned 0x46c710 [0128.217] SysStringLen (param_1="wmiclimofformat") returned 0xf [0128.217] SysStringLen (param_1="TABLE") returned 0x5 [0128.217] SysStringLen (param_1="wmiclimofformat") returned 0xf [0128.217] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0128.217] SysStringLen (param_1="wmiclimofformat") returned 0xf [0128.217] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0128.217] SysStringLen (param_1="wmiclimofformat") returned 0xf [0128.217] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0128.217] SysStringLen (param_1="wmiclimofformat") returned 0xf [0128.217] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0128.217] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0128.217] SysStringLen (param_1="wmiclimofformat") returned 0xf [0128.217] malloc (_Size=0x30) returned 0x468500 [0128.218] malloc (_Size=0x18) returned 0x46c730 [0128.218] free (_Block=0x46c730) [0128.218] malloc (_Size=0x18) returned 0x46c730 [0128.218] malloc (_Size=0x18) returned 0x46c750 [0128.218] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0128.218] SysStringLen (param_1="TABLE") returned 0x5 [0128.218] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0128.218] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0128.218] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0128.218] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0128.218] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0128.218] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0128.218] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0128.218] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0128.218] malloc (_Size=0x30) returned 0x468540 [0128.218] malloc (_Size=0x18) returned 0x46c770 [0128.218] free (_Block=0x46c770) [0128.218] malloc (_Size=0x18) returned 0x46c770 [0128.218] malloc (_Size=0x18) returned 0x46c790 [0128.218] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0128.218] SysStringLen (param_1="TABLE") returned 0x5 [0128.219] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0128.219] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0128.219] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0128.219] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0128.219] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0128.219] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0128.219] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0128.219] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0128.219] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0128.219] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0128.219] malloc (_Size=0x30) returned 0x468580 [0128.219] FreeThreadedDOMDocument:IUnknown:Release (This=0x23d71d0) returned 0x0 [0128.219] free (_Block=0x466de0) [0128.219] GetCommandLineW () returned="wmic shadowcopy delete" [0128.222] malloc (_Size=0x30) returned 0x4685c0 [0128.222] memcpy_s (in: _Destination=0x4685c0, _DestinationSize=0x2e, _Source=0x2025fc, _SourceSize=0x2e | out: _Destination=0x4685c0) returned 0x0 [0128.222] malloc (_Size=0x18) returned 0x46c7b0 [0128.222] malloc (_Size=0x18) returned 0x46c7d0 [0128.222] malloc (_Size=0x18) returned 0x46c7f0 [0128.222] malloc (_Size=0x18) returned 0x46c810 [0128.222] malloc (_Size=0x80) returned 0x466da0 [0128.222] GetLocalTime (in: lpSystemTime=0xaf9f0 | out: lpSystemTime=0xaf9f0*(wYear=0x7e5, wMonth=0x1, wDayOfWeek=0x5, wDay=0xf, wHour=0xd, wMinute=0x6, wSecond=0x10, wMilliseconds=0x125)) [0128.223] _vsnwprintf (in: _Buffer=0x466da0, _BufferCount=0x3f, _Format="%.2d-%.2d-%.4dT%.2d:%.2d:%.2d", _ArgList=0xaf948 | out: _Buffer="01-15-2021T13:06:16") returned 19 [0128.223] lstrlenW (lpString=" shadowcopy delete") returned 19 [0128.223] malloc (_Size=0x28) returned 0x466ee0 [0128.223] lstrlenW (lpString=" shadowcopy delete") returned 19 [0128.223] lstrlenW (lpString=" shadowcopy delete") returned 19 [0128.223] malloc (_Size=0x28) returned 0x466e30 [0128.223] lstrlenW (lpString=" shadowcopy delete") returned 19 [0128.223] lstrlenW (lpString=" shadowcopy delete") returned 19 [0128.223] lstrlenW (lpString=" shadowcopy delete") returned 19 [0128.223] malloc (_Size=0x16) returned 0x46c830 [0128.223] lstrlenW (lpString="shadowcopy") returned 10 [0128.223] _wcsicmp (_String1="shadowcopy", _String2="\"NULL\"") returned 81 [0128.223] malloc (_Size=0x16) returned 0x46c850 [0128.223] malloc (_Size=0x8) returned 0x466e60 [0128.223] free (_Block=0x0) [0128.223] free (_Block=0x46c830) [0128.223] lstrlenW (lpString=" shadowcopy delete") returned 19 [0128.223] malloc (_Size=0xe) returned 0x46c830 [0128.223] lstrlenW (lpString="delete") returned 6 [0128.223] _wcsicmp (_String1="delete", _String2="\"NULL\"") returned 66 [0128.223] malloc (_Size=0xe) returned 0x46c870 [0128.223] malloc (_Size=0x10) returned 0x46c890 [0128.223] memmove_s (in: _Destination=0x46c890, _DestinationSize=0x8, _Source=0x466e60, _SourceSize=0x8 | out: _Destination=0x46c890) returned 0x0 [0128.223] free (_Block=0x466e60) [0128.223] free (_Block=0x0) [0128.223] free (_Block=0x46c830) [0128.223] malloc (_Size=0x10) returned 0x46c830 [0128.223] lstrlenW (lpString="QUIT") returned 4 [0128.223] lstrlenW (lpString="shadowcopy") returned 10 [0128.223] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="QUIT", cchCount2=4) returned 3 [0128.223] lstrlenW (lpString="EXIT") returned 4 [0128.223] lstrlenW (lpString="shadowcopy") returned 10 [0128.224] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="EXIT", cchCount2=4) returned 3 [0128.224] free (_Block=0x46c830) [0128.224] WbemLocator:IUnknown:AddRef (This=0x1f11390) returned 0x2 [0128.224] malloc (_Size=0x10) returned 0x46c830 [0128.224] lstrlenW (lpString="/") returned 1 [0128.224] lstrlenW (lpString="shadowcopy") returned 10 [0128.224] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="/", cchCount2=1) returned 3 [0128.224] lstrlenW (lpString="-") returned 1 [0128.224] lstrlenW (lpString="shadowcopy") returned 10 [0128.224] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="-", cchCount2=1) returned 3 [0128.224] lstrlenW (lpString="CLASS") returned 5 [0128.224] lstrlenW (lpString="shadowcopy") returned 10 [0128.224] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="CLASS", cchCount2=5) returned 3 [0128.224] lstrlenW (lpString="PATH") returned 4 [0128.224] lstrlenW (lpString="shadowcopy") returned 10 [0128.224] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="PATH", cchCount2=4) returned 3 [0128.224] lstrlenW (lpString="CONTEXT") returned 7 [0128.224] lstrlenW (lpString="shadowcopy") returned 10 [0128.224] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="CONTEXT", cchCount2=7) returned 3 [0128.224] lstrlenW (lpString="shadowcopy") returned 10 [0128.224] malloc (_Size=0x16) returned 0x46c8b0 [0128.224] lstrlenW (lpString="shadowcopy") returned 10 [0128.226] GetCurrentThreadId () returned 0x9e8 [0128.226] ??0CHString@@QEAA@XZ () returned 0xaf800 [0128.226] malloc (_Size=0x18) returned 0x46c8d0 [0128.226] malloc (_Size=0x18) returned 0x46c8f0 [0128.226] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1f11390, strNetworkResource="root\\cli", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0xff902998 | out: ppNamespace=0xff902998*=0x1f23a98) returned 0x0 [0129.488] free (_Block=0x46c8f0) [0129.488] free (_Block=0x46c8d0) [0129.488] CoSetProxyBlanket (pProxy=0x1f23a98, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0 [0129.488] ??1CHString@@QEAA@XZ () returned 0x7fef4af482c [0129.488] GetCurrentThreadId () returned 0x9e8 [0129.488] ??0CHString@@QEAA@XZ () returned 0xaf698 [0129.488] malloc (_Size=0x18) returned 0x46c8d0 [0129.489] malloc (_Size=0x18) returned 0x46c8f0 [0129.489] malloc (_Size=0x18) returned 0x46c910 [0129.489] malloc (_Size=0x18) returned 0x46c930 [0129.489] SysStringLen (param_1="root\\cli") returned 0x8 [0129.489] SysStringLen (param_1="\\") returned 0x1 [0129.489] malloc (_Size=0x18) returned 0x46c950 [0129.489] SysStringLen (param_1="root\\cli\\") returned 0x9 [0129.489] SysStringLen (param_1="ms_409") returned 0x6 [0129.489] free (_Block=0x46c930) [0129.489] free (_Block=0x46c910) [0129.489] free (_Block=0x46c8f0) [0129.489] free (_Block=0x46c8d0) [0129.489] malloc (_Size=0x18) returned 0x46c8d0 [0129.489] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1f11390, strNetworkResource="root\\cli\\ms_409", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0xff9029a0 | out: ppNamespace=0xff9029a0*=0x1f23b28) returned 0x0 [0129.500] free (_Block=0x46c8d0) [0129.500] free (_Block=0x46c950) [0129.500] ??1CHString@@QEAA@XZ () returned 0x7fef4af482c [0129.500] GetCurrentThreadId () returned 0x9e8 [0129.500] ??0CHString@@QEAA@XZ () returned 0xaf810 [0129.500] malloc (_Size=0x18) returned 0x46c950 [0129.500] malloc (_Size=0x18) returned 0x46c8d0 [0129.500] malloc (_Size=0x18) returned 0x46c8f0 [0129.500] lstrlenA (lpString="MSFT_CliAlias.FriendlyName='") returned 28 [0129.500] malloc (_Size=0x3a) returned 0x46ca40 [0129.500] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xff891980, cbMultiByte=-1, lpWideCharStr=0x46ca40, cchWideChar=29 | out: lpWideCharStr="MSFT_CliAlias.FriendlyName='") returned 29 [0129.500] free (_Block=0x46ca40) [0129.500] malloc (_Size=0x18) returned 0x46c910 [0129.500] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='") returned 0x1c [0129.500] SysStringLen (param_1="shadowcopy") returned 0xa [0129.501] malloc (_Size=0x18) returned 0x46c930 [0129.501] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='shadowcopy") returned 0x26 [0129.501] SysStringLen (param_1="'") returned 0x1 [0129.501] free (_Block=0x46c910) [0129.501] free (_Block=0x46c8f0) [0129.501] free (_Block=0x46c8d0) [0129.501] free (_Block=0x46c950) [0129.501] IWbemServices:GetObject (in: This=0x1f23a98, strObjectPath="MSFT_CliAlias.FriendlyName='shadowcopy'", lFlags=0, pCtx=0x0, ppObject=0xaf818*=0x0, ppCallResult=0x0 | out: ppObject=0xaf818*=0x1f304e0, ppCallResult=0x0) returned 0x0 [0129.513] malloc (_Size=0x18) returned 0x46c950 [0129.513] IWbemClassObject:Get (in: This=0x1f304e0, wszName="Target", lFlags=0, pVal=0xaf740*(varType=0x0, wReserved1=0xff90, wReserved2=0x0, wReserved3=0x0, varVal1=0xff902998, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xaf740*(varType=0x8, wReserved1=0xff90, wReserved2=0x0, wReserved3=0x0, varVal1="Select * from Win32_ShadowCopy", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0129.513] free (_Block=0x46c950) [0129.513] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0129.513] malloc (_Size=0x3e) returned 0x46ca40 [0129.513] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0129.514] malloc (_Size=0x18) returned 0x46c950 [0129.514] IWbemClassObject:Get (in: This=0x1f304e0, wszName="PWhere", lFlags=0, pVal=0xaf740*(varType=0x0, wReserved1=0xff90, wReserved2=0x0, wReserved3=0x0, varVal1=0x22e0f8, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xaf740*(varType=0x8, wReserved1=0xff90, wReserved2=0x0, wReserved3=0x0, varVal1=" Where ID = '#'", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0129.514] free (_Block=0x46c950) [0129.514] lstrlenW (lpString=" Where ID = '#'") returned 15 [0129.514] malloc (_Size=0x20) returned 0x466e60 [0129.514] lstrlenW (lpString=" Where ID = '#'") returned 15 [0129.514] malloc (_Size=0x18) returned 0x46c950 [0129.514] IWbemClassObject:Get (in: This=0x1f304e0, wszName="Connection", lFlags=0, pVal=0xaf740*(varType=0x0, wReserved1=0xff90, wReserved2=0x0, wReserved3=0x0, varVal1=0x27bc48, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xaf740*(varType=0xd, wReserved1=0xff90, wReserved2=0x0, wReserved3=0x0, varVal1=0x1f309c0, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0129.514] free (_Block=0x46c950) [0129.514] IUnknown:QueryInterface (in: This=0x1f309c0, riid=0xff897360*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0xaf730 | out: ppvObject=0xaf730*=0x1f309c0) returned 0x0 [0129.514] GetCurrentThreadId () returned 0x9e8 [0129.514] ??0CHString@@QEAA@XZ () returned 0xaf658 [0129.514] malloc (_Size=0x18) returned 0x46c950 [0129.514] IWbemClassObject:Get (in: This=0x1f309c0, wszName="Namespace", lFlags=0, pVal=0xaf680*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xff8a738f, varVal2=0x46c950), pType=0x0, plFlavor=0x0 | out: pVal=0xaf680*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x46c950), pType=0x0, plFlavor=0x0) returned 0x0 [0129.514] free (_Block=0x46c950) [0129.514] lstrlenW (lpString="ROOT\\CIMV2") returned 10 [0129.514] malloc (_Size=0x16) returned 0x46c950 [0129.514] lstrlenW (lpString="ROOT\\CIMV2") returned 10 [0129.514] malloc (_Size=0x18) returned 0x46c8d0 [0129.514] IWbemClassObject:Get (in: This=0x1f309c0, wszName="Locale", lFlags=0, pVal=0xaf680*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2ac348, varVal2=0x46c950), pType=0x0, plFlavor=0x0 | out: pVal=0xaf680*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ms_409", varVal2=0x46c950), pType=0x0, plFlavor=0x0) returned 0x0 [0129.515] free (_Block=0x46c8d0) [0129.515] lstrlenW (lpString="ms_409") returned 6 [0129.515] malloc (_Size=0xe) returned 0x46c8d0 [0129.515] lstrlenW (lpString="ms_409") returned 6 [0129.515] malloc (_Size=0x18) returned 0x46c8f0 [0129.515] IWbemClassObject:Get (in: This=0x1f309c0, wszName="User", lFlags=0, pVal=0xaf680*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2ac348, varVal2=0x46c950), pType=0x0, plFlavor=0x0 | out: pVal=0xaf680*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2ac348, varVal2=0x46c950), pType=0x0, plFlavor=0x0) returned 0x0 [0129.515] free (_Block=0x46c8f0) [0129.515] malloc (_Size=0x18) returned 0x46c8f0 [0129.515] IWbemClassObject:Get (in: This=0x1f309c0, wszName="Password", lFlags=0, pVal=0xaf680*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2ac348, varVal2=0x46c950), pType=0x0, plFlavor=0x0 | out: pVal=0xaf680*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2ac348, varVal2=0x46c950), pType=0x0, plFlavor=0x0) returned 0x0 [0129.515] free (_Block=0x46c8f0) [0129.515] malloc (_Size=0x18) returned 0x46c8f0 [0129.515] IWbemClassObject:Get (in: This=0x1f309c0, wszName="Server", lFlags=0, pVal=0xaf680*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2ac348, varVal2=0x46c950), pType=0x0, plFlavor=0x0 | out: pVal=0xaf680*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=".", varVal2=0x46c950), pType=0x0, plFlavor=0x0) returned 0x0 [0129.515] free (_Block=0x46c8f0) [0129.515] lstrlenW (lpString=".") returned 1 [0129.515] malloc (_Size=0x4) returned 0x46ca90 [0129.515] lstrlenW (lpString=".") returned 1 [0129.515] malloc (_Size=0x18) returned 0x46c8f0 [0129.515] IWbemClassObject:Get (in: This=0x1f309c0, wszName="Authority", lFlags=0, pVal=0xaf680*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2ac348, varVal2=0x46c950), pType=0x0, plFlavor=0x0 | out: pVal=0xaf680*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2ac348, varVal2=0x46c950), pType=0x0, plFlavor=0x0) returned 0x0 [0129.515] free (_Block=0x46c8f0) [0129.515] ??1CHString@@QEAA@XZ () returned 0x7fef4af482c [0129.515] IUnknown:Release (This=0x1f309c0) returned 0x1 [0129.515] GetCurrentThreadId () returned 0x9e8 [0129.516] ??0CHString@@QEAA@XZ () returned 0xaf658 [0129.516] malloc (_Size=0x18) returned 0x46c8f0 [0129.516] IWbemClassObject:Get (in: This=0x1f304e0, wszName="__RELPATH", lFlags=0, pVal=0xaf680*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2ac348, varVal2=0xd), pType=0x0, plFlavor=0x0 | out: pVal=0xaf680*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="MSFT_CliAlias.FriendlyName=\"ShadowCopy\"", varVal2=0xd), pType=0x0, plFlavor=0x0) returned 0x0 [0129.516] free (_Block=0x46c8f0) [0129.516] malloc (_Size=0x18) returned 0x46c8f0 [0129.516] GetCurrentThreadId () returned 0x9e8 [0129.516] ??0CHString@@QEAA@XZ () returned 0xaf4d8 [0129.516] ??0CHString@@QEAA@PEBG@Z () returned 0xaf4f0 [0129.516] ??0CHString@@QEAA@AEBV0@@Z () returned 0xaf480 [0129.516] ?Empty@CHString@@QEAAXXZ () returned 0x7fef4af482c [0129.516] ?GetData@CHString@@IEBAPEAUCHStringData@@XZ () returned 0x46cab0 [0129.516] ?Find@CHString@@QEBAHPEBG@Z () returned 0x1b [0129.516] ?Left@CHString@@QEBA?AV1@H@Z () returned 0xaf440 [0129.517] ??H@YA?AVCHString@@AEBV0@PEBG@Z () returned 0xaf488 [0129.517] ??YCHString@@QEAAAEBV0@AEBV0@@Z () returned 0xaf4f0 [0129.517] ??1CHString@@QEAA@XZ () returned 0x5ada0f01 [0129.517] ??1CHString@@QEAA@XZ () returned 0x5ada0f01 [0129.517] ?Mid@CHString@@QEBA?AV1@H@Z () returned 0xaf448 [0129.517] ??4CHString@@QEAAAEBV0@AEBV0@@Z () returned 0xaf480 [0129.517] ??1CHString@@QEAA@XZ () returned 0x1 [0129.518] ?GetData@CHString@@IEBAPEAUCHStringData@@XZ () returned 0x46cb20 [0129.518] ?Find@CHString@@QEBAHPEBG@Z () returned 0xa [0129.518] ?Left@CHString@@QEBA?AV1@H@Z () returned 0xaf440 [0129.518] ??H@YA?AVCHString@@AEBV0@PEBG@Z () returned 0xaf488 [0129.518] ??YCHString@@QEAAAEBV0@AEBV0@@Z () returned 0xaf4f0 [0129.518] ??1CHString@@QEAA@XZ () returned 0x5ada0f01 [0129.518] ??1CHString@@QEAA@XZ () returned 0x5ada0f01 [0129.518] ?Mid@CHString@@QEBA?AV1@H@Z () returned 0xaf448 [0129.518] ??4CHString@@QEAAAEBV0@AEBV0@@Z () returned 0xaf480 [0129.518] ??1CHString@@QEAA@XZ () returned 0x7fef4af482c [0129.518] ?GetData@CHString@@IEBAPEAUCHStringData@@XZ () returned 0x7fef4af4820 [0129.518] ??1CHString@@QEAA@XZ () returned 0x7fef4af482c [0129.518] malloc (_Size=0x18) returned 0x46c910 [0129.518] malloc (_Size=0x18) returned 0x46c970 [0129.518] malloc (_Size=0x18) returned 0x46c990 [0129.518] malloc (_Size=0x18) returned 0x46c9b0 [0129.518] malloc (_Size=0x18) returned 0x46c9d0 [0129.518] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=") returned 0x3c [0129.518] SysStringLen (param_1="\"Description\",RelPath=\"") returned 0x17 [0129.518] malloc (_Size=0x18) returned 0x46c9f0 [0129.518] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"") returned 0x53 [0129.518] SysStringLen (param_1="MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"") returned 0x29 [0129.518] malloc (_Size=0x18) returned 0x46ca10 [0129.518] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"") returned 0x7c [0129.518] SysStringLen (param_1="\"") returned 0x1 [0129.518] free (_Block=0x46c9f0) [0129.519] free (_Block=0x46c9d0) [0129.519] free (_Block=0x46c9b0) [0129.519] free (_Block=0x46c990) [0129.519] free (_Block=0x46c970) [0129.519] free (_Block=0x46c910) [0129.519] IWbemServices:GetObject (in: This=0x1f23b28, strObjectPath="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"\"", lFlags=0, pCtx=0x0, ppObject=0xaf4c8*=0x0, ppCallResult=0x0 | out: ppObject=0xaf4c8*=0x1f30a50, ppCallResult=0x0) returned 0x0 [0129.522] malloc (_Size=0x18) returned 0x46c910 [0129.522] IWbemClassObject:Get (in: This=0x1f30a50, wszName="Text", lFlags=0, pVal=0xaf500*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xff902ac0, varVal2=0x18), pType=0x0, plFlavor=0x0 | out: pVal=0xaf500*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2a67a0*(cDims=0x1, fFeatures=0x180, cbElements=0x8, cLocks=0x0, pvData=0x22de90, rgsabound=((cElements=0x1, lLbound=0))), varVal2=0x18), pType=0x0, plFlavor=0x0) returned 0x0 [0129.522] free (_Block=0x46c910) [0129.522] SafeArrayGetLBound (in: psa=0x2a67a0, nDim=0x1, plLbound=0xaf4e0 | out: plLbound=0xaf4e0) returned 0x0 [0129.522] SafeArrayGetUBound (in: psa=0x2a67a0, nDim=0x1, plUbound=0xaf4d0 | out: plUbound=0xaf4d0) returned 0x0 [0129.522] SafeArrayGetElement (in: psa=0x2a67a0, rgIndices=0xaf4c4, pv=0xaf518 | out: pv=0xaf518) returned 0x0 [0129.522] malloc (_Size=0x18) returned 0x46c910 [0129.522] malloc (_Size=0x18) returned 0x46c970 [0129.522] SysStringLen (param_1="Shadow copy management.") returned 0x17 [0129.522] free (_Block=0x46c910) [0129.522] IUnknown:Release (This=0x1f30a50) returned 0x0 [0129.522] free (_Block=0x46ca10) [0129.522] ??1CHString@@QEAA@XZ () returned 0x5ada0f01 [0129.522] ??1CHString@@QEAA@XZ () returned 0x7fef4af482c [0129.522] free (_Block=0x46c8f0) [0129.522] ??1CHString@@QEAA@XZ () returned 0x7fef4af482c [0129.522] lstrlenW (lpString="Shadow copy management.") returned 23 [0129.522] malloc (_Size=0x30) returned 0x468600 [0129.522] lstrlenW (lpString="Shadow copy management.") returned 23 [0129.522] free (_Block=0x46c970) [0129.522] IUnknown:Release (This=0x1f304e0) returned 0x0 [0129.522] free (_Block=0x46c930) [0129.522] ??1CHString@@QEAA@XZ () returned 0x7fef4af482c [0129.523] lstrlenW (lpString="PATH") returned 4 [0129.523] lstrlenW (lpString="delete") returned 6 [0129.523] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="PATH", cchCount2=4) returned 1 [0129.523] lstrlenW (lpString="WHERE") returned 5 [0129.523] lstrlenW (lpString="delete") returned 6 [0129.523] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="WHERE", cchCount2=5) returned 1 [0129.523] lstrlenW (lpString="(") returned 1 [0129.523] lstrlenW (lpString="delete") returned 6 [0129.523] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="(", cchCount2=1) returned 3 [0129.523] lstrlenW (lpString="/") returned 1 [0129.523] lstrlenW (lpString="delete") returned 6 [0129.523] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="/", cchCount2=1) returned 3 [0129.523] lstrlenW (lpString="-") returned 1 [0129.523] lstrlenW (lpString="delete") returned 6 [0129.523] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="-", cchCount2=1) returned 3 [0129.523] malloc (_Size=0x18) returned 0x46c930 [0129.523] lstrlenW (lpString="GET") returned 3 [0129.523] lstrlenW (lpString="delete") returned 6 [0129.523] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0129.523] lstrlenW (lpString="LIST") returned 4 [0129.523] lstrlenW (lpString="delete") returned 6 [0129.523] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0129.523] lstrlenW (lpString="SET") returned 3 [0129.523] lstrlenW (lpString="delete") returned 6 [0129.523] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0129.523] lstrlenW (lpString="CREATE") returned 6 [0129.523] lstrlenW (lpString="delete") returned 6 [0129.523] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0129.523] lstrlenW (lpString="CALL") returned 4 [0129.523] lstrlenW (lpString="delete") returned 6 [0129.523] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3 [0129.523] lstrlenW (lpString="ASSOC") returned 5 [0129.524] lstrlenW (lpString="delete") returned 6 [0129.524] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0129.524] lstrlenW (lpString="DELETE") returned 6 [0129.524] lstrlenW (lpString="delete") returned 6 [0129.524] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2 [0129.524] free (_Block=0x46c930) [0129.524] lstrlenW (lpString="/") returned 1 [0129.524] lstrlenW (lpString="delete") returned 6 [0129.524] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="/", cchCount2=1) returned 3 [0129.524] lstrlenW (lpString="-") returned 1 [0129.524] lstrlenW (lpString="delete") returned 6 [0129.524] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="-", cchCount2=1) returned 3 [0129.524] lstrlenW (lpString="delete") returned 6 [0129.524] malloc (_Size=0xe) returned 0x46c930 [0129.524] lstrlenW (lpString="delete") returned 6 [0129.524] lstrlenW (lpString="GET") returned 3 [0129.524] lstrlenW (lpString="delete") returned 6 [0129.524] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0129.524] lstrlenW (lpString="LIST") returned 4 [0129.524] lstrlenW (lpString="delete") returned 6 [0129.524] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0129.524] lstrlenW (lpString="SET") returned 3 [0129.524] lstrlenW (lpString="delete") returned 6 [0129.524] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0129.524] lstrlenW (lpString="CREATE") returned 6 [0129.524] lstrlenW (lpString="delete") returned 6 [0129.524] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0129.524] lstrlenW (lpString="CALL") returned 4 [0129.524] lstrlenW (lpString="delete") returned 6 [0129.524] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3 [0129.524] lstrlenW (lpString="ASSOC") returned 5 [0129.524] lstrlenW (lpString="delete") returned 6 [0129.524] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0129.524] lstrlenW (lpString="DELETE") returned 6 [0129.524] lstrlenW (lpString="delete") returned 6 [0129.525] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2 [0129.525] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0129.525] malloc (_Size=0x3e) returned 0x46cab0 [0129.525] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0129.525] wcstok (in: _String="Select * from Win32_ShadowCopy", _Delimiter=" ", _Context=0xffffffffffffff90 | out: _String="Select", _Context=0xffffffffffffff90) returned="Select" [0129.525] malloc (_Size=0x18) returned 0x46c970 [0129.525] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x0 | out: _String=0x0, _Context=0x0) returned="*" [0129.525] lstrlenW (lpString="FROM") returned 4 [0129.525] lstrlenW (lpString="*") returned 1 [0129.525] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="*", cchCount1=1, lpString2="FROM", cchCount2=4) returned 1 [0129.525] malloc (_Size=0x18) returned 0x46c8f0 [0129.525] free (_Block=0x46c970) [0129.526] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x50003d007c0006 | out: _String=0x0, _Context=0x50003d007c0006) returned="from" [0129.526] lstrlenW (lpString="FROM") returned 4 [0129.526] lstrlenW (lpString="from") returned 4 [0129.526] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="from", cchCount1=4, lpString2="FROM", cchCount2=4) returned 2 [0129.526] malloc (_Size=0x18) returned 0x46c970 [0129.526] free (_Block=0x46c8f0) [0129.526] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x50003e007c0006 | out: _String=0x0, _Context=0x50003e007c0006) returned="Win32_ShadowCopy" [0129.526] malloc (_Size=0x18) returned 0x46c8f0 [0129.526] free (_Block=0x46c970) [0129.526] free (_Block=0x46cab0) [0129.526] free (_Block=0x46c8f0) [0129.526] lstrlenW (lpString="SET") returned 3 [0129.526] lstrlenW (lpString="delete") returned 6 [0129.526] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0129.526] lstrlenW (lpString="CREATE") returned 6 [0129.526] lstrlenW (lpString="delete") returned 6 [0129.526] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0129.526] free (_Block=0x46c830) [0129.526] malloc (_Size=0x8) returned 0x46cab0 [0129.526] lstrlenW (lpString="GET") returned 3 [0129.527] lstrlenW (lpString="delete") returned 6 [0129.527] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0129.527] lstrlenW (lpString="LIST") returned 4 [0129.527] lstrlenW (lpString="delete") returned 6 [0129.527] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0129.527] lstrlenW (lpString="ASSOC") returned 5 [0129.527] lstrlenW (lpString="delete") returned 6 [0129.527] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0129.527] WbemLocator:IUnknown:AddRef (This=0x1f11390) returned 0x3 [0129.527] free (_Block=0x30dfb0) [0129.527] lstrlenW (lpString="") returned 0 [0129.527] lstrlenW (lpString="XDUWTFONO") returned 9 [0129.527] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="", cchCount2=0) returned 3 [0129.527] lstrlenW (lpString="XDUWTFONO") returned 9 [0129.527] malloc (_Size=0x14) returned 0x46c830 [0129.527] lstrlenW (lpString="XDUWTFONO") returned 9 [0129.527] GetCurrentThreadId () returned 0x9e8 [0129.527] GetCurrentProcess () returned 0xffffffffffffffff [0129.527] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x28, TokenHandle=0xaf8a0 | out: TokenHandle=0xaf8a0*=0x28c) returned 1 [0129.527] GetTokenInformation (in: TokenHandle=0x28c, TokenInformationClass=0x3, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xaf898 | out: TokenInformation=0x0, ReturnLength=0xaf898) returned 0 [0129.527] malloc (_Size=0x118) returned 0x46cad0 [0129.527] GetTokenInformation (in: TokenHandle=0x28c, TokenInformationClass=0x3, TokenInformation=0x46cad0, TokenInformationLength=0x118, ReturnLength=0xaf898 | out: TokenInformation=0x46cad0, ReturnLength=0xaf898) returned 1 [0129.527] AdjustTokenPrivileges (in: TokenHandle=0x28c, DisableAllPrivileges=0, NewState=0x46cad0*(PrivilegesCount=0x17, Privileges=((Luid.LowPart=0x5, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x9), (Luid.LowPart=0x2, Luid.HighPart=10, Attributes=0x0), (Luid.LowPart=0xb, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0xd), (Luid.LowPart=0x2, Luid.HighPart=14, Attributes=0x0), (Luid.LowPart=0xf, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x12), (Luid.LowPart=0x2, Luid.HighPart=19, Attributes=0x0), (Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x17), (Luid.LowPart=0x3, Luid.HighPart=24, Attributes=0x0), (Luid.LowPart=0x19, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x1d), (Luid.LowPart=0x3, Luid.HighPart=30, Attributes=0x0), (Luid.LowPart=0x21, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x23), (Luid.LowPart=0x2, Luid.HighPart=1742343368, Attributes=0x179), (Luid.LowPart=0x0, Luid.HighPart=3202992, Attributes=0x0), (Luid.LowPart=0x22, Luid.HighPart=1056965436, Attributes=0x16e), (Luid.LowPart=0x0, Luid.HighPart=4587864, Attributes=0x0), (Luid.LowPart=0x0, Luid.HighPart=0, Attributes=0x0), (Luid.LowPart=0x0, Luid.HighPart=0, Attributes=0x0))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0129.527] free (_Block=0x46cad0) [0129.527] CloseHandle (hObject=0x28c) returned 1 [0129.527] lstrlenW (lpString="GET") returned 3 [0129.527] lstrlenW (lpString="delete") returned 6 [0129.527] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0129.527] lstrlenW (lpString="LIST") returned 4 [0129.527] lstrlenW (lpString="delete") returned 6 [0129.527] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0129.527] lstrlenW (lpString="SET") returned 3 [0129.528] lstrlenW (lpString="delete") returned 6 [0129.528] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0129.528] lstrlenW (lpString="CALL") returned 4 [0129.528] lstrlenW (lpString="delete") returned 6 [0129.528] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3 [0129.528] lstrlenW (lpString="ASSOC") returned 5 [0129.528] lstrlenW (lpString="delete") returned 6 [0129.528] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0129.528] lstrlenW (lpString="CREATE") returned 6 [0129.528] lstrlenW (lpString="delete") returned 6 [0129.528] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0129.528] lstrlenW (lpString="DELETE") returned 6 [0129.528] lstrlenW (lpString="delete") returned 6 [0129.528] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2 [0129.529] malloc (_Size=0x18) returned 0x46c8f0 [0129.529] lstrlenA (lpString="") returned 0 [0129.529] malloc (_Size=0x2) returned 0x30dfb0 [0129.529] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xff89314c, cbMultiByte=-1, lpWideCharStr=0x30dfb0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0129.529] free (_Block=0x30dfb0) [0129.529] malloc (_Size=0x18) returned 0x46c970 [0129.529] lstrlenA (lpString="") returned 0 [0129.529] malloc (_Size=0x2) returned 0x30dfb0 [0129.529] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xff89314c, cbMultiByte=-1, lpWideCharStr=0x30dfb0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0129.529] free (_Block=0x30dfb0) [0129.529] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0129.530] malloc (_Size=0x3e) returned 0x46cad0 [0129.530] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0129.530] wcstok (in: _String="Select * from Win32_ShadowCopy", _Delimiter=" ", _Context=0xffffffffffffff70 | out: _String="Select", _Context=0xffffffffffffff70) returned="Select" [0129.530] malloc (_Size=0x18) returned 0x46ca10 [0129.530] free (_Block=0x46c970) [0129.530] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x500042006c0005 | out: _String=0x0, _Context=0x500042006c0005) returned="*" [0129.530] lstrlenW (lpString="FROM") returned 4 [0129.530] lstrlenW (lpString="*") returned 1 [0129.530] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="*", cchCount1=1, lpString2="FROM", cchCount2=4) returned 1 [0129.530] malloc (_Size=0x18) returned 0x46c970 [0129.530] free (_Block=0x46ca10) [0129.530] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x500043006c0005 | out: _String=0x0, _Context=0x500043006c0005) returned="from" [0129.530] lstrlenW (lpString="FROM") returned 4 [0129.530] lstrlenW (lpString="from") returned 4 [0129.530] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="from", cchCount1=4, lpString2="FROM", cchCount2=4) returned 2 [0129.530] malloc (_Size=0x18) returned 0x46ca10 [0129.530] free (_Block=0x46c970) [0129.530] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x500044006c0005 | out: _String=0x0, _Context=0x500044006c0005) returned="Win32_ShadowCopy" [0129.530] malloc (_Size=0x18) returned 0x46c970 [0129.530] free (_Block=0x46ca10) [0129.530] free (_Block=0x46cad0) [0129.530] malloc (_Size=0x18) returned 0x46ca10 [0129.530] malloc (_Size=0x18) returned 0x46c910 [0129.530] SysStringLen (param_1="SELECT * FROM ") returned 0xe [0129.530] SysStringLen (param_1="Win32_ShadowCopy") returned 0x10 [0129.530] free (_Block=0x46c8f0) [0129.531] free (_Block=0x46ca10) [0129.531] ??0CHString@@QEAA@XZ () returned 0xaf810 [0129.531] GetCurrentThreadId () returned 0x9e8 [0129.531] malloc (_Size=0x18) returned 0x46ca10 [0129.531] malloc (_Size=0x18) returned 0x46c8f0 [0129.531] malloc (_Size=0x18) returned 0x46c990 [0129.531] malloc (_Size=0x18) returned 0x46c9b0 [0129.531] malloc (_Size=0x18) returned 0x46c9d0 [0129.531] SysStringLen (param_1="\\\\") returned 0x2 [0129.531] SysStringLen (param_1="XDUWTFONO") returned 0x9 [0129.531] malloc (_Size=0x18) returned 0x46c9f0 [0129.531] SysStringLen (param_1="\\\\XDUWTFONO") returned 0xb [0129.531] SysStringLen (param_1="\\") returned 0x1 [0129.531] malloc (_Size=0x18) returned 0x46cb00 [0129.531] SysStringLen (param_1="\\\\XDUWTFONO\\") returned 0xc [0129.531] SysStringLen (param_1="ROOT\\CIMV2") returned 0xa [0129.531] free (_Block=0x46c9f0) [0129.531] free (_Block=0x46c9d0) [0129.531] free (_Block=0x46c9b0) [0129.531] free (_Block=0x46c990) [0129.531] free (_Block=0x46c8f0) [0129.532] free (_Block=0x46ca10) [0129.532] malloc (_Size=0x18) returned 0x46ca10 [0129.532] malloc (_Size=0x18) returned 0x46c8f0 [0129.532] malloc (_Size=0x18) returned 0x46c990 [0129.532] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1f11390, strNetworkResource="\\\\XDUWTFONO\\ROOT\\CIMV2", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0xff9029d0 | out: ppNamespace=0xff9029d0*=0x1f23c18) returned 0x0 [0129.537] free (_Block=0x46c990) [0129.537] free (_Block=0x46c8f0) [0129.537] free (_Block=0x46ca10) [0129.537] CoSetProxyBlanket (pProxy=0x1f23c18, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0 [0129.537] free (_Block=0x46cb00) [0129.537] ??1CHString@@QEAA@XZ () returned 0x7fef4af482c [0129.537] ??0CHString@@QEAA@XZ () returned 0xaf760 [0129.537] GetCurrentThreadId () returned 0x9e8 [0129.537] malloc (_Size=0x18) returned 0x46ca10 [0129.537] lstrlenA (lpString="") returned 0 [0129.538] malloc (_Size=0x2) returned 0x30dfb0 [0129.538] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xff89314c, cbMultiByte=-1, lpWideCharStr=0x30dfb0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0129.538] free (_Block=0x30dfb0) [0129.538] SysStringLen (param_1="SELECT * FROM Win32_ShadowCopy") returned 0x1e [0129.538] SysStringLen (param_1="") returned 0x0 [0129.538] free (_Block=0x46ca10) [0129.538] malloc (_Size=0x18) returned 0x46ca10 [0129.538] IWbemServices:ExecQuery (in: This=0x1f23c18, strQueryLanguage="WQL", strQuery="SELECT * FROM Win32_ShadowCopy", lFlags=0, pCtx=0x0, ppEnum=0xaf768 | out: ppEnum=0xaf768*=0x1f23d18) returned 0x0 [0130.677] free (_Block=0x46ca10) [0130.677] CoSetProxyBlanket (pProxy=0x1f23d18, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0 [0130.680] IEnumWbemClassObject:Next (in: This=0x1f23d18, lTimeout=-1, uCount=0x1, apObjects=0xaf770, puReturned=0xaf780 | out: apObjects=0xaf770*=0x0, puReturned=0xaf780*=0x0) returned 0x1 [0130.680] IUnknown:Release (This=0x1f23d18) returned 0x0 [0130.681] ??1CHString@@QEAA@XZ () returned 0x7fef4af482c [0130.681] free (_Block=0x46c970) [0130.681] free (_Block=0x46c910) [0130.681] GetCurrentThreadId () returned 0x9e8 [0130.681] ??0CHString@@QEAA@PEBG@Z () returned 0xaf948 [0130.681] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0xaf948 [0130.682] malloc (_Size=0x800) returned 0x46d350 [0130.682] LoadStringW (in: hInstance=0x0, uID=0xb3bc, lpBuffer=0x46d350, cchBufferMax=1024 | out: lpBuffer="No Instance(s) Available.\r\n") returned 0x1b [0130.682] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="No Instance(s) Available.\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0130.682] malloc (_Size=0x1c) returned 0x46d2d0 [0130.682] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="No Instance(s) Available.\r\n", cchWideChar=-1, lpMultiByteStr=0x46d2d0, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="No Instance(s) Available.\r\n", lpUsedDefaultChar=0x0) returned 28 [0130.682] fprintf (in: _File=0x7fefdf72ab0, _Format="%s" | out: _File=0x7fefdf72ab0) returned 27 [0130.682] fflush (in: _File=0x7fefdf72ab0 | out: _File=0x7fefdf72ab0) returned 0 [0130.682] free (_Block=0x46d2d0) [0130.682] free (_Block=0x46d350) [0130.683] ??1CHString@@QEAA@XZ () returned 0x5ada0f01 [0130.683] WbemLocator:IUnknown:Release (This=0x1f23c18) returned 0x0 [0130.683] ?Empty@CHString@@QEAAXXZ () returned 0x7fef4af482c [0130.683] _kbhit () returned 0x0 [0130.695] free (_Block=0x46cab0) [0130.695] free (_Block=0x46c810) [0130.695] free (_Block=0x46c7f0) [0130.695] free (_Block=0x46c7d0) [0130.695] free (_Block=0x46c7b0) [0130.696] free (_Block=0x466ee0) [0130.696] free (_Block=0x46c8b0) [0130.696] free (_Block=0x468600) [0130.696] free (_Block=0x46c930) [0130.696] free (_Block=0x46ca40) [0130.696] free (_Block=0x46c8d0) [0130.696] free (_Block=0x46c950) [0130.696] free (_Block=0x46ca90) [0130.696] free (_Block=0x466d50) [0130.696] free (_Block=0x466e60) [0130.696] ?Empty@CHString@@QEAAXXZ () returned 0x7fef4af482c [0130.696] free (_Block=0x466e30) [0130.696] free (_Block=0x46c850) [0130.696] free (_Block=0x46c870) [0130.696] free (_Block=0x467ed0) [0130.696] free (_Block=0x467f20) [0130.696] free (_Block=0x467f70) [0130.696] free (_Block=0x46c830) [0130.696] free (_Block=0x466570) [0130.696] free (_Block=0x466d30) [0130.696] free (_Block=0x468040) [0130.696] free (_Block=0x466910) [0130.696] free (_Block=0x468000) [0130.696] free (_Block=0x4668b0) [0130.696] free (_Block=0x4668d0) [0130.696] free (_Block=0x466790) [0130.697] free (_Block=0x4667b0) [0130.697] free (_Block=0x466730) [0130.697] free (_Block=0x466750) [0130.697] free (_Block=0x4667f0) [0130.697] free (_Block=0x466810) [0130.697] free (_Block=0x466850) [0130.697] free (_Block=0x466870) [0130.697] free (_Block=0x466670) [0130.697] free (_Block=0x466690) [0130.697] free (_Block=0x466610) [0130.697] free (_Block=0x466630) [0130.697] free (_Block=0x4666d0) [0130.697] free (_Block=0x4666f0) [0130.697] free (_Block=0x4665b0) [0130.697] free (_Block=0x4665d0) [0130.697] free (_Block=0x466520) [0130.697] free (_Block=0x4664f0) [0130.697] free (_Block=0x466da0) [0130.697] WbemLocator:IUnknown:Release (This=0x1f11390) returned 0x2 [0130.697] WbemLocator:IUnknown:Release (This=0x1f23b28) returned 0x0 [0130.702] WbemLocator:IUnknown:Release (This=0x1f23a98) returned 0x0 [0130.833] WbemLocator:IUnknown:Release (This=0x1f11390) returned 0x1 [0130.833] ?Empty@CHString@@QEAAXXZ () returned 0x7fef4af482c [0130.833] WbemLocator:IUnknown:Release (This=0x1f11390) returned 0x0 [0130.833] free (_Block=0x46c730) [0130.833] free (_Block=0x46c750) [0130.833] free (_Block=0x468540) [0130.833] free (_Block=0x46c770) [0130.833] free (_Block=0x46c790) [0130.833] free (_Block=0x468580) [0130.833] free (_Block=0x46c5b0) [0130.833] free (_Block=0x46c5d0) [0130.833] free (_Block=0x4683c0) [0130.834] free (_Block=0x46c5f0) [0130.834] free (_Block=0x46c610) [0130.834] free (_Block=0x468400) [0130.834] free (_Block=0x46c530) [0130.834] free (_Block=0x46c550) [0130.834] free (_Block=0x468340) [0130.834] free (_Block=0x46c570) [0130.834] free (_Block=0x46c590) [0130.834] free (_Block=0x468380) [0130.834] free (_Block=0x46c6b0) [0130.834] free (_Block=0x46c6d0) [0130.834] free (_Block=0x4684c0) [0130.834] free (_Block=0x46c6f0) [0130.834] free (_Block=0x46c710) [0130.834] free (_Block=0x468500) [0130.834] free (_Block=0x46c4b0) [0130.834] free (_Block=0x46c4d0) [0130.834] free (_Block=0x4682c0) [0130.834] free (_Block=0x46c4f0) [0130.834] free (_Block=0x46c510) [0130.834] free (_Block=0x468300) [0130.834] free (_Block=0x46c630) [0130.835] free (_Block=0x46c650) [0130.835] free (_Block=0x468440) [0130.835] free (_Block=0x46c670) [0130.835] free (_Block=0x46c690) [0130.835] free (_Block=0x468480) [0130.835] free (_Block=0x46c3f0) [0130.835] free (_Block=0x46c410) [0130.835] free (_Block=0x468200) [0130.835] free (_Block=0x46c2b0) [0130.835] free (_Block=0x46c2d0) [0130.835] free (_Block=0x4680c0) [0130.835] free (_Block=0x46c270) [0130.835] free (_Block=0x46c290) [0130.835] free (_Block=0x468080) [0130.835] free (_Block=0x46c330) [0130.835] free (_Block=0x46c350) [0130.835] free (_Block=0x468140) [0130.835] free (_Block=0x46c430) [0130.835] free (_Block=0x46c450) [0130.835] free (_Block=0x468240) [0130.835] free (_Block=0x46c2f0) [0130.835] free (_Block=0x46c310) [0130.835] free (_Block=0x468100) [0130.836] free (_Block=0x46c370) [0130.836] free (_Block=0x46c390) [0130.836] free (_Block=0x468180) [0130.836] free (_Block=0x46c3b0) [0130.836] free (_Block=0x46c3d0) [0130.836] free (_Block=0x4681c0) [0130.836] free (_Block=0x46c470) [0130.836] free (_Block=0x46c490) [0130.836] free (_Block=0x468280) [0130.836] CoUninitialize () [0131.040] exit (_Code=0) [0131.040] free (_Block=0x4685c0) [0131.040] free (_Block=0x467c70) [0131.040] ??1CHString@@QEAA@XZ () returned 0x7fef4af482c [0131.040] free (_Block=0x466e90) [0131.040] free (_Block=0x466590) [0131.040] free (_Block=0x467c30) [0131.040] free (_Block=0x467bf0) [0131.040] free (_Block=0x467ba0) [0131.040] free (_Block=0x467b60) [0131.040] free (_Block=0x465ac0) [0131.040] free (_Block=0x467ae0) [0131.041] free (_Block=0x465a80) [0131.041] ??1CHString@@QEAA@XZ () returned 0x7fef4af482c [0131.041] free (_Block=0x46c890) Thread: id = 70 os_tid = 0xa28 Thread: id = 71 os_tid = 0xa20 Thread: id = 72 os_tid = 0xa10 Thread: id = 73 os_tid = 0x85c Thread: id = 74 os_tid = 0xa24 Process: id = "14" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x971d000" os_pid = "0x370" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "13" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000d057" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 76 os_tid = 0x70c Thread: id = 77 os_tid = 0x5a8 Thread: id = 78 os_tid = 0x9d4 Thread: id = 79 os_tid = 0xba4 Thread: id = 80 os_tid = 0x5e0 Thread: id = 81 os_tid = 0x6cc Thread: id = 82 os_tid = 0x42c Thread: id = 83 os_tid = 0x1e4 Thread: id = 84 os_tid = 0x760 Thread: id = 85 os_tid = 0x75c Thread: id = 86 os_tid = 0x74c Thread: id = 87 os_tid = 0x710 Thread: id = 88 os_tid = 0x6d0 Thread: id = 89 os_tid = 0x6bc Thread: id = 90 os_tid = 0x6b8 Thread: id = 91 os_tid = 0x6b0 Thread: id = 92 os_tid = 0x698 Thread: id = 93 os_tid = 0x684 Thread: id = 94 os_tid = 0x678 Thread: id = 95 os_tid = 0x4a8 Thread: id = 96 os_tid = 0x46c Thread: id = 97 os_tid = 0x44c Thread: id = 98 os_tid = 0x424 Thread: id = 99 os_tid = 0x41c Thread: id = 100 os_tid = 0x404 Thread: id = 101 os_tid = 0x14c Thread: id = 102 os_tid = 0x158 Thread: id = 103 os_tid = 0x3fc Thread: id = 104 os_tid = 0x3f4 Thread: id = 105 os_tid = 0x3e8 Thread: id = 106 os_tid = 0x39c Thread: id = 107 os_tid = 0x390 Thread: id = 108 os_tid = 0x38c Thread: id = 109 os_tid = 0x388 Thread: id = 110 os_tid = 0x37c Thread: id = 111 os_tid = 0x374 Thread: id = 132 os_tid = 0x90c Thread: id = 133 os_tid = 0x8fc Thread: id = 134 os_tid = 0x91c Thread: id = 135 os_tid = 0x92c Thread: id = 142 os_tid = 0x664 Thread: id = 143 os_tid = 0xa48 Thread: id = 144 os_tid = 0xadc Thread: id = 145 os_tid = 0x84c Thread: id = 146 os_tid = 0xaf4 Thread: id = 147 os_tid = 0xba0 Thread: id = 148 os_tid = 0xac0 Thread: id = 149 os_tid = 0x644 Process: id = "15" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x6076b000" os_pid = "0xa38" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "14" os_parent_pid = "0x250" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Network Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:00044123" [0xc000000f] Thread: id = 116 os_tid = 0x9e0 Thread: id = 117 os_tid = 0xa60 Thread: id = 118 os_tid = 0xa54 Thread: id = 119 os_tid = 0xa50 Thread: id = 120 os_tid = 0xa4c Thread: id = 121 os_tid = 0xa48 Thread: id = 122 os_tid = 0xa40 Thread: id = 123 os_tid = 0xa3c Thread: id = 136 os_tid = 0x93c Process: id = "16" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x61e66000" os_pid = "0x9ec" os_integrity_level = "0x4000" os_privileges = "0xe60b1e990" monitor_reason = "rpc_server" parent_id = "14" os_parent_pid = "0x250" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000d057" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 124 os_tid = 0x5b8 Thread: id = 125 os_tid = 0xa0c Thread: id = 126 os_tid = 0xa08 Thread: id = 127 os_tid = 0xa04 Thread: id = 128 os_tid = 0xa00 Thread: id = 129 os_tid = 0x9f4 Thread: id = 130 os_tid = 0x9f0 Thread: id = 139 os_tid = 0x7a0